fix(deps): override flatted security release

[ScriptedAlchemy]

Summary

• Adds a pnpm override for flatted 3.4.2.
• Refreshes pnpm-lock.yaml so transitive flatted resolutions use the patched release.

Closes #4575

Validation

• corepack pnpm install --frozen-lockfile --lockfile-only --ignore-scripts
• corepack pnpm audit --prod --json checked flatted advisory visibility after the lock update.

Skipped checks

• Full package build/test/lint were not run because this PR only updates a transitive dependency override and lockfile entries for the security advisory.

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	9bd6f5c
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a1659ef0c4c75000771d3e0
😎 Deploy Preview	https://deploy-preview-4762--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9bd6f5c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@9bd6f5c

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@9bd6f5c

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@9bd6f5c

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@9bd6f5c

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@9bd6f5c

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@9bd6f5c

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@9bd6f5c

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@9bd6f5c

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@9bd6f5c

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@9bd6f5c

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@9bd6f5c

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@9bd6f5c

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@9bd6f5c

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@9bd6f5c

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@9bd6f5c

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@9bd6f5c

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@9bd6f5c

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@9bd6f5c

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@9bd6f5c

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@9bd6f5c

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@9bd6f5c

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@9bd6f5c

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@9bd6f5c

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@9bd6f5c

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@9bd6f5c

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@9bd6f5c

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@9bd6f5c

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@9bd6f5c

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@9bd6f5c

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@9bd6f5c

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@9bd6f5c

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@9bd6f5c

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@9bd6f5c

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@9bd6f5c

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@9bd6f5c

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@9bd6f5c

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@9bd6f5c

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@9bd6f5c

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@9bd6f5c

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@9bd6f5c

commit: 9bd6f5c

[github-actions]

Bundle Size Report

12 package(s) changed, 29 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/cli	26.3 kB	no change	786 B	no change
@module-federation/core	39.1 kB	no change	173 B	no change
@module-federation/devtools	664.0 kB	no change	4.0 kB	no change
@module-federation/enhanced	807.9 kB	no change	672 B	no change
@module-federation/inject-external-runtime-core-plugin	5.2 kB	-26 B (-0.5%)	519 B	no change
@module-federation/managers	69.8 kB	no change	334 B	no change
@module-federation/manifest	136.1 kB	no change	182 B	no change
@module-federation/metro-plugin-rnc-cli	0 B	no change	314 B	no change
@module-federation/node	193.4 kB	no change	217 B	no change
@module-federation/runtime-core	287.4 kB	-8 B (-0.0%)	477 B	no change
@module-federation/storybook-addon	77.9 kB	no change	100 B	no change
@module-federation/utilities	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-31 B (-1.3%)	2.3 kB	-31 B (-1.3%)
@module-federation/core	1.1 kB	-32 B (-2.9%)	1.0 kB	-31 B (-2.9%)
@module-federation/devtools	30.2 kB	-29 B (-0.1%)	30.2 kB	-29 B (-0.1%)
@module-federation/enhanced	2.6 kB	-44 B (-1.6%)	2.6 kB	-44 B (-1.6%)
@module-federation/inject-external-runtime-core-plugin	396 B	no change	396 B	no change
@module-federation/managers	2.4 kB	-27 B (-1.1%)	2.4 kB	-27 B (-1.1%)
@module-federation/manifest	6.1 kB	-40 B (-0.6%)	6.1 kB	-40 B (-0.6%)
@module-federation/metro-plugin-rnc-cli	411 B	-26 B (-5.9%)	411 B	-26 B (-5.9%)
@module-federation/node	9.2 kB	-28 B (-0.3%)	9.2 kB	-28 B (-0.3%)
@module-federation/runtime-core	15.2 kB	no change	15.0 kB	no change
@module-federation/storybook-addon	1.9 kB	-24 B (-1.2%)	1.7 kB	-24 B (-1.3%)
@module-federation/utilities	2.6 kB	-32 B (-1.2%)	2.6 kB	-32 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.4 kB	-21 B (-0.1%)	22.5 kB	-8 B (-0.0%)	+1.1 kB	+13 B

Total dist (raw): 6.78 MB (-34 B (-0.0%))
Total ESM gzip: 76.6 kB (no change)
Total web bundle (gzip): 205.4 kB (-313 B (-0.1%))
Total node bundle (gzip): 205.9 kB (-312 B (-0.1%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.