chore: bump runtime deps to patched versions (security)

[cherkanovart]

Summary

Bumps directly-pinned runtime dependencies to versions patched against open Dependabot advisories (ENG-1056, SOC 2 dependency-scanning hardening). All bumps are patch/minor within the same major — no API changes expected:

• fast-xml-parser 5.3.2 / 5.3.3 → 5.7.0 (@lingo.dev/_compiler, @lingo.dev/compiler) — clears 3 critical + 9 high alerts
• js-cookie 3.0.5 → 3.0.7 (@lingo.dev/_react) — 2 high
• lodash 4.17.21 → 4.18.0 (cli, react, both compilers) — 5 high + medium
• minimatch 10.1.1 → 10.2.5 (root, matches the version already pinned in cli)

Deliberately excluded (kept this PR zero-risk):

• Transitive-only vulnerable copies (axios 1.12.2, minimatch 3.x/5.x/9.x, fast-xml-parser 5.2.5, etc.) — fixing them requires pnpm overrides, which force versions onto all consumers; will be handled separately (overrides PR or dismiss-with-rationale)
• next bumps — separate PR with an app smoke test

Stacked on #2107 (vitest bumps) to avoid lockfile conflicts; retarget to main after it merges.

Test plan

• pnpm install resolves cleanly; lockfile diff is minimal (pins only, no churn)
• Full test suite: 23/24 turbo tasks pass; the one failure is a pre-existing locally-failing test (packages/new-compiler metadata/manager.test.ts "1000 concurrent operations") that fails identically on clean main
• Changeset included: patch release for lingo.dev, @lingo.dev/_compiler, @lingo.dev/compiler, @lingo.dev/_react

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 99736bef-c579-45c0-a64a-c93ddc2c0f78

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch eng-1056-bump-runtime-deps

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}