[GOOD FIRST ISSUE] Update velocityjs to >= 2.1.7 to fix critical prototype pollution #331

Task

Update velocityjs to >= 2.1.7 in the affected serverless examples to patch a critical prototype pollution vulnerability. This is a focused dependency-only change — no logic changes required.

Vulnerability

Open Dependabot alerts: 6 (4 critical, 2 high)

Affected Examples

velocityjs is used by amplify-appsync-simulator or serverless-appsync-simulator to render Apache Velocity Template Language (VTL) resolvers locally.

Steps

1. Fork this repository
2. For each affected example, check the current version:

   cd examples/<example>
   npm ls velocityjs

3. If velocityjs is a direct dependency, update it:

   npm install velocityjs@^2.1.7 --save

4. If it is only a transitive dependency, add an npm override:

   // package.json
   "overrides": {
    "velocityjs": "^2.1.7"
   }

   For pnpm:

   "pnpm": {
    "overrides": {
    "velocityjs": "^2.1.7"
    }
   }

5. Run npm install (or pnpm install) and verify the lock file updated
6. Test the local simulator still works (if applicable):

   npx sls offline start --noPrependStageInUrl

7. Open a PR with just the lock file / package.json changes

Validation

cd examples/<affected-example>
npm ls velocityjs # should show >= 2.1.7
npm audit | grep velocity # should return 0 vulnerabilities

Out of Scope

• Do not change VTL template files or resolver code
• Do not update unrelated packages
• Do not migrate to Serverless v4 in this PR (tracked separately)

References

• velocityjs npm page
• velocityjs GitHub
• npm overrides docs
• pnpm overrides docs