v1.87.1.0 fix: update vulnerable sharp and adm-zip overrides

[garrytan]

Addresses #2866. Adapts the dependency-only fix from #2867 onto current main. Contributed by @smsmatt; the override-expiry ledger and scheduled-scan notification proposal remain in that PR.

Update sharp to 0.35.4 and adm-zip to 0.6.1, including their resolved platform packages, without adding vulnerability exceptions or changing the pinned evaluation harness. Regression tests enforce the fixed version floors, load Sharp, and verify that ordinary archive extraction works while file and directory destination-symlink escapes are rejected.

Verification

• Before: OSV-Scanner 2.3.8 reports GHSA-rgj7-g3m4-5g8c and GHSA-vwc7-r8mq-g2x9, exit 1. The new regression file has 1 pass and 5 failures with the original lockfile, including both symlink escape cases.
• After: the same scanner checks both lockfiles with the existing .osv-scanner.toml, exit 0 with no unsuppressed findings. Three applicable existing exceptions remain; this is not a claim of zero vulnerabilities without exceptions.
• Frozen install and build pass. Final local dependency-security, dependency-smoke, OSV-wiring, and screenshot-guard run: 19 pass, 0 fail, 52 assertions. Symlink cases intentionally skip Windows.
• An independent reviewer checked all 28 changed package records against published npm metadata and exercised ONNX's actual archive-extraction API. Native-context review and the final parent diff review found no unresolved introduced defects. External Claude/Codex CLI review was unavailable.
• The full local free suite was attempted, not passed: 31 failures across nine unrelated files. An isolated eight-file comparison on unchanged main and this patch gives identical results: 306 pass, seven failures, 1,050 assertions; watchdog passed on both reruns. Git remote rewriting, forced fixture authorship, and live GitHub authentication affect this environment. Full-suite validation relies on CI.
• Local paid evals were blocked by the missing Claude CLI; the dependency-only diff selector found no affected model cases.

Owner liveness exemption verified. No compiled binaries, workflow changes, or suppression changes are included.

Documentation

• CONTRIBUTING.md: documents the focused dependency-security regression command, fixed-version/runtime and ZIP-extraction checks, Windows symlink-test skips, and the unchanged OSV exception policy.
• Generated documentation is fresh; documentation validation, context budgets, parity, and focused dependency/screenshot checks passed. One zsh portability test skipped because zsh is absent.

Documentation Debt

• Pre-existing discoverability: docs/cso-scanners.md and docs/cso-release-qualification.md need navigation links to their existing reference/how-to content.
• Pre-existing reference/how-to drift: the CI freshness descriptions in CONTRIBUTING.md and ARCHITECTURE.md still describe a dry run rather than the actual all-host generation and tracked-diff/untracked-file checks.
• Pre-existing explanation inconsistency: docs/BROWSER_INTERNALS.md says /sidebar-chat was removed but also lists it under the tunnel listener; it needs a separate source-grounded documentation correction.

Suggested label: docs-debt. No new public surface lacks documentation, and no new tutorial or page is needed for this dependency patch.

[trunk-io]

😎 Merged successfully - details.

[github-actions]

E2E Evals: ✅ PASS

0/0 tests passed | $0 total cost | reconcile exit: 0

Shard	Result	Status	Cost

Fail-closed reconciliation

[test:paid] report: 6/6 slices, 4 planned shards, tier=gate
  slice 1  passed              0s  test/llm-judge-recommendation.test.ts
  slice 2  passed              0s  test/skill-llm-eval-spec.test.ts
  slice 3  passed              0s  test/skill-llm-eval.test.ts
  slice 4  passed              0s  test/skill-routing-e2e.test.ts
[test:paid] report: ⚠ 3 shard(s) passed with EVERY test skipped — they verified nothing:
  ⚠ test/llm-judge-recommendation.test.ts (1 skipped — external service missing or tier mismatch)
  ⚠ test/skill-llm-eval.test.ts (25 skipped — external service missing or tier mismatch)
  ⚠ test/skill-routing-e2e.test.ts (10 skipped — external service missing or tier mismatch)
[test:paid] report: every planned shard accounted and passed

---

Sliced lane: diff-selected gate census via scripts/test-paid-shards.ts (planner → 6 executors → fail-closed report)

[capy-ai]

Final verification on b5e3b5a: 24 CI checks passed, none failed or pending, including the full free suite, native CSO platform gates, Windows tests/setup, and generated freshness. Build, focused-test, and current-head CI evidence all grade FRESH. Independent native review plus the final parent review have no unresolved introduced findings.

The paid lane reconciled successfully but executed no selected model cases; its empty/skipped shards provide no additional coverage. Local full-suite environment limitations and unavailable external CLI review remain documented above.