chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Adds overrides in package.json to require at least the patched version of transitive dependencies (within the current major). Note: webpack-dev-server alerts (#69, #70) require a major upgrade (4.x → 5.x) — blocked by @nx/webpack@17.3.2 which requires webpack-dev-server ^4.9.3.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#128	serialize-javascript	high	Overridden to ^7.0.5 (RCE via RegExp/Date)
#158	serialize-javascript	medium	Overridden to ^7.0.5 (CPU exhaustion DoS)
#153	@tootallnate/once	low	Overridden to ^3.0.1 (Incorrect Control Flow)
#159	fast-uri	high	Overridden to ^3.1.2 (path traversal via percent-encoded dots)
#160	fast-uri	high	Overridden to ^3.1.2 (host confusion via percent-encoded delimiters)
#161	@babel/plugin-transform-modules-systemjs	high	Overridden to ^7.29.4 (arbitrary code generation from malicious input)

Unresolvable Alerts

Alert	Package	Reason
#69, #70	webpack-dev-server	Patched version is 5.2.1, but @nx/webpack@17.3.2 requires ^4.9.3; major upgrade needed

[gemini-code-assist]

Code Review

This pull request updates several dependencies, including upgrading serialize-javascript to version 7.0.5 and @tootallnate/once to version 3.0.1, while adding minimatch and removing randombytes. Feedback highlights that the serialize-javascript upgrade introduces a breaking requirement for Node.js 20.0.0, which may impact environments on older LTS versions. Additionally, it is recommended to use caret ranges instead of the >= operator in the dependency overrides to ensure stability and prevent unintended major version upgrades.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds npm overrides to mitigate several Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies.

Changes:

• Added overrides for serialize-javascript, @tootallnate/once, fast-uri, and @babel/plugin-transform-modules-systemjs.
• Kept existing test-exclude override (with minimatch) and extended the override list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.