chore: fix CVE-2026-22709

[loganaden]

https://nvd.nist.gov/vuln/detail/CVE-2026-22709

[styfle]

Thanks for the PR! You also need to update the lockfile like so: #1303

[loganaden]

@styfle working on it.

[styfle]

Thanks for flagging this! I've created #1310 which includes both the package.json change and the updated yarn.lock (this repo uses Yarn, so the lockfile needs to be updated as well).