chore: Remediate 7 Dependabot security alerts (lockfile only)

[ernst-dev]

Automated Dependabot security-alert remediation

Alert-driven remediation of this repository's open Dependabot security alerts.
Baseline: d40bfcc0e on main.

Alerts resolved (7 of 7)

Alert	Sev	Package	Major line	Vulnerable range	First patched	Now resolved to	Advisory
#218	high	fast-uri	3.x	>= 3.0.0, < 3.1.5	3.1.5	3.1.5	GHSA-7p8r-x3mc-p8w7 (CVE-2026-18446)
#213	medium	ip-address	10.x	>= 10.1.1, <= 10.2.0	10.2.1	10.4.0	GHSA-22jq-vg5j-6vgg (CVE-2026-54272)
#214	medium	ip-address	10.x	>= 10.1.1, <= 10.2.1	10.2.2	10.4.0	GHSA-4xrf-jv44-h6hh (CVE-2026-69198)
#215	high	ip-address	10.x	<= 10.3.0	10.3.1	10.4.0	GHSA-mwp4-54f8-5fhr (CVE-2026-69192)
#216	medium	undici	6.x	< 6.28.0	6.28.0	6.28.0	GHSA-8xcm-r25x-g524 (CVE-2026-16728)
#217	medium	undici	6.x	< 6.28.0	6.28.0	6.28.0	GHSA-m8rv-5g2x-5cg5 (CVE-2026-15157)
#219	medium	undici	6.x	< 6.28.0	6.28.0	6.28.0	GHSA-v3r7-h72x-cjcm (CVE-2026-16729)

How this was remediated

• Rung 1 — npm audit fix --package-lock-only --ignore-scripts (no --force was used anywhere in this run).
• The repo's own prepare-package-lock convention (postinstall in @cloudscape-design/build-tools) was applied afterwards, so no @cloudscape-design/* entries are (re-)introduced into the lockfile.
• npm's full reconciliation additionally healed unrelated pre-existing lockfile drift (stale entries, dev/optional flags, unrelated minor bumps). That collateral was deliberately discarded: only the security-relevant entries from npm's computed result were applied on top of the committed lockfile, so this diff contains alert-driven changes only.
• Verified with npm ls --package-lock-only --all: zero new unmet/invalid dependency problems versus main.

Lockfile changes (6)

Package	From	To	Scope	Lockfile path
brace-expansion	2.1.2	2.1.4	dev	node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
brace-expansion	2.1.2	2.1.4	dev	node_modules/glob/node_modules/brace-expansion
brace-expansion	2.1.2	2.1.4	dev	node_modules/readdir-glob/node_modules/brace-expansion
fast-uri	3.1.4	3.1.5	dev	node_modules/fast-uri
ip-address	10.2.0	10.4.0	dev	node_modules/ip-address
undici	6.27.0	6.28.0	dev	node_modules/undici

NPMPM (NpmPrettyMuch) availability — internal build safety

Not applicable — 0 non-dev dependencies changed. Every version bump in this PR is dev: true, which the NPMPM availability check skips, so there is no internal-build (Brazil) impact and the check should come back green.

Does merging clear this repository's alert list?

Yes. Merging this PR is expected to close all 7 of this repository's currently-open Dependabot security alerts.

---

_{Existing Dependabot-authored PRs were deliberately not touched, reviewed, rebased, or closed by this run.}

Opened by roko-dependabot on behalf of @ernst-dev. Alert-driven remediation; not merged — a human must review and merge.