Vulnerabilities in the dependencies

I think its kind of scary to run the software when you have 6 audit findings in HIGH severity, which i think could be updated

Enivronment:

• ubuntu 24.04lts
• nvm
• nodejs 26

Steps to reproduce:

• npm install @parity/ppn
• npm audit

during the npm install it also asks for install-scripts for esbuild@0.25.12 package, which is minor thing, but also worth to consider to update the procedures and/or readme

Suggested action:

• update or remove the deepmerge-ts
• upgrade toml to 5.0.0 from 4.1.2

npm audit
# npm audit report

deepmerge-ts  <8.0.0
Severity: high
DeepmergeTS has stack exhaustion when merging recursive object graphs - https://github.com/advisories/GHSA-ggr8-5vv4-36mx
No fix available
node_modules/deepmerge-ts
  write-package  *
  Depends on vulnerable versions of deepmerge-ts
  node_modules/write-package
    @polkadot-api/cli  >=0.4.0
    Depends on vulnerable versions of write-package
    node_modules/@polkadot-api/cli
      polkadot-api  >=0.7.0
      Depends on vulnerable versions of @polkadot-api/cli
      node_modules/polkadot-api
        @parity/ppn  *
        Depends on vulnerable versions of polkadot-api
        Depends on vulnerable versions of toml
        node_modules/@parity/ppn

toml  <=4.1.2
Severity: high
toml-node: Uncontrolled Recursion - https://github.com/advisories/GHSA-82x6-q7mm-w9cf
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization - https://github.com/advisories/GHSA-v5mp-jgw5-2x6j
No fix available
node_modules/toml

6 high severity vulnerabilities

Start by reproducing the report with npm install @parity/ppn and npm audit in the stated Node.js environment. Trace the reported deepmerge-ts and toml dependency paths, then determine whether updates or replacements remove the high-severity findings. Done means the dependency audit no longer reports these vulnerabilities and the install-script guidance is addressed if needed.