fix(deps): override transitive adm-zip and sharp to patched versions

[carlos-alm]

Summary

• Resolves 2 open Dependabot alerts, both transitive dependencies of the optional @huggingface/transformers dev dependency:
  • adm-zip < 0.6.0 (GHSA-xcpc-8h2w-3j85, high) — ZIP central-directory size field is trusted without bounds checking, allowing a ~120-byte crafted ZIP to trigger a ~4GB allocation (DoS). Pulled in via onnxruntime-node.
  • sharp < 0.35.0 (GHSA-f88m-g3jw-g9cj, high) — inherited libvips vulnerabilities (CVE-2026-33327/33328/35590/35591). Pulled in directly by @huggingface/transformers.
• Both packages are only reachable via upstream caret ranges (^0.5.16, ^0.34.5) that exclude the patched releases even at the latest @huggingface/transformers@4.2.0, so an npm overrides entry is the correct fix rather than bumping a direct dependency.

Test plan

• npm ls adm-zip sharp shows both resolved to the overridden patched versions with no ERESOLVE issues
• npm audit no longer reports either CVE
• Full npm test suite passes clean (328/328 files, 5285 passed) after rebuilding the native addon and dist/ in this fresh worktree
• npm run lint clean

[greptile-apps]

Greptile Summary

This PR overrides two vulnerable transitive development dependencies with patched releases and updates the lockfile accordingly.

• Forces adm-zip to ^0.6.0 to address the ZIP allocation denial-of-service advisory.
• Forces sharp to ^0.35.3 and refreshes its platform-specific binaries and libvips dependencies.
• Keeps the upgraded packages within the repository’s declared Node.js runtime requirements.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking defects identified.

The overrides resolve the vulnerable transitive packages, the updated sharp engine requirement remains below the repository’s Node.js minimum, and no reachable dependency incompatibility was established.

Important Files Changed

Filename	Overview
package.json	Adds global npm overrides for the patched adm-zip and sharp versions; no actionable defect was identified.
package-lock.json	Resolves the overridden packages and sharp’s platform artifacts to patched versions with integrity metadata consistent with the manifest change.

_{Reviews (1): Last reviewed commit: "fix(deps): override transitive adm-zip a..." | Re-trigger Greptile}