chore(deps): fix vulnerabilities

e2e/.npmrc

@@ -0,0 +1,16 @@
+# Supply-chain hardening for dependency installs/updates.
+#
+# min-release-age=7 tells npm to only install package versions that were
+# published more than 7 days ago. npm implements this by rewriting it to
+# `--before = now - 7 days`, so freshly published versions (a common vector
+# for compromised/malicious releases) are excluded until they've had time to
+# be detected and pulled from the registry.
+#
+# Requires npm >= 11.10.0. Older npm (e.g. the npm 10.x bundled with the
+# Node 20/22 this repo supports) does not recognize the setting and silently
+# ignores it, so it hardens installs on npm 11+ without breaking older clients.
+min-release-age=7
+
+# exclude min-release-age=7 rule for all packages of @pkg-nec organization
+# Requires npm >= 12.0.0
+min-release-age-exclude[]="@pkg-nec/*"