[Antawari]

What

npm audit fix without --force on ts/package-lock.json only. ts/package.json is unchanged, and no package is added or removed. The nine version changes are all patch or minor and stay inside existing ranges: brace-expansion (four copies), fast-uri 3.1.2 → 3.1.9, js-yaml 4.2.0 → 4.3.2, nanoid 3.3.14 → 3.3.20, postcss 8.5.15 → 8.5.31, source-map-js 1.2.1 → 1.2.2.

The Python side needs nothing: OSV over all 26 pins in requirements-lock.txt returns no advisories.

npm audit (ts)

	critical	high	moderate
before	2	7	3
after	2	1	3

Verified (Node 22)

• A strict npm ci installs the new lock (200 packages). typecheck passes and vitest runs 46/46 passing, both before and after.
• Law-ratchet review: no direct dependency out of range, no semver-major, and every dependent's range is met by the new versions.

OWED

• vitest 2 → 5 (major). This is the only fix for the remaining advisories: vitest and tinypool (CRITICAL), vite (HIGH), and @vitest/mocker, vite-node and esbuild (moderate). Dev and test tooling only.
• Advisory note: brace-expansion 5.0.12 drops Node 18 from its engines field. No workflow here pins Node 18.

🤖 Generated with Claude Code