Update dependencies to address Dependabot security alerts

[wojtekn]

Related issues

Closes ~35 open Dependabot security alerts on the repository.

How AI was used in this PR

Claude identified which Dependabot alerts were fixable via npm update (stale lockfile entries within existing semver ranges) vs. those requiring direct dep bumps or overrides, then applied all the easy wins in one shot.

Proposed Changes

Updates transitive and direct dependencies to their patched versions to close the majority of open Dependabot security alerts. All updates are within the existing declared semver ranges of their parent packages — no breaking changes expected.

Package	From	To	Alerts closed
fast-uri	3.1.0	3.1.2	#210, #207
@xmldom/xmldom	0.8.11	0.8.13	#192, #191, #190, #170
brace-expansion	1.1.12	1.1.15	#168
qs	6.14.0	6.15.2	#228, #89, #110
ip-address	10.1.0	10.1.1	#199
basic-ftp	5.3.0	5.3.1	#202
ws	8.18.0	8.21.0	#224
protobufjs	7.5.5	7.6.2	#221, #220, #217, #216, #219, #218, #215, #225
hono	4.12.7	4.12.23	#211, #208, #204, #203, #188, #185, #184, #183, #182, #181, #209
@hono/node-server	1.19.11	1.19.14	#180
lodash	4.17.23	4.18.1	#172, #171
@babel/plugin-transform-modules-systemjs	7.27.1	7.29.7	#212
@anthropic-ai/sdk	^0.90.0	^0.91.1	#197, #196

Remaining open alerts are blocked by exact-pinned third-party packages (@php-wasm/*, @mariozechner/pi-*, electron2appx) or have no upstream fix (showdown). Those require upstream releases to resolve.

Testing Instructions

• npm run typecheck passes
• npm test passes
• App starts and sites load normally

Pre-merge Checklist

• No direct dependency version constraints changed (all updates are lockfile-only except @anthropic-ai/sdk range bump)
• @wp-playground/* and @php-wasm/* pins untouched

[wpmobilebot]

📊 Performance Test Results

Comparing 8b6c126 vs trunk

app-size

Metric	trunk	8b6c126	Diff	Change
App Size (Mac)	1330.69 MB	1334.61 MB	+3.92 MB	🔴 0.3%

site-editor

Metric	trunk	8b6c126	Diff	Change
load	1664 ms	1649 ms	15 ms	⚪ 0.0%

site-startup

Metric	trunk	8b6c126	Diff	Change
siteCreation	9029 ms	9034 ms	+5 ms	⚪ 0.0%
siteStartup	4416 ms	4402 ms	14 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)