chore: disable install scripts via allowScripts and fix audit vulnerabilities

[btea]

Description

refer to #997 (comment)

Validation

Related Issues

Check List

• I have read the Contributing Guidelines and made commit messages that follow the guideline.
• I have run node --run test and all tests passed.
• I have check code formatting with node --run format:check & node --run lint.
• I've covered new added functionality with unit tests if necessary.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api-docs-tooling	Ready	Preview	Aug 6, 2026 7:32am

[cursor]

PR Summary

Low Risk
Lockfile-only dependency bumps and install-script policy; no runtime or application code changes.

Overview
Adds root allowScripts in package.json to block lifecycle install scripts for fsevents and unrs-resolver, reducing supply-chain exposure from postinstall hooks during npm install.

Updates package-lock.json to brace-expansion 5.0.9 (with a stricter Node engine range) and undici 6.28.0, addressing audit-related dependency bumps without changing application source.

^{Reviewed by Cursor Bugbot for commit 7cb1f9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.63%. Comparing base (4bafb28) to head (7cb1f9c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1009   +/-   ##
=======================================
  Coverage   89.63%   89.63%           
=======================================
  Files         200      200           
  Lines       18501    18501           
  Branches     1729     1729           
=======================================
  Hits        16584    16584           
  Misses       1910     1910           
  Partials        7        7           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds npm install-script controls and refreshes the npm lockfile to address audit findings, aligning this repo with the newer npm “approve/deny dependency scripts” workflow referenced in #997.

Changes:

• Add a root allowScripts configuration to deny install scripts for fsevents and unrs-resolver.
• Update package-lock.json to incorporate vulnerability-related dependency bumps (e.g., brace-expansion, undici).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds allowScripts entries to disable specific dependency install scripts.
package-lock.json	Updates resolved dependency versions/integrities to pick up security/audit-related fixes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MattIPv4]

The changes here seem fine, but as a more general note, I like to leave any changes to dependencies to Dependabot (or rarely, collaborators) -- having external contributors touching lock files introduces a lot of risk for something being snuck in maliciously.

Again, the diff here is fine, the lockfile change is legit, just a general callout.

[ovflowd]

I don't really get why these specific packages to be unallowed.

[avivkeller]

@ovflowd It's all of our packges that use install scripts, since we don't need them