chore: resolve high-severity frontend dependency alerts

documentation/release-notes/13.x.x/13.41.0/README.md

@@ -59,3 +59,10 @@
   Starting a building block from the 'Start' menu of a case did nothing when the start form of its
   main process is configured to be shown in a panel. The panel now opens right away. Previously it
   only appeared after first opening the start form of a regular process in the panel.
+
+## Security
+
+* Addressed the reported high-severity front-end security alerts. The `js-yaml`, `fast-uri`, `ip-address`,
+  `postcss` and `brace-expansion` dependencies were updated to fixed versions. The remaining alerts cannot be
+  resolved without a major upgrade: the Swagger UI fix requires Node 22, and the Angular alerts require the
+  next major Angular version. Both remain tracked.

frontend/package.json

@@ -350,6 +350,9 @@
   },
   "overrides": {
     "swagger-client": "3.37.3",
+    "swagger-ui": {
+      "js-yaml": "4.3.1"
+    },
     "feelers": {
       "@bpmn-io/cm-theme": "0.1.0-alpha.2"
     },
@@ -359,6 +362,10 @@
     "sigstore": "4.1.1",
     "lodash": "4.18.1",
     "lodash-es": "4.18.1",
+    "postcss": "8.5.26",
+    "minimatch@9": {
+      "brace-expansion": "2.1.4"
+    },
     "@angular-devkit/build-angular": {
       "http-proxy-middleware": "3.0.7"
     },