fix: address CVE-2026-27904 (ReDoS in minimatch via nested extglobs)

[Copilot]

• Identified CVE-2026-27904 as GHSA-23c5-xmqv-rm74 - ReDoS in minimatch via nested *() extglobs (high severity)
• Updated package-lock.json with fixed minimatch versions (3.1.5, 9.0.9, 10.2.4)
• Added minimatch overrides to package.json to enforce patched versions
• Resolved merge conflicts with main branch — kept all security overrides from main (serialize-javascript, cookie, flatted, multer, qs, socket.io-parser, immutable, gatsby>webpack) plus our higher minimatch versions
• All tests pass, no high/critical vulnerabilities remain

Original prompt

There is a high severity cve-2026-27904 in the site directory of this repo. Please address this issue

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[mimiflynn]

@copilot fix merge conflicts

[Copilot]

@copilot fix merge conflicts

Merge conflicts resolved in 92a2424. The resolution keeps all security overrides from main (serialize-javascript, cookie, flatted, multer, qs, socket.io-parser, immutable, gatsby>webpack) while retaining the higher minimatch versions from this PR (3.1.5, 9.0.9, 10.2.4).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• unpkg.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node scripts/postinstall.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)