fix: resolve Basic Validation audit failures (brace-expansion, fast-xml-parser)

[HarithaVattikuti]

Summary

Fixes the npm audit --audit-level=high failure in basic-validation.yml

Changes

• Upgraded fast-xml-parser to 5.10.1, fixing GHSA-8r6m-32jq-jx6q
• Added a package.jsonoverrides entry to pin transitive brace-expansion to ^5.0.8, fixing GHSA-mh99-v99m-4gvg in nested deps of @actions/cache, glob, and test-exclude — without the breaking ts-jest@27 downgrade that npm audit fix --force would otherwise pull in
• Refreshed .licenses/npm/* cache to match the updated dependency tree
• Rebuilt dist/setup/index.js and dist/cache-save/index.js

Validation

• npm audit --audit-level=high → 0 vulnerabilities
• licensed status → 48 dependencies checked, 0 errors
• npm run format-check → pass
• npm run lint → pass
• npm run build → pass
• npm test → 69/69 tests pass (7 pre-existing, unrelated test-suite failures due to a jest/ESM teardown issue reproduced identically on unmodified main with Node 24 — out of scope for this fix)

[Copilot]

Pull request overview

This PR addresses npm audit --audit-level=high failures in the basic-validation.yml workflow by updating direct and transitive Node dependencies, and then refreshing generated artifacts (lockfile, bundled dist/ outputs, and .licenses cache) to match the new dependency graph.

Changes:

• Add an npm overrides rule to force patched brace-expansion versions for transitive dependencies.
• Upgrade fast-xml-parser (and its dependency tree) to versions that remediate the referenced security advisory.
• Regenerate package-lock.json, dist/* bundles, and .licenses/npm/* entries to align with updated dependencies.

Reviewed changes

Copilot reviewed 10 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Adds overrides to ensure patched brace-expansion is used in the dependency tree.
package-lock.json	Updates resolved dependency versions (notably brace-expansion and fast-xml-parser) and removes older nested vulnerable copies.
dist/setup/index.js	Rebuilt bundled output to incorporate updated dependencies and their security fixes.
dist/cache-save/index.js	Rebuilt bundled output to incorporate updated dependencies and their security fixes.
.licenses/npm/xml-naming-0.3.0.dep.yml	Adds license metadata for newly introduced xml-naming@0.3.0.
.licenses/npm/xml-naming-0.1.0.dep.yml	Normalizes metadata formatting to match the refreshed license cache.
.licenses/npm/path-expression-matcher.dep.yml	Updates recorded version to match the new dependency tree.
.licenses/npm/is-unsafe.dep.yml	Updates recorded version to match the new dependency tree.
.licenses/npm/fast-xml-parser.dep.yml	Updates recorded version to match the new dependency tree.
.licenses/npm/concat-map.dep.yml	Removes license metadata for a dependency no longer present in the tree.
.licenses/npm/brace-expansion.dep.yml	Updates recorded version to match the new dependency tree.
.licenses/npm/brace-expansion-1.1.15.dep.yml	Removes license metadata for a dependency no longer present in the tree.
.licenses/npm/balanced-match.dep.yml	Adds license metadata for the updated balanced-match version in the tree.
.licenses/npm/balanced-match-1.0.2.dep.yml	Removes license metadata for a dependency no longer present in the tree.
.licenses/npm/@nodable/entities.dep.yml	Updates recorded version to match the new dependency tree.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.