fix(deps): refresh lockfile pins for vulnerable transitive deps

[chargome]

Summary

Updates stale yarn.lock resolutions to patched versions within their existing semver ranges, plus fixes a build breakage in rrweb-worker.

Lockfile refreshes (no package.json changes):

• basic-ftp 5.0.5 -> 5.3.0 (via puppeteer -> proxy-agent -> get-uri)
• node-forge 1.3.1 -> 1.4.0 (via vite-plugin-web-extension -> web-ext-run -> @devicefarmer/adbkit)
• picomatch 2.3.1 -> 2.3.2 (via chokidar, micromatch, @rollup/pluginutils)
• picomatch 4.0.2 -> 4.0.4 (via @rollup/pluginutils)
• flatted 3.3.2 -> 3.4.2 (via eslint -> flat-cache)

rrweb-worker build fix: Replaces rollup-plugin-typescript2 with @rollup/plugin-typescript — the old plugin can't parse import type syntax with the newer rollup version pulled in by the @rollup/plugin-terser v1 bump.

Breaking changes

• Lockfile refreshes: none — all within existing semver ranges
• rollup-plugin-typescript2 -> @rollup/plugin-typescript: drop-in replacement, same rollup plugin API. @rollup/plugin-typescript is the officially maintained plugin. Config options (tsconfig, sourceMap, inlineSourceMap, inlineSources) are compatible. Build verified passing.

Dependabot alerts resolved

• Alert #249 (high) — basic-ftp CRLF injection
• Alert #202 (critical) — basic-ftp path traversal
• Alert #237 (high) — node-forge basicConstraints bypass
• Alert #236 (high) — node-forge Ed25519 signature forgery
• Alert #235 (high) — node-forge RSA-PKCS signature forgery
• Alert #234 (high) — node-forge DoS via BigInteger.modInverse
• Alert #164 (high) — node-forge ASN.1 unbounded recursion
• Alert #163 (medium) — node-forge ASN.1 OID integer truncation
• Alert #162 (high) — node-forge ASN.1 desynchronization
• Alert #232 (medium) — picomatch POSIX class method injection
• Alert #230 (medium) — picomatch POSIX class method injection (4.x)
• Alert #229 (high) — picomatch ReDoS via extglob quantifiers
• Alert #227 (high) — flatted prototype pollution via parse

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2038970. Configure here.}

[cursor]

Plugin swap may break build with composite tsconfig

Medium Severity

Switching from rollup-plugin-typescript2 to @rollup/plugin-typescript while tsconfig.json has composite: true (which implies declaration: true) may cause a build failure. The @rollup/plugin-typescript docs require declarationDir to be set when declaration is enabled, but neither the plugin options nor the tsconfig specify declarationDir. The old plugin handled this differently. This change also goes beyond what the PR description claims ("No package.json changes — only the lockfile is updated").

Additional Locations (1)

• packages/rrweb-worker/package.json#L38-L40

 

^{Reviewed by Cursor Bugbot for commit 2038970. Configure here.}