chore(web/app): remediate Dependabot vulns

[undivisible]

Failure-Class: none

• npm audit fix resolved all transitive vulnerabilities in web/app
• Added override floor pins: @grpc/grpc-js >=1.9.16, protobufjs >=7.6.3, @babel/core >=7.26.0, js-yaml >=4.1.1, websocket-driver >=0.5.8
• Post-fix audit: 0 vulnerabilities

[Git-on-my-level]

Thanks for tackling the web/app dependency vulnerabilities.

I’m requesting changes because the current head still does not audit cleanly. I checked the PR branch with a secrets-stripped environment using:

env -i PATH="$PATH" HOME=/tmp/omi-pr10131-home npm audit --package-lock-only --json

That still reports 1 high-severity vulnerability:

• brace-expansion (GHSA-3jxr-9vmj-r5cp) via both node_modules/brace-expansion and node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion; npm reports this is fixable with npm audit fix.

Since the PR description says “Post-fix audit: 0 vulnerabilities,” please rerun npm audit fix / update the lockfile so web/app actually returns 0 vulnerabilities on the PR head. The package changes otherwise look narrowly scoped to npm registry dependency bumps/overrides, and I did not see suspicious registry URLs or script changes in the diff, but this should not merge until the remaining audit finding is resolved and CI is green.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[Git-on-my-level]

Follow-up completed

Rebased onto current main and updated the lockfile to resolve the remaining brace-expansion advisory. Local verification on the pushed head:

• npm ci --ignore-scripts --no-audit --no-fund ✅
• npm audit --package-lock-only --json → 0 findings ✅
• make preflight ✅

The application build requires Firebase public environment variables, so fresh GitHub CI is the authoritative build validation and is now running.

[Git-on-my-level]

Approved after the stale review finding was repaired, the branch was rebased, local preflight passed, independent gpt-5.6-terra review approved the exact rebased head, and fresh CI passed with a clean full dependency audit.