security: fix CRITICAL/HIGH handlebars/axios/fast-uri alerts (non-breaking)

[mayurrawte]

Summary

Fixes all CRITICAL/HIGH (and incidental moderate) Dependabot alerts using non-breaking, same-major bumps and transitive overrides only. No source changes — only package.json + package-lock.json.

npm audit after the change: 0 vulnerabilities (was 1 critical, 5 high, 2 moderate locally; default branch shows 1 critical / 14 high / 16 moderate / 2 low). Build passes (npm run build).

Packages changed (old → new)

Package	Old	New	How	Severity fixed
axios	^1.9.0 (1.15.2)	^1.17.0	direct dep bump	HIGH: header injection / prototype-pollution gadgets, NO_PROXY loopback & IPv4-mapped IPv6 bypass, read-side credential gadgets, MITM via config.proxy, credential theft via config merge, CRLF in multipart, SSRF
handlebars	4.7.8	^4.7.9	override (transitive via ts-jest)	CRITICAL AST type-confusion JS injection; HIGH @partial-block tampering, object-as-dynamic-partial, CLI precompiler unescaped names
flatted	3.3.3	^3.4.2	override (transitive via eslint→flat-cache)	HIGH prototype pollution via parse(), DoS
fast-uri	3.1.0	^3.1.2	override (transitive via ajv)	HIGH path traversal via percent-encoded dot segments, host confusion via percent-encoded authority delimiters
minimatch	^10.2.2 (override)	^10.2.5	override bump	HIGH ReDoS matchOne, nested extglob backtracking
picomatch	2.3.1 / 4.0.3	2.3.2 / 4.0.4	nested overrides	HIGH ReDoS via extglob quantifiers, POSIX class method injection (incidental, dev/test-only chain)

picomatch uses nested overrides (4.0.4 for tinyglobby/fdir, 2.3.2 for anymatch/micromatch/jest-util) because the two consumer trees pin different major ranges; this keeps every consumer on its own patched same-major version.

DEFERRED

None. All listed CRITICAL/HIGH targets (handlebars, axios, fast-uri, minimatch, flatted) were fixed with non-breaking changes. No major bumps were required, so nothing is deferred.

Notes

• Repo's default branch is develop (there is no main); PR targets develop accordingly.
• 4 test suites fail to compile, but this is pre-existing on develop (TypeScript test/API mismatch: setLocation, createCollectionItem, getCollection, deleteCollectionItem not on ShipthisAPI) and is unrelated to these dependency changes.