Fix npm dependency vulnerabilities in onchain-app-template

[Copilot]

Several direct and transitive npm dependencies in the onchain-app-template carried known CVEs, including critical DoS and authorization bypass issues in next and an unpatched esbuild via @wagmi/cli: latest.

Direct dependency updates

• next ^14.2.5 → ^15.2.9 — 14.x has no patch for the HTTP request deserialization DoS (GHSA-7m27-7ghc-44w9); earliest clean release is 15.2.9
• @wagmi/cli pinned to 2.10.0 (was resolving to 2.1.16 via latest) — picks up patched esbuild (GHSA-67mh-4wv8-2f99)

Transitive dependency resolutions

Added resolutions to force safe versions through the dependency tree:

Package	Pinned to	Severity
sha.js	^2.4.12	Critical
cross-spawn	^7.0.5	High
glob	^10.5.0	High
h3	^1.15.5	High
node-forge	^1.3.3	High
minimatch	^10.2.1	High
bn.js	^5.2.3	Moderate
lodash	^4.17.23	Moderate

Housekeeping

• Moved @testing-library/* entries to their alphabetical position in devDependencies
• Swapped jsdom/lokijs to restore alphabetical order

Original prompt

Pull Request: https://github.com/Deejae69/scaling-computing-machine/pull/4/files

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Updates the onchain-app-template JavaScript dependencies to address known CVEs (including issues called out in next and transitive dependencies), primarily by upgrading direct deps and adding transitive version pinning.

Changes:

• Upgraded next to ^15.2.9 and pinned @wagmi/cli to 2.10.0.
• Added transitive dependency pins via resolutions for several vulnerable packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The resolutions field is only honored by some package managers (notably Yarn). If consumers install this template with npm (which uses overrides) or pnpm (which uses pnpm.overrides), these pins may be ignored and the vulnerable transitive versions could still be selected. Consider either (a) switching to the override mechanism for the intended package manager, or (b) adding a packageManager field (and ideally a lockfile) to make it explicit that installs must use a tool that honors resolutions.

[Copilot]

The dev script uses POSIX-style env var assignment with single quotes (NODE_OPTIONS='--inspect' ...), which will fail on Windows shells. If this template is intended to be cross-platform, consider using a cross-platform env helper (e.g. cross-env) or moving --inspect into a separate dev:inspect script while keeping dev portable.