chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Resolved 2 of 7 open Dependabot security alerts. The remaining 5 alerts are for github.com/docker/docker and currently have no patched version available upstream.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#190	js-cookie	high	Added npm override to >=3.0.7 in playground-app/package.json (transitive via react-use)
#189	github.com/containerd/containerd/v2	high	Bumped to v2.2.4 via go get + go mod tidy in test/integration/go.mod

Unresolvable Alerts

These Docker-related alerts in test/integration/go.mod (transitive via testcontainers-go) have no upstream patched version yet:

• Review Logging #184 (high): Docker PUT /containers/{id}/archive executes container binary on the host
• chore(main): release 0.2.3 #185 (medium): Docker race condition in docker cp allows creation of arbitrary empty files
• [FEATURE] Prometheus metric endpoint #186 (high): Docker race condition in docker cp allows bind mount redirection
• feat: improving the logo #151 (medium): Moby off-by-one error in plugin privilege validation
• feat: http unix socket support #152 (high): Moby AuthZ plugin bypass — advisory references 29.3.1 but no such release exists yet

[netlify]

✅ Deploy Preview for polite-licorice-3db33c canceled.

Name	Link
🔨 Latest commit	7bfda7e
🔍 Latest deploy log	https://app.netlify.com/projects/polite-licorice-3db33c/deploys/6a1f189c1b56700008424139

[gemini-code-assist]

Code Review

This pull request updates several dependencies, including an upgrade of js-cookie to version 3.0.7 in the playground app and minor version bumps for containerd and compress in the integration tests. A review comment suggests refining the js-cookie version override from a loose >=3.0.7 range to a safer ^3.0.7 caret range to avoid potential breaking changes from future major releases.

[toddbaert]

Can this override be avoided? Is there a transitive dep we can update?

[jonathannorris]

react-use is the only dep pulling in js-cookie, and it's a production dependency. The latest version (17.6.0) still requires js-cookie: ^2.2.1, so there's nothing to bump. That said, I don't think we're actually affected: the vulnerability only triggers when a JSON-derived object is passed as the attributes argument to Cookies.set or similar, and the playground only imports useMedia and useObservable from react-use. No cookie APIs are used. I'd lean toward dismissing the alert.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Resolves two Dependabot security alerts by updating vulnerable transitive dependencies in the integration test Go module and the playground app’s npm dependency graph, while documenting that remaining Docker/Moby advisories have no upstream fixes yet.

Changes:

• Bump github.com/containerd/containerd/v2 to v2.2.4 in test/integration/go.mod (with corresponding go.sum updates).
• Update Go transitive deps in the integration test module (klauspost/compress, hcsshim) as a result of the bump/tidy.
• Add an npm overrides rule to force js-cookie to ^3.0.7 and update package-lock.json accordingly.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

File	Description
test/integration/go.mod	Bumps containerd/containerd/v2 (and klauspost/compress) to address security alerts in the integration test dependency graph.
test/integration/go.sum	Syncs module checksums for the updated Go dependencies.
playground-app/package.json	Adds an npm override to force js-cookie to a patched version.
playground-app/package-lock.json	Locks js-cookie to 3.0.7 and records its metadata after applying the override.

Files not reviewed (1)

• playground-app/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jonathannorris]

Superseded by #1980 (on the canonical chore/dependabot-alerts branch), which carries the same containerd + js-cookie fixes. Closing to keep a single active dependabot PR.