chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 9 open Dependabot security alerts by bumping vulnerable dependencies across npm and rubygems manifests.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#284, #282, #276	axios	high / low	Bumped direct dep 1.15.2 -> 1.16.0 in package.json
#285, #283, #277	axios	high / low	Resolved via lockfile (yarn.lock) to 1.16.0
#275	tmp	high	Added resolution tmp@^0.2.3 -> ^0.2.6 (resolves to 0.2.7)
#286, #287	puma	high	Bumped 6.6.0 -> 7.2.1 in proxies/ruby/Gemfile.lock

Verification

• yarn install regenerated the lockfile; confirmed axios@npm:1.16.0 and tmp@npm:0.2.7 resolve.
• yarn test:unit passes (5/5).
• puma 7.2.1 keeps the same single runtime dep (nio4r ~> 2.0); the Ruby proxy Docker image uses Ruby 3.4, which satisfies puma 7.x.

[Copilot]

Pull request overview

This PR resolves a set of Dependabot security alerts by upgrading vulnerable dependencies in the Node.js (Yarn) and Ruby (Bundler) manifests/lockfiles used by the test harness and its proxies.

Changes:

• Bumped axios to 1.16.0 in package.json and updated yarn.lock accordingly.
• Added a Yarn resolutions override to force tmp to a non-vulnerable range (locking to 0.2.7).
• Upgraded Ruby proxy server dependency puma to 7.2.1 in proxies/ruby/Gemfile.lock.

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Updates axios and adds a tmp resolution to address security alerts.
yarn.lock	Regenerates lock entries to resolve axios@1.16.0 and tmp@0.2.7.
proxies/ruby/Gemfile.lock	Bumps puma to 7.2.1 to remediate Ruby-side alerts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.