Fix npm security vulnerabilities

[ditto-integrations]

Summary

• engine.io → 6.6.7 (CVE-2026-59725)
• brace-expansion → 5.0.7 (CVE-2026-13149)

Refs: SPO-1151

Workflow run

Note: Target versions are sourced from Tines and may not always
reflect the latest or most appropriate release (e.g. a version may
be deprecated upstream). Please verify that the resolved versions
in lockfiles are suitable.

Test plan

• CI passes
• No new high/critical vulnerabilities in affected lockfiles
• Affected SDK/component builds successfully

Generated by Tines + Claude Code

[Copilot]

Pull request overview

This PR updates npm dependency resolutions to address reported security vulnerabilities by pinning patched versions via overrides and updating the affected lockfiles accordingly.

Changes:

• Pin engine.io to 6.6.7 via root package.json overrides and update package-lock.json to resolve engine.io@6.6.7 (and related dependency shifts like @types/ws / debug / ws ranges).
• Pin brace-expansion to 5.0.7 in the Vite TypeScript example via overrides and update its lockfile to resolve brace-expansion@5.0.7 in the affected subtree.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Adds an overrides pin for engine.io@6.6.7 (alongside existing override pins).
package-lock.json	Updates resolved dependency graph to include engine.io@6.6.7 and related nested updates (e.g., @types/ws, debug).
examples/vite-typescript-example/package.json	Adds an overrides rule to force brace-expansion@^5.0.2 to 5.0.7 for the example app.
examples/vite-typescript-example/package-lock.json	Updates resolved brace-expansion version to 5.0.7 in the impacted dependency subtree.

Files not reviewed (1)

• examples/vite-typescript-example/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.