chore(deps): bump pprof-format to 2.3.1

[szegedi]

Moves pprof-format from ^2.3.0 to ^2.3.1 and repins the lockfile.

What is actually in 2.3.1

Diffing the published tarballs, package.json is the only file that differs:

$ diff -rq pprof-format-2.3.0/package pprof-format-2.3.1/package
Files a/package/package.json and b/package/package.json differ

and within it: the version, two devDependency bumps (@types/node, eslint), and an overrides block pinning brace-expansion and linkify-it in pprof-format's own dev tree.

pprof-format has no runtime dependencies, and a dependency's overrides are ignored by npm — only the root project's apply. So no shipped code changes here, and no vulnerability we are exposed to is fixed. It keeps us on the current release and off tooling's "behind latest" reports; that is the whole of it. Flagging it so nobody reads the CVE-shaped commit titles upstream and assumes otherwise.

^2.3.0 already admitted 2.3.1, so the substantive part is the lockfile pin. The range moves in step so the declared floor matches what CI tests against.

Diff scope

Confined to pprof-format: one line in package.json, and the version/resolved/integrity triple plus the dependency spec in package-lock.json. Nothing else in the lock moved.

Verification

Full suite 115 passing, gts check 0 errors, addon builds clean.

[github-actions]

Overall package size

Self size: 2.49 MB
Deduped: 3.19 MB
No deduping: 3.19 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | pprof-format | 2.3.1 | 504.33 kB | 504.33 kB | | source-map | 0.8.0 | 185.66 kB | 185.66 kB | | node-gyp-build | 4.8.4 | 13.86 kB | 13.86 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}