Resolve Dependabot alerts

[hshoff]

💥 Breaking Changes

• None.

🚀 Enhancements

• None.

📝 Documentation

• Add a 4.0.0-alpha.16 entry to MIGRATION.md for the dependency security update.

🐛 Bug Fix

• Resolve the open Dependabot alerts by updating vulnerable dependency ranges and lockfile entries.
• Update the demo app to the patched Next.js 15.5 line and resolve Next's pinned PostCSS dependency through a Yarn resolution.
• Update Vitest, Lerna/Nx, Babel preset-env, and vulnerable transitive dependencies including Axios, Handlebars, Tar, Minimatch, Glob, Lodash, Picomatch, js-yaml, mdast-util-to-hast, ip-address, Flatted, and related packages.

🏠 Internal

• Verified with yarn install --immutable, yarn build, yarn test, yarn docs:generate && yarn workspace @visx/demo build, and yarn lint.

[Copilot]

Pull request overview

This PR updates dependency versions and overrides to address reported vulnerabilities, including moving the demo workspace onto a patched Next.js 15.5.x release and pinning transitive dependencies via Yarn resolutions.

Changes:

• Bumped next in @visx/demo to the ^15.5.18 range.
• Updated root dev tooling versions (Babel preset-env, Vitest UI/coverage + Vitest itself, Lerna).
• Added a root Yarn resolutions override for postcss to 8.5.15.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
packages/visx-demo/package.json	Updates the demo app’s Next.js dependency range.
package.json	Bumps build/test tooling deps and adds a postcss resolution override.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hshoff]

Addressed the Copilot review suggestions in 29852f75: narrowed the PostCSS override to postcss@npm:8.4.31 and changed the demo Next.js range to ~15.5.18 so it stays on the 15.5 patch line.

[github-actions]

🎉 This PR is included in version v4.0.0 of the packages modified 🎉