fix: resolve Dependabot security alerts (vite, picomatch, path-to-reg…

[Shubhangi-Microsoft]

This pull request updates several dependencies in both src/app/frontend/package-lock.json and src/app/frontend-server/package-lock.json to their latest patch versions. These updates primarily address minor improvements and potential security or bug fixes in the affected packages.

Dependency updates:

• Brace expansion libraries:

  • Updated brace-expansion from versions 1.1.12 and 2.0.2 to 1.1.13 and 2.0.3 across multiple dependency trees, including those used by @eslint/eslintrc, @humanwhocodes/config-array, eslint, and glob (src/app/frontend/package-lock.json) [1] [2] [3] [4] [5].

• Picomatch libraries:

  • Updated picomatch from 2.3.1 to 2.3.2 and from 4.0.3 to 4.0.4 in both the main dependency tree and within dependencies of tinyglobby and vite (src/app/frontend/package-lock.json, src/app/frontend-server/package-lock.json) [1] [2] [3] [4].

• Path-to-regexp:

  • Updated path-to-regexp from 0.1.12 to 0.1.13 (src/app/frontend-server/package-lock.json).

• Vite:

  • Updated vite from 7.3.1 to 7.3.2 (src/app/frontend/package-lock.json).

These updates help keep the project up-to-date with the latest patches and may include important bug fixes or security improvements.…exp)

• vite: 7.3.1 -> 7.3.2 (fixes arbitrary file read via WebSocket, server.fs.deny bypass, path traversal in optimized deps)
• picomatch: updated in both frontend and frontend-server (fixes ReDoS via extglob quantifiers, method injection in POSIX character classes)
• path-to-regexp: updated in frontend-server (fixes ReDoS via multiple route parameters)
• brace-expansion: updated in frontend (fixes DoS via zero-step sequence)

Resolves Dependabot alerts #177, #179, #180, #181, #183, #185, #186, #187

Purpose

• ...

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (2)

• src/app/frontend-server/package-lock.json: Language not supported
• src/app/frontend/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.