[Matt Masson (mattmasson)]

Summary

• applies npm audit fix without --force to remediate vulnerable transitive dependencies within existing package constraints
• upgrades Mocha from ^11.3.0 to ^12.0.3
• replaces mocha-multi-reporters and mocha-junit-reporter with a local mochaReporter.js composite reporter using Mocha's built-in Spec and XUnit reporters
• preserves readable console output and test-results.xml for both the library and resource test suites
• removes the obsolete reporter configuration and serialize-javascript override; Mocha now resolves patched serialize-javascript directly

Validation

• npm ci
• npm run lint
• npm run build
• npm test — 885 passing, 1 pending; XUnit: 886 tests, 0 failures, 0 errors
• npm run test:resources — 102 passing; XUnit: 102 tests, 0 failures, 0 errors
• npm audit

Remaining audit findings

npm audit reports 8 moderate findings, with 0 high and 0 critical. They are confined to the development toolchain: Mocha's glob/minimatch chain and transitive @typescript-eslint/* dependencies. npm's proposed complete remediations are breaking downgrades to Mocha 11.4.0 and @typescript-eslint 6.15.0, so they were not applied.