chore: migrate publish to npm Trusted Publishing (OIDC)

.changeset/audit-fix-high-sev-overrides.md

@@ -0,0 +1,10 @@
+---
+'helixir': patch
+---
+
+chore(deps): clear high-severity transitive vulnerabilities
+
+Adds pnpm overrides to patch 13 high-severity transitive advisories
+(tar, vite, picomatch, lodash, path-to-regexp, flatted, hono) to their
+fixed releases within the same major version. No breaking changes; build
+and full test suite pass. Brings `pnpm audit --audit-level=high` to zero.

.changeset/trusted-publishing-migration.md

@@ -0,0 +1,11 @@
+---
+'helixir': patch
+---
+
+chore: migrate npm publishing to Trusted Publishing (OIDC)
+
+Removes long-lived `NPM_TOKEN` dependency from the publish workflow.
+Authentication now happens via GitHub Actions OIDC token federation
+(pnpm 9.15.9 has native OIDC trusted-publishing support), in response
+to the npm Mini Shai-Hulud token rotation event. Sigstore provenance
+attestation preserved. No consumer-facing changes.

.github/workflows/ci-matrix.yml

@@ -1,7 +1,7 @@
 # ============================================================================
 # Matrix CI Pipeline — HELiXiR MCP Server
 # ============================================================================
-# Tests across Node.js 20, 22, and 24 to ensure forward-compatibility
+# Tests across Node.js 22 and 24 to ensure forward-compatibility
 # and catch version-specific ESM / native module regressions.
 # ============================================================================
 

.github/workflows/publish.yml

@@ -17,6 +17,7 @@ jobs:
   publish:
     name: Publish to npm
     runs-on: ubuntu-latest
+    environment: npm-publish
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
@@ -86,6 +87,5 @@ jobs:
           title: 'chore: version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.CHANGESET_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: 'true'
           HUSKY: '0'

package.json

@@ -107,12 +107,17 @@
   },
   "pnpm": {
     "overrides": {
-      "hono": ">=4.12.7",
+      "hono": ">=4.12.18",
       "@hono/node-server": ">=1.19.10",
       "express-rate-limit": ">=8.2.2",
       "undici": ">=7.24.0",
-      "flatted": ">=3.4.0",
-      "fast-uri": ">=3.1.2"
+      "flatted": ">=3.4.2",
+      "fast-uri": ">=3.1.2",
+      "tar": ">=7.5.11",
+      "vite": ">=7.3.2",
+      "picomatch": ">=4.0.4",
+      "lodash": ">=4.18.0",
+      "path-to-regexp": ">=8.4.0"
     }
   },
   "engines": {