Resolve all npm security vulnerabilities via overrides and patched dependencies

[Copilot]

Addresses 4 moderate-severity CVEs identified by Dependabot in build toolchain dependencies.

Vulnerabilities Resolved

• lodash (GHSA-xxjr-mmjv-4gpg): Prototype pollution → fixed via npm audit fix
• webpack-dev-server (CVE-2025-30360): Source code theft on non-Chromium browsers → 4.15.2 to 5.2.3
• postcss (CVE-2023-44270): Line return parsing error → upgraded to 8.5.6
• vue-template-compiler (CVE-2024-6783): XSS via prototype pollution → replaced with vue-template-compiler-patched@2.7.16-patch.2

Implementation

Used npm overrides to force secure versions of transitive dependencies where parent packages haven't updated:

{
  "devDependencies": {
    "vue-template-compiler": "npm:vue-template-compiler-patched@^2.7.16-patch.2"
  },
  "overrides": {
    "webpack-dev-server": ">=5.2.1",
    "postcss": ">=8.4.31",
    "vue-template-compiler": "npm:vue-template-compiler-patched@^2.7.16-patch.2"
  }
}

Vue 2 template compiler has no official fix (EOL). Using community-maintained security patches as alias + override to apply across entire dependency tree including @vue/cli-service.

Documentation

Added AI_AGENT_SECURITY_GUIDE.md with remediation workflow, vulnerability-specific solutions, and troubleshooting for future maintenance automation.

Result: npm audit reports 0 vulnerabilities. All build scripts verified.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.