v12.5.3

• format: locize format --format xlsx works again. Local files were read with
  data.toString(), which UTF-8 decoded the binary workbook and corrupted it,
  and the colored line diff was then handed the resulting Buffer and crashed
  with value.split is not a function. xlsx files are now kept as a Buffer
  end to end and the line diff is skipped for binary formats, so a reformat
  round-trip preserves the workbook content.
• deps: updated diff (9.0.0), @yao-pkg/pkg, eslint, rollup and vitest.
  A fresh install now resolves patched js-yaml, undici, postcss,
  brace-expansion, tar and flatted transitives, clearing all open
  Dependabot alerts.
• ci: the test matrix now also covers node 26.