[Snyk] Fix for 14 vulnerabilities

[Ramyromel]

Snyk has created this PR to fix 14 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-15309438	810
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-15353387	810
	Inefficient Algorithmic Complexity SNYK-JS-MINIMATCH-15353389	810
	Directory Traversal SNYK-JS-TAR-15307072	795
	Symlink Attack SNYK-JS-TAR-15456201	785
	Command Injection SNYK-JS-GLOB-14040952	760
	Symlink Attack SNYK-JS-TAR-15416075	710
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	700
	Improper Handling of Unicode Encoding SNYK-JS-TAR-15038581	695
	Directory Traversal SNYK-JS-TAR-15032660	675
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	660
	Directory Traversal SNYK-JS-TAR-15127355	610
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759	585
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	340

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection
🦉 Directory Traversal

[changeset-bot]

⚠️ No Changeset found

Latest commit: a39b989

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a39b989886

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep Arborist within npm's supported Node range

This upgrade makes a core dependency incompatible with the Node versions npm still advertises (^18.17.0 || >=20.5.0 in this same package.json). The published Arborist 9.x packages in this range declare engines.node as ^20.17.0 || >=22.9.0, so installs with engine-strict=true fail on supported Node 18.x/20.5–20.16, and the main install/audit/ls paths load @npmcli/arborist directly. Either keep this on a Node-18-compatible Arborist line or raise npm's own engine range with the major-version change.

Useful? React with 👍 / 👎.