chore(deps): aggregate pending dependency updates

[chrisgervang]

Background

Consolidates the currently open Dependabot updates from #10523, #10522, #10348, #10340, #10339, and #10322 into one current branch and supersedes those PRs.

Change List

• Update pinned GitHub Actions to their pending patch releases.
• Update pre-commit to 2.0.0 and regenerate the missing transitive lock entries.
• Update TinySDF, d3-array types, @tootallnate/once, and the Vitest toolchain; align the paired Vitest browser and coverage packages at 4.1.0 to avoid unsupported mixed versions.
• Regenerate yarn.lock against current master.
• Validation: yarn --frozen-lockfile, yarn lint, yarn build, and yarn test-fast pass; full yarn test passes 1,127 tests with 8 skipped and 7 local failures reproduced identically on origin/master.

---

Note

Low Risk
Changes are limited to CI action pins and dev/test dependencies with no application runtime or security-sensitive logic changes.

Overview
Consolidates several open Dependabot bumps into one branch: GitHub Actions pins move to newer patch releases (actions/checkout v7.0.1, OpenSSF Scorecard v2.4.4, CodeQL SARIF upload v4.37.6, Coveralls v2.3.8) across release, test, scorecard, and website workflows.

Root devDependencies bump the Vitest stack to 4.1.0 (vitest, @vitest/browser-playwright, @vitest/coverage-v8) so browser, coverage, and core packages stay on the same version. pre-commit goes from 1.x to 2.0.0, which refreshes its hook runner (modern cross-spawn / which) while keeping the same test-fast and bindings pre-commit scripts.

yarn.lock is regenerated for transitive updates (e.g. @mapbox/tiny-sdf 2.2.0, @types/d3-array, @tootallnate/once, esbuild 0.27.7, vite 7.3.2) tied to those bumps.

^{Reviewed by Cursor Bugbot for commit a9985f3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 432ee57. Configure here.}

[cursor]

Vite security downgrade in lockfile

Medium Severity

The Vitest 4.1.0 bump regenerates yarn.lock so vite falls from 7.3.6 to 7.3.2. That reintroduces CVE-2026-53571 (GHSA-fx2h-pf6j-xcff), a high-severity Windows server.fs.deny bypass fixed in 7.3.5. Yarn Classic mishandles Vitest 4.1.0’s vite OR-range, which likely drove the bad resolution.

Additional Locations (1)

• package.json#L60-L78

 

^{Reviewed by Cursor Bugbot for commit 432ee57. Configure here.}

[coveralls]

coverage: 84.119%. remained the same — chore/aggregate-dependency-updates into master