chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 3 of 8 open Dependabot alerts by bumping overrides; the rest are bundled inside the published npm package and have no patched release yet

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#170	brace-expansion (1.x)	medium	Override bumped to 1.1.21
#169	brace-expansion (2.x)	medium	Override bumped to 2.1.7
#161	undici	low	Override bumped to 6.29.0 (root copy)

Unresolvable

ip-address (#172, #160, #158) and brace-expansion 5.x (#168), plus the nested undici copy, are bundled inside the npm tarball (latest 11.21.0 and 12.2.0 still ship ip-address 10.5.0, brace-expansion 5.0.9, undici 6.28.0), so overrides cannot reach them. The npm override is bumped to 11.21.0 to pick up a fix once npm ships one.

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

Review effort: Lite
Findings: 3

Open (3)

• If this repo commits a lockfile (e.g., package-lock.json / npm-shrinkwrap.json), it should be… · New
• In npm overrides, an unscoped key like \"undici\" / \"npm\" applies to all occurrences… · New
• If this repo commits a lockfile (e.g., package-lock.json / npm-shrinkwrap.json), it should be… · New

What changed in this PR

Updates dependency override pins in package.json to newer patch/minor releases (likely for security and bugfix uptake).

Changes:

• Bumped override versions for ip-address, npm, and undici
• Updated brace-expansion override pins for v1 and v2, and added an override for v5

File	Description
package.json	Updates override-pinned dependency versions to newer releases

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.