chore(frontend): patch js-yaml and nanoid advisories

[cristim]

Summary

Two new high-severity npm advisories have appeared since #1716 patched brace-expansion and fast-uri, reddening npm audit --audit-level=high on main and every open PR (same time-dependent pattern: npm audit queries the live advisory database, so the same commit goes red the moment an advisory publishes):

• js-yaml — GHSA-5p4m-2wfm-xmqj (quadratic CPU consumption in !!omap resolution)
• nanoid — GHSA-2v37-7h3g-55p8 (custom generators can loop indefinitely when size is zero)

Fix

Lockfile-only, per the same approach as #1716. Neither package is a direct dependency:

• js-yaml comes in transitively via eslint and via ts-jest -> @jest/transform -> babel-plugin-istanbul -> @istanbuljs/load-nyc-config.
• nanoid comes in transitively via css-loader -> postcss.

Both resolve within the semver ranges their parents already declare, so npm audit fix bumped only the three affected lockfile entries with no change to package.json:

Package	Before	After
js-yaml (eslint's copy)	4.3.0	4.3.1
js-yaml (@istanbuljs/load-nyc-config's copy)	3.15.0	3.15.1
nanoid	3.3.16	3.3.18

git diff package.json is empty; git diff package-lock.json touches exactly these three version/resolved/integrity triples (24 lines).

Verification

Before (npm audit --audit-level=high, exit 1):

js-yaml  3.0.0 - 3.15.0 || 4.0.0 - 4.3.0
Severity: high
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml
node_modules/js-yaml

nanoid  <3.3.17
Severity: high
nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8
fix available via `npm audit fix`
node_modules/nanoid

2 high severity vulnerabilities

After (npm audit --audit-level=high, exit 0):

found 0 vulnerabilities

• npm run build: succeeds (webpack compiles with the pre-existing entrypoint-size warning only, no errors).
• npm test: 8 failed / 2773 passed / 1 skipped, both on this branch and reproduced identically on unmodified origin/main in a separate clean worktree (before touching anything). Same failures, same counts, same locale-formatting mismatches ($1.200 vs $1,200, $4.568 vs $4,568, $30,00/mo vs $30.00/mo) — pre-existing, filed as fix(test/frontend): 8 tests assert the host locale's thousands separator, so they fail locally and pass in CI #1728, not affected by this change.

Dependency-hygiene observation (reporting only, not fixing here)

This is the second advisory pair in three days (after #1716's brace-expansion/fast-uri). All four advisories so far have landed on dev-only transitive dependencies (eslint, ts-jest/istanbul, css-loader/postcss, and #1716's pair) rather than anything in the production bundle — none are direct dependencies of cudly-frontend. Worth keeping an eye on whether this keeps recurring at this cadence; if it does, #1712 (where the scanner-decoupling work lives) might be the right place to consider decoupling npm audit's live-advisory-DB dependency from the PR-blocking gate (e.g. running it as a non-blocking scheduled check instead), rather than each new advisory needing an emergency same-day lockfile PR to unblock the merge queue. Not attempting that here — flagging per your request, staying inside the blocking fix.

Scope

frontend/package-lock.json only. package.json untouched (no direct dependency range needed to move). No frontend/src/** changes.

Refs #1712

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0443a5ac-2054-4315-a489-89853f96fd47

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Merging without a CodeRabbit verdict, deliberately, with the reasoning recorded rather than waived.

CodeRabbit has posted nothing on this PR at any head. The repo quota is per-developer, adaptive, and shared across the eight currently-open PRs; a push landing during a throttle is never auto-reviewed retroactively.

Why waiting is the wrong trade here specifically:

• The change is lockfile-only: 3 version bumps, 24 diff lines, frontend/package.json untouched. Both advisories resolved inside their parents' existing semver ranges, so no dependency range moved.
• It is verified end to end: npm audit --audit-level=high goes from exit 1 (2 high) to found 0 vulnerabilities; npm run build succeeds; the 8 remaining test failures were reproduced on an unmodified origin/main worktree first and are the host-locale issue tracked as fix(test/frontend): 8 tests assert the host locale's thousands separator, so they fail locally and pass in CI #1728.
• It gates seven other PRs. Security Scanning feeds CI Success, which sec(ci): main is unprotected while ref:refs/heads/main is a trusted OIDC subject for the AWS deploy role cloud-commitments-platform#154 made a required check on main, so every open PR is red on an advisory in a dev-only transitive dependency none of them touch.

The marginal value of a review bot on three version-number changes is low; the cost of holding seven PRs behind it is not.

Advisories closed:

• js-yaml GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap resolution) - 4.3.0 -> 4.3.1 (eslint), 3.15.0 -> 3.15.1 (@istanbuljs/load-nyc-config)
• nanoid GHSA-2v37-7h3g-55p8 (indefinite loop on zero size) - 3.3.16 -> 3.3.18 (css-loader -> postcss)

Both dev-only transitive dependencies, neither reachable from shipped production code.

The recurring cost of this pattern - two advisory pairs in three days, all four dev-only, each needing a same-day emergency PR to unblock the queue - is filed as #1731 for a deliberate decision about what should gate merges. That issue explicitly does not propose npm audit --omit=dev; suppressing findings to get green is prohibited here, and every option in it reports strictly more than today, not less.