v3.41.0

• 11 new rules close the rest of the month's backlog on widely used packages: multer DoS cluster, @xmldom/xmldom 2026-09 parser cluster, @tiptap/core ReDoS, adm-zip allocation DoS, @angular/platform-server SSR SSRF + XSS, @sap/cds-mtxs credential disclosure, @argos-ci/core and @cyclonedx/cyclonedx-npm command injection, @nuxtjs/mdc XSS, ExifReader memory exhaustion, @rsdoctor/rspack-plugin exposed report API
• xmldom, react-server-dom-* and @mikro-orm/* rules no longer flag ranges that resolve past the fix
• Rule count 492 → 503, CVE version-pin rules 117 → 128; full details in CHANGELOG.md