chore: weekly dependency security refresh (clears remaining 4 highs, GHSA-2v37-7h3g-55p8)

[Jayanth Reddy Bujula (jbujula)]

Opened by hand from the branch that a manual run of the weekly automation (#507) pushed. The workflow could not open it itself - that is what #517 fixes.

Run: https://github.com/microsoft/powerplatform-cli-wrapper/actions/runs/31760930838

What this changes

package-lock.json only. No package.json change, so no dependency range moved - this is purely a lock refresh within ranges that were already declared.

Why it matters

This clears all 4 remaining HIGH advisories in the repo, which were a single dev-only chain:

gulp-sourcemaps -> @gulp-sourcemaps/identity-map -> postcss -> nanoid

	main	this PR
nanoid	3.3.17	3.3.18
postcss	8.5.25	8.5.26

The root advisory is GHSA-2v37-7h3g-55p8 (nanoid < 3.3.18); the other three were all reported purely via it.

npm audit previously suggested "fix" was gulp-sourcemaps@2.6.5, a semver-major downgrade. That was never the right answer - the real fix was always just nanoid >= 3.3.18. The existing override was already ^3.3.17, so the caret admitted the fix all along; 3.3.18 simply was not mirrored on packagefeedproxy.microsoft.io yet, which is why #506 documented it as not-yet-fixable. The mirror has since synced.

After this, the repo should be at 0 critical / 0 high / 0 moderate, with only the 6 known dev-only lows (elliptic chain) remaining.

Verification

All workflow steps passed before the PR step:

• npm ci
• npm update
• scripts/audit-overrides.js --write - no range needed raising
• Build and test - passed (Node 16, matching PullRequest.yml)

Why this was opened manually

The final step failed with:

pull request create failed: GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest)

That is the org/repo policy Settings > Actions > General > "Allow GitHub Actions to create and approve pull requests", not a workflow bug. The branch push succeeded; only PR creation was refused. #517 makes the workflow degrade gracefully so a future weekly run surfaces an actionable link instead of a red X.

[Jayanth Reddy Bujula (jbujula)]

Re-verified today (Aug 17) — still current, still the right branch to merge.

The weekly job has run again since this was opened, so it is worth confirming this has not gone stale. It has not.

Security content is identical to today's run

Ref
origin/main	nanoid 3.3.17	postcss 8.5.25
this PR (...-20260814)	nanoid 3.3.18	postcss 8.5.26
today's ...-20260817	nanoid 3.3.18	postcss 8.5.26

Diffing this PR against today's branch, only 4 packages differ, all unrelated patch bumps:

1.0.12  -> 1.0.13   @tsconfig/node10
5.5.0   -> 5.5.1    default-browser
3.5.11  -> 3.5.12   json-with-bigint
2.0.11  -> 2.0.12   ohash

npm audit --package-lock-only on both: 0 critical / 0 high / 0 moderate, 6 known dev-only lows (elliptic chain).

Why this branch rather than the newer one

This PR has green CI. The 20260817 branch has no PR - the scheduled run could not open one (that is what #517 fixes), so nothing has ever been built or tested from it. Merging the reviewed, CI-verified branch is the safer path; those 4 cosmetic bumps get picked up by the next weekly run regardless.

Once this merges, bot/dependency-refresh-20260817 is stale against the new base and should be deleted rather than merged.

To restate what this clears: the 4 remaining HIGH advisories were one dev-only chain, gulp-sourcemaps -> @gulp-sourcemaps/identity-map -> postcss -> nanoid, rooted in GHSA-2v37-7h3g-55p8 (nanoid < 3.3.18). npm audit proposed gulp-sourcemaps@2.6.5, a semver-major downgrade, which was never the right fix - the existing ^3.3.17 override already admitted 3.3.18; it simply had not been mirrored on packagefeedproxy.microsoft.io at the time of #506.