asymmetric-effort specifyjs

• CVE-2026-50290 Medium 5.3 @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString 0.5%
• CVE-2026-50288 High 8.7 @asymmetric-effort/specifyjs: URL parse failure silently allows request 0.5%