fix: upgrade @nevware21/ts-utils to 0.14.0 (CVE-2026-46681)

[anupamme]

Summary

Upgrade @nevware21/ts-utils from 0.11.4 to 0.14.0 to fix CVE-2026-46681.

Vulnerability

Field	Value
ID	CVE-2026-46681
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-46681
File	package-lock.json
Assessment	Likely exploitable

Description: @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

Evidence

Scanner confirmation: trivy rule CVE-2026-46681 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• package.json
• package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

Summary by CodeRabbit

• Chores
  • Updated the application’s package configuration to support the latest utility enhancements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 20303ed9-988f-4857-afd5-f5107497c225

📥 Commits

Reviewing files that changed from the base of the PR and between 7387b3d and 7f2421b.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

Walkthrough

Added @nevware21/ts-utils version ^0.14.0 to the dependencies in package.json.

Changes

Dependency Update

Layer / File(s)	Summary
Register ts-utils dependency package.json	Adds @nevware21/ts-utils at version ^0.14.0 to the dependencies object.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: anandgupta42, mdesmet

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the dependency upgrade and security fix.
Description check	✅ Passed	It covers the problem, solution, changes, and verification, though the template's Screenshot/Demo and explicit issue reference are absent.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This is a dependency bump (@nevware21/ts-utils pinned to ^0.14.0) to remediate CVE-2026-46681 (prototype pollution via for...in without hasOwnProperty). The change is consistent: package.json adds the direct dependency and package-lock.json resolves it to 0.14.0, which satisfies the transitive peer ranges (>= 0.11.3 < 2.x). No source code imports this package directly, confirming it's a standard transitive-dependency security pin with no behavior change. Light-touch review per repo guidance; lockfile integrity is separately enforced by lockfile-lint.yml.

Files Reviewed (2 files)

• package.json
• package-lock.json

---

_{Reviewed by glm-5.2 · Input: 31.3K · Output: 3K · Cached: 179.3K}

_{Review guidance: REVIEW.md from base branch master}

[dev-punia-altimate]

🤖 Code Review — OpenCodeReview (Gemini) — No Issues Found

No supported files changed.