Dependency audit: manual review needed

`yarn audit:ci` found advisories that [dependency-audit-escalation](https://github.com/MetaMask/metamask-mobile/actions/runs/33500332418) could not fix automatically (no safe version bump, or the fix broke `yarn dedupe`/`yarn constraints`). See .github/audit-owners.yml for the SLA, or add an entry to .github/audit-accepted.yml to accept this as a risk instead of fixing it.

- **ms** (high) — [TEST-0002](https://github.com/MetaMask/metamask-mobile/pull/35470): [TEST] Synthetic advisory injected by a one-off e2e smoke test of dependency-audit-escalation.yml, re-run after the token-exchange-service policy fix. Not a real vulnerability — safe to close/delete anything this produces.
- Reason: Could not determine a published version outside the vulnerable range.

- **ms** (high) — [TEST-0010](https://github.com/MetaMask/metamask-mobile/pull/35470): [TEST] Synthetic advisory injected to confirm the Bugbot fixes (tracking-issue body dedupe, per-advisory revert, dedupe-before-audit ordering, success()/failure()-based Slack gating). Not a real vulnerability — safe to close/delete anything this produces.
- Reason: `ms` is not a direct dependency and has no existing resolutions entry in package.json, so any fix would require add-resolution. The advisory itself provides no CVE/GHSA data, no vulnerable-version range, and no patched-version info (its title self-identifies as a synthetic test advisory with a GitHub PR URL rather than a real security advisory). Although dependents' ranges (debug, humanize-ms, jsonwebtoken, logform, send, serve-favicon) all happen to overlap around ms@2.1.3, that overlap doesn't establish that any particular version actually fixes a real, unspecified vulnerability — pinning a resolution here would be guessing rather than a substantiated fix.

- **@xmldom/xmldom** (moderate) — [1158518](https://github.com/advisories/GHSA-6gmq-8vp8-gcm6): xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
- Reason: AI analyzer returned no proposal for this advisory.
- **qs** (moderate) — [1158506](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx): qs array-limit bypass via bracket-key comma parsing
- Reason: AI analyzer returned no proposal for this advisory.
- **qs** (moderate) — [1158507](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g): qs: Denial of Service via Attacker Controlled isBuffer
- Reason: AI analyzer returned no proposal for this advisory.

- **@xmldom/xmldom** (moderate) — [1158518](https://github.com/advisories/GHSA-6gmq-8vp8-gcm6): xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
- Reason: @xmldom/xmldom is a direct dependency pinned to ^0.8.13, but dependents show conflicting narrow ranges: @expo/plist requires '~0.7.7 | ^0.8.8' and plist requires '^0.8.8 | ^0.9.10'. There is no version confirmed to both contain the fix for this advisory and simultaneously satisfy the 0.7.x/0.8.x-only branch some dependents are locked to, so a bump or resolutions pin risks silently breaking @expo/plist or plist (or leaving them on an unpatched duplicate resolved version).
- **qs** (moderate) — [1158506](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx): qs array-limit bypass via bracket-key comma parsing
- Reason: qs is already force-pinned via package.json resolutions to the exact version 6.15.2, and every listed dependent (storybook packages, body-parser, contentful-sdk-core, eth-url-parser, plus 3 truncated more) shows its declared range as exactly '6.15.2' rather than a real semver range, meaning any change to the resolution target would violate the constraint recorded for all of them; no confirmed-safe alternate version satisfies this fully-locked set.
- **qs** (moderate) — [1158507](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g): qs: Denial of Service via Attacker Controlled isBuffer
- Reason: Same situation as the sibling qs advisory (1158506): qs is resolutions-pinned to exact 6.15.2 and all dependents (with 3 more truncated) report that exact version as their required range, so no target version can be proposed that fixes the DoS issue without conflicting with every recorded dependent constraint.

- **lodash** (moderate) — [TEST-0012](https://github.com/MetaMask/metamask-mobile/pull/35639): [TEST] Synthetic advisory injected to verify ai-analyzer v2.3.0's per-mode maxIterations/model config (30 iterations, claude-sonnet-5) actually takes effect. Not a real vulnerability — safe to close/delete anything this produces.
- Reason: AI analyzer returned no proposal for this advisory.

- **lodash** (moderate) — [TEST-0013](https://github.com/MetaMask/metamask-mobile/pull/35639): [TEST] Synthetic advisory injected to verify ai-analyzer v2.3.0's per-mode maxIterations/model config (30 iterations, claude-sonnet-5) actually takes effect with MetaMask skills disabled. Not a real vulnerability — safe to close/delete anything this produces.
- Reason: This advisory is self-described as a synthetic/test entry (not a real CVE ID, title explicitly states it is a fabricated test case), and the dependents data is internally inconsistent: every one of the 12+ listed dependents (spanning unrelated ecosystems like @docusaurus/*, @appium/support, and @metamask/*-controller packages) reports the exact same literal range '4.18.1', which is not a valid semver range and does not correspond to any real published lodash version (latest stable lodash is 4.17.21). Because the dependents list cannot be used to verify that any candidate version would satisfy real consumer constraints, and there is no genuine vulnerability/fixed-version data to act on, no safe, verifiable fix can be proposed here.