chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 1 of 2 open Dependabot security alerts by bumping a vulnerable transitive dependency

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#187	esbuild	low	Bumped ng-packagr 21.2.5 -> 21.2.7 (lockfile-only, within existing ^21.0.0 range), which dedupes esbuild to 0.28.1

Not resolved

Alert	Package	Severity	Reason
#179	uuid (transitive, dev-only)	medium	No non-override fix available. jest-cucumber@4.5.0 (latest) pins @cucumber/gherkin@^28.0.0, whose accepted @cucumber/messages range (<=28) tops out at @cucumber/messages@28.1.0, which itself pins an exact uuid@11.1.0 (one patch short of the fixed 11.1.1). jest-cucumber also directly pins uuid@^10.0.0. No newer jest-cucumber release exists. Per repo policy this SDK does not use overrides/resolutions. The advisory (GHSA-w5hq-g745-h8pq) only applies when callers pass an external output buffer to uuid v3/v5/v6, which is not how it is used here (dev/test-only, transitive). Left open pending a jest-cucumber upstream update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f4a15bc8-346f-4731-9384-bef5117baa3b

📥 Commits

Reviewing files that changed from the base of the PR and between 7959d6d and f40b29c.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The package configuration adds an overrides block that resolves uuid to ^11.1.1 for jest-cucumber and related cucumber dependencies.

Changes

UUID dependency resolution

Layer / File(s)	Summary
Transitive uuid override package.json	Adds an overrides configuration for jest-cucumber, @cucumber/gherkin, and @cucumber/messages.

Priority: ⬇️ Low — Defer this dependency override because it addresses a transitive, dev-only security alert without changing exported product behavior.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: 🔵 Low · up to f40b2

This changes the UUID implementation used by jest-cucumber and Cucumber test dependencies. A major-version compatibility mismatch could affect test execution, so merge is reasonable with owner awareness and validation of the affected test tooling.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The reviewable change adds a dependency override in package.json. It does not show the provider-interface update required by issue #187. The excluded package-lock.json cannot establish compliance with…	Update the client evaluation method so its resolve argument uses the provider interface, as required by issue #187. Keep the dependency changes only if they are separately justified and linked to an appropriate issue.
Out of Scope Changes check	⚠️ Warning	The dependency-security change is unrelated to issue #187, which requires a provider-interface update. The package-lock.json exclusion does not change the scope assessment for the visible package.json…	Remove the unrelated dependency changes or link them to a dependency-security issue. Add the provider-interface change required by issue #187.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the dependency-security purpose of the package.json change.
Description check	✅ Passed	The description discusses Dependabot alerts and dependency updates, which relates to the package.json change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The reviewable change adds a dependency override in package.json. It does not show the provider-interface update required by issue #187. The excluded package-lock.json cannot establish compliance with that requirement.

Full details: Out of Scope Changes check

Explanation

The dependency-security change is unrelated to issue #187, which requires a provider-interface update. The package-lock.json exclusion does not change the scope assessment for the visible package.json change.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}