Fix HIGH severity Prototype Pollution in flatted (CVE-2026-33228)

[haasonsaas]

Summary

• Fixes Dependabot alert for flatted Prototype Pollution via parse() (CVE-2026-33228, HIGH severity)
• flatted is a transitive dependency (via flat-cache -> eslint), pinned at 3.4.0 in the lockfile
• Added an npm overrides entry in web/package.json to enforce flatted >=3.4.2, updating the lockfile from 3.4.0 to 3.4.2

Test plan

• npm install --package-lock-only succeeds without errors
• Verified flatted resolves to 3.4.2 in the updated lockfile
• CI passes (no runtime changes, dev-only transitive dependency)

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Low risk dependency-only change: adds an npm override and updates package-lock.json to force flatted 3.4.2, with no application/runtime code touched.

Overview
Addresses a Dependabot alert by forcing the transitive flatted dependency to resolve to >=3.4.2 via an npm overrides entry in web/package.json.

Updates web/package-lock.json accordingly, bumping flatted from 3.4.0 to 3.4.2 (used via dev tooling such as flat-cache/eslint).

^{Written by Cursor Bugbot for commit 714f87a. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Unbounded override range risks future major version breakage
  • Changed the flatted override from >=3.4.2 to ^3.4.2 so fresh installs stay within the compatible 3.x range.

_{You can send follow-ups to this agent here.}

[cursor]

Unbounded override range risks future major version breakage

Low Severity

The flatted override uses >=3.4.2, an unbounded upper range that would match future major versions (e.g., 4.0.0). The upstream consumer flat-cache declares "flatted": "^3.2.9" (i.e., <4.0.0). A future major version of flatted could be installed that is incompatible with flat-cache, breaking linting. Using ^3.4.2 instead would stay within the semver-compatible range.