[Chore] Remediate focused dependency security alerts

[roomote-roomote]

Opened on behalf of Matt Rubens. View the task or mention @roomote-roomote for follow-up asks.

What changed

• Updated DOMPurify from 3.4.12 to 3.4.13 for worker HTML sanitization and Mermaid's transitive sanitizer.
• Updated PDF.js from 5.7.284 to 6.2.108 for attachment text extraction.
• Updated Mermaid from 11.15.0 to 11.16.1, nanoid 3.x from 3.3.16 to 3.3.17, and js-yaml from 3.15.0/4.3.0 to 3.15.1/4.3.1.
• Preserved minimumReleaseAge: 10080 without adding package exclusions for these security updates.

Why this change was made

The previous dependency graph contained known XSS, arbitrary JavaScript execution, denial-of-service, prototype-pollution, CSS-injection, and tooling CPU-exhaustion vulnerabilities. This focused bundle moves only the affected packages and their required transitive graphs to GitHub's first patched versions while keeping the existing dependency release-age policy unchanged.

Alert coverage

• [Test] Staging MCP timeout verification (safe to close) #85 and [Fix] Recover subagent spawns that never settle after the child finishes #94: DOMPurify 3.4.13
• [Improve] Disable empty Slack App Home tab in default manifest #93: pdfjs-dist 6.2.108
• [Improve] Set Slack bots always online in app manifests #91 and [Fix] Remove subagent run timeouts #92: js-yaml 4.3.1 and 3.15.1
• [Fix] Let active subagents run without a hard timeout #86, Fix unknown participants on automated tasks #87, [Improve] Attribute automation tasks as "{name} Automation" #88, [Fix] targetBranch is no longer required when updating an existing pull request #89, and Revert "[Fix] Let active subagents run without a hard timeout" (#86) #90: Mermaid 11.16.1
• [Fix] Derive SLACK_AUTH_URI from ROOMOTE_APP_URL when unset #95: nanoid 3.3.17
• [Improve] Default Narration Mode to off #96 and [Improve] Align GitHub App manifest permissions and event subscriptions #97 remain open: image-size 2.0.2 still has no first patched version and remains isolated to Storybook development tooling, so this PR does not force unrelated Storybook churn.

Impact

User-facing Mermaid rendering, worker widget sanitization, PDF attachment processing, and the affected build/test tooling now resolve patched dependency versions. The focused lockfile no longer contains the vulnerable versions covered by alerts #85 through #95, and no new minimum-release-age exclusions are introduced.

Validation completed with a frozen forced workspace install, full lint and type checks, knip, worker and web production builds, PDF.js parser smoke coverage, 617 cloud-agent tests, 1,672 worker tests, targeted DOMPurify and Mermaid-adjacent tests, and live web/API liveness checks. The follow-up removal of the exclusions also passed a frozen install and the full pre-push static suite. The broad test run initially hit unrelated five-second timeouts in five web tests and two worker tests; every timed-out test passed on isolated or serial rerun with additional time.

[roomote-community]

No code issues found. See task

_{Reviewed 37ed187}

[mrubens]

@roomote can we avoid adding more min-age exclusions?

[roomote-community]

I'm on it. I started a dedicated PR follow-up task for this request, and I'll keep updates here. See task

[roomote-community]

Removed the new dompurify, mermaid, and nanoid minimum-release-age exclusions while keeping their patched versions locked. The frozen install and pre-push static suite pass in 37ed187d, and the PR description now reflects the unchanged policy. See task · Revert commit

[mrubens]

@roomote review now

[roomote-community]

I started a PR review task for this request. See task