[notpeter]

• Update @asciidoctor/core (npm) from 2.2.9 to 3.0.4
  • Updates the underlying asciidoctor/asciidoctor (ruby) from 2.0.17 to 2.0.20
  • Updates opal/opal from 0.11.99.dev to 1.7.3.
• Note, the committed dist has been out of sync with the lockfile since 2026-09-14 merging:
  Update dependency @asciidoctor/core to v2.2.9 #442
  The committed parse-rfd/parser/dist/index.js was still generated with 2.2.8
• Add test which which would catch the generated artifact being out of date.
• Upstream transitive dependencies dropped the vulnerable dependency on braces.
  See: CVE-2026-93687
  See: GHSA-vfj7-8cjw-p6xm

Full package diff

package	old	new
@asciidoctor/core	2.2.9	3.0.4
@asciidoctor/opal-runtime		3.0.1
@nodelib/fs.scandir	2.1.5
@nodelib/fs.stat	2.0.5
@nodelib/fs.walk	1.2.8
asciidoctor-opal-runtime	0.3.4
balanced-match		1.0.2
brace-expansion		2.1.7
braces	3.0.3
fast-glob	3.3.3
fastq	1.20.3
fill-range	7.1.1
fs.realpath		1.0.0
glob		8.1.0
glob-parent	5.1.2
inflight		1.0.6
inherits		2.0.4
is-extglob	2.1.1
is-glob	4.0.3
is-number	7.0.0
merge2	1.4.1
micromatch	4.0.8
minimatch		5.1.9
once		1.4.0
picomatch	2.3.2
queue-microtask	1.2.3
reusify	1.1.0
run-parallel	1.2.0
to-regex-range	5.0.1
wrappy		1.0.2