shepherdwind velocity.js

• CVE-2026-73649 Critical 9.8 Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix) 0.7%
• CVE-2026-44966 High 8.3 Velocity.js: Prototype Pollution in #set path assignment 0.5%