Pin yarn resolutions to close 15 of 22 Medium/Low Dependabot alerts

[JerryS22]

GitHub Issue	Follow-up to merged #46. Parent epic: https://github.com/TodayTix/ttg/issues/15135.
Problem	After PR #46 closed Critical+High to 0, the repo still had 15 Medium and 7 Low Dependabot alerts (22 total). All transitives in the legacy webpack 2 / babel 6 dev toolchain. Out of scope for the original ticket but flagged the the M/L cleanup follow-up.
Impact	These don't block the parent epic's "0 C / 0 H" goal but keep the repo non-zero on the org-wide dashboard. Closing them tidies the security surface to 0 alerts of any severity and reduces noise in https://github.com/orgs/TodayTix/security/overview.
Outcome	Repo's Dependabot dashboard goes from 15 M + 7 L = 22 to 5 M + 2 L = 7 (closes 15). The 7 residuals are toolchain-blocked or have no published fix and will be dismissed-with-justification post-merge — same playbook as PR #46. Zero impact on published artifacts: both dist-modules/ and dist/index.js are byte-identical to current master.

Resolutions added

Package	Pin	Closes alert
ajv	^6.12.3	M #83
cookie	^0.7.0	L #170
express	^4.20.0	L #167 + M #152
got	^11.8.5	M #100
ip	^1.1.9	L #149
jsonpointer	^5.0.0	M #72
on-headers	^1.1.0	L #183
send	^0.19.0	L #166
serve-static	^1.16.0	L #165
sockjs	^0.3.20	M #55
stringstream	^0.0.6	M #31
tough-cookie	^4.1.3	M #137
tunnel-agent	^0.6.0	M #24
yargs-parser	^5.0.1	M #51

14 resolutions → 15 alerts closed (express covers two).

Known exceptions (will be dismissed-with-justification post-merge)

Same toolchain-block / no-fix patterns as PR #46:

Alert	Package	Why blocked
M #243, M #139	postcss 8.x	postcss-cssnext@2 (used in dev styles pipeline) is incompatible with postcss 8 — pixrem transitively errors ERR_PACKAGE_PATH_NOT_EXPORTED. Closing requires postcss-cssnext → cssnano migration (out of scope).
M #178, M #179	webpack-dev-server 5.2.1	webpack-dev-server 5 needs webpack 5+; this lib is on webpack 2. Same block as PR #46's H #19.
M #242	uuid 14.0.0	uuid 14 is ESM-only; legacy request package's CommonJS require() can't load it (ERR_REQUIRE_ESM).
M #121	request	Advisory fixed_in=null — package is deprecated upstream, no fix forthcoming.
L #195	elliptic	Advisory fixed_in=null. Not a higher version exists than what we're already pinned to (^6.6.1).

Decisions

• Same single-sweep pattern as PR Pin yarn resolutions to close 67 of 75 Critical/High Dependabot alerts #46. All alerts share one lockfile, all transitives. Splitting wouldn't help review.
• Dropped postcss and uuid resolutions early during bisect once they broke the build. Kept consistent with the "don't fight the toolchain" principle from PR Pin yarn resolutions to close 67 of 75 Critical/High Dependabot alerts #46.
• No changes to package.json#dependencies. Only the resolutions block expanded. Library API surface unchanged.

Verified

Check	Result
yarn install (clean, Node 18.20.8)	✅
yarn run test	✅ 21/21 pass
yarn run lint	✅
yarn run dist:all	✅
A. dist-modules/ byte-diff vs master	✅ identical
A2. dist/index.js byte-diff vs master	✅ identical (unlike PR #46, no internal lodash shift this time)
B. yarn pack + scratch consumer	✅ <Calendar /> renders cleanly against the new tarball

The byte-stability is the headline: this PR is purely lockfile-graph cleanup. Nothing reaches consumers' bundles.

Reviewer FAQ

Q: Does merging this affect any user?
No. Identical to PR #46's analysis: this only updates the repo's master branch + lockfile. No npm publish, no consumer impact, and even if someone published, both dist/index.js and dist-modules/ are byte-identical to master so consumers' bundles wouldn't change.

Q: Does platform need an update?
No. Platform consumes the prebuilt dist/index.js from npm 1.5.8 (2017). All these alerts are dev-only transitives in tt-react-calendar's webpack/babel toolchain — they never reach the runtime artifact platform ships. Platform additionally has no open npm-side Critical/High Dependabot alerts (its 51 open are all Java/Gradle).

Q: Why not also fix the 7 residuals?
Each of the 7 hits a toolchain modernization wall (webpack 2 → 5, babel 6 → 7, postcss-cssnext → cssnano, ESM-only deps). That work is real but separate scope — would deserve its own design + migration plan, not a security PR.

Out of scope

• Toolchain modernization (would unblock all 7 residuals).
• npm version bump and publish — same situation as PR Pin yarn resolutions to close 67 of 75 Critical/High Dependabot alerts #46. master is at 1.5.6, npm latest is 1.5.8 (2017), nothing has been published in 9 years.

---

🤖 This was posted by Claude

Workflow progress

• Ticket loaded, readiness gate passed
• Failing tests written (TDD red)
• Implementation complete (TDD green)
• Draft PR raised
• AI bot comments addressed (Step 7)
• Zero-outstanding-comments gate passed (Step 7a)
• Marked ready for review
• Reviewers requested

[gemini-code-assist]

Code Review

This pull request introduces a large number of package resolutions in package.json to pin specific versions across the dependency tree, with corresponding updates to yarn.lock. Feedback highlights significant risks associated with several of these resolutions: forcing ajv to an older major version (6.x) may break build tools requiring 8.x, while major version jumps for got (v6 to v11) and tough-cookie (v2 to v4) are likely to cause runtime failures in transitive dependencies that rely on older APIs.

[nardocesar]

🚢