issue-53-npm-fix
master
Bring dependency tree from 103 vulns (4 critical / 71 high) down to 4 moderate via npm audit fix, locked transitive overrides, and a CRA-compatible brace-expansion shim. Remaining moderates need react-router v7 and leaving Create React App.