fix(deps): bump vulnerable dependencies (SEC-239)

[Ismael-Torresan]

What did I change:

Bumped transitive dependency versions in package-lock.json to resolve Dependabot security alerts. All vulnerable packages are devDependencies (transitive via semantic-release, commitlint, cypress, html-webpack-plugin, webpack-dev-server), so no runtime impact on the published SDK.

Packages updated:

• handlebars 4.7.8 → 4.7.9 — fixes critical AST type confusion JS injection, plus 6 additional high/medium/low vulnerabilities
• lodash 4.17.23 → 4.18.1 — fixes code injection via _.template and prototype pollution in _.unset/_.omit
• lodash-es 4.17.23 → 4.18.1 — same fixes as lodash
• picomatch 2.3.1 → 2.3.2 and 4.0.3 → 4.0.4 — fixes method injection in POSIX character classes and ReDoS via extglob quantifiers
• path-to-regexp 0.1.12 → 0.1.13 — fixes ReDoS via multiple route parameters
• brace-expansion 5.0.4 → 5.0.5 — fixes zero-step sequence hang/memory exhaustion

No package.json changes were needed — all existing version constraints already allowed the patched versions.

Remaining unfixable (2 warnings): brace-expansion and picomatch bundled inside npm@11.12.0 (transitive via semantic-release) cannot be updated until npm publishes a patched release.

QA Notes:

All bumped packages are devDependencies only — they are not shipped in the published @testboxlab/browser package. The build toolchain (webpack, esbuild, tsc) and commit tooling (commitlint, semantic-release, husky) are the consumers. Risk of regression is low, but CI build success confirms the toolchain still works correctly.

Related Tickets:

SEC-239

Did you...

• test the code locally?
• run unit tests and updated to account for the changes?
• lint the code?
• format the code?
• test the code on staging?

Made with Cursor