build(deps-dev): bump websocket-driver past security advisory

[eviechan]

What did I change:

Lockfile-only refresh moving websocket-driver 0.7.4 → 0.7.5, closing the open critical Dependabot alert (#141, GHSA-xv26-6w52-cph6 / CVE-2026-54466 — message corruption via abuse of protocol length headers). The same bump also clears GHSA-mp7j-qc5w-4988 (resource limit bypass via message compression) flagged by npm audit against the same version.

websocket-driver is not a direct dependency — it is a dev-only transitive: webpack-dev-server@5.2.4 → sockjs@0.3.24 → faye-websocket@0.11.4 → websocket-driver@0.7.4. Both parent ranges (^0.7.4, >=0.5.1) already admit the patched 0.7.5, so no package.json change and no new overrides entry are needed — npm update websocket-driver --package-lock-only is the entire change. The repo has no dependabot.yml, so alerts are raised but fix PRs are never auto-opened; this closes the gap manually.

The new lockfile entry's integrity hash was verified against the official registry metadata for websocket-driver@0.7.5 and against a recomputed sha512 of the tarball itself. 0.7.5's own dependency ranges are unchanged from 0.7.4, so no other lockfile entry moved.

Commit is typed build(deps-dev): rather than fix: so semantic-release does not cut a release for a dev-only lockfile change.

QA Notes:

No QA pass needed. The published package ships zero runtime dependencies (files: ["lib/"], no dependencies block), so websocket-driver never reaches the shipped bundle — it is only loaded by webpack-dev-server during local npm run dev. Exposure was dev-environment noise rather than a shipped vulnerability. CI (Prettier, tsc, Cypress E2E) fully covers the change.

Related Tickets:

None — no Linear ticket. This addresses Dependabot alert #141.

Did you...

• test the code locally? (npm ci, npx tsc, npm run build, npm audit — websocket-driver advisories gone)
• run unit tests and updated to account for the changes? (repo has no unit tests; Cypress E2E runs in CI)
• lint the code? (no ESLint in this repo; npm run format:check passes)
• format the code? (no source changes — lockfile only)
• test the code on staging? (N/A — dev-only lockfile change, nothing ships)