fix: resolve cipher-base to >=1.0.5 in 10 admin-ui-sdk packages (CVE-2025-9287)

[anupamme]

Summary

CVE-2025-9287 (CVSS 9.1 Critical) affects cipher-base versions ≤1.0.4. The dependency tree in 10 of the 12 admin-ui-sdk sub-packages resolves cipher-base at 1.0.4 via crypto-browserify → browserify-aes / browserify-des / create-hash / create-hmac.

This PR adds an npm overrides entry to each affected package.json and regenerates the corresponding package-lock.json so that cipher-base resolves to ≥1.0.5 (lockfiles now pin 1.0.7).

"overrides": {
  "cipher-base": ">=1.0.5"
}

The two menu/ sub-packages (custom-menu, custom-menu-no-react) already resolve cipher-base@1.0.7 and are unchanged.

Affected packages (all under admin-ui-sdk/):

• banner-notification/custom-mass-actions
• banner-notification/custom-order-view-button
• customer/custom-grid-columns
• customer/custom-mass-action
• order/custom-fees
• order/custom-grid-columns
• order/custom-mass-action
• order/custom-view-button
• product/custom-grid-columns
• product/custom-mass-action

Notes

• cipher-base is not a direct dependency of any package in this repo — it is fully transitive. This PR does not add it as a direct dependency; overrides is the correct npm mechanism for forcing a transitive version.
• The overrides approach pins only cipher-base and does not alter any other resolved dependency version.
• Supersedes closed PR fix: upgrade cipher-base to 1.0.5 (CVE-2025-9287) #76, which targeted the same CVE but was generated against an older repo snapshot and incorrectly added cipher-base as a direct dependency.

Test plan

• In each of the 10 affected directories: npm install && npm ls cipher-base — confirm no 1.0.4 in the output
• grep -r '"version": "1.0.4"' admin-ui-sdk/*/package-lock.json — should return no matches for cipher-base
• Existing test suites pass: npm test in each sub-package (all use jest --passWithNoTests)

🤖 Generated with Claude Code