Renovate dependency batch (13 PRs)

[sirugh]

Summary

Consolidates 13 open Renovate PRs onto a single branch, validated locally with the same gating as CI (npm ci && npm run lint && npm run test — 123/123 passing) plus inspection of breaking-change notes.

Included

Security patches

• Update dependency diff to v8.0.3 [SECURITY] #260 diff → v8.0.3
• Update dependency js-yaml to v4.1.1 [SECURITY] #252 js-yaml → v4.1.1
• Update dependency vega to v6.2.0 [SECURITY] #251 vega → v6.2.0
• Update dependency handlebars to v4.7.9 [SECURITY] #269 handlebars → v4.7.9

DevDep minors / lockfile

• Update eslint monorepo to v9.39.4 #210 eslint monorepo → v9.39.4
• Update dependency jest to v30.3.0 #213 jest → v30.3.0
• Update dependency dotenv to v17.4.2 #221 dotenv → v17.4.2
• Update dependency globals to v16.5.0 #230 globals → v16.5.0
• Update dependency vega-lite to v6.4.3 #225 vega-lite → v6.4.3

Runtime minors / lockfile

• Update dependency @whatwg-node/server to v0.10.18 #240 @whatwg-node/server → v0.10.18
• Update dependency @adobe/aio-lib-runtime to v7.3.0 #233 @adobe/aio-lib-runtime → v7.3.0

Major bumps (audited)

• Update adobe/aio-apps-action action to v4 #222 adobe/aio-apps-action v3 → v4 — breaking change is "remove sudo from aio-cli commands" (workflow-side only); the renovate PR's CI passed with v4.
• Update dependency p-limit to v7 #204 p-limit v6 → v7 — breaking changes are Node ≥20 (CI is Node 22) and activeCount semantics (we don't read it); only call site is pLimit(50) in actions/check-product-changes/poller.js via dynamic import.

Excluded

• Update dependency msw to v2.14.3 #218 msw → v2.14.3 — real regression: pulls in transitive rettime (ESM-only .mjs) and our test files use require('msw'), so jest fails with Must use import to load ES Module. Needs one of: pin upper bound (~2.10), convert affected tests to ESM, or add jest transformIgnorePatterns for rettime. Tracking via PR Update dependency msw to v2.14.3 #218.

Test plan

• npm ci clean
• npm run lint clean
• npm run test — 123/123 passing
• CI green on this PR (Test PR + Kodiak)
• e2e (npm run e2e) — not run locally (requires deployed AIO Runtime); not in CI either, matching existing gating
• deploy app from this branch against small catalog.

🤖 Generated with Claude Code