build(deps): bump npm to 11.19.1 to clear pacote GHSA-w4pp-8pjf-rmxw

[cursor]

What

Refreshes the transitive npm resolution (pulled in via @semantic-release/npm@13.1.5) from 11.16.0 → 11.19.1. That bump upgrades the nested pacote from 21.5.0 → 21.5.1, which is the version that fixes GHSA-w4pp-8pjf-rmxw — pacote is vulnerable to Denial of Service (DoS) via the addGitSha function (High).

This is the only new Dependabot advisory that appeared since the last cron run; all other outstanding advisories are already covered by existing open PRs (#1200 brace-expansion, #1201 ip-address, #1202 undici, #1203 fast-uri, #1204/#1205 js-yaml, #1206 nanoid in examples/with-next).

How

Used the standard lockfile-refresh trick (no manifest change, no new resolutions entry):

1. Removed the "npm@npm:^11.6.2" and "pacote@npm:^21.0.0, ..." blocks from yarn.lock.
2. Ran yarn install, letting Yarn re-resolve both ranges against the registry.
3. Yarn locked npm@11.19.1 (still satisfies @semantic-release/npm's ^11.6.2) and pacote@21.5.1.

Diff is confined to yarn.lock (53 lines each way). No resolutions entry was added, per the repo's preference to avoid them.

Verification

• yarn npm audit --recursive --all --json no longer reports GHSA-w4pp-8pjf-rmxw (pacote entry gone).
• yarn test — 37 suites / 139 tests pass.
• yarn build — succeeds.

Notes

• npm@12.x was intentionally not chosen because it would fall outside @semantic-release/npm's declared npm@^11.6.2 peer/dep range.
• Deprecation-only entries surfaced by the audit (eslint 8, glob 7, rimraf 3, etc.) are not CVEs and are left alone.