Fix all Dependabot security alerts (npm audit fix)

[DominicBM]

Summary

Runs `npm audit fix` to resolve all 14 open Dependabot alerts. Only `thumbnailer/package-lock.json` is changed — no direct dependency versions in `package.json` were modified.

Critical (resolved):

• `fast-xml-parser` — entity encoding bypass via regex injection in DOCTYPE, entity expansion DoS, eval bypass (×3 CVEs)
• `@aws-sdk/*` chain — cascading alerts via `fast-xml-parser` and `@smithy/config-resolver`
• `form-data` — unsafe random function for boundary generation

High (resolved):

• `axios` — SSRF vulnerability, DoS via `proto` key in mergeConfig, DoS via missing data-size check

Low (resolved):

• `@smithy/config-resolver` — defense-in-depth region parameter validation

Test plan

• CI passes
• Confirm `npm audit` reports 0 vulnerabilities after merge

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• thumbnailer/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 509d0f2c-6c46-4a58-808d-b3a719cd0d0f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}