Fix Snyk vulnerabilities in direct dependencies

[peyman-mashhadi]

Summary

• Upgrade axios 1.13.5 → 1.15.0 (fixes 1 Critical + 1 High: Confused Deputy, HTTP Response Splitting)
• Upgrade dompurify 3.2.4 → 3.3.2 (fixes 5 Medium: XSS, Prototype Pollution, Permissive Inputs)
• Upgrade immutable 4.2.2 → 4.3.8 (fixes 1 Critical: Prototype Pollution)
• Upgrade lodash 4.17.23 → 4.18.1 (fixes 1 High + 1 Medium: Code Injection, Prototype Pollution)

All upgrades are backward compatible (patch/minor semver bumps, no breaking changes).

Resolves 10 of 14 Snyk vulnerabilities. The remaining 4 are transitive (follow-redirects, qs, socket.io-parser, yaml) and require upstream package updates.

Ref: 131658

Test plan

• npm install succeeds
• npm run build — all 18 bundles compile without errors
• snyk test confirms 10 vulnerabilities resolved (14 → 4 remaining)
• Smoke test webchat widget in browser

🤖 Generated with Claude Code

[graymalkin77]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR updates a set of direct npm dependencies to address Snyk-reported vulnerabilities, keeping the lockfile aligned so CI (npm ci) installs deterministically.

Changes:

• Bump axios to ^1.15.0 and update its resolved lockfile entries (including proxy-from-env).
• Bump dompurify to 3.3.2 and refresh lockfile metadata (incl. engines/license fields from upstream).
• Bump immutable to ^4.3.8 and lodash to ^4.18.1, updating corresponding lockfile resolutions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates direct dependency version specs to the intended patched/minor releases.
package-lock.json	Synchronizes resolved versions/integrity for the bumped dependencies to keep npm ci consistent.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.