security(deps): bump dompurify, js-yaml, brace-expansion, undici

[parthrohit22]

Summary

Four npm advisories were published after dev@04d8e2b's last green CI run and started failing the Frontend job's dependency-audit gate (scripts/dependency-audit.mjs) on every open PR, including unrelated ones (confirmed on PR #255). This bumps the four affected packages via apps/frontend/package.json's overrides to their patched versions — all within the major version already in use, no breaking migration.

Linked issue

Closes #256

Roadmap alignment

• Roadmap §23 workstream this advances: none directly — this is a CI/security maintenance fix, not a product capability.
• §28 market-fit criterion this moves toward: not directly applicable.
• Accepted evidence it is real: node scripts/dependency-audit.mjs exits 0 locally (was exit 1); full frontend suite, lint, and build all still pass after the bump.

This doesn't cleanly map to a §23/§28 citation because it's infrastructure hygiene (an unblocking fix for a repo-wide CI gate), not a product change. Flagging honestly rather than forcing a citation, consistent with how #239's PR handled the same gap.

What changed

• apps/frontend/package.json: overrides bumped — dompurify 3.4.12 → 3.4.13, brace-expansion ^5.0.8 → ^5.0.9, js-yaml 4.3.0 → 4.3.1, and undici newly added at 7.29.0 (was unpinned, transitively resolving to 7.28.0 via jsdom).
• apps/frontend/package-lock.json: regenerated to match (npm install --prefix apps/frontend, which is the correct invocation for this workspace layout — plain npm install from inside apps/frontend incorrectly resolves against the monorepo root and would create a stray root-level lockfile; this repo intentionally has none, per scripts/dependency-audit.mjs's own comment).

Patched-version confirmation (via GitHub Advisory API first_patched_version, not just npm audit's summary text, since one advisory's title text ("fix not backported") is easy to misread as applying to the 4.x line when it's actually about 3.x):

• brace-expansion 5.0.9 fixes GHSA-rgw5-rvv9-x895.
• dompurify 3.4.13 fixes GHSA-55q2-fjhq-7xh7 and GHSA-c2j3-45gr-mqc4.
• js-yaml 4.3.1 fixes GHSA-52cp-r559-cp3m and GHSA-5p4m-2wfm-xmqj (patched range is >= 4.3.1; the 3.x-line "fix not backported" phrasing in the advisory title doesn't apply to 4.x).
• undici 7.29.0 fixes GHSA-4cwx-7wf7-3272 and the other four undici advisories (patched range >= 7.29.0 for the 7.x line) — same target version as the already-open Dependabot PR chore(deps): bump undici from 7.28.0 to 7.29.0 in /apps/frontend #253, which this supersedes for CI-unblocking purposes; chore(deps): bump undici from 7.28.0 to 7.29.0 in /apps/frontend #253 can still merge independently later.

Acceptance criteria completed

• node scripts/dependency-audit.mjs exits 0 locally
• npm --prefix apps/frontend run test, npm run lint:frontend, npm run build:frontend all pass
• No unrelated dependency changes

Testing performed

node scripts/dependency-audit.mjs
  -> No blocking findings (1 accepted: the existing, unrelated, unexpired react-router acceptance)

npm --prefix apps/frontend run test -- --run
  Test Files  38 passed (38)
  Tests       215 passed (215)

npm run lint:frontend
  eslint . -> clean

npm run build:frontend
  tsc -b && vite build -> succeeded

Screenshots

Not applicable — dependency/lockfile-only change, no UI impact.

Security and data considerations

This PR itself is the security fix: it closes four advisories (one runtime-reachable — dompurify, used by the Monaco editor preview; three development/build-time-only). No new dependency was added (undici was already a transitive dependency, just previously unpinned in overrides), no scope widened, no new attack surface.

Dependencies and blocked work

None. PR #255 (feature/239-architecture-graph-non-visual) is currently blocked on the same CI gate this fixes; once this merges, #255 will need a rebase to go green (its own diff is unrelated and unaffected by this change).

Scope changes or remaining work

None for this PR's scope. The pre-existing react-router acceptance in scripts/dependency-audit-policy.json (expires 2026-10-01) is untouched and still valid — not this PR's concern.

Contributor checklist

• This PR targets dev
• I claimed the issue and had it assigned before starting substantial work (self-assigned security: bump dependency-audit-policy overrides for newly disclosed npm advisories #256; not commented per maintainer instruction)
• The branch was created from an up-to-date upstream/dev
• The branch is rebased on the latest upstream/dev
• This PR addresses one clearly scoped issue
• This PR advances a §23 workstream toward a §28 market-fit criterion — see honest Roadmap alignment note above; this is CI/infra hygiene, not a product change
• Every acceptance criterion I claim as complete is actually complete
• Relevant tests pass
• Documentation is updated for any user-visible change — none needed, no user-visible change
• No secrets, credentials, local env files, or generated artifacts are included
• No unrelated files were changed
• Closing syntax (Closes) is used only because the issue is fully resolved
• Dependencies and follow-up work are linked