security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-73rr-hh4g-fpgx	diff, ts-node	None	10.7.0	4.0.4		confirmed

Not Included

• Deferred by batch limit: 11 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	highlight.js	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Lockfile-only transitive dependency patch for a known advisory; no runtime or application code changes.

Overview
Security remediation for GHSA-73rr-hh4g-fpgx by bumping the locked diff package from 4.0.2 to 4.0.4 in yarn.lock. There are no direct package.json edits in this diff—the change resolves the advisory on the diff dependency used by ts-node (dev tooling via tsn).

This is a narrow dependency lockfile update with no application source changes.

^{Reviewed by Cursor Bugbot for commit 7e5f9c5. Bugbot is set up for automated code reviews on this repo. Configure here.}