[Snyk] Fix for 3 vulnerabilities

[maniator]

Snyk has created this PR to fix 3 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Handling of Unicode Encoding SNYK-JS-TAR-15038581	713
	Regular Expression Denial of Service (ReDoS) SNYK-JS-DIFF-14917201	708
	Prototype Pollution SNYK-JS-LODASH-15053838	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

[Copilot]

Pull request overview

This PR updates several JavaScript dependencies (both direct and transitive via yarn.lock) to remediate three Snyk-reported vulnerabilities in tar, diff, and lodash.

Changes:

• Bump devtools-launchpad from ^0.0.100 to ^0.0.139, updating its dependency tree (including React-related and tooling packages) in yarn.lock.
• Bump devtools-source-map from ^0.14.2 to ^0.15.0 and align its transitive dependencies (e.g., devtools-utils) in yarn.lock.
• Bump lodash from ^4.17.4 to ^4.17.23 and update related entries and security-sensitive transitive packages in yarn.lock (e.g., replacing older adm-zip/tar.gz paths with newer adm-zip/tar/https-proxy-agent combinations).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates direct dependency versions for devtools-launchpad, devtools-source-map, and lodash to safer releases recommended by Snyk.
yarn.lock	Regenerates and adjusts locked dependency graph to match the new manifest versions, including updated transitive security-sensitive libraries (adm-zip, tar, https-proxy-agent, lodash, and devtools-related packages).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.