[ernst-dev]

Updates 5 development dependencies to patched releases (lockfile only) to resolve 12 open security alerts.

Merging this PR is expected to resolve 12 of this repository's 14 open security alerts. The other 2 are listed under "Not resolved".

Alerts addressed

• GHSA-qr28-fpjm-wq7f: decode-uri-component, high, 0.5.0 -> 0.5.1
• GHSA-333x-w4r6-6crp: fast-uri, low, 3.1.7 -> 3.1.9
• GHSA-wjr9-j795-jxcr: fast-uri, medium, 3.1.7 -> 3.1.9
• GHSA-xhq7-xmqj-769h: fast-uri, low, 3.1.7 -> 3.1.9
• GHSA-w74x-v6f9-j3xg: fast-uri, medium, 3.1.7 -> 3.1.9
• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-mrwp-f3q8-3g9p: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-698v-4r3x-3vcv: launch-editor, medium, 2.14.1 -> 2.14.2
• GHSA-587h-7wmj-h5pm: launch-editor, high, 2.14.1 -> 2.14.2
• GHSA-r825-w8mm-5pxw: launch-editor, medium, 2.14.1 -> 2.14.2
• GHSA-m5mm-p8h7-m29v: serialize-javascript, low, 7.0.5 -> 7.1.4

How it was fixed

All five packages are transitive dependencies that npm can update within their existing parent ranges, so each was updated to its patched release with npm update <package> --package-lock-only. package.json is unchanged. The diff is limited to these five entries in package-lock.json; all are dev dependencies. npm audit fix could not be used for this repository because it stops on an existing webdriverio / puppeteer-core peer dependency conflict that is unrelated to these alerts.

Not resolved

• GHSA-gcqx-w48m-w2h4: deepmerge, low. No patched release has been published, so there is nothing to update to.
• GHSA-g3hv-75wg-m249: minimatch, medium. The only patched release is 11.0.1 (a new major version). The vulnerable copies sit on several older major lines (3.x, 5.x, 9.x and 10.x) pulled in by different parents (eslint, jest, typescript-eslint, wdio and others), so no parent update reaches the fix. Resolving it would need a package.json overrides entry across multiple major versions, which needs a maintainer decision.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: Bump serialize-javascript from 7.0.5 to 7.1.4 #5222: Bump serialize-javascript from 7.0.5 to 7.1.4
• chore: Bump fast-uri from 3.1.7 to 3.1.9 #5221: Bump fast-uri from 3.1.7 to 3.1.9
• chore: Bump launch-editor from 2.14.1 to 2.14.2 #5171: Bump launch-editor from 2.14.1 to 2.14.2
• chore: Bump follow-redirects from 1.16.0 to 1.16.1 #5164: Bump follow-redirects from 1.16.0 to 1.16.1

Verification

Run locally on this commit with Node 22: npm run build passes, and npm run test:unit passes for 665 of 671 test suites (14,346 tests passed, 162 skipped, 0 failed). The 6 suites that did not run (token-versions, flashbar x3, theming x2) fail to load with Must use import to load ES Module for @material/material-color-utilities and @cloudscape-design/global-styles. They fail the same way on the unmodified lockfile, so they are unrelated to this change. Please rely on CI for those.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.76%. Comparing base (8a3001d) to head (db0b4b6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5223   +/-   ##
=======================================
  Coverage   97.76%   97.76%           
=======================================
  Files        1003     1003           
  Lines       32572    32572           
  Branches    12109    12109           
=======================================
  Hits        31843    31843           
  Misses        723      723           
  Partials        6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.