Fix npm dependency vulnerabilities

[manuelpuyol]

Summary

• upgrade @web/test-runner from ^0.20.0 to ^1.0.0, pulling in the patched Chrome runner and Puppeteer dependency chain
• remove the vulnerable extract-zip path by upgrading to @puppeteer/browsers 3.x
• update vulnerable transitive dependencies to patched releases: js-yaml 4.3.2, nanoid 3.3.18, and qs 6.16.0

Advisories fixed

• extract-zip symlink path traversal/arbitrary file write (GHSA-jmr9-qjv8-65gv, GHSA-7pqw-9j4j-h8q3)
• js-yaml merge-key CPU denial of service (GHSA-2883-xcg3-v3hh)
• nanoid infinite-loop/integer overflow advisories (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w)
• qs denial-of-service advisories (GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g)

Validation

• npm ci --registry=https://registry.npmjs.org/
• CI=true npm test
• npm run build
• npm audit --json — 0 vulnerabilities

[Copilot]

Copilot review overview

🟡 Changes recommended

The Node setup is incompatible with the upgraded toolchain, and lockfile integrity hashes were weakened to SHA-1.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	package.json — Align the repository setup action with the new Node requirement View comment

What changed in this PR

Upgrades the browser test toolchain and patches vulnerable transitive dependencies.

Changes:

• Upgrades @web/test-runner to 1.x.
• Updates Puppeteer and vulnerable transitive packages.

File	Description
package.json	Upgrades the test runner.
package-lock.json	Refreshes the dependency graph and patched versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.