[INFOSEC-634] Update vulnerable hash dependencies - #92

Description

Updates the vulnerable production dependencies currently blocking the audit check on #91.

The SECURITY.md PR is documentation-only, but its CI audit fails because the temporary exceptions for cipher-base and sha.js expired on September 21, 2026 while the lockfile still resolved vulnerable versions.

Reviewer guide

There are no application source-code or package.json changes in this PR. Only two files are modified:

• .nsprc: removes the two resolved audit exceptions
• package-lock.json: updates cipher-base from 1.0.4 to 1.0.7 and sha.js from 2.4.11 to 2.4.12

The other lockfile lines are npm-generated transitive metadata for those two production dependency updates. The most useful review points are the cipher-base and sha.js entries and the removal of exceptions 1109536 and 1109535.

Changes

• updates cipher-base from 1.0.4 to 1.0.7 (patched in 1.0.5)
• updates sha.js from 2.4.11 to 2.4.12
• removes the resolved audit exceptions 1109536 and 1109535 from .nsprc

Security context

• cipher-base: GHSA-cpq7-6gpm-g9rc
• sha.js: GHSA-95m3-7q98-8xr5

Testing

• npm run audit --production — passes (All good)
• unit tests on Node 20 — 3,047 passing
• formatting — passes
• source and test linting — passes
• generated-code diff check — passes
• all GitHub CI checks — pass

Merge order

This PR must merge first. After it lands on master, #91 can be rebased so its audit check passes, and then the SECURITY.md change can merge.

Tracking

INFOSEC-634: Publish SECURITY.md for public repositories

Related SECURITY.md PR: #91