Possible fix(deps): 2 vulnerable dependencies in yarn.lock

This might be a false positive, but `yarn.lock` around line 402 looked worth a second pair of eyes.

The project uses @grpc/grpc-js version 1.12.2, which is vulnerable to CVE-2026-48068. An attacker can send a malformed HTTP/2 stream that triggers an unhandled exception, causing the gRPC server process to crash. This denial‑of‑service condition is classified as HIGH severity because it can bring down critical services. Upgrading to a patched release (≥ 1.12.7, or any of the listed fixed versions) eliminates the flaw.

Something like this might fix it:

````diff
```diff
--- a/yarn.lock
+++ b/yarn.lock
@@
-@grpc/grpc-js@1.12.2:
- version "1.12.2"
- resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.12.2.tgz#..."
- integrity sha512-...
- dependencies:
- ...
+@grpc/grpc-js@1.14.4:
+ version "1.14.4"
+ resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.14.4.tgz#..."
+ integrity sha512-...
+ dependencies:
+ ...
```
````

For reference: rule `CVE-2026-48068`. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Inspect yarn.lock around line 402 and confirm how @grpc/grpc-js 1.12.2 is resolved in this project. Check the available patched release and update the lockfile only if compatible, then run the project's existing validation or build checks. Done means the vulnerable dependency is resolved to a patched version without breaking the extension.

Written by the indexing model from the issue text.