fix(deps): remediate 2 critical npm advisories in React frontend

[devin-ai-integration]

Summary

Dependency audit of TraderX found 2 CRITICAL npm advisories in web-front-end/react (backend pip-audit was clean). This applies npm audit fix — lockfile-only, no package.json / direct-dependency changes, no breaking upgrades.

Critical fixes (both transitive under react-scripts):

• shell-quote 1.8.3 → 1.10.0 — GHSA-w7jw-789q-3m8p (newline escaping in quote()), GHSA-395f-4hp3-45gv (quadratic-complexity DoS in parse())
• websocket-driver 0.7.4 → 0.7.5 — GHSA-mp7j-qc5w-4988 (compression resource-limit bypass), GHSA-xv26-6w52-cph6 (message corruption via protocol length headers)

Also picked up in the same non-breaking pass (runtime path via socket.io-client):

• socket.io-parser 4.2.5 → 4.2.7, ws 8.18.3/8.19.0 → 8.21.3, engine.io-client 6.6.4 → 6.6.6

Result: npm audit goes 54 → 30 vulnerabilities, 0 critical remaining. Remaining 30 (15 high) are all dev-only chains under react-scripts@5.0.1 (webpack-dev-server/sockjs/uuid, underscore via jsonpath/bfj) that only npm audit fix --force would touch, which downgrades react-scripts to 0.0.0 — deliberately not done here.

Verified: npm run build compiles successfully and npm run lint is clean.

Link to Devin session: https://app.devin.ai/sessions/ab88829c7e8943d580fe601ff5999065
Open in Devin Desktop: https://app.devin.ai/desktop/session/ab88829c7e8943d580fe601ff5999065?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime verification — socket.io realtime path unaffected by the lockfile bumps

Ran the full stack locally on this branch with node_modules at the bumped versions (socket.io-parser 4.2.7, ws 8.21.3, engine.io-client 6.6.6): backend on :8000, React dev server on :18094, default tenant acme_corp.

Created two trades through the New Trade dialog. Trade Blotter and Position Blotter both updated without a page reload — rows are appended only inside the socket.on('publish', …) handler in src/Datatable/Datatable.tsx (no polling/refetch), so this is direct proof the websocket → engine.io → socket.io-parser decode chain still works.

Before (3 trades / 3 positions)	After AAPL 4242 Buy pushed live (4 / 4)

Second trade (MSFT 777 Sell) → counts 4→5, position correctly -777, with inbound 42["publish",{"topic":"/accounts/11413/trades"…}] frames visible in DevTools:

Transport is a real websocket (HTTP 101), not a polling fallback

socket.io/?tenant=acme_corp&EIO=4&transport=websocket → 101 Switching Protocols, Upgrade: websocket, Server: uvicorn. Frames: outgoing 42["subscribe","/accounts/11413/trades"] / …/positions"], incoming 42["publish",…].

Console check: zero entries matching websocket / engine.io / socket.io / xhr poll error / TypeError. Only two pre-existing MUI/React dev warnings (validateDOMNesting <h6> in <h2> from DialogTitle, Autocomplete "key" prop spread into JSX), unrelated to this change. State also persists correctly after a full page reload (REST re-render).

Written by Devin