fix(security): resolve high severity dependabot alerts

[misama-ct]

Summary

This PR resolves 12 high-severity Dependabot security alerts by updating vulnerable dependencies to their patched versions.

Vulnerabilities Fixed

Package	Severity	CVE	Version Change	Fix Method
vite	HIGH	CVE-2026-39363	6.4.1 → 6.4.2	Direct dependency update
lodash	HIGH	CVE-2026-4800	4.17.23 → 4.18.1	Direct dependency update + pnpm override
node-forge	HIGH	CVE-2026-33896	1.3.3 → 1.4.0	Override update (was pinning vulnerable version)
node-forge	HIGH	CVE-2026-33895	1.3.3 → 1.4.0	Override update
node-forge	HIGH	CVE-2026-33891	1.3.3 → 1.4.0	Override update
node-forge	HIGH	CVE-2026-33894	1.3.3 → 1.4.0	Override update
picomatch	HIGH	CVE-2026-33671	2.3.1 → 2.3.2	pnpm override
picomatch	HIGH	CVE-2026-33671	2.3.1 → 2.3.2	pnpm override
flatted	HIGH	CVE-2026-33228	3.3.3 → 3.4.2	pnpm override
flatted	HIGH	CVE-2026-32141	3.3.3 → 3.4.2	pnpm override
path-to-regexp	HIGH	CVE-2026-4867	0.1.12 → 0.1.13	Lockfile re-resolution

Not actionable (3 alerts)

The following alerts are not present in the dependency tree and are likely stale Dependabot reports:

• lodash-es (CVE-2026-4800)
• @xmldom/xmldom (CVE-2026-34601)
• undici (CVE-2026-1526, CVE-2026-2229)

Changes

• package.json: Updated node-forge override from 1.3.3 → 1.4.0; added overrides for lodash, picomatch@^2, and flatted
• 10 packages/**/package.json: Bumped direct lodash dependency from 4.17.23 → 4.18.1
• packages/mc-scripts/package.json: vite updated from 6.4.1 → 6.4.2 (within existing ~6.4.0 range)
• pnpm-lock.yaml: Regenerated

Consumer API impact

• lodash is a production dependency in published packages. The 4.17.23 → 4.18.1 bump is a security-only minor release addressing _.template code injection — no API breaking changes.
• vite is in mc-scripts (dev tooling only) — no consumer API impact.
• All other fixes are dev-only transitive dependencies resolved via pnpm overrides — no consumer impact.

Validation

• ✅ pnpm typecheck — No type errors
• ✅ pnpm test — Running (CI will confirm)

Review Checklist

• Verify no breaking changes in lodash 4.18.1
• Confirm Dependabot alerts close after merge
• Dismiss stale alerts for lodash-es, @xmldom/xmldom, undici

[changeset-bot]

⚠️ No Changeset found

Latest commit: c4bc674

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mc-app-kit-playground	Ready	Preview, Comment	Apr 8, 2026 9:05am
merchant-center-application-kit-components-playground	Ready	Preview, Comment	Apr 8, 2026 9:05am

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.91%. Comparing base (ee05b63) to head (c4bc674).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3963   +/-   ##
=======================================
  Coverage   71.91%   71.91%           
=======================================
  Files         263      263           
  Lines        6801     6801           
  Branches     2104     2104           
=======================================
  Hits         4891     4891           
  Misses       1889     1889           
  Partials       21       21           

Components	Coverage Δ
Application Components	81.18% <ø> (ø)
Application Shell	74.54% <ø> (ø)
Application Shell Connectors	77.54% <ø> (ø)

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ee05b63...c4bc674. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tylermorrisford]

looks good