Worked remediation: bun

From the student project, after reviewing the report and advisories:

bun add --exact --ignore-scripts axios@1.20.0 lodash@4.18.1
node --test
node src/app.mjs
bun pm ls --all
npm exec --yes --package=cve-lite-cli@1.40.0 -- cve-lite . --json --all --no-open

The supplied solution pins axios 1.20.0 and lodash 4.18.1. Its application code and four functional tests are unchanged. Both vulnerable direct packages are upgraded; axios's transitive graph changes too. This is a reviewed major-version migration, not a claim that it is the smallest fix. The captured scanner instead proposes axios 0.34.0 and lodash 4.18.0 as lower known-non-vulnerable targets. Students may investigate those alternatives and receive credit if their evidence and tests support them. Do not claim the alternative was tested by this kit.

Measured reference outcome on 2026-10-25: 2 vulnerable packages before, 0 after, complete scans. This is a package count, not a CVE count. Passing these narrow benign tests does not prove compatibility for every application or absence of exploitable behavior.