chore: Remediate 25 Dependabot security alerts (lockfile only)

[SpyZzey]

Updates seven transitive dependencies in package-lock.json to resolve 25 of the 26 open Dependabot security alerts in this repository. package.json is unchanged. Grouped into a single PR so the repository's alerts can be cleared in one review instead of 25 separate dependency updates.

Alerts addressed

• GHSA-xw65-4hp5-5hc7 (CVE-2026-106444) — handlebars, medium — 4.7.9 -> 4.7.10
• GHSA-8r5x-fm3f-whwj (CVE-2026-106446) — handlebars, critical — 4.7.9 -> 4.7.10
• GHSA-p8wg-vrv2-v86f (CVE-2026-106445) — handlebars, critical — 4.7.9 -> 4.7.10
• GHSA-pqg4-j6r4-53mv (CVE-2026-102422) — shell-quote, critical — 1.10.0 -> 1.12.0
• GHSA-68fv-2mgg-jv7q (CVE-2026-93749) — source-map-js, high — 1.2.1 -> 1.2.2
• GHSA-wr44-6hxh-3jwq (CVE-2026-90771) — joi, medium — 18.2.8 -> 18.2.9
• GHSA-j8rh-479h-cp32 (CVE-2026-101904) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-4hqw-qxg8-jxx2 (CVE-2026-101900) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-m8m8-qj5v-23w3 (CVE-2026-101905) — axios, high — 1.18.1 -> 1.20.0
• GHSA-44g4-m2mj-wpvx (CVE-2026-101899) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-r4gj-5m52-g5wh (CVE-2026-101907) — axios, high — 1.18.1 -> 1.20.0
• GHSA-vh66-26gq-q6x8 (CVE-2026-101908) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-9fr6-4gfg-395g (CVE-2026-101902) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-x97p-jq2g-jp4f (CVE-2026-101909) — axios, high — 1.18.1 -> 1.20.0
• GHSA-3pq3-5fj3-cg6v (CVE-2026-101898) — axios, high — 1.18.1 -> 1.20.0
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 1.1.16 -> 1.1.21
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 2.1.4 -> 2.1.7
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 5.0.9 -> 5.0.12
• GHSA-pmjh-fq2x-6v4x (CVE-2026-18149) — undici, medium — 7.29.0 -> 7.29.1
• GHSA-r53p-7pc4-xj5r (CVE-2026-18540) — undici, low — 7.29.0 -> 7.29.1
• GHSA-r53p-7pc4-xj5r (CVE-2026-18540) — undici, low — 6.28.0 -> 6.28.1
• GHSA-2jfj-6hjv-fm6j (CVE-2026-84933) — undici, medium — 7.29.0 -> 7.29.1
• GHSA-2gqq-gqf2-x968 (CVE-2026-84947) — undici, low — 7.29.0 -> 7.29.1
• GHSA-8436-99hf-9mmv (CVE-2026-85008) — undici, low — 7.29.0 -> 7.29.1
• GHSA-w293-vg96-wgc3 (CVE-2026-84961) — undici, high — 7.29.0 -> 7.29.1

Not fixed

• GHSA-hp3w-g68c-fv3c (CVE-2026-97058) — sprintf-js, medium — no patched release has been published for any affected version, so there is nothing to update to. This alert stays open and needs a separate decision (dependency removal or an upstream fix).

How it was fixed

Every affected package is transitive-only, so each vulnerable lockfile entry was moved to its patched release and nothing was promoted to a direct dependency:

• handlebars 4.7.9 -> 4.7.10 (covers three advisories)
• shell-quote 1.10.0 -> 1.12.0
• source-map-js 1.2.1 -> 1.2.2
• joi 18.2.8 -> 18.2.9
• axios 1.18.1 -> 1.20.0 (covers nine advisories)
• brace-expansion 1.1.16 -> 1.1.21, 2.1.4 -> 2.1.7 (two nested entries), 5.0.9 -> 5.0.12
• undici 7.29.0 -> 7.29.1 and 6.28.0 -> 6.28.1 (covers seven advisories)

Major lines are tracked separately for brace-expansion and undici because each line has its own alert and an update on one line does not address the others. For undici the first patched release on each line was chosen rather than the newest release, to keep the change minimal.

All seven packages are development dependencies, so no published artifact changes. The diff is 89 changed lines and contains only these version changes: no unrelated upgrades, no added or removed packages, and no package.json change. npm audit reports none of these advisories after the change.

Verification

Run locally on this exact commit:

• npm install — succeeds
• npm run build — succeeds
• npm run lint — clean
• npm run test:unit — 51 suites, 474 tests, all passing

The browser-driven integration tests (npm run test:integ) could not be used as verification locally: they fail during browser startup because the local Chrome and ChromeDriver versions do not match, which is unrelated to these dependency changes. Please rely on CI for that suite.

Superseded pull requests

These auto-generated update PRs are covered by this one and have been closed:

• chore: Bump source-map-js from 1.2.1 to 1.2.2 #260 — source-map-js 1.2.1 -> 1.2.2
• chore: Bump shell-quote from 1.10.0 to 1.12.0 #261 — shell-quote 1.10.0 -> 1.12.0
• chore: Bump handlebars from 4.7.9 to 4.7.10 #262 — handlebars 4.7.9 -> 4.7.10

If this PR fails CI or is abandoned, any of them can be restored by commenting the Dependabot reopen command on it; Dependabot will not recreate them on its own.

Merging this PR is expected to resolve 25 of this repository's 26 open alerts; the sprintf-js alert listed above will remain open.

All upgraded packages are available internally.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.04%. Comparing base (5d810a5) to head (5a36b77).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #263   +/-   ##
=======================================
  Coverage   99.04%   99.04%           
=======================================
  Files          48       48           
  Lines        1368     1368           
  Branches      373      373           
=======================================
  Hits         1355     1355           
- Misses         12       13    +1     
+ Partials        1        0    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.