fix: resolve security alerts

[maxatwork]

Summary

• add explicit read-only GitHub Actions workflow permissions
• harden core path writes against prototype pollution and cover them with regression tests
• refresh the lockfile to patched dependency versions and replace flagged bracket-parsing regex paths

Test Plan

• npm audit --json
• npm run lint
• npm run typecheck
• npm run test:packages
• npm run test:integration

---

Summary by cubic

Fixes security alerts by hardening path writes to prevent prototype pollution and by setting read-only GitHub Actions permissions. Replaces regex-based bracket parsing with a safe matcher and refreshes dependencies to patched versions.

• Bug Fixes

  • Hardened setPathValue: uses null-prototype maps and own-property access; blocks __proto__, prototype, and constructor unless explicitly allowed, and stores them as own props when allowed; adds regression tests.
  • Safer bracket parsing in core and js2form with a custom matcher (no regex backtracking), including tests for unmatched brackets and array index markers.

• Dependencies

  • Refreshed lockfile to patched versions (e.g., rollup 4.59.1, minimatch 3.1.5/9.0.9/10.2.4, ajv 6.14.0, flatted 3.4.2).

^{Written for commit 8f4f249. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 6 files