[kumilingus]

Summary

Clears Dependabot alerts held by dev tooling in the Angular example and in @joint/sanitize.

@joint/sanitize build and test tools (rollup ×2, serialize-javascript ×3)

Its devDependencies were older than the rest of the repository - the versions @joint/core and the other packages use now:

	From	To
rollup	4.36.0	4.64.12
@rollup/plugin-terser	^0.4.4	^1.0.2 (serialize-javascript 6 → 7)
@rollup/plugin-node-resolve	^15.2.3	^16.0.3
mocha	11.1.0	12.0.3 (serialize-javascript 6 → 7)

Nothing a consumer installs changes: no runtime dependencies, the @joint/core peer range (>=4.1.0 <5), src/ and the bundle configuration are untouched.

Angular example (undici ×8)

Pending - to be added to this PR. @angular/build 21.2.28 pins undici 7.29.1; 21.2.29 ships 7.30.1 (same Node range). 21.2.29 was published on 2026-10-28, and Yarn's minimum package age (1 day) quarantines it until 2026-10-29.

Testing

• dist/sanitize.js, dist/sanitize.min.js and the test bundle build/test/sanitize.js are byte-identical when built with the old and the new tools.
• @joint/sanitize yarn test: mocha 12 passing, karma 106 / 106 (Chrome 156).
• Against the oldest supported core, @joint/core 4.1.0 from npm: mocha 12 passing (every require('@joint/core') resolved to 4.1.0), karma 106 / 106 with its dist/joint.js.
• yarn changeset status passes (empty changeset).

[kumilingus]

Moved to #3570.