fix: patch vulnerabilities and bump outdated dependencies

[waldekmastykarz]

Pull Request Title

fix: patch vulnerabilities and bump outdated dependencies

Linked Issue

Supersedes #7593.

One PR = One Commit

This replacement carries forward both commits from #7593 and adds the latest verified dependency refresh commit.

New Command = Five Files

N/A. This PR updates dependencies and the existing Zod compatibility helper only.

Main Branch Only

Targets upstream main.

Merge Conflicts

The branch is based on the current upstream main used for this dependency refresh.

Summary

• includes all changes from fix: patch vulnerabilities and bump outdated dependencies #7593
• updates cooldown-eligible direct dependencies: chalk, csv-parse, csv-stringify, and @typescript-eslint
• updates the serialize-javascript override to 7.1.2
• updates transitive brace-expansion to 5.0.12 through the resolved dependency tree
• retains zod 4.5.4 because 4.6.5 breaks the required coverage instrumentation
• retains @types/node 24.13.6 because 24.19.0 causes TypeScript errors in existing fs.readFileSync test stubs

Security status

npm audit now reports one high-severity node-forge advisory. Version 1.4.0 is the latest published version and npm reports no fix available.

Not auto-applied

• cooldown until 2026-10-09: @azure/msal-common 16.14.2 and @azure/msal-node-extensions 5.5.2
• major updates: @azure/msal-node, eslint-plugin-mocha, mocha, typescript, and several overrides
• pre-release-only updates: @typescript-eslint 8.70.2 alpha releases
• incompatible updates: zod 4.6.5 and @types/node 24.19.0

Validation

• npm run build — passed
• npm test — passed
• 16,171 tests passing
• 100% statement, branch, function, and line coverage