Clear dependabot alerts via npm overrides

[skearnes]

Summary

Clears all 23 open dependabot alerts (12 high, 10 moderate, 1 low) in the Vue SPA's npm tree.

Approach: add an overrides block in app/package.json pinning four transitive packages to their patched versions, and regenerate app/package-lock.json via npm install.

Why overrides instead of npm audit fix --force

npm audit fix --force would have downgraded @vue/cli-plugin-eslint from ^5.0.9 to 3.12.1 — a major regression of the build toolchain. The underlying problem is that @vue/cli v5 (the latest, in maintenance mode) still pins outdated versions of webpack-dev-server, copy-webpack-plugin, and friends. Overrides force-patch those transitives without touching vue-cli itself.

Overrides

Package	Pinned to	Fixes
cross-spawn	^7.0.6	ReDoS in cross-spawn reached via execa → yorkie
postcss	^8.5.10	Line-return parsing error + XSS via unescaped </style> in CSS stringify
serialize-javascript	^7.0.5	RCE via RegExp.flags and Date.prototype.toISOString; CPU-exhaustion DoS
webpack-dev-server	^5.2.1	Cross-origin source-code theft (two CVEs)

The serialize-javascript fix cascades to copy-webpack-plugin and css-minimizer-webpack-plugin; the postcss fix cascades to @vue/component-compiler-utils and vue-loader.

All four packages are dev-only or build-only — none ship in the production bundle that gets served to users, so the immediate risk surface was already limited to local development.

What's not touched

@vue/cli-service itself stays on ~5.0.0. A full move off vue-cli (e.g. to Vite via create-vue) would clear the few remaining root-cause warnings, but is a much larger migration belonging in its own PR.

Documentation

README.md now includes a short Frontend dependencies section pointing future readers at the overrides block, why it exists, and the eventual exit ramp (vue-cli → Vite).

Test plan

• cd app && npm install resolves the new tree cleanly (165 packages funding)
• cd app && npm ci reproduces the tree from package-lock.json and reports 0 vulnerabilities
• cd app && npm audit reports 0 vulnerabilities
• cd app && npm run build produces a working dist/ bundle (verified locally with Ketcher v2.5.1 extracted to src/ketcher)
• cd app && npm run serve boots the dev server at http://localhost:8080/ (200 OK on /), confirming webpack-dev-server@5 doesn't break vue-cli's internal devServer config — the proxy option in vue.config.js is the only configured devServer field, and it's stable across webpack-dev-server 4→5
• CI test_app workflow exercises the same build inside Docker and should pass

🤖 Generated with Claude Code

[skearnes]

Superseded by #176, which migrates the SPA from @vue/cli to Vite and clears the same 23 dependabot alerts at the root rather than via transitive overrides. With #176 in place this PR's overrides block becomes dead code.