build(deps): resolve AC-4477 high security alerts

[jpyzio123]

Summary

• resolve the High-severity Dependabot alerts tracked by AC-4477
• refresh compatible transitive resolutions for browserslist, fast-uri, js-yaml, and svgo
• override pacote to ^21.5.1 because both the current and latest Lerna releases pin a vulnerable version
• leave existing overrides unchanged where their ranges already permit patched releases

Resolved versions

• browserslist: 4.28.2 → 4.28.9
• fast-uri: 3.1.5 → 3.1.7
• js-yaml: 4.3.1 → 4.3.2
• pacote: 21.0.1 → 21.5.1
• svgo: 3.3.4 → 3.3.5

Verification

• npm ci (Node 20.17.0 / npm 10.8.2)
• npm run check — 517 tests passed
• npm run build
• npm audit --audit-level=high — 0 High, 0 Critical

[Copilot]

🟢 Approval recommended

The changes are limited to dependency override + lockfile refresh, and the resulting lockfile resolves pacote to the intended patched version.

Pull request overview

This PR addresses the high-severity Dependabot alerts tracked in AC-4477 by updating/refreshing dependency resolutions and explicitly overriding pacote to a patched release when upstream (Lerna) still depends on a vulnerable line.

Changes:

• Add an overrides entry to force pacote to ^21.5.1.
• Refresh lockfile-resolved versions for affected packages (notably browserslist, fast-uri, js-yaml, svgo) and associated transitive metadata.

File summaries

File	Description
package.json	Adds pacote override to enforce a patched version across the dependency graph.
package-lock.json	Updates resolved versions and dedupes/realigns transitive dependencies to match the new overrides and patched releases.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.