fix: upgrade path-to-regexp to 0.1.13 (CVE-2026-4867)

[anupamme]

Summary

Upgrade path-to-regexp from 0.1.12 to 0.1.13 to fix CVE-2026-4867.

Vulnerability

Field	Value
ID	CVE-2026-4867
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-4867
File	yarn.lock (dependency: path-to-regexp)
Assessment	Present in dependency tree, not confirmed reachable

Description: path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters

Evidence

Scanner confirmation: trivy rule CVE-2026-4867 flagged this pattern.

Changes

• package.json
• yarn.lock

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 750367cc-a7b5-4486-b849-9b3e439f7738

📥 Commits

Reviewing files that changed from the base of the PR and between 2b56e9c and 4d6e61c.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated package resolution to use a specific version of a routing utility for improved consistency and compatibility.

Walkthrough

The package resolutions retain the pinned webpack version and add path-to-regexp pinned to 0.1.13.

Changes

Dependency Resolution

Layer / File(s)	Summary
Add path-to-regexp resolution package.json	The resolutions block adds path-to-regexp at version 0.1.13 and retains the existing webpack pin.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: clintonium-119

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency upgrade and the CVE it addresses.
Description check	✅ Passed	The description directly explains the dependency upgrade, vulnerability, affected files, and intended security outcome.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: [BABEL] /package.json: Using babel-preset-react-app requires that you specify NODE_ENV or BABEL_ENV environment variables. Valid values are "development", "test", and "production". Instead, received: undefined. (While processing: "/node_modules/babel-preset-react-app/index.js")

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request has been flagged as potential spam (promotional) by CodeRabbit slop detection and should be reviewed carefully.