fix vulnerable dependencies

[sheehanmunim]

Summary

• update vulnerable brace-expansion and undici transitive dependencies
• update the Ruby json lock entry to 2.19.9
• make the semantic-release npm plugin use the npm executable provisioned by actions/setup-node, removing its vulnerable bundled npm dependency tree
• update body-parser to 2.3.0 after a fresh audit identified an additional low-severity advisory

Root cause and impact

The lockfiles contained vulnerable transitive versions, including copies bundled inside the npm CLI dependency used only by semantic-release. The changes retain the existing release workflow while removing that duplicate bundled CLI tree. Application runtime APIs are unchanged.

Validation

• npm ci --ignore-scripts
• npm run build
• npm audit — 0 vulnerabilities
• verified semantic-release resolves the system npm executable
• parsed example/Gemfile.lock and verified json 2.19.9
• git diff --check

[github-actions]

🎉 This PR is included in version 0.6.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀