fix: sync package-lock.json to satisfy npm ci in trivy Security Scan

[groupthinking]

Closes #1624

Canonical issue

Issue #1624, open: lockfile out of sync with the manifest, which breaks the dependency install inside the trivy Security Scan job.

The trivy Security Scan job on main never reaches a vulnerability scan because docker build dies at:

RUN npm ci --workspace=apps/web --production --legacy-peer-deps

npm ci performs an integrity check: if the lockfile doesn't satisfy package.json, it hard-aborts. The mismatch:

package	package.json requires	lockfile was pinned to
@ai-sdk/gateway	^4.0.55	4.0.23
postcss (apps/web nested)	^8.5.26	8.5.21

This has blocked Security Scan on PRs #1609, #1612, #1621 and on main itself.

Outcome

The dependency install resolves again, so the trivy Security Scan job reaches the vulnerability scan instead of dying during install. On head f8659ff the trivy check passes in 3m25s.

No user-facing or runtime behaviour changes: the only file in this PR is package-lock.json (1 file changed, +82 / -210). Application code, routes, CSP, billing and the model pin are untouched.

Scope

Regenerated package-lock.json with npm install --package-lock-only --legacy-peer-deps.
Only package-lock.json is touched. No application code, routes, model pins, CSP, billing, or pipeline logic changed.

• Included: lockfile-only version moves, @ai-sdk/gateway 4.0.23 -> 4.0.73 and nested postcss 8.5.21 -> 8.5.28, both already inside the ranges package.json declares.
• Explicitly excluded: no change to package.json, no application or infrastructure code, no workflow or image build edits, no Vercel environment or billing changes, and the google/gemini-3.8-flash model pin is unchanged.

Risk

• Risk level: low. Lockfile-only change; both packages move within the semver ranges the manifest already declared, and the whole tree was reinstalled from the regenerated lockfile before this PR was opened.
• Failure mode: a transitive resolution shift in @ai-sdk/gateway or postcss breaks the apps/web build or styling. Contained on this head: build, test, test-frontend and lint-frontend are all green on f8659ff, and the apps/web suite is 509/509.
• Rollback: revert the single squash commit to restore the previous package-lock.json. There is no migration, no state change and no deploy-time coupling, so revert is complete and immediate.

Verification

All evidence below is bound to head f8659ff.

Local, by the agent that produced the lockfile:

# Exact CI command from Dockerfile / trivy workflow:
$ npm ci --workspace=apps/web --production --legacy-peer-deps
added 547 packages in 12s
# exit 0 ✓

# Full dev install:
$ npm ci --legacy-peer-deps
# exit 0 ✓

# Web test suite:
$ npm run test (apps/web)
Test Files  84 passed (84)
     Tests  509 passed (509)
# exit 0 ✓

# Model pin:
# google/gemini-3.8-flash — unchanged ✓

• Focused tests: apps/web suite 509/509 passed (84 files), and the exact install command that was failing in CI now exits 0 with 547 packages.
• Required CI on f8659ff, all green: trivy (3m25s), build, test, test-frontend, lint-frontend, lint-python, dependency-review, Security Scan - javascript, Security Scan - python.
• Also green on the same head: gitleaks, guards, validate, bandit, python-safety, CodeQL, coverage, and the dependency audit job.
• Review threads resolved: none open. The only review on this head is an automated Copilot comment stating it could not review any files; zero line comments.

Production evidence

• trivy Security Scan on this head, the job this PR exists to unblock: pass in 3m25s, https://github.com/groupthinking/EventRelay/actions/runs/33774068091/job/100711263514
• Vercel preview deployment for the v0-uvai project that serves https://uvai.io: check reports pass, Deployment has completed, https://vercel.com/garv1/v0-uvai/J52w34Em2StzYobWHXQdkH9rm1zj
• Vercel Agent Review pass and Vercel Preview Comments pass on the same head; the preview build compiled the app against the regenerated lockfile, which is the production install path.
• Production runtime evidence beyond the successful preview build is not applicable: no shipped code, config, route or model pin changes in this PR, only resolved dependency versions in the lockfile.

Agent handoff

• One canonical issue is linked: lockfile out of sync with package.json — breaks npm ci in trivy Security Scan #1624, open, a real issue and not a pull request.
• No competing PR implements the same issue: fix: sync package-lock.json to satisfy npm ci in trivy Security Scan #1625 is the only open PR referencing lockfile out of sync with package.json — breaks npm ci in trivy Security Scan #1624.
• Acceptance criteria are satisfied: the install step succeeds and trivy Security Scan completes green on this head.
• Required checks pass on the current head f8659ff.
• Human decision is requested only for product, security, irreversible infrastructure, or production approval: none of those apply to a lockfile sync, so no human decision is requested.

  

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 3, 2026 3:41pm UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: a99da327-b9e8-4d95-98c0-df9bed7b9773

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA f8659ff.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@ai-sdk/gateway	4.0.73	Unknown	Unknown
npm/@ai-sdk/gateway	4.0.55	Unknown	Unknown
npm/@ai-sdk/provider	4.0.10	Unknown	Unknown
npm/@ai-sdk/provider	4.0.7	Unknown	Unknown
npm/@ai-sdk/provider-utils	5.0.36	Unknown	Unknown
npm/@ai-sdk/provider-utils	5.0.27	Unknown	Unknown
npm/postcss	8.5.28	Unknown	Unknown

Scanned Files

• package-lock.json

[linear-code]

GRV-467