Feat/entity value admin console

[osalama7]

Use Create Entity Value endpoints to create Entities independently when values are provided

• ev-resolver.go is responsible for resolving value linking via entityId in JSON definition see ev-resolver.go
• This change allows to rely on newly introduced end points in the entity value policies refactor branch to create entities and values conditionally.
• Allows to refactor UpdateUsermetaNamespace rest handler to be responsible for Namespace Crud Operations only.

Additional Notes

1. Resolves: WPB-27253
2. Implements: Admin side Namespace and EV Crud operations for Entity value policy refactor

• Bug: WPB-27348
• Bug: WPB-27253
• Issue: WPB-23527

[semgrep-code-pydio]

Semgrep found 1 ssc-c8b7a1f2-4d36-4f0a-9e2b-1a5c8d7e6f30 finding:

• frontend/assets/pnpm-lock.yaml
  • L8791 - Triage

Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like /.env::$DATA?raw, or 8.3 short filenames), allowing an attacker to read otherwise-denied files when the dev server is exposed to the network.

Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows

Fix: Upgrade this library to at least version 7.3.5 at cells/frontend/assets/pnpm-lock.yaml:8791.

Reference(s): GHSA-fx2h-pf6j-xcff, CVE-2026-53571

Semgrep found 1 ssc-1a0f4ed6-c2fe-47ec-b275-9bdc1073cf2e finding:

• frontend/assets/pnpm-lock.yaml
  • L2249 - Triage

Risk: Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with modules: "systemjs") can cause Babel to emit output that executes arbitrary JavaScript when the compiled bundle is loaded.

Manual Review Advice: A vulnerability from this advisory is reachable if you install @babel/plugin-transform-modules-systemjs plugin through cli, or use @babel/preset-env preset with modules set to "systemjs"

Fix: Upgrade this library to at least version 7.29.4 at cells/frontend/assets/pnpm-lock.yaml:2249.

Reference(s): GHSA-fv7c-fp4j-7gwp, CVE-2026-44728

Semgrep found 1 ssc-1289c362-ab31-4c96-bd5e-5e444f4fb067 finding:

• frontend/assets/pnpm-lock.yaml
  • L8791 - Triage

Risk: Affected versions of vite are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Missing Authentication for Critical Function. This occurs because the Vite Dev Server WebSocket improperly exposes the fetchModule method, allowing unauthenticated remote attackers to bypass filesystem restrictions and read arbitrary files from the host machine

Manual Review Advice: A vulnerability from this advisory is reachable if you enable vite dev server using --host flag and websocket is not disabled

Fix: Upgrade this library to at least version 7.3.2 at cells/frontend/assets/pnpm-lock.yaml:8791.

Reference(s): GHSA-p9ff-h696-f583, CVE-2026-39363

Semgrep found 1 ssc-81d0f8fa-e5f9-414f-a539-fa38f9590a35 finding:

• frontend/assets/pnpm-lock.yaml
  • L8791 - Triage

Risk: Affected versions of vite are vulnerable to Improper Access Control / Incorrect Behavior Order. Vite's dev server can bypass server.fs.deny protections: if the server is exposed to the network and a denied file is within an allowed directory, an attacker can retrieve sensitive files such as .env or certificate files by requesting them with query parameters like ?raw, ?import&raw, or ?import&url&inline.

Manual Review Advice: A vulnerability from this advisory is reachable if you enable vite dev server using --host flag and have sensitive data in deny list

Fix: Upgrade this library to at least version 7.3.2 at cells/frontend/assets/pnpm-lock.yaml:8791.

Reference(s): GHSA-v2wj-q39q-566r, CVE-2026-39364

Semgrep found 1 ssc-09995be6-8422-43ba-9a1a-1642ad98bd96 finding:

• frontend/assets/pnpm-lock.yaml
  • L8383 - Triage

Risk: Affected versions of svgo are vulnerable to Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'). SVGO's XML parsing supports custom DOCTYPE entities and will expand them without limits, allowing a "Billion Laughs" style entity-expansion payload (recursive/nested entity references) in a tiny SVG to consume excessive CPU/memory and stall or crash the Node.js process when optimizing untrusted SVG input (e.g., user uploads) via optimize().

Manual Review Advice: A vulnerability from this advisory is reachable if you are using svgo on the CLI

Fix: Upgrade this library to at least version 3.3.3 at cells/frontend/assets/pnpm-lock.yaml:8383.

Reference(s): GHSA-xpqw-6gx7-v673, CVE-2026-29074

Semgrep found 1 ssc-6193c409-cebc-449c-8a55-f95fa9d0e4f0 finding:

• frontend/assets/pnpm-lock.yaml
  • L7985 - Triage

Risk: Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing ../ sequences to survive and be passed into path.resolve when computing output paths. This lets an attacker escape the configured output directory and overwrite arbitrary files on the host filesystem that the build process can write to, potentially leading to persistent RCE by clobbering shell/profile or other executable/config files.

Manual Review Advice: A vulnerability from this advisory is reachable if you are running rollup --input

Fix: Upgrade this library to at least version 4.59.0 at cells/frontend/assets/pnpm-lock.yaml:7985.

Reference(s): GHSA-mw96-cpmx-2vgc, CVE-2026-27606

Semgrep found 1 ssc-c45b5a59-f3fa-45d7-b31d-0b048412a07c finding:

• frontend/assets/pnpm-lock.yaml
  • L8831 - Triage

Risk: Affected versions of vitest are vulnerable to Missing Authorization. When the Vitest UI server is listening, the deprecated isFileServingAllowed check is applied without normalizing the URL before filesystem operations, allowing path traversal that lets an attacker read, write, and execute arbitrary files outside the project directory.

Manual Review Advice: A vulnerability from this advisory is reachable if you run the Vitest UI on Windows, or you expose the Vitest UI server to the network with the --api.host flag or api.host config option

Fix: Upgrade this library to at least version 4.1.0 at cells/frontend/assets/pnpm-lock.yaml:8831.

Reference(s): GHSA-5xrq-8626-4rwp

[semgrep-code-pydio]

Semgrep found 2 ssc-7b3c1e5a-9d24-4f80-b6a1-2c8e0f35d719 findings:

• frontend/assets/pnpm-lock.yaml
  • L6019 - Triage
  • L6023 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large !!omap sequence, which js-yaml resolves with a linear duplicate-key scan inside its per-element loop. Resolution is therefore quadratic in the number of entries, so a modestly sized document consumes disproportionate CPU inside the load call and blocks the event loop, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.1 at cells/frontend/assets/pnpm-lock.yaml:6023.

Reference(s): GHSA-5p4m-2wfm-xmqj

Semgrep found 2 ssc-b5be3fd7-c1fb-4156-b16f-2fc35cb62b00 findings:

• frontend/assets/pnpm-lock.yaml
  • L6019 - Triage
  • L6023 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.0 at cells/frontend/assets/pnpm-lock.yaml:6023.

Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869