deps: clear 40 of 54 audit findings via targeted overrides

[mnaamani]

Clears the high/moderate-severity dependency vulnerabilities: 54 → 14 findings, all 26 moderates gone.

Why not npm audit fix --force

It is unusable on this repo. npm counts any version outside the vulnerable range as a fix — including going backwards — so --force proposes:

• pear-electron-forge-maker-appimage → 0.0.0, flatpak → 0.0.4 (stub versions)
• expo 55 → 53, react-native 0.83 → 0.72 (would destroy the mobile app)
• an undefined to undefined change

…and still leaves most highs. Plain npm audit fix is a no-op here: every finding is transitive and pinned by its parent.

What this does instead

Bumps them through the root overrides block, using npm's name@major selector so each major line takes a patch bump rather than being force-marched across majors:

package	fix
brace-expansion	1.1.18 / 2.1.4 / 5.0.9 (three live major lines)
js-yaml	3.15.1 / 4.3.1
undici	6.28.0 / 7.29.0
app-builder-lib	$app-builder-lib, declared range raised to ^26.15.7
builder-util-runtime	9.7.0
fast-uri	3.1.5
ip-address	10.5.0
nanoid	3.3.18
postcss	8.5.26
tar	7.5.19 → 7.5.22

Two gotchas worth knowing:

• app-builder-lib is a direct devDependency, which npm refuses to override by literal version (EOVERRIDE) — hence the $name form. Note its current dist-tag latest (26.15.3) is itself in the advisory range; 26.15.4+ is not.
• The lock is regenerated from scratch. An incremental npm install left the mobile workspace's subtree (expo → postcss/nanoid, @expo/cli → js-yaml) on the old versions. The committed lock had also drifted off the existing axios/ws overrides (axios 1.15.0, ws 8.17.1) — the regenerate restores them.

Mobile is covered: postcss 8.5.16→8.5.26, nanoid 3.3.15→3.3.18, js-yaml 4.3.0→4.3.1, plus the shared fixes.

Electron is deliberately NOT bumped

41.10.4 clears its advisory and passes npm test, npm run lint and npm run make — but the app is broken: the Bare worker never boots (no wallet.seed.enc/swarm.seed.enc, no <storage>/hyperwave corestore, and nothing logged even with ELECTRON_ENABLE_LOGGING=1). The renderer window opens but never reaches renderer/lib/ipc.js's startWorker, so main's client.call('init', …) never runs. Verified A/B against a 40.10.6 control. Only launching the app catches this — worth a boot smoke test before anyone retries.

The 14 remaining findings

• 13 → image-size, which has no fixed version at any release (latest 2.0.2 is vulnerable). Build-tooling only — appdmg (DMG packaging) and Metro (mobile bundler); nothing that ships.
• 1 → electron, per above.

Both documented in TODO.md § Dependency watch, along with a warning not to run --force here.

Verification

All green on this tree: app boot (seeds + corestore written), npm test, npm run lint, npm run make, and the 8-peer local-DHT e2e (34/34 asserts).

🤖 Generated with Claude Code