Fix high Dependabot vulnerabilities and add CODE_OF_CONDUCT.md

[Copilot]

Resolves the OSS compliance violations: 4 high-severity open Dependabot vulnerabilities (MUST) and a missing CODE_OF_CONDUCT.md (SHOULD).

Security

• Ran npm audit fix to patch high-severity advisories in transitive dependencies. Only package-lock.json is touched — no direct dependency versions or breaking upgrades.
  • brace-expansion — DoS via unbounded expansion
  • fast-uri — host confusion via backslash authority delimiter
  • shell-quote — quadratic-complexity ReDoS in parse()
• npm audit --audit-level=high now reports 0 high vulnerabilities.

Content

• Added CODE_OF_CONDUCT.md (Contributor Covenant v2.1), with the enforcement contact pointing at Trimble's existing Cybersecurity reporting form for consistency with SECURITY.md.

Out of scope

Remaining npm audit findings are all moderate (file-type, postcss) and only fixable via breaking major bumps (hugo-bin, out-of-range postcss). Left unchanged to avoid destabilizing the Hugo build; they fall outside the MUST (zero high/critical) requirement.

• Fixes 🚨 Policy Compliance Violation — Action Required #470

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[github-actions]

Super-linter summary

Language	Validation result
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter