fix(ENG-2103): pin the antigravity Defender transitive deps

[glebedel]

Closes all 11 open Dependabot alerts on this repo.

Cause

Every alert is in one file — plugins/security/stackone-defender-antigravity/package-lock.json. That copy of Defender ships an empty "overrides": {}, while plugins/security/stackone-defender already pins the same five packages and has zero alerts. The fix is to copy those pins across and regenerate the lockfile.

Resolved

Severity	Package	Was	Now
critical	tar	≤ 7.5.18	7.5.21
high	tar	≤ 7.5.17, ≤ 7.5.20	7.5.21
high	nanoid	< 3.3.16, < 3.3.18	3.3.18
high	sharp	< 0.35.0	0.35.0
high	adm-zip	< 0.6.0	0.6.0
medium	protobufjs	≤ 7.6.2, ≤ 7.6.4	7.6.5
medium	tar	≤ 7.5.16, ≤ 7.5.17	7.5.21

All transitive, pulled in through @huggingface/transformers and onnxruntime-node.

Out of scope, deliberately

@stackone/defender stays at ~0.7.0 here versus 0.8.2 in the main plugin. That is a functional version difference, not a security fix, so bumping it does not belong in a dependency-hygiene PR.

Verified

• Lockfile scanned: no remaining resolution of any flagged package below its patched version.
• npm test in the antigravity plugin: 12/12 pass.
• claude plugin validate . passes.

Diff is the 5 overrides lines plus the regenerated lockfile; indentation of package.json left untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LHqJgp9mMhn3gCfBrkRS3o

---

Summary by cubic

Pins transitive dependencies in stackone-defender-antigravity to patched versions, closing all 11 open Dependabot alerts on this repo.

The antigravity plugin's lockfile had an empty overrides block, leaving vulnerable versions of five packages pulled in through @huggingface/transformers and onnxruntime-node. The same pins already exist in the main stackone-defender plugin, so this copies them over and regenerates the lockfile.

Dependencies

• Pins adm-zip, nanoid, protobufjs, sharp, and tar to patched versions.
• sharp 0.35.0 raises the required Node engine from ^18.17.0 to >=20.9.0.
• @stackone/defender stays at ~0.7.0; a version bump there is a functional change, not a security fix.

^{Written for commit 7183f83. Summary will update on new commits.}

[Copilot]

Pull request overview

Pins vulnerable transitive dependencies for the stackone-defender-antigravity plugin using npm overrides, then regenerates the lockfile so resolved package versions are updated and Dependabot alerts are cleared.

Changes:

• Add npm overrides to pin adm-zip, nanoid, protobufjs, sharp, and tar to patched versions.
• Regenerate package-lock.json to reflect the new resolved dependency graph (including updated sharp platform packages and related dependency bumps).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
plugins/security/stackone-defender-antigravity/package.json	Adds overrides to pin vulnerable transitive packages to patched versions.
plugins/security/stackone-defender-antigravity/package-lock.json	Updates resolved versions in the lockfile to match the new overrides and refreshed dependency tree.

Files not reviewed (1)

• plugins/security/stackone-defender-antigravity/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cubic-dev-ai]

No issues found across 2 files

<sub>Requires human review: Pins vulnerable transitive dependencies and regenerates the lockfile, but the sharp 0.35.0 override raises the required Node engine from Node 18/20.3 to >=20.9, a compatibility tradeoff that needs human sign-off.

Re-trigger cubic</sub>