IS-11041: Update SSP dependencies to fix npm audit vulnerabilities

[urre]

IS-11041: Update SSP dependencies due to vulnerabilities

Summary

• Updated react-router from ^7.9.4 to ^7.13.1 to fix 4 high-severity CVEs (CSRF, XSS, open redirect)
• Updated vite from ^7.1.12 to ^7.3.1 to fix high-severity rollup path traversal CVE
• Updated cypress from ^15.5.0 to ^15.11.0 to fix high-severity systeminformation command injection CVEs
• Ran npm audit fix to resolve remaining auto-fixable transitive vulnerabilities (qs, lodash, and others)

Vulnerabilities fixed

Package	Severity	CVE / Advisory	Fix
react-router	High	GHSA-h5cw-625j-3rxh (CSRF in Action/Server Action)	Bumped to ^7.13.1
react-router	High	GHSA-2w69-qvjg-hvjx (XSS via Open Redirects)	Bumped to ^7.13.1
react-router	High	GHSA-8v8x-cx79-35w7 (SSR XSS in ScrollRestoration)	Bumped to ^7.13.1
react-router	High	GHSA-9jcx-v3wj-wh4m (unexpected external redirect)	Bumped to ^7.13.1
rollup	High	GHSA-mw96-cpmx-2vgc (Arbitrary File Write via Path Traversal)	Bumped vite to ^7.3.1
systeminformation	High	GHSA-wphj-fx3q-84ch (Command Injection on Windows)	Bumped cypress to ^15.11.0
systeminformation	High	GHSA-5vv4-hvf7-2h46 (Command Injection via locate)	Bumped cypress to ^15.11.0
systeminformation	High	GHSA-9c88-49p5-5ggf (Command Injection in wifi.js)	Bumped cypress to ^15.11.0
qs	Moderate	GHSA-w7fw-mjwx-w883 / GHSA-6rw7-vpxm-498p (DoS)	npm audit fix
lodash	Moderate	GHSA-xxjr-mmjv-4gpg (Prototype Pollution)	npm audit fix

Test plan

• npm run build:ssp succeeds with no errors
• All 77 unit tests pass (npm run test -- --run)
• Smoke test login/SSP flows in browser

[Copilot]

Pull request overview

Updates Self Service Portal (SSP) dependencies to address npm audit-reported vulnerabilities across direct and transitive packages.

Changes:

• Bumped react-router to ^7.13.1.
• Bumped vite to ^7.3.1 and cypress to ^15.11.0.
• Regenerated package-lock.json via npm audit fix to pick up patched transitive dependencies (eg rollup, qs, lodash).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
src/self-service-portal/app/package.json	Updates SSP direct dependencies/devDependencies to patched versions.
package-lock.json	Updates resolved dependency graph to patched versions for direct + transitive packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aleixsuau]

LGTM