security: consolidated crit+high remediation

[lua-stefan-kruger]

Summary

Consolidated remediation of CRITICAL + HIGH Dependabot alerts for lua-shopping-assistant (the only alerted package manifest in this repo; npm).

The transitive tree was already refreshed to patched versions in prior lockfile commits (#21, lua-cli@3.21.0 refresh) but package.json carried no overrides, leaving the fix fragile. This PR makes it durable by adding major-scoped npm overrides (pkg@major keys, >=floor <next-major ranges) plus direct-dep range bumps. Lockfile re-resolved with no downgrades and no major-forcing (verified per-package).

Criticals closed (→ 0 remaining in scope)

• protobufjs — GHSA critical, pinned >=7.6.5 <8 (tree: 7.6.5)
• websocket-driver <0.7.5 — not present in tree; pinned >=0.7.5 <0.8 to prevent reintroduction

Highs closed (within-major, bump/override-fixable)

axios (^1.16.0, tree 1.18.1), undici (>=6.27.0), ws (>=8.21.0), form-data (>=4.0.6), @grpc/grpc-js (>=1.9.16), react-router (>=7.15.0), picomatch (>=4.0.4), socket.io-parser (>=4.2.6), tar (>=7.5.16), minimatch (>=10.2.3), @isaacs/brace-expansion (>=5.0.1), protobufjs (7.6.x high chain).

Also clears in-scope mediums/lows for free: js-yaml (^4.2.0), uuid (^13.0.1), follow-redirects, @protobufjs/utf8, mdast-util-to-hast.

npm audit confirms every Dependabot-target package is clean in the resolved tree.

Deferred — MAJOR-only / breaking (NOT in this PR, no open Dependabot alert)

These are only fixable via a breaking lua-cli@3.7.0 downgrade and are out of within-major scope:

• @opentelemetry/ cluster* (propagator-jaeger, sdk-trace-node highs; core/resources/otlp moderates)
• @livekit/agents (+ plugins) — high, via otel
• sharp <0.35 — high (libvips CVEs). Note: sharp 0.35 changed its TS export; a future bump must fix any import * as sharp sites.

Verification (no CI configured in this repo)

• npm install / lockfile re-resolve: clean, idempotent, no downgrades.
• tsc: 50 pre-existing app-source type errors in EcommerceTool.ts / dist-v2 — identical count on master baseline; this PR introduces none. Only package.json + package-lock.json changed.
• Signed commit (verified).

Do not squash-merge blindly — leave for admin merge. Merging closes the crit+high Dependabot alerts listed above.

---

Note

Medium Risk
Touches many transitive networking, gRPC, and parsing libraries via overrides; within-major only but still affects the full install tree at runtime.

Overview
Hardens lua-shopping-assistant dependency resolution against known CRITICAL/HIGH npm advisories by bumping a few direct ranges and adding major-scoped overrides so transitive packages stay on patched floors.

Direct dependency ranges move to axios ^1.16.0, js-yaml ^4.2.0, and uuid ^13.0.1; package-lock.json is re-resolved to match. New overrides pin minimum safe versions for transitives including protobufjs@7, websocket-driver@0, undici@6, ws@8, form-data@4, @grpc/grpc-js@1, react-router@7, picomatch@4, socket.io-parser@4, tar@7, minimatch@10, and @isaacs/brace-expansion@5—all within the same major lines to avoid forced breaking upgrades.

^{Reviewed by Cursor Bugbot for commit 2eee0df. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8549182. Configure here.}