chore(deps): align npm runtime and development updates

[dependabot]

Summary

Consolidates the npm runtime, development, and js-yaml updates into one manifest and reconciled lockfile. Aligns the Next.js packages at 16.3.4 and preserves the versions proposed by the original dependency PRs.

Consolidates #2648 (f8a805f), #2700 (0ce9b87), #2746 (87c2a01). Original heads are retained as ancestors; absorbed PRs are closed only after publication is verified.

Verification

• npm install --package-lock-only --ignore-scripts --no-audit --no-fund — passed. node scripts/setup-codex-worktree.mjs — installed the exact reconciled lockfile with npm ci; trusted-lock verification passed.

• npm run format — passed; formatting committed.

• git diff --check — passed.

• Verification not run: full local PR/release suites; focused integration checks above were selected, and GitHub remains the merge gate. No live provider evaluation, deployment, migration or production data access was performed.

• UI verification not run: local browser matrix; applicable hosted UI checks must pass before merge.

• Current-base CI limitation: Make the outstanding-issues snapshot merge-safe (v2), and record the measured assessment of two other rows #2735 run 34495136858 failed only the aged ranking fixture provenance test (32 days old). clinical(governance): resolve forms permissions, test guards, and alert tiers (Bundle 1) #2763 carries the existing refresh; these bundles must not be merged past failed required checks.

• Aligned the Node and Next.js Sentry SDKs at 10.73.0 to remove incompatible event types. Updated the sharp override to 0.35.4, which matches the Next.js dependency requirement and fixes the reported high-severity advisory.

• npm run check:installed-lock-parity — passed for 769 package locations and 60046 files after the trusted postinstall lifecycle.

• npm run typecheck:source — passed.

• npm run test -- tests/error-tracking.test.ts tests/worker-observability.test.ts — 10 passed.

• npm audit --omit=dev --audit-level=high — passed, zero vulnerabilities. Native sharp 0.35.4 loaded successfully.

Risk and rollout

• Risk: Runtime, build and container compatibility across a dependency update; hosted build, static, coverage and container results remain necessary before merge.
• Rollback: revert the consolidated merge commit as one unit; original source branches and heads remain available.
• Provider or production effects: GitHub branch/PR updates only during consolidation. No deployment or provider write was performed.
• RAG impact: none

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Unit coverage — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #16595 (success). That run's conclusion is an aggregate and did not exercise Unit coverage.

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 79ae641f-2b17-464e-aa5a-b25af35d905e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}