Track dependency audit vulnerabilities blocking CI

[leynos]

Evidence

The Namespace migration PR (adopt-namespace-runners) passes the application verification gates, but the dependency audit fails on pre-existing transitive vulnerabilities. The migration changes runner configuration only and does not change dependency declarations.

Observed on 2026-09-01 after rebasing PR #54 onto current main:

• fast-uri 3.1.2: GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, and GHSA-4c8g-83qw-93j6 (high).
• shell-quote 1.8.4: GHSA-395f-4hp3-45gv (high).
• js-yaml 4.2.0: GHSA-52cp-r559-cp3m and GHSA-5p4m-2wfm-xmqj (high).
• brace-expansion, browserslist, and immutable also report high-severity advisories; body-parser reports a low-severity advisory.

Requested follow-up

Audit direct and transitive dependency paths, update or override to patched versions where compatible, and rerun bun audit and the full verification workflow. Keep this remediation separate from PR #54, which only migrates CI runners.

[leynos]

Fresh recheck on 2026-09-02:

• PR Move CI to the shared Namespace runner #54 head e502ca69260fdc6b73f276150648ecc26797d38e (adopt-namespace-runners) fails bun audit with Bun 1.3.11 (af24e281): 14 vulnerabilities (13 high, 1 low).

• Untouched current GitHub main at e11cf049ed85ee4b1d263664b849b3b600f06345 produces the identical result. The two trees have byte-identical package.json (SHA-256 14bca62d04b7fde3ae5ae99369deb84e482285d1abbbd315cba9178db22f49d0) and bun.lock (SHA-256 1edcb8d03624e49929e06c9d95f1f9778cdbb2611fd7eb932bb2ccefc037dc3f).

• Exact current audit output:

  browserslist <=4.28.6: GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g (high)
  body-parser >=2.0.0 <2.3.0: GHSA-v422-hmwv-36x6 (low)
  brace-expansion >=4.0.0 <5.0.8: GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, GHSA-3jxr-9vmj-r5cp (high)
  shell-quote <=1.8.4: GHSA-395f-4hp3-45gv (high)
  fast-uri >=3.0.0 <3.1.5: GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6 (high)
  immutable >=5.0.0-beta.1 <5.1.8: GHSA-xvcm-6775-5m9r, GHSA-v56q-mh7h-f735 (high)
  js-yaml >=4.0.0 <4.3.0: GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj (high)
  

  Resolved versions are browserslist@4.28.2, body-parser@2.2.2, brace-expansion@5.0.6, shell-quote@1.8.4, fast-uri@3.1.2, immutable@5.1.5, and js-yaml@4.2.0.

• CI run 33550405294, job 99998154335, confirms the Namespace runner and all preceding format/typecheck/lint/test gates pass; only Audit dependencies fails and Build package is skipped.

• Namespace admission is healthy: profile default on the ubuntu-22.04 amd64 4-vCPU/16-GB profile, with a provisioned runner, started at 19:36:28Z, and failed only at the audit step at 19:36:55Z.

Conclusion: blocker #55 still reproduces independently of the Namespace migration. PR #54 remains unchanged and draft. Dependency remediation requires package/lockfile changes and remains follow-up work for #55 rather than an unrelated change folded into this runner rollout.