Fix lodash, urijs and path-to-regexp advisories in lib

[ch-asimakopoulos]

Chain 2 of 4. Base: security/root-high-deps (#10).

Alert	Package	Advisory	Before	After
SokratisVidros#55	lodash (direct)	Code Injection via _.template imports key names	4.17.21	4.18.1
SokratisVidros#21	urijs	Incorrect protocol extraction via \r, \n, \t	1.19.6	1.19.11
SokratisVidros#37	path-to-regexp	Outputs backtracking regular expressions	1.8.0	1.9.0

All three are plain semver-compatible updates

No overrides needed. koa-router@7.4.0 accepts urijs@^1.19.2 and path-to-regexp@^1.1.1, so both transitive fixes land on their own; only the direct lodash range needed editing.

path-to-regexp deserves a note: the backtracking fix was backported to the 1.x line as 1.9.0, so this stays on koa-router 7 rather than needing the koa-router 12 / path-to-regexp 8 jump.

lib only consumes lodash/merge and lodash/isEmpty — neither touched by the _.template advisory nor by anything in the 4.17 → 4.18 range.

Verification

• All three alerts report clear
• 9/9 tests pass, and lib/index still loads
• The build.test.js snapshot is unchanged — the useful signal here, since it captures the router's compiled regexes. path-to-regexp 1.9.0 produces byte-identical routing output.
• Changes are confined to the intended packages. A full diff of the runtime tree (npm ls --omit=dev --all) before and after shows only the three bumps above, plus incidental in-range moves of hoek 4.2.1 → 4.3.1 and topo 2.0.2 → 2.1.1 underneath koa-joi-validate — which chain 3 removes outright.

Remaining in this lockfile

• hoek — chain 3 (Bump y18n from 4.0.0 to 4.0.1 in /lib SokratisVidros/apicco#33)
• a moderate joi link() RangeError
• brace-expansion — advisory has no patched version at any release

🤖 Generated with Claude Code