fix(dependencies): resolve 2026-08 security advisories

[gabriel-taufer]

What

Clears all 15 advisories from the vuln dashboard (18 findings in npm audit, including one critical it rates higher than the dashboard): npm audit now reports 0 vulnerabilities.

Changes

Direct devDependency bumps:

Package	From	To	Why
cypress	^13.15.0	^15.21.1	breaking: only fix for extract-zip — every published extract-zip is vulnerable (GHSA-jmr9-qjv8-65gv, symlink path traversal); Cypress 15 dropped it for yauzl
webpack-dev-server	^5.0.4	^5.2.6	CVE-2026-9595 + pulls launch-editor 2.14.1 (CVE-2026-53632)
esbuild	^0.27.2	^0.28.2	GHSA-g7r4-m6w7-qqqr
tar	>=7.5.8	>=7.5.21	CVE-2026-53655 / CVE-2026-59871 + the critical PAX-header advisories

New/updated overrides (transitive deps Dependabot can't reach):

• ws >=8.21.0 — CVE-2026-48779 (uninitialized memory disclosure)
• ip-address >=10.3.1 — CVE-2026-69192 + 69198 + 54272
• uuid >=11.1.1 — CVE-2026-41907 (consumers sockjs / @cypress/request both use require('uuid').v4, compatible with v11)
• qs >=6.15.2 — CVE-2026-8723 (also clears the express/body-parser chains; body-parser itself bumped to 1.20.6)
• http-proxy-middleware >=2.0.10 — CVE-2026-55602
• npm >=11.19.1 — npm bundles tar via bundleDependencies so overrides can't reach it; 11.19.1 ships fixed tar 7.5.22, brace-expansion 5.0.9, undici 6.28.0 internally

Notes

• webpack-dev-server stays on 5.x: v6 (which drops sockjs/uuid) requires Node >=22.15 and CI/dev is on Node 20. Moving to Node 22+ later lets most of the overrides block be deleted.
• undici: only npm's nested copy was vulnerable (<6.28.0); the top-level copy is 7.29.0.

Verification

• npm audit → 0 vulnerabilities
• npm run format:check → clean
• npm run build (tsc + esbuild) → passes
• cypress run against webpack serve → 9/9 passing on Cypress 15.21.1

🤖 Generated with Claude Code