chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Addresses all open Dependabot security alerts by bumping direct deps where possible, adding overrides only where a major-version jump is required.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#128, #171	serialize-javascript	high/medium	Override to ^7.0.5 (required: copy-webpack-plugin / css-minimizer-webpack-plugin pin ^6.x)
#159, #160	fast-uri	high	Resolved naturally via OTel dep updates (lockfile: 3.1.2)
#161	@babel/plugin-transform-modules-systemjs	high	Resolved naturally via OTel dep updates (lockfile: 7.29.4)
#164	@opentelemetry/auto-instrumentations-node	high	Direct dep bumped to ^0.76.0
#165	@opentelemetry/sdk-node	high	Direct dep bumped to ^0.218.0
#168	protobufjs	medium	Resolved naturally; removed stale override (lockfile: 7.6.1)
#169	uuid	medium	Override to ^11.1.1 (no patch available in v8/v9/v10 line)
#170	@tootallnate/once	low	Resolved naturally; http-proxy-agent's ^2 range allows 2.0.1
#172	qs	medium	Override bumped to ^6.15.2
#173	tmp	high	Resolved naturally; NX's ~0.2.1 range allows 0.2.7
#174, #175, #176, #177	axios	high/medium/low	Override bumped to ^1.16.0
#69, #70, #166	webpack-dev-server	medium	Override to ^5.2.4 (required: @nx/webpack@17 pins ^4.x)

Notes

• npm install requires --legacy-peer-deps due to a pre-existing @nestjs/schematics / prettier peer dependency conflict unrelated to this change.

[gemini-code-assist]

Code Review

This pull request updates several dependencies, including upgrading serialize-javascript to version 7.0.5 and @tootallnate/once to version 3.0.1, while adding minimatch and removing randombytes. Feedback highlights that the serialize-javascript upgrade introduces a breaking requirement for Node.js 20.0.0, which may impact environments on older LTS versions. Additionally, it is recommended to use caret ranges instead of the >= operator in the dependency overrides to ensure stability and prevent unintended major version upgrades.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds npm overrides to mitigate several Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies.

Changes:

• Added overrides for serialize-javascript, @tootallnate/once, fast-uri, and @babel/plugin-transform-modules-systemjs.
• Kept existing test-exclude override (with minimatch) and extended the override list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.