fix(security): dependabot follow-up — transitive overrides + remove stale npm lockfile

[diegomayorga-dept]

Title

fix(security): Dependabot follow-up — transitive overrides + remove stale npm lockfile

Type of Change

• New feature
• Bug fix
• Documentation update
• Refactoring
• Hotfix
• Security patch
• UI/UX improvement

Description

The three previous Dependabot PRs (#822 overrides batch, #823 nuxt + aws-cdk-lib, #824 axios) bumped direct dependencies, but ~58 alerts remained on development. Investigation found three root causes those PRs didn't cover:

1. Vulnerable transitive copies not forced up. The axios bump pinned only the front-end's direct dependency; nx@15.9.7 (build tooling) still pulled the vulnerable axios@1.8.4 transitively. A direct-dep pin does not affect transitive copies — a pnpm override is required.
2. An unused npm lockfile inflating the count. packages/shared-lib/package-lock.json (committed once in Sept 2024) is an npm lockfile inside a pnpm workspace. Nothing uses it — all CI runs pnpm install --frozen-lockfile — but Dependabot scanned it as a separate project, producing duplicate alerts (minimatch, aws-cdk-lib, js-yaml, uuid, cdk).
3. An override floor below the fix. The existing js-yaml override was >=4.1.1, which still resolved to the vulnerable 4.1.1 (exposed to CVE-2026-53550, quadratic-complexity DoS, fixed in 4.2.0).

This PR adds/bumps pnpm.overrides in .projenrc.ts to force the remaining transitive copies to patched versions, and removes the stale lockfile.

Overrides added/changed (all in .projenrc.ts):

• axios >=1.18.1 — forces nx's transitive 1.8.4 up (prototype-pollution + SSRF/proxy CVE cluster)
• js-yaml >=4.1.1 → >=4.2.0 — CVE-2026-53550 quadratic-complexity DoS
• fast-uri >=3.1.2 — path traversal + host confusion
• tmp >=0.2.6 — path traversal + symlink write
• got >=11.8.5 — redirect-to-UNIX-socket
• follow-redirects >=1.16.0 — auth-header leak on cross-domain redirect
• @opentelemetry/core >=2.8.0 — unbounded memory allocation in W3C Baggage propagation
• h3 >=1.15.9 — request smuggling + path traversal + SSE injection

Also removed a now-contradictory comment in .projenrc.ts that stated @opentelemetry/core was excluded from overrides.

Testing

• Regenerated via pnpm exec projen + pnpm install --no-frozen-lockfile.
• Verified resolved versions in pnpm-lock.yaml: axios@1.18.1 (zero copies of 1.8.4), js-yaml@5.2.1, h3@1.15.11, fast-uri@4.1.0, tmp@0.2.7, got@15.1.0, follow-redirects@1.16.0, @opentelemetry/core@2.9.0.
• Back-end test suite: 491/491 pass (66/66 suites), run both explicitly and via the pre-commit hook.

Impact

• No application code changed — dependency-resolution only.
• All overrides move transitive packages within backwards-compatible ranges; back-end tests confirm no runtime regression.
• Removing packages/shared-lib/package-lock.json has no build effect (it was never consumed) and eliminates a duplicate Dependabot scan target.

Additional Information

Some remaining alerts are not resolved by this PR because they are not production-reachable and should be dismissed in the Dependabot UI rather than force-upgraded:

• uuid — real fix is v14 (ESM-only, would break CJS Lambda); the app never calls uuid with a buf argument, so the buffer-bounds advisory is unreachable.
• @nuxt/ui — the advisory is an SSR-markup-before-hydration leak; the front-end is a client-side SPA (ssr: false), so no SSR markup exists. No v2 patch exists (fix is v4-only).
• lodash.pick — dev-only (via @useoptic/optic), deprecated, no fix available.
• @babel/*, esbuild — build/dev-tooling only, not shipped to any runtime.

The @aws-amplify/storage>fast-xml-parser scoped override (4.x) was intentionally left in place: Amplify breaks on fast-xml-parser 5.x, and the XMLBuilder advisory affects XML building while Amplify only parses S3 responses — not reachable.

Checklist

• No new errors or warnings have been introduced.
• All tests pass successfully and new tests added as necessary.
• Documentation has been updated accordingly.
• Code adheres to the coding and style guidelines of the project.
• Code has been commented in particularly hard-to-understand areas.