Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 88: The package.json dependency entry for "fast-xml-parser" currently
uses the unbounded, vulnerable version specifier ">=5.3.5"; update that
specifier to either "^5.3.5" to constrain upgrades to the 5.x line or ">=5.3.6"
to explicitly exclude the vulnerable 5.3.5 release (choose one and replace the
existing ">=5.3.5" value in the package.json dependency for "fast-xml-parser").

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 89: The override for "js-yaml": ">=4.1.1" is out-of-scope for the
fast-xml-parser CVE and uses an unbounded range; change the version specifier to
a bounded caret range (e.g., "^4.1.1") to pin to the 4.x line and add a short
comment in package.json (and/or a note in the PR description) stating this was
added specifically to address CVE-2025-64718 (js-yaml 3.14.1/4.1.0) so reviewers
know why this separate security override was included.

---

Duplicate comments:
In `@package.json`:
- Line 90: Dependency declaration for fast-xml-parser should explicitly require
a secure minimum version; update the package.json entry for "fast-xml-parser"
(the dependency name) to ensure it resolves to at least 5.3.6 (e.g., change the
version string to ">=5.3.6" or a fixed minimum like "^5.3.6") so the
CVE-2026-25896 fix and defense-in-depth improvements are pulled in; verify
package-lock.json/yarn.lock is regenerated and included so CI installs the
patched version.