fix(security): patch 2 critical npm CVEs via overrides (shell-quote, websocket-driver)

[devin-ai-integration]

Summary

npm audit in web-front-end/react reported 2 critical advisories, both in transitive dev dependencies of react-scripts@5.0.1 with no direct upgrade path (a direct npm audit fix on the tree wants react-scripts@0.0.0). Pinned them with npm overrides instead — no direct dependency versions change, no source changes.

+ "overrides": {
+   "shell-quote": "^1.10.0",       // was 1.8.3 — GHSA critical (<=1.8.4)
+   "websocket-driver": "^0.7.5"    // was 0.7.4 — GHSA-mp7j-qc5w-4988 / GHSA-xv26-6w52-cph6
+ }

Chains: react-scripts → react-dev-utils / webpack-dev-server → launch-editor → shell-quote, and react-scripts → webpack-dev-server → sockjs → faye-websocket → websocket-driver.

Result: critical count 2 → 0 (total 54 → 52; remaining 28 high / 14 moderate / 10 low are unchanged and mostly require the react-scripts major bump or an ag-grid-community major bump — out of scope here). npm ls confirms both overrides resolve; tsc --noEmit and npm run lint pass.

Python backend (traderx-monolith/requirements.txt): pip-audit reports no known vulnerabilities. Note that file is fully unpinned, so pip-audit resolves the latest release of each package — it does not tell you whether a deployed/installed environment is vulnerable.

Link to Devin session: https://app.devin.ai/sessions/5e03233949124c82a8be932c88e6a2e1
Open in Devin Desktop: https://app.devin.ai/desktop/session/5e03233949124c82a8be932c88e6a2e1?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime smoke test: PASSED

Verified the app end-to-end with the new overrides installed (shell-quote 1.10.0, websocket-driver 0.7.5), backend on :8000 and CRA dev server on :18094.

The risk area — dev-server websocket / HMR — works. With the page open and untouched, I edited the header string in src/App.tsx; the UI updated in place with no manual refresh, which is only possible if the webpack-dev-server websocket (backed by websocket-driver/sockjs) is healthy. Console had zero websocket/sockjs errors. (Edit was reverted.)

Golden path — trade placed and pushed live over socket.io: selected account Private Clients Fund TTXX #11413 (3 seeded trades/positions), submitted MSFT 250 Buy. Green "Trade created successfully" snackbar, and without any refresh a new MSFT / 250 / Buy / Settled blotter row + matching position appeared, totals 3 → 4.

Dev server compile output

Compiled successfully!
webpack compiled successfully
No issues found.

Only pre-existing noise: Browserslist "caniuse-lite is 6 months old" and the webpack-dev-server onBeforeSetupMiddleware/onAfterSetupMiddleware deprecation warnings.

Account load / blotters before the trade (3 trades, 3 positions)

Notes

• Pre-existing (not caused by this PR) console warnings on the Create Trade dialog: validateDOMNesting: <h6> cannot appear as a child of <h2> and MUI Autocomplete "props object containing a 'key' prop is being spread into JSX".
• Not covered: production npm run build, other tenants, trade validation edge cases.

Tested by Devin — session