chore: Remediate 15 Dependabot security alerts (lockfile only)

[SpyZzey]

Updates five transitive dependencies in package-lock.json to resolve all 15 open Dependabot security alerts in this repository. package.json is unchanged. Grouped into a single PR so the repository's alerts can be cleared in one review instead of 15 separate dependency updates.

Alerts addressed

• GHSA-pqg4-j6r4-53mv (CVE-2026-102422) — shell-quote, critical — 1.10.0 -> 1.12.0
• GHSA-68fv-2mgg-jv7q (CVE-2026-93749) — source-map-js, high — 1.2.1 -> 1.2.2
• GHSA-wr44-6hxh-3jwq (CVE-2026-90771) — joi, medium — 18.2.8 -> 18.2.9
• GHSA-j8rh-479h-cp32 (CVE-2026-101904) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-4hqw-qxg8-jxx2 (CVE-2026-101900) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-m8m8-qj5v-23w3 (CVE-2026-101905) — axios, high — 1.18.1 -> 1.20.0
• GHSA-44g4-m2mj-wpvx (CVE-2026-101899) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-r4gj-5m52-g5wh (CVE-2026-101907) — axios, high — 1.18.1 -> 1.20.0
• GHSA-vh66-26gq-q6x8 (CVE-2026-101908) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-9fr6-4gfg-395g (CVE-2026-101902) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-x97p-jq2g-jp4f (CVE-2026-101909) — axios, high — 1.18.1 -> 1.20.0
• GHSA-3pq3-5fj3-cg6v (CVE-2026-101898) — axios, high — 1.18.1 -> 1.20.0
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 1.1.18 -> 1.1.21
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 2.1.4 -> 2.1.7
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 5.0.9 -> 5.0.12

How it was fixed

Every affected package is transitive-only, so each vulnerable lockfile entry was moved to its patched release and nothing was promoted to a direct dependency:

• shell-quote 1.10.0 -> 1.12.0
• source-map-js 1.2.1 -> 1.2.2
• joi 18.2.8 -> 18.2.9
• axios 1.18.1 -> 1.20.0 (covers nine advisories)
• brace-expansion 1.1.18 -> 1.1.21, 2.1.4 -> 2.1.7 (three nested entries), 5.0.9 -> 5.0.12

The three brace-expansion major lines are tracked separately because each has its own alert and an update on one line does not address the others.

All five packages are development dependencies, so no published artifact changes. The diff is 35 changed lines and contains only these version changes: no unrelated upgrades, no added or removed packages, and no package.json change. npm audit reports none of these five advisories after the change.

Verification

Run locally on this exact commit:

• npm install — succeeds
• npm run build — succeeds, including the size-limit check
• npm test (lint + unit tests) — 8 test files, 51 tests, all passing

Superseded pull requests

These auto-generated update PRs are covered by this one and have been closed:

• chore: Bump source-map-js from 1.2.1 to 1.2.2 #182 — source-map-js 1.2.1 -> 1.2.2
• chore: Bump shell-quote from 1.10.0 to 1.12.0 #183 — shell-quote 1.10.0 -> 1.12.0

If this PR fails CI or is abandoned, either can be restored by commenting the Dependabot reopen command on it; Dependabot will not recreate them on its own.

Merging this PR is expected to resolve all 15 of this repository's open alerts, leaving none open.

All upgraded packages are available internally.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f0f8dd0) to head (5de18db).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #184   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines           81        81           
  Branches        21        21           
=========================================
  Hits            81        81           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.