fix(deps): resolve open Dependabot alerts

[drewstone]

Summary

Completes the interrupted Dependabot remediation (SOC 2 Vanta Request 7) for tangle-network/dapp. This finalizes commit 32f2d30e (dependency bumps via resolutions in package.json + regenerated yarn.lock, plus scripts/migration/package.json overrides + package-lock.json), which was staged but untested.

All 19 alerts with a first_patched_version are resolved. Verification found the staged bumps already satisfied every patchable alert — no additional manifest or lockfile edits were required. elliptic (#160, low) has no upstream patch and is left open.

Alerts addressed

Alert	Package	Severity	Manifest	From	To (patched)
#423	@tiptap/core	moderate	yarn.lock	3.29.1	3.31.1 (≥3.30.4)
#422	@humanfs/node	moderate	yarn.lock	0.16.6	0.16.8
#419	postcss-selector-parser	low	yarn.lock	6.1.2	6.1.4 (≥6.1.3)
#417	postcss-selector-parser	low	yarn.lock	7.1.0	7.1.6 (≥7.1.3)
#416	decode-uri-component	moderate	yarn.lock (root resolutions)	≤0.4.2	0.5.0
#377	valibot	moderate	yarn.lock	1.2.0	1.4.2
#335	@babel/core	low	yarn.lock	7.26.10	7.29.7 (≥7.29.6)
#295	uuid	moderate	scripts/migration/package-lock.json (npm overrides)	9.0.1	11.1.1
#294	qs	moderate	yarn.lock	<6.15.2	6.15.2 / 6.16.0
#292	@tootallnate/once	low	yarn.lock	2.0.0	2.0.1
#291	uuid	moderate	yarn.lock (root resolutions)	8.3.2 / ^9.x	11.1.1
#257	follow-redirects	moderate	yarn.lock	1.16.0	1.16.0 (already at patched version; alert appears stale on GitHub's side)
#218	yauzl	moderate	yarn.lock	3.2.0	3.4.0
#186	bn.js	moderate	yarn.lock	5.2.1	5.2.5 (≥5.2.3)
#185	bn.js	moderate	yarn.lock	4.12.1	4.12.5 (≥4.12.3)
#178	qs	low	yarn.lock	<6.14.2	6.16.0
#151	qs	moderate	yarn.lock	<6.14.1	6.16.0
#125	prismjs	moderate	yarn.lock (root resolutions)	~1.27.0	1.30.0
#95	bn.js	moderate	scripts/migration/package-lock.json	5.2.2	5.2.5 (≥5.2.3)

Left open

Alert	Package	Severity	Reason
#160	elliptic	low	No first_patched_version published upstream for the current advisory. Left open per policy: do not dismiss via API.

Gates run

Worktree, yarn@4.7.0 (via corepack), NODE_OPTIONS=--no-network-family-autoselection (host has no IPv6 route):

yarn install --immutable
  → clean, 0 lockfile drift, no dropped platform-optional entries (verified @esbuild/*, @rollup/rollup-*, @swc/core-*, @biomejs/cli-* counts identical to origin/develop)

yarn nx affected --target=lint --base=origin/develop
  → 13 projects + 2 dependency tasks, 0 errors (14 pre-existing React Compiler warnings, unrelated to this change)

yarn nx affected --target=typecheck --base=origin/develop
  → 5 projects + 2 dependency tasks, pass

yarn nx affected --target=test --base=origin/develop
  → 12 projects + 2 dependency tasks, 197 tests pass (167 tangle-cloud, 30 tangle-dapp, 0 leaderboard/no test files)

yarn nx affected --target=build --base=origin/develop
  → 11 projects + 5 dependency tasks, pass

npm ci (scripts/migration, standalone npm workspace outside the yarn workspace)
  → 106 packages installed, 0 vulnerabilities

git push triggered the repo's Husky pre-push hook (yarn lint && yarn format:check, yarn test, yarn build — full, not affected-scoped): passed, mostly served from the Nx cache populated by the affected runs above.

Base

develop (repo's default/integration branch per CLAUDE.md branch strategy; not tagged [RELEASE]).

DO NOT MERGE — awaiting review.