Apply safe npm audit fixes

[Copilot]

Runs npm audit fix without force flags or overrides.

Changes

• Updates transitive dependencies in package-lock.json.
• Leaves two low-severity findings requiring a breaking, forced Sinon upgrade unchanged.

[Bill Schnurr (bschnurr)]

🔒 Automated review in progress — Bill Schnurr (@bschnurr) is auto-reviewing this PR.

[Bill Schnurr (bschnurr)]

Result: ⚠️ partially-verified

Verification details

Verification: The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: The lockfile parsed successfully, and 30 upgraded records had the expected versions and SHA-512 integrity metadata. Offline dependency restoration was blocked because `update-browserslist-db@1.3.2` was not cached. Consequently, TypeScript compilation and unit tests could not run, so verification is partial.

Test runs: 2 passed, 3 not run

• ⚠️ Not run | Offline dependency restoration | npm ci --offline
• ⚠️ Not run | TypeScript test compilation | npm run compile-tests
• ⚠️ Not run | Mocha unit tests | node ./node_modules/mocha/bin/mocha.js --config=./build/.mocha.unittests.json
• ✅ Passed | Toolchain and test-script discovery | printf 'sandbox_profile=%s\n' "${AUTOMATION_SANDBOX_PROFILE:-unset}"; node --version; npm --version; if [ -d node_modules ]; then echo 'node_modules=present'; else echo 'node_modules=missing'; fi; npm pkg get scripts; echo 'HEAD changed files:'; git diff-tree --no-commit-id --name-status -r HEAD; echo 'Changed test files:'; git diff-tree --no-commit-id --name-only -r HEAD | grep -E '(^|/)(test|tests)/|.(test|spec).' || true
• ✅ Passed | Updated lockfile record validation | node - <<'NODE'
const fs = require('fs');
const lock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
const expected = {
'brace-expansion': new Set(['1.1.18', '2.1.4', '5.0.9']),
'baseline-browser-mapping': new Set(['2.11.21']),
'browserslist': new Set(['4.28.9']),
'caniuse-lite': new Set(['1.0.30001810']),
'electron-to-chromium': new Set(['1.5.425']),
'fast-uri': new Set(['3.1.7']),
'js-yaml': new Set(['4.3.2']),
'node-releases': new Set(['2.0.55']),
'qs': new Set(['6.16.0']),
'update-browserslist-db': new Set(['1.3.2'])
};
let checked = 0;
for (const [path, meta] of Object.entries(lock.packages || {})) {
const name = path.split('/node_modules/').pop()?.replace(/^node_modules//, '');
if (expected[name]) {
if (!expected[name].has(meta.version)) throw new Error(${path}: unexpected ${meta.version});
if (!meta.integrity?.startsWith('sha512-')) throw new Error(${path}: missing sha512 integrity);
checked++;
}
}
function walk(deps) {
for (const [name, meta] of Object.entries(deps || {})) {
if (expected[name]) {
if (!expected[name].has(meta.version)) throw new Error(legacy ${name}: unexpected ${meta.version});
if (!meta.integrity?.startsWith('sha512-')) throw new Error(legacy ${name}: missing sha512 integrity);
checked++;
}
walk(meta.dependencies);
}
}
walk(lock.dependencies);
if (lock.lockfileVersion !== 2) throw new Error(unexpected lockfileVersion ${lock.lockfileVersion});
if (checked < 20) throw new Error(only checked ${checked} upgraded entries);
console.log(package-lock JSON parsed; ${checked} upgraded package records have expected versions and sha512 integrity metadata);
NODE

⚠️ Offline dependency restoration diagnostic output

npm error code ENOTCACHED
npm error request to https://packagefeedproxy.microsoft.io/npm/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz failed: cache mode is 'only-if-cached' but no cached response is available.

⚠️ TypeScript test compilation diagnostic output

Not invoked because offline dependency restoration failed.

⚠️ Mocha unit tests diagnostic output

Not invoked because offline dependency restoration failed.

[Bill Schnurr (bschnurr)]

Result: ⚠️ partially-verified

Verification details

Verification: The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: The package-lock dependency graph validated successfully with `npm ls --package-lock-only --all`. No tests were added by this lockfile-only PR. Offline installation could not complete because the updated `update-browserslist-db@1.3.2` tarball was not cached, so TypeScript compilation and unit tests could not run. Verification is therefore partial rather than a product-test pass.

Test runs: 2 passed, 3 not run

• ⚠️ Not run | TypeScript test compilation | npm run compile-tests
• ⚠️ Not run | TypeScript unit tests | npm run unittest
• ⚠️ Not run | Offline dependency bootstrap | npm ci --offline
• ✅ Passed | Environment and test discovery preflight | printf '%s\n' '=== sandbox ==='; printf 'profile=%s\n' "$AUTOMATION_SANDBOX_PROFILE"; node --version; npm --version; printf '%s\n' '=== changed files ==='; git diff --name-status HEAD^ HEAD; printf '%s\n' '=== package scripts and engines ==='; node -e "const p=require('./package.json'); console.log(JSON.stringify({scripts:p.scripts,engines:p.engines},null,2))"; printf '%s\n' '=== dependencies ==='; if [ -d node_modules ]; then echo node_modules-present; else echo node_modules-missing; fi; printf '%s\n' '=== changed tests ==='; git diff --name-only HEAD^ HEAD | grep -E '(^|/)(test|tests)/|.(test|spec).' || true
• ✅ Passed | Package-lock dependency graph validation | npm ls --package-lock-only --all

⚠️ TypeScript test compilation diagnostic output

tsc: not found because offline dependency installation did not complete.

⚠️ TypeScript unit tests diagnostic output

Not invoked because dependencies and compiled tests were unavailable.

⚠️ Offline dependency bootstrap diagnostic output

npm error code ENOTCACHED
update-browserslist-db-1.3.2.tgz failed: cache mode is 'only-if-cached' but no cached response is available.

[Bill Schnurr (bschnurr)]

Approved via Review Center.