security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-73rr-hh4g-fpgx	diff, ts-node	None	10.7.0	4.0.4		confirmed

Not Included

• Deferred by batch limit: 11 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Low Risk
Lockfile-only patch upgrade of a transitive dev dependency with no application logic changes.

Overview
Addresses GHSA-73rr-hh4g-fpgx by updating the locked diff package from 4.0.2 to 4.0.4 in yarn.lock. No source or manifest edits appear in the diff—only the transitive dependency resolution changes, likely pulled in via tooling such as ts-node / Jest-related packages.

Low scope: dependency patch bump for a known advisory; behavior should be unchanged aside from the security fix in diff.

^{Reviewed by Cursor Bugbot for commit f68f6db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

lgtm — dependency-only security bump, CI green