From 171ea857cf16f2230f45abd7e16efc049dfed699 Mon Sep 17 00:00:00 2001
From: Joe Boccanfuso <109477394+jbocce@users.noreply.github.com>
Date: Fri, 13 Mar 2026 15:25:55 -0400
Subject: [PATCH] fix(security): Bump flattened version to address
 CVE-2026-32141 for release 3.12 (#5898)

---
 bun.lock     | 3 ++-
 package.json | 3 ++-
 yarn.lock    | 8 ++++----
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/bun.lock b/bun.lock
index 2081e78b9..1bcc6d723 100644
--- a/bun.lock
+++ b/bun.lock
@@ -959,6 +959,7 @@
     "cross-spawn": "7.0.6",
     "dcmjs": "0.49.4",
     "diff": "5.2.2",
+    "flatted": "3.4.0",
     "glob-parent": "6.0.2",
     "lodash": "4.17.23",
     "lodash-es": "4.17.23",
@@ -3131,7 +3132,7 @@
 
     "flatbuffers": ["flatbuffers@1.12.0", "", {}, "sha512-c7CZADjRcl6j0PlvFy0ZqXQ67qSEZfrVPynmnL+2zPc+NtMvrF8Y0QceMo7QqnSPc7+uWjUIAbvCQ5WIKlMVdQ=="],
 
-    "flatted": ["flatted@3.3.3", "", {}, "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg=="],
+    "flatted": ["flatted@3.4.0", "", {}, "sha512-kC6Bb+ooptOIvWj5B63EQWkF0FEnNjV2ZNkLMLZRDDduIiWeFF4iKnslwhiWxjAdbg4NzTNo6h0qLuvFrcx+Sw=="],
 
     "follow-redirects": ["follow-redirects@1.15.11", "", {}, "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ=="],
 
diff --git a/package.json b/package.json
index bcfc6259a..c2c00c1a5 100644
--- a/package.json
+++ b/package.json
@@ -159,7 +159,8 @@
     "webpack": "5.105.0",
     "tar": "7.5.11",
     "serialize-javascript": "7.0.4",
-    "svgo": "3.3.3"
+    "svgo": "3.3.3",
+    "flatted": "3.4.0"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }
diff --git a/yarn.lock b/yarn.lock
index 6a7f27f57..3a117d99c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10217,10 +10217,10 @@ flatbuffers@^1.12.0:
   resolved "https://registry.yarnpkg.com/flatbuffers/-/flatbuffers-1.12.0.tgz#72e87d1726cb1b216e839ef02658aa87dcef68aa"
   integrity sha512-c7CZADjRcl6j0PlvFy0ZqXQ67qSEZfrVPynmnL+2zPc+NtMvrF8Y0QceMo7QqnSPc7+uWjUIAbvCQ5WIKlMVdQ==
 
-flatted@^3.2.9:
-  version "3.3.3"
-  resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.3.tgz#67c8fad95454a7c7abebf74bb78ee74a44023358"
-  integrity sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==
+flatted@3.4.0, flatted@^3.2.9:
+  version "3.4.0"
+  resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.0.tgz#92ab2efec9b272eb85a3a25a106c3afbbc990d8b"
+  integrity sha512-kC6Bb+ooptOIvWj5B63EQWkF0FEnNjV2ZNkLMLZRDDduIiWeFF4iKnslwhiWxjAdbg4NzTNo6h0qLuvFrcx+Sw==
 
 follow-redirects@^1.0.0:
   version "1.15.9"