chore(deps): clear all high-severity npm advisories + enforce 3-day minimum release age

.yarnrc.yml

@@ -1 +1,23 @@
 nodeLinker: node-modules
+
+# Supply-chain minimum release age: refuse to install any dependency version
+# published less than 3 days ago (smash-and-grab malware is usually yanked
+# within hours). Internal @convertcom/* packages are exempt so our own release
+# chain never stalls on a freshly-published package.
+#
+# This file governs BOTH Berry projects in the repo: Yarn resolves rcfiles by
+# walking up from the cwd, so the nested parity project under tools/ inherits
+# these settings even though it has no .yarnrc.yml of its own (verify with
+# `yarn config --json` from tools/ — `source` points back here). That nested
+# project is why npmPreapprovedPackages is NOT dead config here, unlike the
+# php-sdk and python-sdk gates: tools/ depends on @convertcom/js-sdk-bucketing,
+# and regenerating the cross-SDK parity vectors against a freshly published
+# bucketing package would otherwise stall for three days.
+#
+# NOTE: a Yarn lockfile migration rewrites this file with hardening OPT-OUTS —
+# `npmMinimalAgeGate: 0` among them — which would silently disable the gate and
+# strip these comments. If a dependency PR ever shows this file changing,
+# that is the red flag, not the noise.
+npmMinimalAgeGate: 4320
+npmPreapprovedPackages:
+  - "@convertcom/*"

package.json

@@ -14,6 +14,6 @@
     "@semantic-release/git": "^10.0.0",
     "@semantic-release/release-notes-generator": "^14.0.0",
     "conventional-changelog-conventionalcommits": "^8.0.0",
-    "semantic-release": "^24.0.0"
+    "semantic-release": "^25.0.0"
   }
 }