Update vulnerable packages

[rorymckinley]

This is a bundle issue to cover upgrading issues picked up as a combination pnpm audit and dependabot. Each upgrade will be covered by a comment on the issue, covering the reasoning for the upgrade.

[rorymckinley]

decode-uri-component:

This library is only used by devDependencies, so hopefully a safe change to make . The version to be upgraded is 0.2.0 will upgrade to 0.2.2 which has been out for almost 2 years.

[rorymckinley]

braces:

"if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop" - per GHSA-grv7-fg5c-xmjg.

braces is used by a lot of prod dependencies but, given that we execute what is essentially untrusted code :), it feels prudent to apply the patch version bump. The updated version has been out since May.

Unfortunately, braces can not be completely expunged as there is not a newer version of live-server available. This is not the end of the world as it is a devDependency but it will cause noise - so perhaps worth considering a switch to https://github.com/ljcp/alive-server.

[josephjclark]

@rorymckinley live-server is only used by an out of date ad unused dev server. We can just remove it and maybe fix the server later (i don't think the demo even needs it).

I'll raise an issue to fix / update the dev demo. You can just remove the live-server dependency.

[rorymckinley]

Note to self: When submitting the PR, add 'alarming comments' re: the ws update as we jumped several minor versions.

[rorymckinley]

Updated typesync - bumped up two minor versions as it was depending on ip which does not have a patch for the latest version and no patch on the horizon. typesync is a devDependency.

[rorymckinley]

postcss: Vulnerability relates to parsing of untrusted CSS - also only a devDependency.

[rorymckinley]

micromatch - vulnerable to regex DOS - used in a number of prod dependencies, but only 3 patch version bump needed to get a non-vulnerable version.

[rorymckinley]

word-wrap: devDependency vulnerable to a regex DOS.