fix(deps): clear high advisories and gate on audit

[altaywtf]

Problem

pnpm audit --audit-level high failed with two high advisories:

• GHSA-2v37-7h3g-55p8 nanoid 3.3.17 (<3.3.18), via @voidzero-dev/vite-plus-core > postcss > nanoid and @uinaf/design > postcss > nanoid
• GHSA-rgj7-g3m4-5g8c sharp 0.35.2 (<0.35.4), via @cloudflare/vitest-pool-workers > miniflare > sharp and wrangler > miniflare > sharp

Nothing gated on audit, so the advisories went unnoticed.

Solution

• nanoid: postcss 8.5.26 already declares ^3.3.17; the lockfile is refreshed to 3.3.19. No manifest change.
• sharp: miniflare pins sharp exactly, and every published @cloudflare/vitest-pool-workers (up to 0.22.0) pins a miniflare that pins sharp 0.35.2. Added override "sharp@<0.35.4": "^0.35.4" in pnpm-workspace.yaml. The range selector retires the override on its own once miniflare declares >=0.35.4 (miniflare 5.20260910.0-alpha and later already do).
• Gate: audit script (pnpm audit --audit-level high) chained into verify, and a pnpm run audit step in the existing verify job right after the frozen install, so local and CI agree.

Proof

• pnpm audit --audit-level high exits 0 (2 moderate remain, out of scope)
• pnpm run verify passes locally
• actionlint .github/workflows/verify.yml clean
• Lock diff: sharp 0.35.2 -> 0.35.4, @img/sharp-libvips-* 1.3.1 -> 1.3.3, nanoid 3.3.17 -> 3.3.19, plus @types/node peer-suffix rewrites; no major bumps

[Copilot]

🟢 Approval recommended

The changes consistently enforce an audit gate and resolve the stated high advisories with a targeted override and lockfile refresh.

Pull request overview

This PR addresses recently detected high-severity dependency advisories by updating the lockfile (nanoid and sharp) and adding an explicit pnpm audit --audit-level high gate to both local verification and CI, so high advisories can’t silently regress.

Changes:

• Add a pnpm override to force sharp to >=0.35.4 when a dependency still pins an older vulnerable version.
• Refresh pnpm-lock.yaml to resolve sharp to 0.35.4 and nanoid to 3.3.19.
• Add an audit script and run it in both pnpm run verify and the GitHub Actions verify workflow.

File summaries

File	Description
pnpm-workspace.yaml	Adds a targeted override to bump vulnerable sharp versions to ^0.35.4.
pnpm-lock.yaml	Lockfile refresh reflecting the override and updated resolved versions for sharp and nanoid.
package.json	Introduces audit script and gates verify by running audit first.
.github/workflows/verify.yml	Runs pnpm run audit after frozen install to enforce the same security gate in CI.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 3/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0798aca944

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Route the validation script through the audited verify command

When contributors use the documented canonical ./scripts/verify.sh entry point, the new audit is skipped because that script still invokes pnpm exec vp run ready directly (scripts/verify.sh:8), despite CONTRIBUTING.md:15-17 describing it as equivalent to pnpm run verify. Route the script through this package command or add the audit there so local validation actually gains the intended high-advisory gate.

AGENTS.md reference: AGENTS.md:L39-L40

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T09:23:08.953243Z	0798aca	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.