build(deps): fix security vulnerabilities via dependency upgrades and overrides

[ethan ozelius (ethan-ozelius-contentful)]

  ┌────────────┬──────────────────────┬─────────────────────────────────────┬──────────────────────────────────────────────┐
  │   Alert    │       Package        │                 CVE                 │                  Fix method                  │
  ├────────────┼──────────────────────┼─────────────────────────────────────┼──────────────────────────────────────────────┤
  │ #197       │ serialize-javascript │ CVE-2026-34043                      │ Upgraded @rollup/plugin-terser 0.4.4 → 1.0.0 │
  ├────────────┼──────────────────────┼─────────────────────────────────────┼──────────────────────────────────────────────┤
  │ #194       │ lodash               │ CVE-2026-4800 (code injection)      │ npm overrides: lodash >=4.18.0               │
  ├────────────┼──────────────────────┼─────────────────────────────────────┼──────────────────────────────────────────────┤
  │ #193       │ lodash               │ CVE-2026-2950 (prototype pollution) │ npm overrides: lodash >=4.18.0               │
  ├────────────┼──────────────────────┼─────────────────────────────────────┼──────────────────────────────────────────────┤
  │ #187, #188 │ picomatch            │ CVE-2026-33672 (method injection)   │ npm overrides: picomatch >=4.0.4             │
  ├────────────┼──────────────────────┼─────────────────────────────────────┼──────────────────────────────────────────────┤
  │ #125       │ tmp                  │ CVE-2025-54798 (symlink bypass)     │ npm overrides: tmp >=0.2.4                   │
  └────────────┴──────────────────────┴─────────────────────────────────────┴──────────────────────────────────────────────┘

Summary

• Upgrades @rollup/plugin-terser from 0.4.4 to 1.0.0, pulling in serialize-javascript@7.0.5 — fixes #197 (CVE-2026-34043: CPU exhaustion DoS)
• Adds npm overrides to force patched versions of transitive dev deps that upstream parents pin to vulnerable ranges:
  • lodash >=4.18.0 — fixes #193 (CVE-2026-2950: prototype pollution via _.unset/_.omit) and #194 (CVE-2026-4800: code injection via _.template imports)
  • picomatch >=4.0.4 — fixes #187 / #188 (CVE-2026-33672: method injection in POSIX character classes)
  • tmp >=0.2.4 — fixes #125 (CVE-2025-54798: symlink bypass for arbitrary temp file write)
• All affected packages are dev-only transitive deps — nothing is shipped to SDK consumers

Note: A picomatch@4.0.3 instance inside npm's own bundled modules (node_modules/npm/node_modules/tinyglobby) cannot be overridden from project config — that alert will persist in npm audit but is not exploitable from userland code.

Test plan

• Build passes (npm run build)
• Unit tests pass (113 tests, 0 failures)
• Type tests pass (tsd)
• Verified patched versions installed: lodash@4.18.1, picomatch@4.0.4, tmp@0.2.5, serialize-javascript@7.0.5

Generated with Claude Code

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at michael.pearce@contentful.com.