fix(deps): updated vulnerable npm packages to patched versions

.github/workflows/nodejs-pr.yml

@@ -0,0 +1,46 @@
+# =============================================================================
+# 🔍 PR Validation
+# =============================================================================
+# Runs type check, unit tests, production build and a dependency audit on
+# every pull request to main - including Dependabot PRs - so dependency
+# updates are verified before they are merged.
+#
+# Deploy (deploy-pages.yml) and release (release.yml) still run on push to
+# main only; this workflow neither deploys nor publishes anything.
+# =============================================================================
+
+name: 🔍 PR Validation
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# pull-requests: write is required by the reusable workflow's code-quality
+# job declaration (validated at run creation, even with SonarQube disabled).
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: pr-validation-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: 🧪 Build & Test
+    uses: bauer-group/automation-templates/.github/workflows/nodejs-build.yml@main
+    with:
+      node-version-file: '.nvmrc'
+      package-manager: 'npm'
+      frozen-lockfile: true
+      run-typecheck: true
+      typecheck-command: 'npm run type-check'
+      run-tests: true
+      test-command: 'npm run test:run'
+      build-command: 'npm run build'
+      run-audit: true
+      audit-level: 'high'
+      upload-artifacts: false
+      timeout-minutes: 15
+    secrets: inherit