TM.AI: dependabot and forward port

TM.AI: merged the npm dependabot group on v17 (#60), then merged v17 forward to v18 (#61). Lock-only change, resolved to v18's lock