chore(deps): pin csv-parse to ^7.0.2 via overrides (#13117)

[KooshaPari]

Summary

Fixes #13117

Adds csv-parse: ^7.0.2 to the overrides block in package.json, bumping the transitive dep from 7.0.1 to 7.0.2 to close the upstream security advisory.

Why overrides (not a direct dep)

csv-parse is a transitive dependency in this repo — it appears in package-lock.json (resolved through a sub-dep chain) but no source file in src/, open-sse/, or tests/ imports it directly. Adding a direct dependencies entry would be wrong (it would imply the package is used directly in this repo).

Per the pattern Diego established in #12592 (browserslist override), transitive bumps ship as overrides entries rather than direct dependencies. npm install resolves the override chain and pulls csv-parse@7.0.2 for every sub-dep that requests csv-parse.

Diff

   "overrides": {
     "hono": "^4.13.7",
+    "csv-parse": "^7.0.2",
     "h2": "^3.4.4",
     ...
   }

Verification

• npm view csv-parse@7.0.2 returns successfully — the version exists on the registry
• overrides is the documented npm mechanism for pinning transitive deps without changing direct deps
• Single-line addition, no schema/permission impact

Fixes #13117

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.