Update Socket patches: +12 patches

[socket-security]

Summary

This PR updates Socket security patches for your dependencies.

These patches are applied via the Socket patch agent — .socket/manifest.json + a package.json postinstall hook.

Changes

• ✅ Added: CVE-2026-32141 in pkg:npm/flatted@3.3.3 (Socket Patch)
  • Severity: HIGH
  • Summary: flatted vulnerable to unbounded recursion DoS in parse() revive phase
• ✅ Added: CVE-2026-6322 in pkg:npm/fast-uri@3.1.0 (Socket Patch)
  • Severity: HIGH
  • Summary: fast-uri vulnerable to host confusion via percent-encoded authority delimiters
• ✅ Added: CVE-2026-4800 in pkg:npm/lodash@4.17.23 (Socket Patch)
  • Severity: HIGH
  • Summary: lodash vulnerable to Code Injection via _.template imports key names
• ✅ Added: CVE-2026-48779 in pkg:npm/ws@7.5.10 (Socket Patch)
  • Severity: HIGH
  • Summary: ws: Memory exhaustion DoS from tiny fragments and data chunks
• ✅ Added: CVE-2026-6321 in pkg:npm/fast-uri@3.1.0 (Socket Patch)
  • Severity: HIGH
  • Summary: fast-uri vulnerable to path traversal via percent-encoded dot segments
• ✅ Added: CVE-2026-26996 in pkg:npm/minimatch@3.1.2 (Socket Patch)
  • Severity: HIGH
  • Summary: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• ✅ Added: CVE-2026-26996 in pkg:npm/minimatch@9.0.5 (Socket Patch)
  • Severity: HIGH
  • Summary: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• ✅ Added: CVE-2026-33671 in pkg:npm/picomatch@4.0.3 (Socket Patch)
  • Severity: HIGH
  • Summary: Picomatch has a ReDoS vulnerability via extglob quantifiers
• ✅ Added: CVE-2026-33671 in pkg:npm/picomatch@2.3.1 (Socket Patch)
  • Severity: HIGH
  • Summary: Picomatch has a ReDoS vulnerability via extglob quantifiers
• ✅ Added: in pkg:npm/serialize-javascript@6.0.2 (Socket Patch)
  • Severity: HIGH
  • Summary: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
• ✅ Added: CVE-2026-33937 in pkg:npm/handlebars@4.7.8 (Socket Patch)
  • Severity: CRITICAL
  • Summary: Handlebars.js has JavaScript Injection via AST Type Confusion
• ✅ Added: CVE-2026-9277 in pkg:npm/shell-quote@1.8.3 (Socket Patch)
  • Severity: CRITICAL
  • Summary: shell-quote quote() does not escape newlines in object .op values

Testing

Review the patches and test your application to ensure compatibility.

---

🔒 Powered by Socket Security

[linux-foundation-easycla]

• ❌ - login: @Socket-Security[bot] / name: socket-security[bot]. The commit (b46da64) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.40%. Comparing base (2c0aedf) to head (b46da64).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #211   +/-   ##
=======================================
  Coverage   95.40%   95.40%           
=======================================
  Files           9        9           
  Lines         848      848           
  Branches      360      360           
=======================================
  Hits          809      809           
  Misses         35       35           
  Partials        4        4           

Flag	Coverage Δ
integration	95.40% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.