Sync from base-builder

Author: github-actions[bot]

.github/workflows/generate.yml

@@ -268,6 +268,10 @@ jobs:
           node -v
           [ -e "node_modules" ] && git rm -r node_modules
           npm install --save
+          # npm install honors the committed package-lock.json, so vulnerable
+          # transitive deps stay pinned forever. audit fix bumps only the
+          # vulnerable ones, within the existing semver ranges (no --force).
+          npm audit fix
           git add node_modules
 
       - name: Check modifications