[apollos-medic]

npm audit --omit=dev in CI (validate) now fails on new high-severity advisories in dependencies of workflow@5.2.0. This blocks every PR, including #694. Merging this unblocks #694.

The workflow packages pin their dependencies to exact versions, and the latest releases (workflow@5.2.3, @workflow/world-local@5.1.2, @workflow/world-vercel@5.2.3, @vercel/cli-auth@0.3.12, @vercel/cli-config@0.3.3) still pin vulnerable versions. A version bump can't fix this, so this PR adds npm overrides and regenerates package-lock.json:

• undici → 7.30.1: fixes GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472. Before this it was pinned to 7.30.0 by @workflow/world-local / @workflow/world-vercel.
• zod → 4.6.7: fixes GHSA-mrhx-c7xc-m3w5 (zod <4.6.6). The same audit run flags it. Before this it was 4.5.4 (~4.5.4 from @workflow/*) and 4.1.11 (pinned by @vercel/cli-auth / @vercel/cli-config). This is a minor-version bump within zod 4.

Remove these overrides once the workflow packages ship patched pins.

Local checks (Node 24.22.1, clean npm ci): npm audit --omit=dev and full npm audit both report 0 vulnerabilities, npm run check passes, npm test passes 96/96, and npm run build passes.

Proof

Proof is available on request.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bug-board	Ready	Preview	Oct 26, 2026 2:47pm UTC

[github-actions]

🟢 e2e: 8 passed

All 8 tests in 1 file

	Test	Time
🟢	tests/dashboard.e2e.ts · 8 passed	11.3s
🟢	dashboard navigation and no-secrets rendering	3.1s
🟢	preset and custom date windows survive navigation	1.2s
🟢	review and DAG filters use URL state	1.8s
🟢	mobile navigation stays usable	2.8s
🟢	sign-in card has room around its action on phones and desktop	673ms
🟢	health is public, API and cron remain closed without authentication	437ms
🟢	legacy dashboard URLs still resolve	450ms
🟢	review filters stay in sync after Back and reload	802ms

_{e2e 0.21.2 · 13.2s · web · run artifacts}