[Copilot]

Trivy flagged multiple HIGH CVEs on axios@0.21.4 in the client dependency graph. This PR removes all 0.21.4 references from the client lock graph by upgrading Axios and eliminating the transitive source that kept the vulnerable version pinned.

• Dependency remediation

  • Upgraded client direct dependency from axios@^0.21.1 to axios@1.18.1.
  • Added npm override to enforce axios@1.18.1 resolution in the dependency tree.
  • Refreshed client/package-lock.json to reflect upgraded Axios artifacts.

• Transitive vulnerability source removal

  • Removed lite-server and concurrently dev dependencies, which introduced localtunnel and retained axios@0.21.4 in lock metadata.
  • Updated start script to run react-scripts start directly.
  • Removed obsolete server script tied to lite-server.

• Files updated

  • client/package.json
  • client/package-lock.json

{
  "dependencies": {
    "axios": "1.18.1"
  },
  "overrides": {
    "axios": "1.18.1"
  },
  "scripts": {
    "start": "react-scripts start"
  }
}

---

Thanks for the PR!

After merge, new images are deployed and promoted to DEV:

• DEV Homepage

[Copilot]

Pull request overview

This PR remediates Trivy-reported HIGH CVEs by upgrading the client’s Axios dependency to 1.18.1 and removing dev dependencies that were retaining the vulnerable axios@0.21.4 in the lockfile graph.

Changes:

• Upgrade axios from ^0.21.1 to 1.18.1 and add an npm override to enforce resolution.
• Remove lite-server and concurrently (and simplify the start script to run react-scripts start directly).
• Regenerate client/package-lock.json to eliminate axios@0.21.4 and related transitive entries.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
client/package.json	Pins Axios to 1.18.1, adds overrides, and removes dev tooling/scripts that pulled in vulnerable transitive deps.
client/package-lock.json	Updates the resolved dependency graph to reflect Axios 1.18.1 and removal of lite-server/concurrently transitive chain.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rogene-bcgov]

All tests good. Merging this now.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud