[hayarobi]

Resolved high-severity vulnerabilities in transitive dependencies by updating the lock file. The affected packages were not directly depended on but were pulled in through upstream libraries.

Also removed two previously allowlisted advisories (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) related to image-size. These had been explicitly suppressed in audit-ci.jsonc because no patch was available at the time — patches have since been released, so the allowlist entries are no longer needed.

This fixes the failing Security audit (high/critical) step in the build CI job (test.yml), which was blocking PR merges.

[nolnol3]

Verified the fix — npm audit on this branch is clean, and all 8 failing advisories are covered by the lock bumps.

One request before merge: README.md Security section (~L113–119) still says the image-size advisories are allowlisted with no patch available. Please drop that paragraph here, since the repo is public.

(Context: image-size moved to Codeberg, so 2.0.3/2.0.4 have no GitHub tag — same maintainer, fix is in the tarball.)

[hayarobi]

A few additional vulnerabilities have been identified while this PR was waiting for approval.

I’ll add another commit to address them as well. Once the changes are in, I’d appreciate it if you could take another look and approve the PR.