fix(FFESUPPORT-750): address open Dependabot vulnerabilities

[aarsilv]

Summary

• Updates Node relay/testing lockfiles and Yarn resolutions for the vulnerable transitive packages.
• Updates symfony/cache and related Composer packages in the PHP relay lockfile.
• Adds ws coverage in the React Native relay because the refreshed audit surfaced the same moderate ws advisory through Expo/jsdom tooling.

Dependabot alerts addressed

• symfony/cache advisories in package-testing/php-sdk-relay/composer.lock, updated to 6.4.41.
• qs GHSA-q8mj-m7cp-5q26, patched in 6.15.2.
• brace-expansion npm advisory 1119088 / GHSA-v6h2-p8h4-qcjw, patched in 5.0.6 where affected.
• fast-uri GHSA-v39h-62p7-jpjc and GHSA-q3j6-qgpj-74h6, patched in 3.1.2.

Verification

• yarn install --frozen-lockfile at repo root.
• yarn validate:tests
• yarn obfuscate:ufc
• yarn build in package-testing/testing-api
• yarn install --frozen-lockfile and yarn audit --level moderate in each touched Node package directory.
• yarn build and yarn test eppoClientProxy in package-testing/node-sdk-relay.
• yarn test --watchAll=false in package-testing/react-native-sdk-relay.
• composer install --no-interaction and composer audit in package-testing/php-sdk-relay.

Note: the full package-testing/node-sdk-relay Jest suite still fails in the existing app.controller bootstrap path because importing app.controller imports main and starts the Nest app during unit test collection; the dependency-focused eppoClientProxy test passes.

🤖 Generated with Codex

[Copilot]

Pull request overview

Updates dependency lockfiles and Yarn/Composer overrides across the relay test packages to remediate Dependabot-reported transitive vulnerabilities (Node/Yarn and PHP/Composer).

Changes:

• Bumps transitive Node dependencies in Yarn lockfiles (e.g., qs, brace-expansion, fast-uri, ws) and adds targeted resolutions where needed.
• Updates PHP relay Composer lockfile to newer Symfony cache-related packages.
• Adds additional Yarn resolutions in the React Native relay to address ws surfaced by refreshed audits.

Reviewed changes

Copilot reviewed 3 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package-testing/testing-api/yarn.lock	Updates transitive Node packages (e.g., brace-expansion, qs) to patched versions.
package-testing/testing-api/package.json	Adds Yarn resolutions to force patched qs.
package-testing/react-native-sdk-relay/yarn.lock	Updates transitive packages (e.g., brace-expansion, fast-uri, ws) to patched versions.
package-testing/react-native-sdk-relay/package.json	Adds Yarn resolutions for fast-uri and ws.
package-testing/php-sdk-relay/composer.lock	Updates Symfony cache stack and related packages in the lockfile.
package-testing/node-sdk-relay/yarn.lock	Updates transitive packages (e.g., brace-expansion, fast-uri, qs) to patched versions.
package-testing/node-sdk-relay/package.json	Adds Yarn resolutions for fast-uri and qs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 7 changed files in this pull request and generated 2 comments.

[aarsilv]

🤖 Response from AI: Resolved in the current head by adding explicit resolutionRationales metadata for the react-native relay overrides instead of adding fake package patterns inside resolutions. Strict install and audit pass.

[aarsilv]

🤖 Response from AI: Resolved in the current head by adding resolutionRationales for uuid, fast-uri, and qs while keeping resolutions limited to actual package selectors. Strict install and audit pass.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 7 changed files in this pull request and generated no new comments.

[aarsilv]

🤖 Context from Codex: This updates vulnerable Node relay/test package transitives plus the PHP relay Symfony cache stack. Validation covered root yarn validate:tests, yarn obfuscate:ufc, strict installs/builds/audits for affected JS fixtures, React Native Jest, and composer audit. The full node-sdk-relay suite still hits the pre-existing app.controller bootstrap path, so I verified the dependency-sensitive eppoClientProxy test directly. Copilot is clean.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 12 changed files in this pull request and generated 1 comment.