[GOOD FIRST ISSUE] Update velocityjs to >= 2.1.7 to fix critical prototype pollution

[ulises-jeremias]

Task

Update velocityjs to >= 2.1.7 in the affected serverless examples to patch a critical prototype pollution vulnerability. This is a focused dependency-only change — no logic changes required.

---

Vulnerability

Advisory	Severity	Description
GHSA-xxxx-velocityjs	Critical	Prototype pollution via template rendering, allowing property injection on Object.prototype

Open Dependabot alerts: 6 (4 critical, 2 high)

---

Affected Examples

velocityjs is used by amplify-appsync-simulator or serverless-appsync-simulator to render Apache Velocity Template Language (VTL) resolvers locally.

Example	Path
examples/serverless-cognito-local	package-lock.json
examples/serverless-localstack-with-s3-and-dynamodb	pnpm-lock.yaml
examples/serverless-node-typescript-bundle	package-lock.json
examples/serverless-node-typescript-middy-custom-middleware	package-lock.json

---

Steps

1. Fork this repository
2. For each affected example, check the current version:

   cd examples/<example>
   npm ls velocityjs

3. If velocityjs is a direct dependency, update it:

   npm install velocityjs@^2.1.7 --save

4. If it is only a transitive dependency, add an npm override:

   // package.json
   "overrides": {
     "velocityjs": "^2.1.7"
   }

   For pnpm:

   "pnpm": {
     "overrides": {
       "velocityjs": "^2.1.7"
     }
   }

5. Run npm install (or pnpm install) and verify the lock file updated
6. Test the local simulator still works (if applicable):

   npx sls offline start --noPrependStageInUrl

7. Open a PR with just the lock file / package.json changes

---

Validation

cd examples/<affected-example>
npm ls velocityjs        # should show >= 2.1.7
npm audit | grep velocity  # should return 0 vulnerabilities

---

Out of Scope

• Do not change VTL template files or resolver code
• Do not update unrelated packages
• Do not migrate to Serverless v4 in this PR (tracked separately)

---

References

• velocityjs npm page
• velocityjs GitHub
• npm overrides docs
• pnpm overrides docs