Fix dependency security vulnerabilities

[MarceloRGonc]

Fixes OPS-4380

Direct dependency updates:

• uuid: 10.0.0 → 11.1.1 (fixes medium-severity buffer bounds check issue)
• @playwright/test: 1.52.0 → 1.60.0 (fixes high-severity SSL cert verification bypass)
• postcss-url: 8.0.0 → 10.1.4 (fixes 2 moderate postcss vulnerabilities)

Removed unnecessary dependency:

• npm: removed from package.json — the Dockerfile and CI use the system npm bundled with Node.js. This eliminates 3 vulnerabilities (brace-expansion, picomatch, ip-address) that were bundled inside it.

Added npm overrides for transitive vulnerabilities:

• js-cookie: forced to 3.0.7 (high-severity prototype hijack, transitive from @segment/analytics-next and react-use)
• ws: forced to 8.20.1 (medium-severity memory disclosure, transitive from socket.io/jsdom)
• axios: forced to root version via $axios (medium-severity CRLF injection, transitive from nx)
• uuid: forced to root version via $uuid (ensures all transitive copies use patched 11.1.1)

[linear]

OPS-4380

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates JavaScript dependencies to address reported security vulnerabilities (OPS-4380) by bumping several direct deps, removing the npm package dependency, and enforcing patched versions of select transitive packages via npm overrides.

Changes:

• Bumped direct dependencies: uuid, @playwright/test (and playwright), and postcss-url.
• Removed the npm package dependency from package.json / package-lock.json.
• Added npm overrides to force patched transitive versions (js-cookie, ws) and align transitive axios/uuid with root versions.

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated 2 comments.

File	Description
package.json	Removes npm, bumps direct deps, and adds overrides for vulnerable transitive packages.
package-lock.json	Regenerates lockfile to reflect removed npm, upgraded direct deps, and applied override resolutions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MarceloRGonc]

Our codebase never uses useCookie from react-use. It only imports:

• useEffectOnce
• useDeepCompareEffect
• usePrevious
• useMeasure
• useUpdateEffect

None of these touch js-cookie. The js-cookie dependency in react-use is only used by its useCookie hook, which we don't import.

[MarceloRGonc]

I will handle it in another PR