chore(deps): force patched js-yaml, fast-uri, ip-address (6 HIGH Dependabot alerts)

[romainsalles]

Closes 6 HIGH Dependabot alerts for the Vanta compliance sweep by adding npm overrides (keyed per major so nodes on other majors are untouched) and regenerating both lockfiles. Lock-only change: no runtime code touched; all flagged packages are transitive dependencies.

Alerts

Root package-lock.json:

• #442 — js-yaml >=4.0.0 <4.3.1 (GHSA-5p4m-2wfm-xmqj) → 4.3.1
• #431 — fast-uri >=3.0.0 <3.1.5 (CVE-2026-18446) → 3.1.5
• #428 — ip-address <=10.3.0 (CVE-2026-69192) → 10.5.0

functions/package-lock.json:

• #443 — js-yaml 4.x (GHSA-5p4m-2wfm-xmqj) → 4.3.1
• #441 — js-yaml >=3.0.0 <3.15.1 (GHSA-5p4m-2wfm-xmqj) → 3.15.1
• #432 — fast-uri 3.x (CVE-2026-18446) → 3.1.5

Notes

• ip-address: the flagged instance in the root lock was already on the 10.x major (10.2.0, via firebase-tools → socks), so a keyed ip-address@10 override bumps it within the same major — no compatibility risk. It is dev-tooling-only (firebase-tools devDependency), so runtime exposure was nil anyway.
• Existing overrides blocks from previous sweeps (tar, uuid, brace-expansion, fast-xml-parser) are preserved; new keys were added alongside them.
• Verification: both locks scanned post-regeneration — every js-yaml 3.x >= 3.15.1, every js-yaml 4.x >= 4.3.1, every fast-uri 3.x >= 3.1.5, ip-address at 10.5.0. Nodes on other majors untouched.
• Tests (functions/, c8 + ava): 159 pass, 48 fail — the failures are all FirebaseIntegration tests requiring GCP credentials/Firestore emulator, and a clean origin/develop baseline fails the exact same 48. Zero regressions from this change.

🤖 Generated with Claude Code