From e33803cac27f4b517dfc0cb4511d78076a95bb4b Mon Sep 17 00:00:00 2001
From: splitsec2 <35583321+splitsec2@users.noreply.github.com>
Date: Fri, 23 Oct 2026 02:00:44 -0600
Subject: [PATCH] build(deps): update socket.io-parser, ws and
 baseline-browser-mapping in the lockfiles (#1560)

Dependabot has four open npm alerts and no PRs for them, since they are
all transitive. This updates the lockfiles only, no package.json change.

| Package | From | To | Alert |
|---|---|---|---|
| socket.io-parser | 4.2.6 | 4.2.7 | zero-attachment memory exhaustion
(high) |
| ws | 8.18.3 | 8.21.3 | memory exhaustion DoS (high) and uninitialized
memory disclosure (medium) |
| engine.io-client | 6.6.4 | 6.6.7 | needed to get ws past its `~8.18`
range |
| baseline-browser-mapping | 2.9.19 | 2.11.31 | process termination on
invalid input (medium, dev only) |

I think the practical risk was low to begin with, since ws is only used
by engine.io-client under Node and the built bundle doesn't include it.
Still, it clears the alerts and the bumps are small.

Done with npm 11 so the `libc` fields in the lockfile stay as they were.
A clean `npm ci` from the new lockfile gives 0 vulnerabilities, and
`tsc`, `vitest` (241 tests) and `vite build` all pass.
---
 package-lock.json              | 11 +++++++----
 src/frontend/package-lock.json | 20 ++++++++++----------
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d394c756..428798b9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,13 +9,16 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.19",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
-      "integrity": "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==",
+      "version": "2.11.31",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.31.tgz",
+      "integrity": "sha512-b0k7wXlWjpuL/Uxb/pYlpjY0ej5BjAmurtPUk3eRGuloI4yjK32m8TiKUQ81l1ptcLjKS/KH2+uqIolZti1x4Q==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     }
   }
diff --git a/src/frontend/package-lock.json b/src/frontend/package-lock.json
index 451342d1..39a0e722 100644
--- a/src/frontend/package-lock.json
+++ b/src/frontend/package-lock.json
@@ -2731,15 +2731,15 @@
       }
     },
     "node_modules/engine.io-client": {
-      "version": "6.6.4",
-      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.4.tgz",
-      "integrity": "sha512-+kjUJnZGwzewFDw951CDWcwj35vMNf2fcj7xQWOctq1F2i1jkDdVvdFG9kM/BEChymCH36KgjnW0NsL58JYRxw==",
+      "version": "6.6.7",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.7.tgz",
+      "integrity": "sha512-GyAvmPA7gnRCpDQbYACAy79Lg4ewevrmaPzySZz0OVvgyZc3gEfLLqPTYk8wVBScjOEpM9ZO4KryyFpVItjGEA==",
       "license": "MIT",
       "dependencies": {
         "@socket.io/component-emitter": "~3.1.0",
         "debug": "~4.4.1",
         "engine.io-parser": "~5.2.1",
-        "ws": "~8.18.3",
+        "ws": "~8.21.0",
         "xmlhttprequest-ssl": "~2.1.1"
       }
     },
@@ -3595,9 +3595,9 @@
       }
     },
     "node_modules/socket.io-parser": {
-      "version": "4.2.6",
-      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
-      "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==",
+      "version": "4.2.7",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz",
+      "integrity": "sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==",
       "license": "MIT",
       "dependencies": {
         "@socket.io/component-emitter": "~3.1.0",
@@ -4216,9 +4216,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.18.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
-      "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"