SYN-592: Remediate critical dependency findings

[KARSE22]

Resolves the critical npm dependency findings tracked in SYN-592. The change is limited to package metadata and does not modify application code.

What changed

• Upgraded webpack, @babel/traverse, minimist, and form-data to patched versions.
• Declared terser-webpack-plugin directly because the existing webpack configuration imports it.
• Regenerated the lockfile and synchronized the package version metadata.

Validation

Ran a clean install, all 29 tests, lint, and the production build. A fresh audit reports 0 critical findings. I also loaded both CDN bundles in Chromium and confirmed they initialize without console errors.

Compatibility

The updated dependency graph requires Node 18 or newer through node-releases. The repository does not currently declare a supported Node version, and validation passed on Node 20, 22, and 24.

[guardrails]

⚠️ We detected 6 security issues in this pull request:

Vulnerable Libraries (6)

Severity	Details
Critical	pkg:npm/eslint@4.19.1 (t) upgrade to: 9.26.0
High	pkg:npm/@babel/core@7.14.6 (t) upgrade to: > 7.14.6
High	pkg:npm/webpack-cli@4.7.2 (t) upgrade to: > 4.7.2
Medium	pkg:npm/@babel/register@7.14.5 (t) upgrade to: > 7.14.5
High	pkg:npm/mocha@9.0.2 (t) upgrade to: > 9.0.2
Medium	pkg:npm/@babel/preset-env@7.14.7 (t) upgrade to: > 7.14.7

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[samkitsheth95]

LGTM but we should test it out once released.

[NateWaldschmidt]

What are the new packages being added without any code references?

[KARSE22]

Ahh, good callout. Those are transitive dependencies tied to the audit findings, and I initially thought adding direct pins was the safest way to force the patched versions. But you're right, they don't belong in package.json since the code doesn't use them directly. I removed the direct entries and kept the patched versions in package-lock.json. The only new direct dependency is terser-webpack-plugin, which webpack.config.js imports.