ci: sync shrinkwrap for Dependabot

[rebeccahum]

Description

This pull request introduces a new GitHub Actions workflow to automatically sync npm-shrinkwrap.json with package-lock.json on Dependabot PRs, and updates several dependencies and binary entries in npm-shrinkwrap.json. The workflow ensures consistency between lock files, while the dependency updates bring in the latest security and bug fixes.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/sync-shrinkwrap.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/sync-shrinkwrap.yml

[Copilot]

Pull request overview

Adds automation to keep npm-shrinkwrap.json aligned with package-lock.json on Dependabot PRs, and updates the shrinkwrap content accordingly so published installs remain consistent with CI.

Changes:

• Introduces a GitHub Actions workflow that copies package-lock.json to npm-shrinkwrap.json and pushes the result back to Dependabot PR branches.
• Updates npm-shrinkwrap.json to include new CLI bin entries and refreshed dependency resolutions (e.g., axios, ws, tar, form-data).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
npm-shrinkwrap.json	Syncs lockfile content (bin entries + dependency resolution updates) to match current package-lock.json.
.github/workflows/sync-shrinkwrap.yml	New workflow to auto-sync shrinkwrap on Dependabot PRs by committing/pushing the copied lockfile.

Files not reviewed (1)

• npm-shrinkwrap.json: Generated file

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• npm-shrinkwrap.json: Generated file

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• npm-shrinkwrap.json: Generated file