chore: back-merge main into develop, and clear three high advisories reddening CI

[mahmutkaya]

Two commits, both required to unblock release #210.

1. Back-merge — ancestry only, zero content change

Release PR #210 is refused by the main-develop ruleset's strict up-to-date rule. That is a commit-graph fact, not a content one: every release merges develop → main as a merge commit, so develop is BEHIND the moment a release lands and stays there until back-merged.

"BEHIND" and "main holds something develop lacks" are different claims, so the content test ran first:

• no main-only files — git diff --diff-filter=A --name-only origin/develop origin/main is empty
• git merge-tree --write-tree origin/main origin/develop → CLEAN
• the only lines the raw diff attributes to main are develop's own refactors: main calls buildTenantRegistryEntry(input) where develop calls buildTenantRegistryEntry({ ...input, partnerBrand }), a strict superset; and "domains" is present in all six locales on both sides

Asserted, not assumed: after the merge, git diff --stat origin/develop HEAD is empty. The control is git diff --stat origin/develop origin/main, which is not empty (25 files, 1730 deletions) — so the empty result means something.

2. Three high advisories that were already red on develop

develop has been failing CI at 48091a5 — the commit this branch was cut from — so these were not introduced here. Three jobs, one cause. Trivy is named "misconfig + secrets" but was reporting dependency CVEs, so it, OSV-Scanner and npm audit (high+) all named the same packages:

package	was	advisory	needs
browserslist	4.28.4	CVE-2026-73088 / 73089 — prototype pollution, unbounded memory growth	4.28.7
mysql2	3.15.3	GHSA-3f6p-5ww8-9rcr — auth-plugin downgrade leaks plaintext credentials	3.22.0
fast-uri	3.1.5	4 advisories — SSRF, host confusion	3.1.6

fast-uri already had an override, at ^3.1.4, which resolved happily to the vulnerable 3.1.5. A pin that exists is not a pin that covers the advisory.

mysql2 arrives via prisma@7.8.0, whose CLI bundles a driver for every database it supports. Sofra is Postgres and never executes it — but the gate counts findings rather than judging them, and an unexecuted credential-leak path is still one if the graph shifts.

Fixed with overrides, not direct dependencies: none of the three is a direct dep, so declaring one would risk EOVERRIDE on any future spec mismatch. Resolved to browserslist 4.28.8, mysql2 3.24.3, fast-uri 3.1.7; npm audit reports 0 vulnerabilities.

Lockfile reconciled, not regenerated — npx npm@10 install --package-lock-only against the existing lock, so the linux-x64 optional binaries CI needs survive (58 before, 58 after; a from-scratch regen on macOS drops them). Verified with npx npm@10 ci --dry-run, the only local command that runs what CI runs.

Merge mode

Must land as a merge commit — a squash would drop the ancestry link and leave the next release to hit the same refusal. The merge gate detects this by asking whether base..head carries main's tip.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud