Fix 12 dependabot alerts: update transitive deps, replace vulnerable ip package, bump fast-xml-parser override

[Copilot]

Resolves dependabot alerts 473–482, 484–485 spanning all 15 package manifests in the repo.

Transitive dependency updates (npm audit fix)

• Root and all 7 function packages: patched ajv, brace-expansion, diff, flatted, js-yaml, minimatch, picomatch, semver, @smithy/config-resolver

fast-xml-parser override bump (getSecretDetails)

• 4.5.4 → 5.5.10 in both resolutions and overrides to fix GHSA-8gc5-j5rx-235r and GHSA-jp2q-39xq-3w4g (entity expansion DoS)

Replace ip with ipaddr.js (githubWebhookIPValidator)

• ip has an unpatched SSRF vulnerability (GHSA-2p57-rm9w-gvfp) with no fix available
• Switched to ipaddr.js@^2.2.0 which has built-in TypeScript types

// Before
import { cidrSubnet } from "ip";
const findIP = (keys: string[], ipToCheck: string) => {
  return keys.some((cidr) => cidrSubnet(cidr).contains(ipToCheck));
};

// After
import * as ipaddr from "ipaddr.js";
const findIP = (keys: string[], ipToCheck: string) => {
  const parsedIP = ipaddr.parse(ipToCheck);
  return keys.some((cidr) => {
    const [addr, prefixLength] = ipaddr.parseCIDR(cidr);
    return parsedIP.match(addr, prefixLength);
  });
};

Remove unused ip dep (githubWebhookSecretValidator)

• ip and @types/ip were listed but never imported — removed both

All 15 package-lock.json manifests now report 0 audit vulnerabilities. TypeScript compilation verified on affected packages.

[felickz]

👍