build(deps): bump chai to v6

[claude]

Requested by David Babenko-Sanders · Slack thread

This bumps chai from 5 to 6.3.0, the latest release that clears the repo's 7-day package age gate. It also moves the chai type definitions from v4 to v5, which matches what vitest already pulls in, because chai 6 still doesn't ship its own types. The only breaking change in chai 6 is that it now ships as a single bundled file, so code that deep-imports its internal files breaks. This repo only uses the top-level expect import, so no source changes were needed. The 6.x minor releases changed how keys() and deep oneOf behave, and neither is used here. The tests' inline snapshots of chai assertion messages, which the parser surfaces to users, still pass unchanged, so the error text users see should stay the same. Lint, build and the full test suite pass locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R1iLgtNj9JZPkuSQCZbGfR

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	chai@​5.1.2 ⏵ 6.3.0	+1			+1

View full report

[claude]

LGTM, a straightforward dependency version bump. Checked that chai is only consumed via the top-level expect import in src/block-parsers.ts, src/DocsParser.ts, and src/markdown-helpers.ts (no deep imports into chai internals, which is the only breaking change in chai 6), and the yarn.lock diff consistently reflects the new chai 6.3.0 / @ types/chai 5.2.3 resolutions with their now-unused chai 5 transitive deps removed.

Extended reasoning...

The diff is limited to package.json and yarn.lock, bumping chai ^5.1.1→^6.3.0 and @ types/chai ^4.3.19→^5.2.3 with no source code changes. It touches no security-sensitive surface (no auth, crypto, or permissions code). Verified via grep that chai is only used through the top-level expect import in three source files, matching the PR's claim that chai 6's single-bundled-file breaking change does not affect this repo. The lockfile changes are mechanical and consistent with the version bump, dropping now-unneeded chai 5 transitive packages.