The fix is within the pinned 0.3.x line but the exact pin kept npm update from reaching it. Clears the last high-severity production vulnerability; frontend build and full spec suite verified.
