fix: resolve high severity dependency vulnerabilities

[tonychang04]

Summary

• Add npm overrides for minimatch (>=3.1.4) and flatted (>=3.4.2)
• Addresses CVE-2026-27903, CVE-2026-27904, CVE-2026-33228

Test plan

• Verify npm audit shows no high severity vulnerabilities for these packages
• Verify extension compiles with npm run compile
• Verify extension packages with npm run package

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated dependency resolution to ensure stability and compatibility.

Note

Fix high severity vulnerabilities by pinning minimatch and flatted dependency versions

Adds an overrides section to package.json forcing minimatch to >=3.1.4 and flatted to >=3.4.2, addressing known high severity vulnerabilities in transitive dependencies.

^{Macroscope summarized 4465b73.}

[coderabbitai]

Walkthrough

The pull request adds an overrides section to package.json that enforces specific minimum versions for two dependencies: minimatch (>=3.1.4) and flatted (>=3.4.2). This ensures predictable dependency resolution across the project.

Changes

Cohort / File(s)	Summary
Dependency Version Constraints package.json	Added overrides configuration to force resolution of minimatch and flatted to specified minimum versions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 With whiskers twitching, I declare with cheer,
Two dependencies now crystal clear!
Minimatch and flatted, locked in place,
No version conflicts in this space! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding npm overrides to resolve high severity dependency vulnerabilities in minimatch and flatted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/resolve-dependency-vulnerabilities

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

package.json (1)

165-167: Use exact versions in overrides to explicitly document security patch intent.

The lockfile currently pins minimatch@10.2.4 and flatted@3.4.2, and npm ci in CI ensures deterministic builds. However, for CVE remediation, explicit version pins make the intent clearer and are more defensive against accidental version floats if the lockfile is regenerated or if developers use npm install locally. Consider changing to exact versions:

Suggested change

   "overrides": {
-    "minimatch": ">=3.1.4",
-    "flatted": ">=3.4.2"
+    "minimatch": "10.2.4",
+    "flatted": "3.4.2"
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 165 - 167, Change the overrides entries to use
exact versions (not ranges) to document the security patch intent: replace
"minimatch": ">=3.1.4" and "flatted": ">=3.4.2" with exact pins matching the
lockfile (e.g., "minimatch": "10.2.4" and "flatted": "3.4.2") in the
package.json "overrides" section so the intent is explicit and deterministic.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@package.json`:
- Around line 165-167: Change the overrides entries to use exact versions (not
ranges) to document the security patch intent: replace "minimatch": ">=3.1.4"
and "flatted": ">=3.4.2" with exact pins matching the lockfile (e.g.,
"minimatch": "10.2.4" and "flatted": "3.4.2") in the package.json "overrides"
section so the intent is explicit and deterministic.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 68d229b1-aba7-49b7-a5c1-14dc23ac0fe6

📥 Commits

Reviewing files that changed from the base of the PR and between 36c4d05 and 4465b73.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json