[ls-valentinas-bakaitis]

Fixed

All dev-only transitive deps, updated in package-lock.json via npm update.

• form-data 4.0.0 → 4.0.6 (CVE-2025-7783, CVE-2026-12143) 1 2
• flatted 3.1.1 → 3.4.4 (CVE-2026-32141, CVE-2026-33228) 1 2
• js-yaml 3.14.1 → 3.15.2, 4.1.0 → 4.3.2 (CVE-2026-59869, CVE-2026-84375, GHSA-5p4m-2wfm-xmqj) 1 2 3
• brace-expansion 1.1.11 → 1.1.21, 2.0.1 → 2.1.7 (CVE-2026-102276, CVE-2026-102278, CVE-2026-13149, CVE-2026-14257, CVE-2026-69152) 11305 11323 429 9721 9892
• ws 8.16.0 → 8.22.2 (CVE-2024-37890, CVE-2026-48779) 1 2
• browserslist 4.22.2 → 4.29.5 (CVE-2026-73088, CVE-2026-73089) 1 2
• braces 3.0.2 → 3.0.3 (CVE-2024-4068) alert
• minimatch 3.1.2 → 3.1.5, 9.0.3 → 9.0.9 (CVE-2026-26996, CVE-2026-27903, CVE-2026-27904) 1 2 3
• cross-spawn 7.0.3 → 7.0.6 (CVE-2024-21538) alert
• picomatch 2.2.3 → 2.3.2 (CVE-2026-33671) alert

Already resolved

None

Verification

CI=true npm run lint passed; npm run build passed; npm run test passed (19/19). Same results before and after. Installed with --ignore-scripts.

Left for a human

Socket's stated targets for js-yaml (4.3.1, applied to the 3.x copy), brace-expansion (5.0.11) were not met for the older-major copies (js-yaml 3.15.2, brace-expansion 1.x/2.x), since parents constrain majors. Re-check Socket after merge. The form-data (3.0.5) and cross-spawn (6.0.6) targets were lower than installed majors, so latest in the installed major was used.

Other changes

package.json gains an overrides entry forcing minimatch ^9.0.7 under @typescript-eslint/typescript-estree (it pinned 9.0.3).

---

Generated by socket-alerts (AI agent). Run vend__reactular__npm/20261110T004613Z. Review before merging.

---

🛡️ Release Checklist

1. Merge Timing (Required)

When will this PR be merged?

• During the thaw phase
• I will wait for the thaw phase to finish, and I will merge this PR on my own
• I will merge this before the freeze on my own

2. Feature Flag

Does this PR require a feature flag to be created?

• No feature flag required
• Requires feature flag:
  • Flag Name:
  • Initial Value: [ ] true [ ] false

3. Environment Variables

Does this PR require environment variables to be added/removed/updated?

• No environment variable changes
• Requires environment variable changes

4. Database Migration

Does this PR require a database migration applied to production BEFORE it lands? (Production usually has no auto-deploy.)

• No database migrations
• Requires migration (must be applied to production before merge)

5. Rollback Safety

Is this PR safe to rollback?

• Safe to rollback (stateless change, backward-compatible)
• Not trivially reversible — rollback procedure (document below):

6. Dependencies

Is this PR self-contained, or does it depend on another PR not yet in master/main?

• Self-contained PR
• Depends on other PR(s) to merge first (Links/PR #s below):

7. Risk Assessment (Select exactly one)

• 🟢 Low Risk (stateless bugfix, copy update, dark flag)
• 🟡 Medium Risk (behavioral change, new dependency)
• 🟠 High Risk (schema, shared infra, payment flows)
• 🔴 Critical Risk (irreversible or wide blast radius)

8. Urgency (Select exactly one)

• 🧊 Not urgent (can wait for normal release cadence)
• ⏳ Normal (should land soon)
• 🚨 Urgent (Sev-1/P0 hotfix, needs expedited merge)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.