chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 6 open Dependabot security alerts by upgrading npm (via override) to 11.18.0, which bundles patched versions of all affected transitive dependencies

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#118	tar	medium	Bundled via npm@11.18.0 (7.5.13 -> 7.5.19)
#120	undici	medium	Bundled via npm@11.18.0 (6.25.0 -> 6.27.0)
#121	undici	low	Bundled via npm@11.18.0 (6.25.0 -> 6.27.0)
#122	undici	low	Bundled via npm@11.18.0 (6.25.0 -> 6.27.0)
#124	@sigstore/core	medium	Bundled via npm@11.18.0 (3.2.0 -> 3.2.1)
#125	@sigstore/verify	medium	Bundled via npm@11.18.0 (3.1.0 -> 3.1.1)

Notes

All 6 vulnerable packages were bundled inside npm@11.14.1 (which is a dependency of @semantic-release/npm@13.1.5). Standard overrides entries cannot reach into npm's bundled dependencies. Overriding npm itself to 11.18.0 causes npm to install a newer version of itself with all the patched bundled packages.

[Copilot]

Pull request overview

This PR aims to resolve multiple Dependabot security alerts by upgrading npm (via overrides) so that patched versions of vulnerable transitive/bundled dependencies are installed.

Changes:

• Updated overrides to force npm@11.18.0 (to pick up patched bundled dependencies).
• Added additional overrides for affected packages (@sigstore/*, undici, tar) and updated package-lock.json accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds/updates overrides to pin npm and related vulnerable transitive dependencies.
package-lock.json	Reflects the updated npm version and associated bundled/transitive dependency updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.