[Chore] Resolve 10 Dependabot alerts via npm overrides

[roomote-conceal-network]

Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

Expanded the npm overrides block in package.json and refreshed package-lock.json to pin six transitive dependency packages at patched versions, clearing all 10 open Dependabot alerts in this repository.

All vulnerable packages are transitive (pulled in by react-native, nitrogen, clang-format, and their sub-dependencies), so no direct dependency versions changed. The override structure uses parent-scoped nesting for picomatch because two vulnerable majors (2.x under jest/react-native and 4.x under nitrogen/ts-morph) coexist in the tree and cannot be collapsed to a single version without breaking one consumer's API contract.

Package	Alert(s)	Severity	Was	Now
shell-quote	#19, #25	critical, high	1.8.3	1.10.0
js-yaml	#26, #24	high, medium	4.1.1	4.3.1
minimatch	#13, #11	high, high	3.1.2 / 10.0.3	3.1.5
brace-expansion	#27	high	1.1.12	1.1.18
picomatch	#18, #15	medium, medium	2.3.1 / 4.0.3	2.3.2 / 4.0.5
@babel/core	#23	low	7.28.5	7.29.7

Why this change was made

These 10 alerts (1 critical, 5 high, 3 medium, 1 low) were the highest-priority uncovered bundle in the ConcealNetwork environment. They are all ReDoS / DoS / file-read class vulnerabilities in build-time and test-time tooling dependencies. A single cohesive override-based remediation resolves the entire bundle rather than opening one PR per alert.

Impact

No user-facing or runtime change — this is a React Native native C++ crypto library and none of these packages ship in the published artifact (they are dev/build/test transitive deps). npm audit confirms none of the 10 target packages remain. The remaining npm audit output (6 high vulns in image-size/metro via react-native) is a separate advisory chain outside this bundle that would require a react-native major upgrade.

The npm run lint and npm run check gates pass. npm test and npm run cpp fail on main as well — jest is not a devDependency and the C++ files are not clang-formatted; both are pre-existing and unrelated to these dependency changes.

[roomote-conceal-network]

1 issue outstanding. See task

Review summary

The override block and refreshed lockfile resolve all 10 target Dependabot alerts as described — verified that shell-quote, js-yaml, minimatch, brace-expansion, picomatch (both 2.3.2 and 4.0.5), and @babel/core now resolve to the claimed patched versions, and npm audit no longer lists any of them. The remaining 6 high advisories are the unrelated image-size/metro/react-native chain noted in the PR. The parent-scoped picomatch nesting is justified — 2.x and 4.x genuinely coexist in the tree.

One follow-up: regenerating the lockfile bumped @biomejs/biome 2.3.1 → 2.5.7 (the ^2.2.6 devDependency range allows it), which leaves biome.json pinned to the old schema and now emits migration info diagnostics on every lint/check run.

#	Severity	File	Line(s)	Issue
1	🟡 Medium	biome.json	2	$schema is pinned to 2.3.1 while @biomejs/biome now resolves to 2.5.7; npm run lint / npm run check emit 2 info diagnostics (schema mismatch + recommended deprecation). Per CLAUDE.md, the $schema (and recommended → preset) should be migrated in the same change as the biome bump, or biome should be pinned back to 2.3.x.

• biome.json:2 — update $schema to 2.5.7 and run biome migrate (the lockfile bumped @biomejs/biome 2.3.1 → 2.5.7, leaving the config on a stale schema and emitting info diagnostics on every lint/check; CLAUDE.md requires the schema migration to land with the biome bump).

_{Reviewed f7491a6}

[Acktarius]

check Pr #3