Chore/dependency advisories

[gibbsie]

Summary

npx audit-ci --config .audit-ci.json currently exits 1 on main, which blocks the deploy pipeline at its test gate for every PR — including changes that have nothing to do with dependencies. These advisories are upstream and time-based, not introduced by any feature branch.

Changes

• ip-address → 10.4.0, taking Dependabot's bump (clean; no unrelated majors), closing build(deps): bump ip-address from 10.2.0 to 10.4.0 #61
• fast-uri override floor raised to a patched release. The previous floor resolved to a still-vulnerable version and needed an explicit npm update to reify in the lockfile.
• brace-expansion floors raised across the jest and glob chains (resolved 1.1.18 / 5.0.9); js-yaml → 4.3.1.

Not fixed, deliberately

GHSA-rgw5-rvv9-x895 cannot be fixed here: aws-cdk-lib bundles its own brace-expansion at 5.0.8, below the patched 5.0.9 — confirmed by inspecting the aws-cdk-lib@2.263.0 tarball. A bundled copy is unreachable by an overrides entry, so it is allowlisted with a justification naming the advisory, why no fix exists, and a recheck trigger, rather than a floor that silently fails to apply.

Verification

• audit-ci exit 0; npm audit reduced to the single allowlisted advisory.
• Every declared override confirmed reified in the lockfile.
• backend tsc clean; backend jest 5386; frontend jest 2010; pytest 1347.

Notes

• Diff is dependency files only: package.json, package-lock.json, .audit-ci.json, audit-ci-allowlist-justifications.md.
• Dependabot alerts are scoped wider than this gate — the root config does not scan frontend/package-lock.json, so the react-router alerts (no patched release available) will persist after this merges. Tracked separately.
• Pre-existing, out of scope: the justification file claims test-exclude- and eslint-scoped brace-expansion overrides that do not exist in package.json, leaving a latent TypeError: expand is not a function in test-exclude's minimatch@3.1.5 chain. Reproduces byte-identically on main; no suite reaches it.