Refresh the vulnerable development toolchain

[jskoiz]

Verified against main at 715c52e. Audit observation date: 2026-08-09.

Impact

Under the repository's required Node 24.18.0 runtime, npm audit --audit-level=high currently exits non-zero with 7 high-severity vulnerabilities. The affected installed graph includes brace-expansion through ESLint/minimatch, nanoid and postcss through Vite, and sharp/undici through Wrangler/Miniflare plus jsdom.

npm audit --omit=dev --audit-level=high reports zero vulnerabilities. This is therefore a development, test, build, and deployment-tooling exposure and a failing documented audit gate—not evidence of a vulnerability shipped in the browser bundle or dependency-free standalone runtime image.

Concrete code references

• The direct development-tool ranges are declared here.
• The lockfile currently resolves vulnerable brace-expansion.
• The lockfile currently resolves vulnerable nanoid.
• The lockfile currently resolves vulnerable postcss.
• The lockfile currently resolves vulnerable sharp.
• The lockfile currently resolves vulnerable undici.
• The documented verification workflow requires the high-severity audit.

Acceptance criteria

• Update direct development dependencies and package-lock.json to versions whose resolved graph has no high-severity audit findings.
• Use the smallest supported updates that preserve Node 24, Vite, Vitest, ESLint, jsdom, and Cloudflare Worker behavior; review transitive resolution rather than applying a forced major migration blindly.
• npm ci succeeds under Node 24.18.0.
• Both npm audit --audit-level=high and npm audit --omit=dev --audit-level=high exit successfully.
• npm run check passes, including the strict Wrangler dry-run and hosted smoke.
• The committed diff is limited to intentional dependency metadata unless a narrowly required compatibility adjustment is documented.

Test expectations

• Record before/after audit summaries in the PR without claiming a production exploit.
• Run the complete canonical gate, not only focused tests, because this update touches every build/test/deploy tool.
• If Wrangler/Miniflare changes behavior, run the local Worker smoke documented in docs/HARNESS.md in addition to the dry-run.

Dependencies / order

Independent. Rebase/re-run the full gate if other backlog items land first because advisory and lockfile state can drift.

Non-goals

• A broad application refactor or unrelated dependency modernization.
• Claiming these dev-only findings are present in the shipped production dependency graph.
• Using npm audit fix --force without reviewing version and runtime changes.
• Migrating Node, the package manager, or the deployment platform.