Possible fix(deps): 2 vulnerable dependencies in package-lock.json

[begininvoke]

Came across something in frontend/src/angular/package-lock.json around line 5035 that looked worth flagging.

CVE-2026-73088 (HIGH): The browserslist package (v4.28.1) in frontend/src/angular/package-lock.json is vulnerable to prototype pollution via normalizeStats(). This function is reached unconditionally through getStat()/loadStat() on EVERY browserslist() call and processes untrusted input — browserslist-stats.json, opts.stats, or CLI --stats data — using an unguarded for...in loop that also enumerates inherited Object.prototype properties. Attacker-controlled keys such as proto, toString, valueOf, constructor, hasOwnProperty, or isPrototypeOf are handled with unchecked bracket access/assignment, allowing prototype pollution of the returned normalized object or uncaught TypeErrors. Impact: an attacker who can influence the stats file or --stats input (e.g., malicious file in a repo, compromised dependency, or contributed build config) can crash the CI/build pipeline (DoS via uncaught exceptions), corrupt build behavior, or chain the pollution into further attacks via gadget code that trusts Object.prototype. Risk level: HIGH — exploitability depends on attacker control of stats input, but the vulnerable code path is exercised on every invocation of browserslist(). Remediation: upgrade browserslist from 4.28.1 to 4.28.7, which guards the for...in loop and brackets access against inherited keys.

Something like this might fix it:

Recommended fix: upgrade the dependency via npm rather than hand-editing the lockfile:

cd frontend/src/angular
npm install browserslist@^4.28.7
# or update all vulnerable transitive dependencies:
npm audit fix

This produces the following change in frontend/src/angular/package-lock.json (lines 5035-5067):

```diff
--- a/frontend/src/angular/package-lock.json
+++ b/frontend/src/angular/package-lock.json
@@ -5035,10 +5035,10 @@
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-<old-integrity-hash>",
+      "version": "4.28.7",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz",
+      "integrity": "sha512-<new-integrity-hash-automatically-generated-by-npm>",
       "dev": true,
       "license": "MIT",
       "dependencies": {
```

Notes:
1. Do not manually set the integrity hash — let npm compute it; the new hash corresponds to browserslist-4.28.7.tgz.
2. If browserslist is pinned transitively by another dependency, add an override in frontend/src/angular/package.json and reinstall:
```diff
 {
   "overrides": {
+    "browserslist": "^4.28.7"
   }
 }
```
3. Verify the fix with `npm ls browserslist` (should report 4.28.7 in all dependency trees) and re-run the vulnerability scanner to confirm CVE-2026-73088 is cleared. Commit the updated package-lock.json.

For reference: rule CVE-2026-73088. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.