fix(security): bump transitive npm deps via overrides (clears 17 npm alerts)

[mdheller]

Third Dependabot tranche. All npm alerts are transitive in apps/socioprophet-web, fixed by pinning patched versions through package.json overrides:

Package	From → To
undici	6.19.7 → 6.27.0
fast-xml-parser	5.9.3 → 5.10.1
fast-uri	3.1.3 → 3.1.4
brace-expansion	2.1.1 → 2.1.2
protobufjs	7.6.4 → 7.6.5
@hono/node-server	1.19.14 → 2.0.5 (major)

npm install --package-lock-only rc=0; all six verified at patched versions in the lockfile. Five are in-major/patch; @hono/node-server is a major bump (transitive) — build-web CI gates any regression, and auto-merge won't fire unless it's green.

Completes the Dependabot remediation with #1130 (go criticals) and #1142 (pip). Remaining: starlette major migration, protobuf-vs-arcticdb, lattice pypdf, and dev-only pytest — each documented in #1142.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pins patched transitive npm dependencies in apps/socioprophet-web via package.json overrides to clear npm security alerts.

Changes:

• Added overrides entries for undici, fast-xml-parser, fast-uri, brace-expansion, protobufjs, and @hono/node-server
• Kept existing qs override and resolutions entry

Files not reviewed (1)

• apps/socioprophet-web/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

apps/socioprophet-web/package.json:57

• This file uses both npm overrides and (typically Yarn) resolutions, but the new security pins are only applied via overrides. If anyone installs with Yarn (or tooling that relies on resolutions), they may still pull vulnerable transitive versions. Consider mirroring these new pins into resolutions (or removing resolutions if Yarn isn’t supported here) to keep behavior consistent across package managers.

  "overrides": {
    "qs": "^6.11.2",
    "undici": "6.27.0",
    "fast-xml-parser": "5.10.1",
    "fast-uri": "3.1.4",
    "brace-expansion": "2.1.2",
    "protobufjs": "7.6.5",
    "@hono/node-server": "2.0.5"
  },
  "resolutions": {
    "qs": "^6.11.2"
  }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.