security(deps): resolve 18 Dependabot alerts in frontend and backend lockfiles

[NetworkTheoryAppliedResearchInstitute]

Closes 18 of the 24 open Dependabot alerts. npm audit reports 0 vulnerabilities in both frontend/ and backend/ after this change.

Why the existing Dependabot PRs could not do this

The postcss alerts are unfixable by a version bump. next pins postcss to an exact 8.4.31, and postcss in turn pulls nanoid: ^3.3.6. Dependabot cannot move an exact transitive pin, so it has been refiling postcss alerts since May — four are now stacked (81, 128, 131, 150). The same applies to minimatch 9.0.3, pinned exactly by @typescript-eslint/typescript-estree. These need overrides entries, which Dependabot does not propose.

The remaining transitives had simply gone stale. js-yaml, flatted and picomatch all sit behind caret ranges that npm had left at their originally-resolved versions; npm update moves them.

qs needed the override raised. express and body-parser pin qs to ~6.15.1, so the patched 6.16.0 is out of range. The existing qs override goes from ^6.14.1 to ^6.16.0.

Changes

frontend — 15 alerts

Package	Before	After	Alerts
postcss	8.4.31	8.5.28	81, 128, 131, 150
js-yaml	4.1.1	4.3.2	120, 127, 156, 168
nanoid	3.3.11	3.3.19	153, 159, 164
picomatch	2.3.1	4.0.7	56, 61
minimatch	9.0.3	9.0.9	48
flatted	3.3.3	3.4.4	51

backend — 3 alerts

Package	Before	After	Alerts
qs	6.15.3	6.16.0	167, 175
js-yaml	3.15.1	3.15.2	176 (CVE-2026-84375, CVSS 7.5)

Manifest changes are limited to overrides (postcss, minimatch, nanoid added to frontend; qs raised in backend). No declared dependency versions change.

Supersedes

This makes these Dependabot PRs redundant — all five are currently CONFLICTING against main after the 09-14 merges (#153, #158, #160) rewrote the same lockfiles:

• chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /frontend #149 nanoid 3.3.18 — covered here at 3.3.19
• chore(deps-dev): bump js-yaml from 4.1.1 to 4.3.1 in /frontend #150 js-yaml 4.3.1 — superseded, alert 168 wants 4.3.2
• chore(deps): bump postcss and next in /frontend #151 postcss + next — next is already 15.5.24 on main; postcss covered here
• chore(deps): bump qs from 6.14.0 to 6.16.0 in /backend #156 qs 6.16.0 — covered here

Worth noting that rebasing them individually would not have resolved this: #149, #150 and #151 all touch frontend/package-lock.json, so merging any one re-conflicts the other two.

Not addressed

aws-sdk v2 (alert 173) and uuid 8.0.0 (alert 174). uuid is pinned exactly by aws-sdk v2, which is genuinely imported at backend/lib/dynamodbClient.js:1. Clearing these needs the v2 → v3 migration, not a lockfile bump. Separately, aws-sdk is declared in devDependencies despite that runtime import.

🤖 Generated with Claude Code