Update Socket patches: +12 patches

[socket-security]

Summary

This PR updates Socket security patches for your dependencies.

These patches are applied via the Socket patch agent — .socket/manifest.json + a package.json postinstall hook.

Changes

• ✅ Added: CVE-2026-32141 in pkg:npm/flatted@3.3.3 (Socket Patch)
  • Severity: HIGH
  • Summary: flatted vulnerable to unbounded recursion DoS in parse() revive phase
• ✅ Added: CVE-2026-6322 in pkg:npm/fast-uri@3.0.6 (Socket Patch)
  • Severity: HIGH
  • Summary: fast-uri vulnerable to host confusion via percent-encoded authority delimiters
• ✅ Added: CVE-2026-4800 in pkg:npm/lodash@4.17.21 (Socket Patch)
  • Severity: HIGH
  • Summary: lodash vulnerable to Code Injection via _.template imports key names
• ✅ Added: CVE-2026-48779 in pkg:npm/ws@8.18.2 (Socket Patch)
  • Severity: HIGH
  • Summary: ws: Memory exhaustion DoS from tiny fragments and data chunks
• ✅ Added: CVE-2026-6321 in pkg:npm/fast-uri@3.0.6 (Socket Patch)
  • Severity: HIGH
  • Summary: fast-uri vulnerable to path traversal via percent-encoded dot segments
• ✅ Added: CVE-2026-26996 in pkg:npm/minimatch@3.1.2 (Socket Patch)
  • Severity: HIGH
  • Summary: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• ✅ Added: CVE-2026-26996 in pkg:npm/minimatch@9.0.5 (Socket Patch)
  • Severity: HIGH
  • Summary: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• ✅ Added: CVE-2026-33671 in pkg:npm/picomatch@4.0.3 (Socket Patch)
  • Severity: HIGH
  • Summary: Picomatch has a ReDoS vulnerability via extglob quantifiers
• ✅ Added: CVE-2026-33671 in pkg:npm/picomatch@2.3.1 (Socket Patch)
  • Severity: HIGH
  • Summary: Picomatch has a ReDoS vulnerability via extglob quantifiers
• ✅ Added: in pkg:npm/serialize-javascript@6.0.2 (Socket Patch)
  • Severity: HIGH
  • Summary: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
• ✅ Added: CVE-2026-33937 in pkg:npm/handlebars@4.7.8 (Socket Patch)
  • Severity: CRITICAL
  • Summary: Handlebars.js has JavaScript Injection via AST Type Confusion
• ✅ Added: CVE-2026-9277 in pkg:npm/shell-quote@1.8.3 (Socket Patch)
  • Severity: CRITICAL
  • Summary: shell-quote quote() does not escape newlines in object .op values

Testing

Review the patches and test your application to ensure compatibility.

---

🔒 Powered by Socket Security

[linux-foundation-easycla]

• ❌ - login: @Socket-Security[bot] / name: socket-security[bot]. The commit (adaa081) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.93%. Comparing base (5df4705) to head (adaa081).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #651   +/-   ##
=======================================
  Coverage   94.93%   94.93%           
=======================================
  Files          15       15           
  Lines         296      296           
  Branches      149      149           
=======================================
  Hits          281      281           
  Misses         15       15           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.