fix: make the npm vulnerability gate see dev dependencies

.github/workflows/security.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: aquasecurity/trivy-action@master
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: config
           # Scoped to the Dockerfile — the one config artifact this repo owns
@@ -69,9 +69,18 @@ jobs:
   trivy-fs:
     name: trivy (filesystem vuln scan — npm deps)
     runs-on: ubuntu-latest
+    env:
+      # trivy's npm/pnpm parser drops dev dependencies unless told otherwise, so
+      # this job reported zero findings while the lockfile carried a fixable HIGH.
+      # A build-time dependency still executes in CI with repo credentials, which
+      # is the surface this gate exists to cover, and the sibling repos scanning
+      # the same tree with osv-scanner have always counted them — the two tools
+      # disagreed on the same advisory in the same org. trivy-action exposes no
+      # input for it; the flag is only reachable as its TRIVY_-prefixed env var.
+      TRIVY_INCLUDE_DEV_DEPS: "true"
     steps:
       - uses: actions/checkout@v4
-      - uses: aquasecurity/trivy-action@master
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .

package.json

@@ -74,7 +74,8 @@
     "esbuild": "^0.28.1",
     "axios": "^1.18.1",
     "body-parser": "^2.3.0",
-    "gaxios": "^7.3.0"
+    "gaxios": "^7.3.0",
+    "nanoid": "^3.3.17"
   },
   "engines": {
     "node": ">=24"