explorer: astro 4.16.18 carries 3 HIGH advisories; Dependency audit cannot go green without a major upgrade

[Depo-dev]

Split out of #386 so a framework major bump is not bundled into a CI repair.

Why this is separate

Dependency audit runs npm audit --audit-level=high for three packages: explorer, sdk/typescript, sdk/react. #386 fixes the nanoid advisory in the two SDK lockfiles. explorer is the remaining blocker and it needs a breaking change.

Worth noting: explorer runs first in that step list, so it fails the job before the SDK steps are reached. The job has never passed on dev — every recorded Security Scan run is failure.

Current state

explorer/package.json pins astro: ^4.16.18. A non-breaking npm audit fix takes it from 13 advisories to 5 (2 moderate, 3 high). The 3 that remain all require astro@5.18.2:

Advisory	Severity	Fix
sharp <0.35.0 — libvips CVE-2026-33327, -33328, -35590, -35591 (GHSA-f88m-g3jw-g9cj)	HIGH	astro 5.18.2 (semver-major)
vite	HIGH	astro 5.18.2 (semver-major)
astro (direct)	HIGH	5.18.2 (semver-major)

The four that do fix cleanly (fast-uri, js-yaml, nanoid, postcss) are transitive and resolve with a plain npm audit fix.

What makes this risky

explorer has no CI job — nothing builds or type-checks it (also flagged as a P3 item in #371). security-scan.yml audits it, but an astro 4→5 upgrade would land with no automated signal that the site still builds. Recommend pairing the upgrade with an explorer build/check job so the regression surface is covered.

Suggested scope

1. Add an explorer CI job running astro build and astro check.
2. Upgrade astro 4.16.18 → 5.x, working through the 4→5 migration guide.
3. Confirm npm audit --audit-level=high exits 0.

Note for whoever picks this up: regenerate explorer/package-lock.json on Linux, not Windows. Windows npm prunes optional transitive packages the ubuntu runner requires, which produces a lockfile where local npm ci passes and CI fails with Missing: @emnapi/core@... from lock file. That happened in #386 (commit d50d796, reverted in 53c8c84).

[Depo-dev]

Correction — I filed this on a bad reading and it should be re-scoped or closed.

The 13-advisory / 7-HIGH figure came from running npm audit against a locally-copied lockfile, not from CI. In the actual CI run (job 93277961434) the npm audit (explorer) step passes:

success  npm audit (explorer)
success  npm audit (sdk/typescript)
success  npm audit (sdk/react)
failure  pip-audit (sdk/python)

So explorer is not what blocks Dependency audit. The real blocker was the pip-audit step being pointed at pyproject.toml instead of the project directory, which made it fail at TOML-parse before auditing anything — fixed in #386.

The astro 4.16.18 pin and the sharp/libvips CVEs are still worth tracking, since a npm audit fix --force would pull astro@5.18.2. But they are not currently failing CI, so this is a maintenance upgrade rather than a CI blocker. The point about explorer having no build/type-check job still stands on its own (P3 in #371).