security: consolidated crit+high remediation (#24)

* security: consolidated crit+high remediation (lua-shopping-assistant)

Adds durable major-scoped npm overrides + direct-dep range bumps so the
already-patched transitive tree cannot regress on future installs.

Closes (patched version present in tree, override-pinned within major):
- CRITICAL protobufjs GHSA (7.6.5), CRITICAL websocket-driver <0.7.5 (absent, pinned >=0.7.5)
- HIGH axios (1.16.0+), undici (6.27.0), ws (8.21.0), form-data (4.0.6),
  @grpc/grpc-js (1.9.16), react-router (7.15.0), picomatch (4.0.4),
  socket.io-parser (4.2.6), tar (7.5.16), minimatch (10.2.3),
  @isaacs/brace-expansion (5.0.1), protobufjs (7.6.x)
- plus med/low: js-yaml, uuid, follow-redirects, @protobufjs/utf8, mdast-util-to-hast

Overrides are major-scoped (pkg@major) with >=floor <next-major ranges to
avoid downgrade/major-forcing regressions. Lockfile-verified: no downgrades.

Deferred (MAJOR-only, breaking lua-cli@3.7.0 downgrade; no open Dependabot
alert): @opentelemetry/* cluster, @livekit/agents, sharp <0.35.

* security: mirror npm overrides into package-lock root (Bugbot sync fix)

Bugbot flagged that package.json overrides were not reflected in the
package-lock.json root package. Mirror the major-scoped overrides into
packages[""].overrides so the lockfile is self-consistent with the manifest.
npm ci --dry-run passes; no version downgrades (tree already patched).

Author: lua-stefan-kruger

lua-shopping-assistant/package-lock.json

@@ -16,17 +16,31 @@
     "@pinecone-database/pinecone": "^6.1.2",
     "@types/inquirer": "^9.0.9",
     "@types/js-yaml": "^4.0.9",
-    "axios": "^1.6.0",
+    "axios": "^1.16.0",
     "inquirer": "^12.9.6",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.2.0",
     "lua-cli": "^3.21.0",
     "openai": "^5.23.0",
-    "uuid": "^13.0.0",
+    "uuid": "^13.0.1",
     "zod": "^3.24.1"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
     "tsx": "^4.7.0",
     "typescript": "^5.9.2"
+  },
+  "overrides": {
+    "protobufjs@7": ">=7.6.5 <8",
+    "websocket-driver@0": ">=0.7.5 <0.8",
+    "undici@6": ">=6.27.0 <7",
+    "ws@8": ">=8.21.0 <9",
+    "form-data@4": ">=4.0.6 <5",
+    "@grpc/grpc-js@1": ">=1.9.16 <2",
+    "react-router@7": ">=7.15.0 <8",
+    "picomatch@4": ">=4.0.4 <5",
+    "socket.io-parser@4": ">=4.2.6 <5",
+    "tar@7": ">=7.5.16 <8",
+    "minimatch@10": ">=10.2.3 <11",
+    "@isaacs/brace-expansion@5": ">=5.0.1 <6"
   }
 }