fix: remediate high & critical vulnerabilities in example lockfiles

[pkaeding]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Remediates 60 of 62 open high/critical Dependabot alerts, all originating from stale examples/hoc/yarn.lock and examples/async-provider/yarn.lock.

Describe the solution you've provided

• Upgraded direct deps: express ^4.17.3→^4.21.0, lodash ^4.17.21→^4.18.0
• Added yarn resolutions to force patched versions of vulnerable transitive deps (elliptic, cipher-base, sha.js, pbkdf2, node-forge, path-to-regexp, serialize-javascript, koa, ws, braces, json5, minimatch, flatted, tmp, ansi-regex, @babel/plugin-transform-modules-systemjs, body-parser, webpack-dev-middleware, cross-spawn, trim-newlines, http-proxy-middleware, ansi-html)
• Regenerated both lockfiles

Remaining (unfixable): 2 ip SSRF alerts (1 per lockfile) — no patch exists for the ip package. These come from universal-hot-reload > webpack-dev-server > ip.

Describe alternatives you've considered

Removing the example projects entirely, or upgrading their build toolchain from webpack 4 to webpack 5+. Both would be more disruptive than targeted resolutions.

Additional context

The main package-lock.json has zero high/critical vulnerabilities. All alerts were isolated to the example project lockfiles. Build, lint, and all 93 tests pass on the main SDK — only example lockfiles changed.

Link to Devin session: https://app.devin.ai/sessions/f782088a3883446e8bb7b049e5631747
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[pkaeding]

#401 is more comprehensive