chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Overrode transitive toml dependency to >=4.1.2 to resolve a high severity prototype pollution vulnerability (alert Hook Specification #42)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#42	toml	high	Overrode to >=4.1.2 (resolves to 5.0.0) via npm overrides, since the vulnerable version is pulled in transitively through markdown-toc -> gray-matter@2.1.1, and markdown-toc (unmaintained, latest is 1.2.0) pins gray-matter" to ^2.1.0, which cannot resolve to a gray-matter version without the vulnerable toml dependency. Verified make markdown-toc` produces identical output with the overridden toml version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2a0f03df-d292-4158-9db8-0cdd9bc19b5e

📥 Commits

Reviewing files that changed from the base of the PR and between de5e410 and f07a404.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• .markdown-link-check-config.json

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The package configuration requires toml version 4.1.2 or newer. The Markdown link-check configuration retries HTTP 429 responses and ignores Cloud Native Slack archive links.

Changes

Configuration updates

Layer / File(s)	Summary
toml version override package.json	Adds an npm overrides entry that requires toml version 4.1.2 or newer.
Link-check configuration .markdown-link-check-config.json	Enables retries for HTTP 429 responses and ignores links under cloud-native.slack.com/archives/.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to f07a4

The dependency and link-check configuration changes show no merge-blocking failure and are ready for normal checks.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	Issue #42 requires a hook specification. The specification must cover hook concepts, parameters and return values, attachment levels, execution order, error and abnormal-execution behavior, state stor…	Add the hook specification content required by issue #42, including the listed behaviors and attachment levels. Add automated tests when the specification introduces testable behavior.
Out of Scope Changes check	⚠️ Warning	The toml npm override in package.json and the Slack-link and retry settings in .markdown-link-check-config.json address dependency security and CI behavior. These changes have no demonstrated co…	Remove these unrelated dependency and Markdown link-check changes from this pull request, or link them to a separate issue and submit them separately.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title clearly and concisely describes the primary change: resolving Dependabot security alerts through dependency updates.
Description check	✅ Passed	The description directly explains the toml override, the security alert, and the verification performed. It is related to the changeset.

Full details: Linked Issues check

Explanation

Issue #42 requires a hook specification. The specification must cover hook concepts, parameters and return values, attachment levels, execution order, error and abnormal-execution behavior, state storage, and hook-context mutation. The reviewed changes only modify package.json and .markdown-link-check-config.json. They do not provide the required specification or implementation evidence for any listed objective.

Full details: Out of Scope Changes check

Explanation

The toml npm override in package.json and the Slack-link and retry settings in .markdown-link-check-config.json address dependency security and CI behavior. These changes have no demonstrated connection to the hook specification in issue #42. The excluded package-lock.json cannot be assessed, but this does not establish a connection to issue #42.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}

[jonathannorris]

@copilot fix the json-lint CI failure

[Copilot]

@copilot fix the json-lint CI failure

Fixed in de5e410 by enabling retryOn429 in the markdown link checker configuration, so transient Slack rate limiting no longer fails make lint.