fix: resolve npm audit vulnerabilities in samples/sampler

[hong6316]

Summary

Resolve direct dependency vulnerabilities reported by npm audit in samples/sampler by updating the shrinkwrap-locked versions via npm audit fix.

Changes

samples/sampler/npm-shrinkwrap.json

Updated direct dependency versions to resolve high-severity vulnerabilities:

Package	Before	After	Vulnerability Fixed
brace-expansion	1.1.15	1.1.18	DoS via exponential-time expansion (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
fast-uri	3.1.4	3.1.5	Host confusion via backslash authority (GHSA-v2hh-gcrm-f6hx, GHSA-7p8r-x3mc-p8w7, GHSA-4c8g-83qw-93j6)
js-yaml	4.3.0	4.3.1	Quadratic CPU in merge-key chains (GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj)
nanoid	3.3.17	3.3.18	Infinite loop with negative/zero size (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8)
postcss	8.5.22	8.5.26	Path traversal in source map auto-loading (GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849)

No changes to root package.json

All 19 root-level npm audit findings originate entirely from @enact/ui-test-utils@4.0.4 sub-dependencies, which are locked by the package's published npm-shrinkwrap.json. npm overrides cannot override dependencies pinned by a sub-module's own shrinkwrap file. @enact/ui-test-utils@4.0.4 is already the latest available version.

Remaining Unfixable Vulnerabilities

Root project (19 high)

All from @enact/ui-test-utils shrinkwrap:

• brace-expansion (11 instances)
• extract-zip / @puppeteer/browsers / @wdio/* chain
• fast-xml-parser, ip-address, js-yaml, undici

Sampler (13: 6 low + 7 high)

All from @enact/storybook-utils@8.0.2 shrinkwrap:

• brace-expansion (14 instances)
• elliptic / browserify-sign / crypto-browserify chain
• fast-uri, image-size/less, js-yaml, nanoid, postcss

These will resolve when the upstream packages (@enact/ui-test-utils, @enact/storybook-utils) publish new versions without a bundled shrinkwrap or with updated sub-dependencies.

Verification

• npm run lint -- -- --report-unused-disable-directives --max-warnings 0 . passes
• npm test -- --runInBand --coverage passes (62 suites, 644 tests)
• npm run validate-docs passes
• Node 20.20.2 compatible
• No production dependency vulnerabilities (npm audit --omit=dev = 0 vulnerabilities)

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

jenkins_swp seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.60%. Comparing base (daf0bd7) to head (5287c2d).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #872   +/-   ##
========================================
  Coverage    85.60%   85.60%           
========================================
  Files          118      118           
  Lines         4495     4495           
  Branches      1226     1225    -1     
========================================
  Hits          3848     3848           
  Misses         503      503           
  Partials       144      144           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.