chore: fix dependency vulnerabilities (28 -> 8, all highs resolved)

[jbujula]

Summary

• Resolves all 9 high-severity npm-audit findings and the open Dependabot alerts across transitive dev/runtime dependencies.
• npm audit: 28 → 8 total (remaining 8 are documented accepted-risk / deferred — see below).
• S360/ADO query skipped this run (az devops not authenticated for the dynamicscrm org); fix plan derived from Dependabot + npm audit.

Dependencies updated

Package	Before	After	Strategy	Source
serialize-javascript	^7.0.3	^7.0.5	bump override	Dependabot #179 + npm
postcss	^8.4.31	^8.5.15	bump override	Dependabot #173 + npm
qs	^6.14.2	^6.15.2	bump override	Dependabot #180 + npm
basic-ftp	^5.3.0	^6.0.1	bump override	npm audit
tmp	0.2.5	^0.2.7	new override	Dependabot #181 + npm
undici	6.23.0	^6.24.0	new override	Dependabot #152/153/156 + npm
defu	6.1.4	^6.1.7	new override	npm audit
flatted	3.4.1	^3.4.2	new override	npm audit
form-data	2.5.5	^2.5.6	new override	npm audit
ip-address	10.1.0	^10.2.0	new override	npm audit
js-yaml	4.1.1	^4.2.0	new override	npm audit
lodash	4.17.23	^4.18.1	new override	npm audit
picomatch (under tinyglobby)	4.0.3	^4.0.4	scoped override	Dependabot #161 + npm
uuid (under tfx-cli)	13.0.0	^13.0.1	scoped override	Dependabot #174 + npm
tar	^7.5.11	^7.5.16	direct dep bump	npm audit
follow-redirects	1.15.11	1.16.0	lock-file patch	Dependabot #170 + npm

Why scoped/lock-patch: picomatch and uuid each have an inBundle sibling (picomatch 2.3.2, uuid 3.4.0) that must not be force-upgraded, so scoped overrides target only the vulnerable nested copies. follow-redirects is inBundle via the bundled cli-wrapper subtree, so an override cannot reach it — patched directly in package-lock.json to 1.16.0.

Known limitations / follow-ups

• uuid 3.4.0 (runtime, Dependabot Deploy Package Task fail #178 / moderate) — bundled inside azure-pipelines-task-lib (requires uuid ^3.0.1). Fixing needs uuid v3→v11 (breaking API) and the package is bundled in the VSIX, so an override cannot reach it. Must be fixed upstream in azure-pipelines-task-lib. Deferred.
• elliptic chain (browserify-sign, create-ecdh, crypto-browserify, node-libs-browser, rewiremock) — known permanent accepted risk (GHSA-848j-6mx2-7j84, LOW), dev-only, no patched version.

Test plan

• npm install clean
• npm audit — 28 → 8 (all highs resolved; remaining are documented accepted-risk/deferred)
• npm run ci — compile (32 tasks) + lint + restore pass. unitTest fails locally only on Node 24 (ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX, native TS strip vs CJS ts-node/register) — reproduces identically on clean main; CI runs Node 20 where it passes. Not a regression.

🤖 Generated with Claude Code