chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 5 open Dependabot security alerts by bumping devDependencies (markdownlint-cli) and adding a targeted npm override for a transitive dependency (ip-address)
• Fixed a dead link in specification/appendix-c/index.md (CNCF Slack invite) that was causing the lint CI job to fail on this branch

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#38	ip-address	medium	Bumped to 10.4.0 via npm override >=10.2.2 (transitive, via markdown-link-check -> proxy-agent -> socks-proxy-agent -> socks)
#37	ip-address	medium	Same override as above, also resolves this alert
#33	linkify-it	high	Bumped to 5.0.2 (transitive, via markdownlint-cli 0.49.1)
#32	js-yaml	high	Bumped to 5.2.2 (transitive, via markdownlint-cli 0.49.1)
#31	brace-expansion	high	Bumped to 5.0.8 (lockfile refresh)

No changes to production code; devDependencies and lockfile only, plus the one-line dead-link fix noted above. Verified npm audit reports 0 vulnerabilities for the packages listed above, and make lint / make markdown-toc pass locally matching CI behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

package.json now requires Node.js >=22.22.2, upgrades markdownlint-cli to ^0.49.1, and adds an ip-address override requiring >=10.2.2. The markdown link-check configuration adds an ignore pattern for matching CNCF community invitation links.

Changes

Maintenance updates

Layer / File(s)	Summary
Runtime and tooling requirements package.json	Updates the Node.js engine requirement to >=22.22.2, upgrades markdownlint-cli to ^0.49.1, and adds an ip-address package override requiring >=10.2.2.
Markdown link-check pattern .markdown-link-check-config.json	Adds an ignore pattern for matching CNCF community invitation links at communityinviter.com/apps/cloud-native/cncf.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• open-feature/spec#395: Previously updated the same markdownlint-cli development dependency in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main change: resolving Dependabot security alerts through dependency updates.
Description check	✅ Passed	The description is directly related to the changeset, detailing which security alerts were resolved and how.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates JavaScript devDependencies/lockfile to address open Dependabot security alerts affecting transitive packages used by the markdown linting/tooling workflow.

Changes:

• Bumped markdownlint-cli devDependency from ^0.49.0 to ^0.49.1.
• Updated package-lock.json to pull patched transitive versions (including linkify-it, js-yaml, and brace-expansion) and related dependency bumps.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps markdownlint-cli to ^0.49.1 to pick up patched transitive dependencies.
package-lock.json	Refreshes the lockfile with updated transitive dependency versions (including security-related updates).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.markdown-link-check-config.json:11

• This unrelated exemption changes markdown-link-check behavior by permanently skipping the existing CNCF invite link in specification/appendix-c/index.md:19, although the PR is described as a dependency-only security update whose checks behave identically to main. Please remove it from this PR, or separately document why this URL must no longer be validated.

    {
      "pattern": ".*communityinviter.com/apps/cloud-native/cncf.*"