Fix 28 security vulnerabilities in npm dependencies

[Copilot]

Resolved all security vulnerabilities in package.json dependencies identified by npm audit.

Vulnerabilities Fixed

28 total (13 high, 7 moderate, 8 low severity):

• High: body-parser, cross-spawn, braces, multer, path-to-regexp, express (DoS/ReDoS attacks)
• Moderate: @nestjs/common (RCE via Content-Type header), @babel/helpers, micromatch, nanoid, serialize-javascript, tar, validator
• Low: tmp, cookie, inquirer, send (various injection/bypass issues)

Changes

Automatic fixes via npm audit fix

• Updated 18+ transitive dependencies to patched versions
• Zero breaking changes to production dependencies

Manual version bumps (devDependencies only)

- "@nestjs/cli": "^10.4.5"
+ "@nestjs/cli": "^11.0.10"

- "@swc/cli": "^0.4.0"  
+ "@swc/cli": "^0.7.9"

Documentation

Added SECURITY-FIXES.md with full vulnerability details and remediation tracking.

Verification

• npm audit: 0 vulnerabilities
• Build and lint: pass

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint.prisma.io
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/NeonBroCRM-backend/NeonBroCRM-backend/node_modules/prisma/build/child {"product":"prisma","version":"5.19.1","cli_install_type":"local","information":"","local_timestamp":"2025-11-07T12:07:02Z","project_hash":"10c69a95","cli_path":"/home/REDACTED/work/NeonBroCRM-backend/NeonBroCRM-backend/node_modules/prisma/build/index.js","cli_path_hash":"c82ffe03","endpoint":"REDACTED","disable":false,"arch":"x64","os":"linux","node_version":"v20.19.5","ci":true,"ci_name":"GitHub Actions","command":"generate --postinstall \"UNABLE_TO_FIND_POSTINSTALL_TRIGGER__ENVAR_MISSING\"","schema_providers":["postgresql"],"schema_preview_features":[],"schema_generators_providers":["prisma-client-js"],"cache_file":"/home/REDACTED/.cache/checkpoint-nodejs/prisma-c82ffe03","cache_duration":43200000,"remind_duration":172800000,"force":false,"timeout":5000,"unref":true,"child_path":"/home/REDACTED/work/NeonBroCRM-backend/NeonBroCRM-backend/node_modules/prisma/build/child","client_event_id":"","previous_client_event_id":"","check_if_update_available":true} (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

find security issues in package.json dependencies

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.