chore(security): patch remaining HIGH/MED CVEs flagged by OpenSSF Scorecard (#239)

Patches 8 vulnerabilities (mermaid, fast-uri, postcss, babel-systemjs)
and enables npm provenance via sigstore on release. See commit message
for GHSA list. 1199/1199 tests pass; all lockfiles audit-clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

.github/workflows/release.yml

@@ -120,11 +120,11 @@ jobs:
 
       - name: Publish to npm
         if: inputs.dry-run == false
-        run: npm publish --access public
+        run: npm publish --access public --provenance
 
       - name: Publish to npm (dry run)
         if: inputs.dry-run == true
-        run: npm publish --access public --dry-run
+        run: npm publish --access public --provenance --dry-run
 
       - name: Create GitHub Release
         if: inputs.dry-run == false

packages/demo-video/package-lock.json

@@ -22,7 +22,9 @@
   },
   "overrides": {
     "brace-expansion@>=1.0.0 <2.0.0": "^1.1.13",
-    "brace-expansion@>=2.0.0 <3.0.0": "^2.0.3"
+    "brace-expansion@>=2.0.0 <3.0.0": "^2.0.3",
+    "fast-uri": ">=3.1.2",
+    "postcss": ">=8.5.10"
   },
   "scripts": {
     "dev": "remotion studio",

packages/demo-video/package.json

@@ -26,7 +26,7 @@
     "@xterm/xterm": "^5.5.0",
     "highlight.js": "^11.11.1",
     "material-icon-theme": "^5.32.0",
-    "mermaid": "^11.13.0",
+    "mermaid": "^11.15.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-markdown": "^10.1.0",
@@ -42,7 +42,8 @@
     "lodash-es": ">=4.18.0",
     "dompurify": "^3.4.1",
     "uuid": "^14.0.0",
-    "fast-uri": ">=3.1.2"
+    "fast-uri": ">=3.1.2",
+    "@babel/plugin-transform-modules-systemjs": ">=7.29.4"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.6.3",