fix: resolve high-severity npm audit vulnerabilities blocking CI

[Copilot]

Context

CI builds failing on npm audit --audit-level=high due to high-severity ReDoS vulnerabilities in transitive dependencies.

Changes:

• Added npm override for minimatch@^10.2.1 to patch GHSA-3ppc-4f35-3m26 across all transitive dependencies (eslint, typescript-eslint, typedoc, graphql-config)
• Ran npm audit fix to resolve markdown-it vulnerability

Notes:

• 13 moderate-severity ajv@6 vulnerabilities remain in eslint packages (non-blocking per CI audit level)
• Upgrading ajv to v8 breaks eslint@9 compatibility; deferred until eslint v10 adoption

Related Jira ticket

N/A

Screenshots

N/A

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[timowestnosto]

@copilot can't this be just bumped in package-lock without this override declaration?

[Copilot]

Unfortunately no. The vulnerable minimatch versions (3.1.2, 9.0.5) come from transitive dependencies (eslint, typescript-eslint, typedoc) that have specific version constraints in their package.json files (e.g., "minimatch": "^3.1.2"). Simply running npm update minimatch doesn't affect these nested dependencies.

The overrides field is the standard npm solution for this scenario - it forces all instances of minimatch throughout the dependency tree to use the secure version, regardless of what individual packages specify. Without it, we'd need to wait for each package maintainer to update their minimatch dependency, which could take months.

I tested removing the override and running npm update, and it left the vulnerable versions in place, causing npm audit to fail with 13 high-severity issues.

[Copilot]

Pull request overview

This PR addresses high-severity npm audit vulnerabilities that were blocking CI builds. The changes apply a minimatch version override and run npm audit fix to resolve security issues.

Changes:

• Added npm override for minimatch@^10.2.1 to address GHSA-3ppc-4f35-3m26 ReDoS vulnerability across all transitive dependencies
• Upgraded markdown-it from 14.1.0 to 14.1.1 via npm audit fix
• Updated dependency tree to support minimatch v10 (brace-expansion v5.0.2, balanced-match v4.0.3)

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Added npm overrides section with minimatch version constraint
package-lock.json	Applied minimatch override across all dependencies, upgraded markdown-it, removed obsolete packages (concat-map, jackspeak, @isaacs/cliui), and updated supporting dependencies

[nosto-release-public]

🎉 This PR is included in version 11.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀