fix(deps): upgrade npm packages for 14 CVE fixes [mtc-1.8]

[midays]

Summary

Upgrades 6 vulnerable npm dependencies to address 14 CVE security issues in MTC 1.8.

Security Fixes

Critical Dependencies:

• axios: 1.16.1 → 1.18.0

  • CVE-2026-67320: Information disclosure via Prototype Pollution
  • CVE-2026-67314: Outbound Request Tampering via Prototype Pollution
  • CVE-2026-67313: DoS via uncontrolled recursion in formDataToJSON
  • CVE-2026-67321: DoS via object serialization bypass

• fast-uri: 3.1.2 → 4.1.3

  • CVE-2026-16221: Security policy bypass due to URL parsing inconsistency

• node-tar: 7.5.6 → 7.5.22

  • CVE-2026-73566: DoS via crafted long-path tar archive
  • CVE-2026-59874: DoS via malformed tar archive header
  • CVE-2026-59873: DoS via crafted gzip bomb

• js-yaml: 3.14.1 → 5.4.1

  • CVE-2026-73643: DoS via exponential parsing in flow collections
  • CVE-2026-59869: DoS via crafted YAML documents

Additional Fixes:

• brace-expansion: 5.0.7 → 5.0.9

  • CVE-2026-14257: DoS via memory exhaustion in expand() function
  • CVE-2026-69152: DoS via unbounded intermediate arrays

• ip-address: 10.1.1 → 10.7.0

  • CVE-2026-69192: Inconsistent IP address parsing leads to SSRF

Excluded CVEs (Require ESM Migration):

• CVE-2026-73086 (nanoid): Requires nanoid 6.x which is ESM-only, breaking change
• CVE-2026-69153 (postcss): Requires postcss 8.5.26+ which depends on nanoid 6.x

These will be addressed in a separate migration PR.

Testing

• ✅ All unit tests passing (14/14)
• ✅ Build successful (no ESM compatibility issues)
• ✅ No breaking changes detected
• ✅ Yarn Berry compatibility maintained

Jira Tickets

Fixes: MIG-1993, MIG-1995, MIG-1994, MIG-1992, MIG-1991, MIG-1990, MIG-1983, MIG-1982, MIG-1970, MIG-1969, MIG-1968, MIG-1961, MIG-1960, MIG-1959

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 64a353cc-487a-475d-a7b9-351729e89b8e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}