fix(security): bump vulnerable JS deps to patched versions (ENG-12518)

[andriy-sudo]

Summary

Fixes two HIGH-severity open Dependabot alerts by floor-pinning transitive JS dependencies via npm overrides in examples/js/package.json.

Package	Old Version	New Version	Advisory	CVSS
axios	1.13.2	1.13.6	GHSA-43fc-jf86-j433	HIGH
minimatch	3.1.2	3.1.5	GHSA-7r86-cg39-jmmj	HIGH

Both packages are transitive dependencies (axios via agentql, minimatch via eslint/glob). They cannot be updated directly — instead, npm overrides are used to force the resolver to pick a safe version.

This supersedes Dependabot PR #138 (which only addressed axios).

Test plan

• npm install resolves axios to 1.13.6 and minimatch to 3.1.5
• OSV scanner CI check passes on this PR

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

This change adds an npm overrides section to the examples/js/package.json file. The overrides configuration specifies version constraints for two packages: axios at version >=1.13.5 and minimatch at version ^3.1.3. This configuration modifies npm's dependency resolution behavior to enforce these specific versions, ensuring that these packages resolve to the specified versions regardless of what other dependencies request.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: using npm overrides to bump two vulnerable JS dependencies to patched versions, matching the changeset's security fix.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed context about the security vulnerabilities, the specific version updates, and the rationale for using npm overrides.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch glewit/ENG-12518-fix-js-vulns

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

examples/js/package.json (1)

26-29: Overrides approach is appropriate for pinning transitive dependencies.

The axios vulnerability (GHSA-43fc-jf86-j433) is fixed in 1.13.5, so >=1.13.5 is correct.

For minimatch, GHSA-7r86-cg39-jmmj affects versions ">=0.0.0, <3.1.3" and 3.1.3 is listed as a patched version for the 3.x line. However, related minimatch vulnerabilities (CVE-2026-27904) require version 3.1.4 to fix. Since your test plan targets 3.1.5, consider tightening the constraint to ensure npm resolves to at least 3.1.4:

   "overrides": {
     "axios": ">=1.13.5",
-    "minimatch": "^3.1.3"
+    "minimatch": ">=3.1.4"
   }

This ensures coverage for multiple minimatch ReDoS vulnerabilities disclosed around the same time.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@examples/js/package.json` around lines 26 - 29, Update the minimatch override
to ensure resolution to a patched release: change the "minimatch" override
currently set to "^3.1.3" to require at least 3.1.4 (for example ">=3.1.4" or
"^3.1.4") so npm will pick a version that includes the CVE fixes; leave the
axios override ("axios": ">=1.13.5") as-is.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@examples/js/package.json`:
- Around line 26-29: Update the minimatch override to ensure resolution to a
patched release: change the "minimatch" override currently set to "^3.1.3" to
require at least 3.1.4 (for example ">=3.1.4" or "^3.1.4") so npm will pick a
version that includes the CVE fixes; leave the axios override ("axios":
">=1.13.5") as-is.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2823812-9925-4dea-b680-06313ec753fd

📥 Commits

Reviewing files that changed from the base of the PR and between 1bfddac and 919ad9f.

⛔ Files ignored due to path filters (1)

• examples/js/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• examples/js/package.json