chore(deps): pin the vulnerable transitives instead of bumping majors

[Utzig26]

Closes the eight open advisories GitHub reports on every push.

Stacked on #200.

What they were

All eight were denial of service in glob, YAML and schema parsing libraries pulled in transitively:

	Package	Vulnerable	Pinned to
high	minimatch	9.0.3	^9.0.7
high	picomatch	4.0.1	^4.0.4
moderate	ajv	8.12.0	^8.18.0
high	js-yaml	5.2.1	^5.2.2
high	brace-expansion	5.0.8	^5.0.9

Why overrides and not npm audit fix --force

npm's suggestions were downgrades. It offered to take @nestjs/cli from 11 to 6.8.1 and jest from 29 to 25, both flagged isSemVerMajor. Pinning the patched version within the same major line closes the same advisories without touching the toolchain.

Each override is range scoped, so only the vulnerable instances move. ajv@6.15.0 under eslint 8 stays where it is rather than being dragged to 8.x.

The production tree is clean

$ npm audit --omit=dev
found 0 vulnerabilities

$ npm ls brace-expansion --omit=dev --all
chess-api@0.0.1
└── (empty)

What is left, and why

33 findings against brace-expansion 1.1.18 and 2.1.4. Those are the newest releases of their lines, so there is nothing to pin to.

The first attempt overrode them to 5.0.9 and broke eslint:

Oops! Something went wrong! :(
ESLint: 8.57.1
TypeError: expand is not a function

The fifth major changed the export shape, and minimatch@3 — which eslint 8 depends on — calls it as a function. The override is now scoped to the 5.0.x line and the older instances are left alone. They reach only eslint, jest and the nest CLI, none of which ship.

Clearing them for real means eslint 8 → 10, which is a flat config migration and belongs in its own change.

Verification

Lint, strict typecheck, nest build, 99 unit and 82 end-to-end tests all green after the pins. The eslint break above is exactly why the build was run rather than trusting the audit number.