chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Added a tmp resolution forcing ^0.2.6 to fix a high-severity vulnerability (alert chore: update changelog from prepare release step #105). The vulnerable tmp@0.2.5 was pulled in transitively via @vscode/vsce; it now resolves to 0.2.7.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#105	tmp	high	Bumped 0.2.5 -> 0.2.7 via resolutions

[Copilot]

Pull request overview

Updates the dependency graph to address a high-severity Dependabot alert by forcing tmp to a non-vulnerable version via Yarn resolutions, ensuring transitive consumers (e.g., via @vscode/vsce) no longer pull tmp@0.2.5.

Changes:

• Add a Yarn resolutions override for tmp to ^0.2.6 in package.json.
• Update yarn.lock so tmp resolves to 0.2.7.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds a resolutions entry to force tmp to ^0.2.6.
yarn.lock	Locks tmp to 0.2.7, removing the previously-resolved vulnerable 0.2.5.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.