Dependency maintenance

The root and docs/ workspaces have separate lockfiles. Use npm ci in the relevant workspace for reproducible local installation; do not substitute npm install in release verification.

Intentional overrides

• path-to-regexp@0.1.13 is pinned under Express 4 for the reviewed ReDoS mitigation. Reassess it only as part of an Express 5 upgrade.
• picomatch@4.0.4 is pinned in both workspaces for a reviewed transitive dependency baseline. Reassess it in the next dependency batch with its parent dependency updates.
• The docs workspace pins Vite through VitePress because VitePress currently operates on its Vite 6 compatibility line.

Dependabot monitors both / and /docs, batching minor and patch development updates. A generated PR still requires normal diff, lockfile, test, build, and staging review; automation does not authorize a production promotion.