fix: remediate all HIGH severity transitive dependency vulnerabilities

[devin-ai-integration]

Summary

Adds npm overrides in package.json to remediate all HIGH severity vulnerabilities in transitive dependencies (all via @rx-angular/cdk → ng-morph):

Package	Vulnerable	Fixed	CVE	Severity
brace-expansion@1	1.1.12	1.1.13	CVE-2026-33750 (Infinite Loop)	HIGH (7.1)
brace-expansion@2	2.0.2	2.0.3	CVE-2026-33750 (Infinite Loop)	HIGH (7.1)
minimatch@3	3.1.2	3.1.3	CVE-2026-26996 (ReDoS), CVE-2026-27903 (Inefficient Complexity)	HIGH (8.7)
minimatch@9	9.0.5	9.0.7	CVE-2026-26996, CVE-2026-27904 (ReDoS), CVE-2026-27903	HIGH (8.7)
minimatch@10	10.0.1	10.2.3	CVE-2026-26996, CVE-2026-27904 (ReDoS), CVE-2026-27903	HIGH (8.7)
picomatch@2	2.3.1	2.3.2	CVE-2026-33671 (ReDoS)	HIGH (8.7)

A package-lock.json was generated via npm install --legacy-peer-deps to resolve the overrides.

Updates since last revision

• Updated minimatch overrides: Initial fix versions (minimatch@9: 9.0.6, minimatch@10: 10.2.1) were themselves vulnerable to two additional CVEs (CVE-2026-27904, CVE-2026-27903). Updated to 9.0.7 and 10.2.3 respectively.
• Scoped picomatch override to @2: The previous unscoped "picomatch": "2.3.2" override was downgrading picomatch 4.x to 2.x for all consumers (vite, vitest, @angular/build, @angular-devkit/core, tinyglobby, @parcel/watcher). Changed to "picomatch@2": "2.3.2" so only the vulnerable 2.x instances (via micromatch) are overridden. Verified that picomatch 4.0.3 is preserved for build toolchain packages.
• Snyk re-scan verified: Post-fix snyk test confirms 0 HIGH severity vulnerabilities remaining. Only 1 LOW severity issue remains (@angular/compiler XSS, unrelated).

Review & Testing Checklist for Human

• Dual lockfile: This repo uses Bun (bun.lock + "setup": "bun install"). The new package-lock.json creates a second lockfile. Verify that CI and contributors won't be confused by competing lockfiles, and note that npm overrides do not apply when using bun install.
• --legacy-peer-deps was required: Peer dependency conflicts existed during resolution. Run npm install (without --legacy-peer-deps) and ng build to verify the dependency tree is valid and the app builds cleanly.
• Run the test suite: Run npm run build and npm run test to verify nothing is broken by the version changes.

Recommended test plan

1. npm ci && npm run build — confirm the app compiles with the new lockfile
2. npm run test — unit tests pass
3. npm run start — app serves without runtime errors
4. snyk test — re-verify 0 HIGH vulnerabilities (already confirmed by automated re-scan but worth a manual check)

Notes

• All overrides are scoped by major version (e.g., "minimatch@3": "3.1.3", "picomatch@2": "2.3.2") which is safe — they stay within semver range and do not affect unrelated major versions.
• An alternative approach would be to update @rx-angular/cdk or ng-morph upstream to pull in fixed transitive versions, avoiding overrides entirely.

Link to Devin session: https://app.devin.ai/sessions/93ff86a08bb44f80aae6541f4147a54d
Requested by: @SachetCognition

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 Unscoped picomatch override downgrades picomatch 4.x to 2.x for all consumers

The "picomatch": "2.3.2" override lacks version scoping (unlike the other overrides which use @version syntax), so it forces all picomatch instances to version 2.3.2—including packages that depend on picomatch 4.x. The package-lock.json confirms that vite, vitest, @angular/build, @angular-devkit/core, @parcel/watcher, and tinyglobby all had their picomatch 4.0.3 dependency downgraded to 2.3.2. This is a breaking major version downgrade that can cause runtime failures in the build toolchain, dev server, and test runner since picomatch 4.x has a different API surface from 2.x.

Evidence from package-lock.json

All these packages now resolve picomatch to 2.3.2 instead of 4.0.3:

• node_modules/vite/node_modules/picomatch → 2.3.2 (expects ^4.0.3)
• node_modules/vitest/node_modules/picomatch → 2.3.2 (expects ^4.0.3)
• node_modules/@angular/build/node_modules/picomatch → 2.3.2 (expects 4.0.3)
• node_modules/@angular-devkit/core/node_modules/picomatch → 2.3.2 (expects 4.0.3)
• node_modules/tinyglobby/node_modules/picomatch → 2.3.2 (expects ^4.0.3)
• node_modules/@parcel/watcher/node_modules/picomatch → 2.3.2 (expects ^4.0.3)

The vulnerable dependency was only micromatch's picomatch (^2.3.1). The fix should scope the override to major version 2 only.

Suggested change

	"picomatch": "2.3.2"
	"picomatch@2": "2.3.2"

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Good catch — fixed in 62ecb8f. Changed "picomatch" → "picomatch@2" so only the vulnerable 2.x instances (via micromatch) are overridden. Verified that picomatch 4.0.3 is now preserved for vite, vitest, @angular/build, etc. Snyk re-scan still confirms 0 HIGH vulnerabilities.