High Priority Vulnerabilities

[SorsOps]

Describe the bug
The prod bundle we emit for the figma plugin only has 2 remaining high priority vulnerabilities.

1. Prototype pollution arising from set-value GHSA-4jqc-8m5r-9rpr
2. ReDos vulnerability for minimatch GHSA-f8q6-p94x-37v3

Neither have any real impact to the security of the plugin, however they are affecting auditing reports.

1 relies on a major version upgrade, https://github.com/tokens-studio/figma-plugin/actions/runs/4431195197 shows that this introduces a major regression

2. Seems more manageable, https://github.com/tokens-studio/figma-plugin/actions/runs/4431205127 shows that it does also cause a regression , but is localized for the cypress testing.

We will likely need to get surgical with the package-lock.json and manually remediate these

[SorsOps]

The minimatch vulnerability should be solved in #1707

Set-value is much harder to resolve

[six7]

Fixed in 1.35.3