🐛 fix(deps): clear security alerts

[xdanger]

Summary

• migrate the markdownlint-cli2 peer from 0.18.1 to 0.23.2
• update direct js-yaml from 4.1.1 to 4.3.1
• refresh both npm and pnpm locks to patched markdown-it@14.3.0, linkify-it@5.0.2, and picomatch@2.3.2
• clear all 17 open Dependabot alerts in both tracked ecosystems

Validation

• pnpm 10.11.0 frozen install
• JSON configuration parsing
• markdownlint-cli2 0.23.2 configuration smoke test
• npm and pnpm audits: no known vulnerabilities
• npm package dry-run

Breaking-change risk

markdownlint-cli2 is a pre-1.0 minor upgrade and raises its Node.js floor from 20 to 22. The repository's publish workflow already uses Node.js 22, the shared configuration loads successfully, and no configuration migration was required.

[greptile-apps]

Greptile Summary

此 PR 升级 markdownlint-cli2 与 js-yaml，并同步刷新 npm、pnpm 和 JSR 依赖声明，以采用已修复安全问题的传递依赖。

• 将 markdownlint-cli2 从 0.18.1 系列升级至 0.23.2 系列，并同步其 Node.js 最低版本要求
• 将直接依赖 js-yaml 从 4.1.1 升级至 4.3.1
• 更新 npm 与 pnpm lockfile 中 markdown-it、linkify-it、picomatch 等传递依赖

Confidence Score: 5/5

此 PR 看起来可以安全合并，未发现由本次依赖升级引入且未被说明的具体故障。

依赖声明和两套 lockfile 保持一致，仓库内相关 workflow 使用升级后要求的 Node.js 22，且现有 markdownlint-cli2 配置未使用已证实不兼容的自定义扩展。

Important Files Changed

Filename	Overview
node-configs/package.json	更新 markdownlint-cli2 peerDependency 与 js-yaml dependency；未发现未说明的可到达故障。
node-configs/jsr.json	同步 JSR manifest 中 markdownlint-cli2 的版本范围。
node-configs/package-lock.json	npm lockfile 与新依赖声明一致，并解析到目标修复版本。
node-configs/pnpm-lock.yaml	pnpm lockfile 与 manifest 更新一致，并包含升级后的传递依赖图。

_{Reviews (1): Last reviewed commit: "🐛 fix(deps): clear security alerts" | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR updates the Node.js shared-configs package dependency set and lockfiles to remediate known security alerts, primarily by upgrading markdownlint-cli2 and js-yaml and refreshing the npm/pnpm lock resolutions to patched transitive versions.

Changes:

• Bump markdownlint-cli2 from ^0.18.1 to ^0.23.2 (peer dependency for npm; dependency for JSR manifest).
• Bump direct js-yaml from ^4.1.1 to ^4.3.1.
• Refresh pnpm-lock.yaml and package-lock.json to pick up patched transitive dependencies (e.g., markdown-it, linkify-it, picomatch).

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
node-configs/pnpm-lock.yaml	Updates pnpm lock resolutions to the new direct/peer versions and patched transitives.
node-configs/package.json	Updates markdownlint-cli2 peer dependency and js-yaml direct dependency versions.
node-configs/package-lock.json	Updates npm lockfile to reflect the new dependency graph and patched transitives.
node-configs/jsr.json	Updates markdownlint-cli2 dependency version for the JSR manifest.

Files not reviewed (2)

• node-configs/package-lock.json: Generated file
• node-configs/pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.