fix(QTDI-3346): CVE npm security updates

[undx]

https://qlik-dev.atlassian.net/browse/QTDI-3346

Requirements

• Any code change adding any logic MUST be tested through a unit test executed with the default build
• Any API addition MUST be done with a documentation update if relevant

Why this PR is needed?

What does this PR adds (design/code thoughts)?

AI generated code

https://internal.qlik.dev/general/ways-of-working/code-reviews/#guidelines-for-ai-generated-code

• [] this PR has been written with the help of GitHub Copilot or another generative AI tool

[Copilot]

Pull request overview

Updates frontend NPM dependency pins/overrides across the documentation site and tooling UIs to address CVE/security advisory findings (QTDI-3346), keeping lockfiles in sync with the intended resolved versions.

Changes:

• Bump brace-expansion (v1 and v2 lines) and js-yaml via overrides/lockfiles.
• Update webpack-dev-server to ^5.2.6 and refresh related transitive resolutions (e.g., fast-uri, postcss, shell-quote, immutable, websocket-driver) in the webapp/starter lockfiles.
• Align package templates with their corresponding package.json/lockfile updates.

Reviewed changes

Copilot reviewed 6 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
documentation/src/main/frontend/package-template.json	Updates overrides to force patched brace-expansion and js-yaml.
documentation/src/main/frontend/package-lock.json	Updates resolved versions/integrity for patched transitive dependencies.
component-tools/src/main/frontend/package.json	Bumps direct brace-expansion dependency.
component-tools/src/main/frontend/package-lock.json	Updates resolved brace-expansion version and lockfile dependency graph.
component-tools-webapp/src/main/frontend/package.json	Updates webpack-dev-server and multiple security-related overrides (incl. websocket-driver).
component-tools-webapp/src/main/frontend/package-template.json	Mirrors the webapp package.json dependency/override updates for templating.
component-tools-webapp/src/main/frontend/package-lock.json	Updates resolved versions/integrity and transitive deps consistent with overrides.
component-starter-server/src/main/frontend/package.json	Updates webpack-dev-server and security-related overrides (incl. websocket-driver).
component-starter-server/src/main/frontend/package-template.json	Mirrors the starter server package.json dependency/override updates for templating.
component-starter-server/src/main/frontend/package-lock.json	Updates resolved versions/integrity and transitive deps consistent with overrides.

Files not reviewed (4)

• component-starter-server/src/main/frontend/package-lock.json: Generated file
• component-tools-webapp/src/main/frontend/package-lock.json: Generated file
• component-tools/src/main/frontend/package-lock.json: Generated file
• documentation/src/main/frontend/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonar-rnd]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (63.30% Estimated after merge)
• No data about duplications (1.40% Estimated after merge)

Project ID: org.talend.sdk.component:component-runtime

View in SonarQube