chore(security): non-breaking npm audit fix for app, cms and shared

[MrDirkelz]

Why

Alerts have re-accumulated since #1849. Not all of them need the breaking major upgrades tracked in #1868 — this clears everything npm audit fix can resolve without touching a package.json, so the remaining migration slices start from a smaller, cleaner diff.

What changed

Lockfiles only. No package.json changes, no major upgrades, no source changes.

	before	after
app	3 crit / 24 high / 11 mod / 3 low	2 / 7 / 8 / 1
cms	2 / 9 / 6 / 0	2 / 7 / 6 / 0
shared	2 / 13 / 9 / 0	2 / 10 / 9 / 0

app loses the shell-quote critical and 20 highs — lodash-es, postcss, rollup, glob, form-data, js-cookie, flatted, fast-uri, @xmldom/xmldom, editorconfig, plus the workbox/babel chain. cms and shared pick up js-yaml, nanoid and brace-expansion.

api is deliberately excluded. #1950 rewrites api/package-lock.json wholesale and already carries js-yaml@4.3.1 / @istanbuljs/…/js-yaml@3.15.1, both newer than main and both out of the advisory range. Including api here would buy nothing and put a conflict in front of an approved PR.

Verification

package	lint	type-check / build	unit tests
shared	✅	✅ vue-tsc + vite build	1363/1364 — 1 pre-existing failure, see below
app	✅ 0 errors (3 pre-existing warnings)	✅	✅ 110 files / 980 tests
cms	✅ 0 errors (1 pre-existing warning)	✅	✅ 124 files / 1054 tests

The shared test failure is pre-existing

src/util/HybridQuery/responseCache.spec.ts → "drops any stale entry for the key when the write overflows quota".

Restoring the pre-sweep lockfile and running npm ci reproduces it identically, so it is not fallout from this change. Root cause: vi.spyOn(Storage.prototype, "setItem") does not intercept localStorage.setItem under jsdom 24 — the spy never fires, the write succeeds, and the assertion sees the new entry instead of undefined. Its sibling test (swallows a thrown setItem) passes vacuously for the same reason. writeResponseCache does call removeItem in its catch, so this is a broken test rather than broken code. Tracked separately.

Only three lockfile entries changed in shared (brace-expansion, js-yaml, nanoid), none of them jsdom.

What's left

All of it is devDependency tooling that never ships, and none of it is production-reachable. Continues in #1868:

• app — vitest 4, vite 8, vue-tsc 3, @vitejs/plugin-vue 6, @unhead/vue, vite-ssg
• cms — vitest 4, vite 8, vue-tsc 3, @vitejs/plugin-vue 6
• shared — vitest 4, vite 8, vue-tsc 3, uuid 14, vite-plugin-dts 5

The @typescript-eslint/* high cluster (5 alerts × 3 packages) reports as fixAvailable: true but cannot be moved here — it is pinned by @vue/eslint-config-typescript@12's peer range, so it belongs to the eslint slice.

Refs #1868

🤖 Generated with Claude Code