fix(deps): resolve npm audit vulnerabilities

[0xMudit]

Summary

Fixes #3724

Resolves three npm audit vulnerabilities by running
pm audit fix:

• @babel/core <=7.29.0: Arbitrary File Read via sourceMappingURL Comment (GHSA-4x5r-pxfx-6jf8)
• brace-expansion 4.0.0-5.0.8: DoS via unbounded expansion length (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
• undici 7.0.0-7.28.0: Multiple vulnerabilities in @electron/get\ transitive dependency (5 advisories)

All fixes are minor/patch version bumps within existing semver ranges. Only \package-lock.json\ is modified.

Verification

• 
  pm audit: 0 vulnerabilities (was 3)
• 
  pm run lint: passed
• 
  pm run format:check: passed
• 
  pm run build: passes (pre-existing @maka/ui\ type errors are unrelated to this change)
• 
  pm --workspace @maka/core test: 656/656 pass
• 
  pm run typecheck: passes (pre-existing @maka/ui\ errors are on clean \main\ too)

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: opencode/big-pickle — identified vulnerabilities, ran audit fix, verified results

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• No

[Astro-Han]

Update on ebe6d30: CODE GO — lockfile only (+59/-56), deps patch (Babel 7.29.7, brace-expansion, undici), 0 audit vuln, lint green. No P0-P3.

简体中文

仅锁文件更新，无阻断。

[Phoenix500526]

Update on ebe6d30: CODE GO — lockfile only (+59/-56), deps patch (Babel 7.29.7, brace-expansion, undici), 0 audit vuln, lint green. No P0-P3.

简体中文
仅锁文件更新，无阻断。

This PR is duplicated to PR #3725 @Astro-Han

[M4n5ter]

Thank you for fixing these dependency vulnerabilities and verifying the updated lockfile. PR #3725 was the earlier canonical fix for the same issue and has now merged as 9d62ee9a8e16f6ad75e9e31beb7d4644d49ad8d9; its lockfile resolves the same three audit findings and #3724 is closed. I am therefore closing this duplicate as superseded so the repository keeps one dependency-update owner.

---

Posted by an automated review agent operated by @M4n5ter. This is not an independent human review and does not satisfy the committer review required by CONTRIBUTING.md. A human is accountable for this comment — please push back if anything here is wrong.

简体中文

本条评论由 @M4n5ter 运行的自动化审查程序发出。它不构成 CONTRIBUTING.md 所要求的独立人类审查，也不能替代人类审查。有人类对本条评论负责，如有错误请直接指出。