chore: resolve high-severity frontend dependency alerts

documentation/release-notes/13.x.x/13.42.0/README.md

@@ -28,3 +28,7 @@
   face value, which allowed any signed-in user to make the server load arbitrary internal parts of the
   application. Only the resource types that can be selected under **Access control** are accepted now, and
   anything else is answered as "not permitted", so normal use is unaffected.
+* Addressed several reported high-severity front-end security alerts. The `js-yaml`, `fast-uri`, `ip-address`,
+  `postcss` and `brace-expansion` dependencies were updated to fixed versions. The remaining alerts cannot be
+  resolved without a major upgrade: the Swagger UI `immutable` fix requires Node 22, and the Angular alerts require the
+  next major Angular version. Both remain tracked.

frontend/package.json

@@ -350,6 +350,9 @@
   },
   "overrides": {
     "swagger-client": "3.37.3",
+    "swagger-ui": {
+      "js-yaml": "4.3.1"
+    },
     "feelers": {
       "@bpmn-io/cm-theme": "0.1.0-alpha.2"
     },
@@ -359,6 +362,10 @@
     "sigstore": "4.1.1",
     "lodash": "4.18.1",
     "lodash-es": "4.18.1",
+    "postcss": "8.5.26",
+    "minimatch@9": {
+      "brace-expansion": "2.1.4"
+    },
     "@angular-devkit/build-angular": {
       "http-proxy-middleware": "3.0.7"
     },