fix(deps): patch 2 critical npm CVEs via shell-quote / websocket-driver overrides

[devin-ai-integration]

Summary

npm audit in web-front-end/react reports 55 vulnerabilities, 2 of them CRITICAL. Both are transitive under react-scripts@5.0.1, which pins them below the patched releases, so they can only be lifted with overrides:

"overrides": {
  "shell-quote": "^1.10.0",      // was 1.8.3 — GHSA-w7jw-789q-3m8p (newline escape bypass in quote()), GHSA-395f-4hp3-45gv
  "websocket-driver": "^0.7.5"   // was 0.7.4 — GHSA-mp7j-qc5w-4988, GHSA-xv26-6w52-cph6
}

Chains: react-dev-utils/launch-editor → shell-quote, and webpack-dev-server → sockjs(+faye-websocket) → websocket-driver.

Both patched versions are semver-minor/patch and API-compatible; npm run build compiles successfully and npm audit now reports 0 critical (53 remaining: 12 low, 12 moderate, 29 high).

The remaining HIGH findings are not addressed here — they need semver-major bumps (react-scripts eject-level upgrade, ag-grid-community 29 → 36) and belong in separate PRs. Python backend (pip-audit -r traderx-monolith/requirements.txt) reports no known vulnerabilities.

Link to Devin session: https://app.devin.ai/sessions/abd057b367af41d9936bb393e1e88a71
Open in Devin Desktop: https://app.devin.ai/desktop/session/abd057b367af41d9936bb393e1e88a71?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime smoke test — dependency overrides verified end-to-end

Since this PR only pins shell-quote ^1.10.0 and websocket-driver ^0.7.5 inside the
react-scripts dev toolchain, the risk surface is the dev server boot
(react-dev-utils/launch-editor → shell-quote) and the dev-server websocket / HMR
(webpack-dev-server → sockjs → faye-websocket → websocket-driver). Both were exercised
against a real running stack (monolith on :8000, CRA dev server on :18094 from the
regenerated lockfile).

socket.io real-time update works — new trade lands in both blotters with no page reload

Submitted IBM / 42 / Buy via the New Trade dialog. Trade Blotter went 3 → 4 trades and
Position Blotter 3 → 4 positions instantly, with no refresh:

Backend confirmed the publishes:

Client <sid> subscribed to room: /accounts/11413/trades
Client <sid> subscribed to room: /accounts/11413/positions
Published trade update to room /accounts/11413/trades: trade_id=22 state=Settled
Published position update to room /accounts/11413/positions: security=IBM qty=42

Dev server boots clean & blotters load with seed data

npm start printed Compiled successfully! / webpack compiled successfully with no
shell-quote or sockjs errors (only the pre-existing onBeforeSetupMiddleware deprecation and
stale caniuse-lite warnings). Connection chip reads Connected:

HMR over the dev-server websocket (the discriminating test for websocket-driver)

Edited the TraderX header string in src/App.tsx with the app open; the live page hot-updated
to "TraderX HMR OK" within a couple of seconds without a manual reload, and reverted cleanly.

Browser console contained zero entries matching sockjs|websocket|shell-quote|transport.
The only console output was two pre-existing MUI React warnings (validateDOMNesting <h6> in <h2>
from DialogTitle, and "key" prop spread into JSX from Autocomplete) — unrelated to this PR.