fix: address npm audit security vulnerabilities

[Copilot]

Summary

Addresses security vulnerabilities found by npm audit.

Changes

High severity (fixed)

• serialize-javascript RCE (GHSA-5c6j-r48x-rmvq): Updated terser-webpack-plugin from 5.1.1 → 5.3.17 (direct dep fix). Added overrides entry to pin serialize-javascript to 7.0.4 for mocha's transitive dependency.
• diff DoS (GHSA-73rr-hh4g-fpgx): Added overrides entry to pin diff to 8.0.3, fixing mocha's transitive dependency.

Low severity (mitigated)

• elliptic risky crypto (GHSA-848j-6mx2-7j84): Added overrides entry to pin elliptic to 6.6.1 (latest). npm audit still reports this since the advisory marks all versions as vulnerable, but the GitHub Advisory Database confirms 6.6.1 is safe. The only npm-suggested fix would downgrade crypto-browserify from 3.12.0 → 3.3.0, which is a major breaking change.

Security Summary

• All 3 high-severity vulnerabilities resolved
• 4 low-severity issues (elliptic chain) mitigated by pinning to latest safe version per GitHub Advisory DB; cannot be fully eliminated without a breaking crypto-browserify downgrade

[Copilot]

Pull request overview

This PR addresses npm audit findings by updating a direct dependency and pinning several vulnerable transitive dependencies via npm overrides, alongside updating VS Code proposed API typings for chat session forking.

Changes:

• Bumped terser-webpack-plugin to a patched version to address serialize-javascript vulnerability exposure.
• Added npm overrides to pin diff, serialize-javascript, and elliptic to non-vulnerable versions.
• Extended proposed VS Code API typings to support forking chat sessions via a new handler (and deprecated the older fork handler location).

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/@types/vscode.proposed.chatSessionsProvider.d.ts	Adds/updates proposed API types for chat session forking and adjusts provider registration parameter naming/docs.
package.json	Updates terser-webpack-plugin and introduces npm overrides for vulnerable transitive dependencies.
package-lock.json	Regenerates lockfile to reflect the dependency bump and overrides-pinned transitive dependency graph.

---

You can also share your feedback on Copilot code review. Take the survey.

[rzhao271]

@copilot Run npm i to update lockfile.

[Copilot]

@copilot Run npm i to update lockfile.

Done in a04c481.