fix(deps): resolve high-severity npm audit advisories failing CI

[thetechjon]

Root cause

CI run 29895161376 on the @dnd-kit/sortable 8→9 Dependabot branch failed in the Audit dependencies step (npm audit --audit-level=high) of both jobs. The sortable bump itself is innocent: new advisories were published after main's last green run (July 18), so every fresh CI run now fails the audit gate. Reproduced locally on main.

Advisories:

• sharp <0.35.0 — libvips CVEs (CVE-2026-33327/33328/35590/35591, GHSA-f88m-g3jw-g9cj). Pulled as an optional dependency by next (root) and by miniflare/wrangler (collab-server), both with stale ranges.
• js-yaml 4.0.0–4.2.0 — quadratic CPU via merge-key chains (GHSA-52cp-r559-cp3m).
• brace-expansion — exponential-time expansion DoS (GHSA-3jxr-9vmj-r5cp).

Fix

• Added sharp: "^0.35.0" to overrides in both package.json and collab-server/package.json (same pattern already used for esbuild, js-yaml, etc.). npm audit fix --force would instead downgrade next to 14 / wrangler to 4.15 — not acceptable.
• Bumped the existing js-yaml override to ^4.2.1.
• brace-expansion fixed by lockfile-only npm audit fix.

Verification

• npm audit --audit-level=high: 0 vulnerabilities in root and collab-server
• Root: lint ✅, typecheck ✅, jest (3160 passed) ✅, next build ✅
• collab-server: typecheck ✅, vitest (11 passed) ✅

Merging this into main will unblock the Dependabot PRs (including #238) once they rebase.

---

This PR was opened by the automated autofix bot and is awaiting human review.

🤖 Generated with Claude Code

[thetechjon]

Superseded — closing.

The advisories this PR targets are already fixed on main:

• chore(deps): clear high-severity audit findings (brace-expansion, js-yaml, sharp) #268 added the sharp: ^0.35.0 override (root + collab-server) plus the js-yaml/brace-expansion updates, merged to dev 2026-07-22 and promoted to main via Release: multi-host vault support (GitHub / Codeberg / Forgejo) + audit fixes #269.
• chore(deps): bump next to 15.5.21 to clear high-severity advisories #270 bumped next to 15.5.21.

origin/main now resolves sharp 0.35.3 / js-yaml 4.3.0 and npm audit --audit-level=high is clean; the last CI run on main is green on all jobs.

This PR is also now CONFLICTING against main, and duplicates #265 (already closed) — the autofix bot opened the same fix twice.

The red Dependabot runs were not the audit gate. They were two flaky tests (taskEditModal.test.tsx and e2e/attachment-drag.spec.ts); re-running all three failed runs turned them green with no code change. Tracked separately.