[Improvement]: Warn against breaking changes from 'npm audit fix --force' in TG-SUPPLY-002

[githubmofo]

🔍 Rule ID

TG-SUPPLY-002 (Vulnerable Dependency Review)

❓ What is the problem?

During v0.3.0 NodeGoat validation tests, running npm audit fix --force caused major version jumps across core packages (e.g., Express 4 to 5, MongoDB driver v2 to v6). This broke runtime behavior and crashed the application.

🎯 Expected Behavior

The remediation guidance should clearly advise developers against blind --force upgrades in production projects.

💡 Suggested Fix

Update rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md:

• Emphasize that automated fixes should only apply non-breaking minor/patch updates (npm audit fix).
• Advise manual refactoring and regression testing for any major-version CVE remediations.