[marekdano]

Summary

• Applies npm audit fix, which updates package-lock.json only; package.json is unchanged.

  • shadcn 4.21.4 → 4.22.1 (with @shadcn/registry 0.1.3 → 0.2.0)
  • concurrently 10.0.5 → 10.0.6
  • shell-quote 1.9.0 → 1.12.0
  • Lockfile version 0.2.2 → 0.2.3, to match package.json

• Fixes a failing test in ForgotPassword.test.tsx. Since refactor(auth): use shared Field in Login, ForgotPassword and PasswordChangeRequired #191, ForgotPassword uses the shared Field, which omits aria-invalid when there is no field-level error. The 429 rate-limit error is form-level, so the test now asserts the attribute is absent instead of "false".

Not addressed

npm audit still reports 7 high-severity findings, all from GHSA-vfj7-8cjw-p6xm in braces@3.0.3, reached through shadcn → fast-glob → micromatch → braces.

• No patched version exists. The maintainer disputes the advisory and does not plan a release (Security Advisory: Uncontrolled Recursion Depth in Tree Walkers Leads to Stack-Overflow DoS micromatch/braces#70, Show the full value on truncated text #73).
• npm audit fix --force would downgrade shadcn to 1.0.0, so it was not used.
• Exposure here is minimal: shadcn is only used for its build-time CSS import and the CLI, and nothing feeds braces untrusted patterns.
• This will clear with a normal npm audit fix once a fix ships or the advisory is corrected.

Notes

• shadcn and @shadcn/registry now resolve a nested zod@4. The app's own zod stays on 3.25.
• The lockfile also loses the libc fields on optional native packages (local npm version difference); this has no effect on installs.
• The ForgotPassword test failure was already present on main, independent of the dependency bumps.

Test plan

• src/pages/ForgotPassword.test.tsx passed
• Full npm run test passed
• npm ci
• npm run build
• npm run lint

[vishu-bh]

LGTM 🚀