fix: patch CVEs (#5520)

![image](https://github.com/user-attachments/assets/caa0bb87-c716-4f28-aae5-52c648ef9d2d)

Related to https://github.com/grafana/irm/issues/1617

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] Added the relevant release notes label (see labels prefixed w/
`release:`). These labels dictate how your PR will
    show up in the autogenerated release notes.

Author: Dominik Broj

grafana-plugin/package.json

@@ -95,7 +95,7 @@
     "eslint-plugin-rulesdir": "^0.2.1",
     "eslint-plugin-unused-imports": "^3.1.0",
     "eslint-webpack-plugin": "^4.0.1",
-    "express": "^4.20.0",
+    "express": "^4.21.2",
     "fork-ts-checker-webpack-plugin": "^8.0.0",
     "glob": "^10.2.7",
     "identity-obj-proxy": "3.0.0",
@@ -184,5 +184,17 @@
   "resolutions": {
     "braces": "3.0.3",
     "micromatch": "4.0.8"
+  },
+  "pnpm": {
+    "overrides": {
+      "uplot@<1.6.31": ">=1.6.31",
+      "send@<0.19.0": ">=0.19.0",
+      "path-to-regexp@<0.1.12": ">=0.1.12",
+      "path-to-regexp@>=2.0.0 <3.3.0": ">=3.3.0",
+      "prismjs@<1.30.0": ">=1.30.0",
+      "@babel/runtime@<7.26.10": ">=7.26.10",
+      "@babel/helpers@<7.26.10": ">=7.26.10",
+      "cookie@<0.7.0": ">=0.7.0"
+    }
   }
 }