chore(security): patch 12 Dependabot alerts

[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

12 fixed, 0 ignored, 4 deferred, 0 resolutions added, 0 resolutions removed. | label: 🔒 security applied

All fixes are lockfile-only re-resolutions in yarn.lock: the patched versions already satisfy the semver ranges declared by the parent packages (semantic-release tooling), so no package.json change was needed.

Fixed

Done	Alert	Package	Ecosystem	From → To	Severity	What was bumped
- [ ]	#73	tar	npm	7.5.15 → 7.5.19	medium	lockfile re-resolution (transitive via semantic-release > @semantic-release/npm > npm)
- [ ]	#74	undici	npm	7.25.0 → 7.28.0	high	lockfile re-resolution (transitive via semantic-release > @semantic-release/github)
- [ ]	#75	undici	npm	7.25.0 → 7.28.0	medium	lockfile re-resolution (same chain as #74)
- [ ]	#76	undici	npm	7.25.0 → 7.28.0	high	lockfile re-resolution (same chain as #74)
- [ ]	#77	undici	npm	7.25.0 → 7.28.0	low	lockfile re-resolution (same chain as #74)
- [ ]	#78	undici	npm	7.25.0 → 7.28.0	high	lockfile re-resolution (same chain as #74)
- [ ]	#79	undici	npm	7.25.0 → 7.28.0	medium	lockfile re-resolution (same chain as #74)
- [ ]	#80	undici	npm	7.25.0 → 7.28.0	low	lockfile re-resolution (same chain as #74)
- [ ]	#81	undici	npm	6.25.0 → 6.27.0	high	lockfile re-resolution (transitive via semantic-release > @semantic-release/npm > npm > node-gyp and @actions/http-client)
- [ ]	#82	undici	npm	6.25.0 → 6.27.0	medium	lockfile re-resolution (same chain as #81)
- [ ]	#83	undici	npm	6.25.0 → 6.27.0	low	lockfile re-resolution (same chain as #81)
- [ ]	#84	undici	npm	6.25.0 → 6.27.0	low	lockfile re-resolution (same chain as #81)

Ignored

None.

Deferred

Skipped by the 7-day age gate — will be handled by the next run:

• #85 — @sigstore/core ≤ 3.2.0 (medium, opened 2026-06-30)
• #86 — @sigstore/verify = 3.1.0 (medium, opened 2026-07-02)
• #87 — sigstore ≤ 4.1.0 (high, opened 2026-07-02)
• #88 — js-yaml ≥ 4.0.0, ≤ 4.1.1 (medium, opened 2026-07-02)

Resolutions added

None — every patched version satisfies the semver range already declared by its parent, so plain lockfile re-resolution was sufficient.

Resolutions removed

None — the root package.json resolutions block is empty; no other package.json exists in the repo.

Risks

• undici 6.25.0 → 6.27.0 / 7.25.0 → 7.28.0: minor/patch releases within the ranges declared by @semantic-release/github, @actions/http-client, node-gyp. undici is only used by release tooling in CI; no source code in this repo imports it. No breaking changes in these ranges per upstream changelog.
• tar 7.5.15 → 7.5.19: patch releases (parser hardening fixes). Only consumed by the bundled npm/pacote/node-gyp chain inside release tooling. No behavior change beyond the patched vulnerabilities.
• All three packages are devDependencies-scope transitives of semantic-release; the shipped Ruby gems are unaffected.

Manual testing

Covered by CI.

Validation

✅ CI green

[forest-bot]

🎉 This PR is included in version 1.35.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀