chore(deps): clear the open Dependabot security alerts (supersedes #196)

[dvcdsys]

Closes the five open Dependabot alerts (#23, #24, #25, #26, #27) with the smallest change that actually improves the security posture, and supersedes #196 — whose react-router bump would have made things worse.

What changed

Alert	Package	From → To	How
#27 high	sharp (GHSA-f88m-g3jw-g9cj)	0.34.5 → 0.35.2	wrangler 4.112.0 → 4.114.0 (sharp is transitive via miniflare)
#23 high	brace-expansion (GHSA-3jxr-9vmj-r5cp)	2.1.0 → 2.1.2	npm update, in range
#24 #25 #26 moderate	react-router / react-router-dom (CVE-2026-53666/53668/53669)	6.30.4 → 7.18.1	direct bump

Both high alerts are GitHub-labelled Development — dev-only tooling, not in any shipped bundle or image.

Why not #196

Dependabot proposed react-router 7.0.0. Scanning that PR's ref shows 7.0.0 introduces eight HIGH advisories that 6.30.4 does not have — CVE-2026-55685 (fixed 7.18.0), CVE-2026-42342 (7.15.0), CVE-2026-42211 (7.14.2), CVE-2026-34077 (7.14.0, also via turbo-stream), CVE-2026-22029 and CVE-2026-21884 (7.12.0), CVE-2025-59057 (7.9.0), CVE-2025-43865 (7.5.2). That is three moderates traded for eight highs, which is why the Trivy check on #196 reports 1 new alert including 1 high severity security vulnerability.

7.18.1 is the right target: it is the newest 7.x, its peer range is react >=18 so React stays on 18, and turbo-stream is gone from its tree.

Migration cost: zero

The dashboard's entire react-router surface is BrowserRouter, Routes, Route, Navigate, Link, NavLink, useNavigate, useParams, useSearchParams — all unchanged in v7. No source file was touched. npm run typecheck, tsc -b && vite build (dashboard) and vite build (site) all pass locally; npm audit in site/ is at zero.

Known remainders (no non-breaking fix, neither reachable here)

• GHSA-mh99-v99m-4gvg (brace-expansion OOM DoS) is patched only in 5.0.8, but minimatch@5 — pinned by @redocly/openapi-core, itself pinned by openapi-typescript — requires ^2.0.1. An overrides to 5.x breaks the toolchain: brace-expansion 5's CJS entry exports { expand } instead of a callable default, and minimatch calls the module directly (verified). The only consumer is the gen:api codegen over our own doc/openapi.yaml.
• GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass) is patched only in 8.3.0, which requires react >=19.2.7 — the React 19 major stays deferred per the dependency policy. The dashboard is a Vite SPA on BrowserRouter with no RSC and no SSR, so the advisory does not apply.

Note the dashboard build is not covered by PR CI, so it was validated locally.

🤖 Generated with Claude Code

[dvcdsys]

Retargeted from develop to main, for two reasons:

1. Dependabot computes alerts from the default branch — the alerts page says Dependency files checked … for commit bdc5d6f, which is on main. Merging only into develop would leave ci: split CLI/server release pipelines + standardize workflows #23–ci(release-server): wire openapi build context for dashboard stage #27 open. This is also why the npm_and_yarn security group in .github/dependabot.yml carries no target-branch and chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates #196 was opened against main, unlike the version-update groups that target develop.
2. Security (govulncheck + Trivy) and CodeQL are wired to pull_request: branches: [main] only, so on a develop-based PR they never ran here — the two green checks were just CI: Server and CI Site. Targeting main puts the dependency scan back in the gate.

The four touched files are byte-identical between main and develop, so the retarget is conflict-free. develop needs the same commit cherry-picked after this merges (a direct main→develop merge conflicts in this repo).

[dvcdsys]

Reopening to fire the pull_request workflows against the new base — a base change alone emits action=edited, which the default trigger types skip, so Security/CodeQL never queued.