[Juliusolsson05]

Supersedes #1322 for everything except happy-dom.

Why not merge #1322 as it stands

Its quality-gate failed (run 36168289491) on DOM-event tests, all under happy-dom, which #1322 moves 20.9.0 → 20.14.5:

• the real-xterm terminal wheel-boundary suite;
• keybinding-recorder click/focus handling;
• pane resume.

Agent Code already carries shims for happy-dom in the real-xterm test (see terminalWheelBoundary.xterm.renderer.test.ts). A happy-dom minor that breaks event dispatch needs its own investigation, not a ride-along in a bulk bump.

What this takes

#1322's other 20 updates:

• @iconify-json/vscode-icons 1.2.80;
• @opentelemetry/* 2.11.0;
• @radix-ui/react-dialog 1.1.23, react-dropdown-menu 2.1.24, react-label 2.1.15, react-slot 1.3.3;
• highlight.js 11.12.0, pidtree 0.6.1, tailwind-merge 3.7.0;
• ws (resolves to 8.22.0 inside ^8.21.3), yaml 2.9.1, zustand 5.0.15;
• @electron/asar (resolves to 4.3.1), @tailwindcss/vite and tailwindcss 4.3.3;
• @testing-library/react 16.3.3, tsx 4.23.15.

The lockfile was regenerated with npm install --package-lock-only from the edited package.json, plus npm update for the two caret-range lock-only bumps, with the package submodules initialised, since the file: deps are embedded. happy-dom stays at 20.9.0.

Gate

CI on this PR. If the same DOM-event tests pass here, the happy-dom attribution is confirmed. A follow-up issue will then track the happy-dom 20.14 move.

Residual: highlight.js 11.12.0 does not reach markdown code blocks

The root now resolves highlight.js 11.12.0, and the six direct import hljs from 'highlight.js' sites get it. Markdown code blocks, however, highlight through rehype-highlight → lowlight@3.3.0, which declares highlight.js ~11.11.0. So npm nests node_modules/lowlight/node_modules/highlight.js@11.11.2 for that path.

The 11.12.0 grammar fixes (the C/C++ type-token run and XML recursive-sublanguage ReDoS fixes) therefore apply to direct highlighting only, not to markdown code blocks. That needs a lowlight release that accepts 11.12. Found by review c.

🤖 Generated with Claude Code

[Juliusolsson05]

Parked (W1). The quality-gate at 0b93bd76 failed on the runner itself: no space left on device (and goal-loop temp-dir ENOENTs caused by it), not on a test of this change. The build machine's data volume is at 100%; the manager is told in the W1 status file. I'll re-run CI once space is freed, then ask reviewers a and b to re-check. Reviewer c is already MERGE-READY.

[Juliusolsson05]

READY (W1). Head 0b93bd76.

• CI. Run 36306368722, attempt 2, is the manager's q98 rerun after the runner ran out of disk. It passes at the exact head.
• Reviews. Every reviewer is MERGE-READY: a (verify-report-a), b (verify-report-b) and c (report-c). a's and b's first rounds had no code finding; their only blocker was the then-pending CI.
• Diff since review. Both verifications confirmed that the PR's own patch is byte-identical to what they reviewed; only a main merge was added. They also confirmed the lowlight → highlight.js 11.11.2 residual stated in the body.
• Gate. merge-gate.sh --member: GATE PASS. Mergeable and clean.