Patch tmp and serialize-javascript without the broken chromium bump from Dependabot #26

[Copilot]

Dependabot #26 removed the vulnerable tmp@0.0.33 by bumping chromium from 3.0.3 to 3.2171.3008. That version only sorts higher. 3.2171.x is an unrelated package (a Chromium embed for the Tint framework) whose install.js runs spawn('install.bat') on every non-macOS platform. As a result, npm install fails on Linux with spawn install.bat ENOENT.

This PR applies the same security fixes and keeps chromium on the release main already uses.

Changes

• chromium: stays at 3.0.3.
• tmp: an override scoped to chromium forces tmp to ^0.2.6 (resolves to 0.2.7), which fixes the path-traversal advisory (< 0.2.6). chromium@3.0.3 only calls tmp.file() and tmp.setGracefulCleanup(), and both still work in 0.2.x. os-tmpdir drops out of the tree, and karma's tmp now dedupes to the same copy.
• serialize-javascript: 7.1.1 → 7.1.2 in the lockfile (GHSA-gfhx-hw2g-v5hg).

"overrides": {
  "@types/ws": "8.5.4",
  "chromium": {
    "tmp": "^0.2.6"
  }
}

Notes for reviewers

• This supersedes Bump the npm_and_yarn group across 1 directory with 2 updates #26, which can be closed after merge.
• Dependabot will likely propose chromium@3.2171.x again. Consider an ignore rule for that range.

Original prompt

Investigate and fix the CI failure affecting Dependabot PR #26 (remove tmp and update serialize-javascript 7.1.1 to 7.1.2). Both build jobs fail during chromium install on Node 24 with Error: spawn install.bat ENOENT. Make the smallest compatible fix and validate the build; preserve the security update.

[siddharthkp]

Merged this fix into Dependabot PR #26 so the security updates and Chromium workaround can land together.