fix(deps): bump fflate to 0.8.3 (WCN-2574, GHSA-px8p-9vwx-vf98)

[zahin-mohammad]

Ticket

WCN-2574

Problem

The SDK release workflow failed at the Enforce Vulnerability Severity Threshold gate (osv-severity-gate, CVSS >= 7.0 blocks the release): run 33773067086

Single blocking finding out of 41 advisory groups:

• fflate@0.8.2 — CVSS 7.5 (HIGH) — GHSA-px8p-9vwx-vf98 / CVE-2026-45820: unzipSync() infinite-loops when parsing a malformed ZIP64 archive (central-directory entry declares compressed_size=0xFFFFFFFF but lacks the required ZIP64 extra field tag 0x0001) — denial of service.
• Patched in fflate 0.8.3 (release v0.8.3).
• The GHSA received its 7.5 CVSS score on 2026-09-03, which is why a previously green release tree began failing the gate.

Why lockfile-only (no jspdf upgrade, no resolutions entry)

• fflate arrives transitively via jspdf (jspdf >= 4.2.0 → fflate ^0.8.1).
• jsPDF 4.2.1 is already the newest published version (npm latest and upstream master package.json both still pin fflate ^0.8.1); there is nothing to upgrade to that would change fflate's constraint.
• The ^0.8.1 range already admits the patched 0.8.3, so this is purely a stale lockfile resolution — refreshing yarn.lock suffices.
• A permanent root resolutions entry was considered and rejected: redundant while ^0.8.1 admits the fix, and it adds a forced override that must be removed once jspdf bumps its floor.

Change

Single yarn.lock hunk: fflate 0.8.2 → 0.8.3.

Verification

• CI's literal commit-lint command (GITHUB_REPO_BRANCH=master yarn run check-commits) passes: ✔ found 0 problems, 0 warnings.
• Replicated the release audit locally with the same image and args as npmjs-release.yml#L272-L281 (ghcr.io/google/osv-scanner-action:v2.3.8 … --config=osv-scanner.toml --format=json ./, scanned yarn.lock, 2798 packages):
  • fflate_findings=0 in scan results.
  • Severity-gate jq predicate (advisory groups with max_severity >= 7.0) = 0 → gate passes (40 advisory groups remain, all below threshold).
• yarn install --frozen-lockfile passes (matches the release workflow's Install dependencies step).

[linear-code]

WCN-2574