chore: updated several dependencies with sec issues (#1484)

SECURITY.md

@@ -27,7 +27,7 @@ question we ask of any report is **what does the attacker control?**
   (for example passing an attacker-controlled string as a hook entry point). We
   treat these as defensive fixes.
 
-The dividing line is about *who supplies the dangerous element*, not how severe
+The dividing line is about _who supplies the dangerous element_, not how severe
 the consequence sounds. A report framed as "stored XSS" that requires the
 application to allow `onerror` via a hook is still a hardening bug, because the
 application allowed `onerror`. Configuration patterns that are safe by default

package.json

@@ -124,7 +124,7 @@
     "@rollup/plugin-typescript": "^12.3.0",
     "@types/estree": "^1.0.9",
     "@types/node": "^25.9.3",
-    "babel-plugin-istanbul": "^8.0.0",
+    "babel-plugin-istanbul": "^5.2.0",
     "cross-env": "^10.1.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.6",
@@ -133,7 +133,7 @@
     "husky": "^9.1.0",
     "jquery": "^3.6.0",
     "jsdom": "^29.1.1",
-    "nyc": "^18.0.0",
+    "nyc": "^14.1.1",
     "prettier": "^3.8.4",
     "qunit": "^2.26.0",
     "qunit-tap": "^1.5.0",