chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Adds and updates overrides in package.json to require at least the patched version of transitive dependencies (within the current major) for all open Dependabot security alerts. The alerts will auto-close once Dependabot re-scans against the resolved lockfile.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#128	serialize-javascript	high	Overridden to ^7.0.5 (RCE via RegExp/Date)
#171	serialize-javascript	medium	Overridden to ^7.0.5 (CPU exhaustion DoS)
#170	@tootallnate/once	low	Overridden to ^3.0.1
#159	fast-uri	high	Overridden to ^3.1.2 (path traversal)
#160	fast-uri	high	Overridden to ^3.1.2 (host confusion)
#161	@babel/plugin-transform-modules-systemjs	high	Overridden to ^7.29.4
#164	@opentelemetry/auto-instrumentations-node	high	Already on patched 0.75.0
#165	@opentelemetry/sdk-node	high	Already on patched 0.217.0
#168	protobufjs	medium	Override bumped to ^7.5.8 (lockfile resolves to 7.6.0)
#169	uuid	medium	New override to ^11.1.1 (buffer bounds check fix)
#172	qs	medium	Override bumped to ^6.15.2 (DoS via comma-format arrays)
#69, #70, #166	webpack-dev-server	medium	Overridden to ^5.2.4

Notes

• All overrides use caret ranges to allow future patch/minor updates within the same major while still pinning at or above the patched version.
• npm install requires --legacy-peer-deps due to a pre-existing @nestjs/schematics / prettier peer dependency conflict that is unrelated to this change.

[gemini-code-assist]

Code Review

This pull request updates several dependencies, including upgrading serialize-javascript to version 7.0.5 and @tootallnate/once to version 3.0.1, while adding minimatch and removing randombytes. Feedback highlights that the serialize-javascript upgrade introduces a breaking requirement for Node.js 20.0.0, which may impact environments on older LTS versions. Additionally, it is recommended to use caret ranges instead of the >= operator in the dependency overrides to ensure stability and prevent unintended major version upgrades.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds npm overrides to mitigate several Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies.

Changes:

• Added overrides for serialize-javascript, @tootallnate/once, fast-uri, and @babel/plugin-transform-modules-systemjs.
• Kept existing test-exclude override (with minimatch) and extended the override list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.