fix(security): heal composer/npm audit gates — 2026-07 advisory wave lockfile bumps

[nash87]

Why

The scheduled Security workflow has been red ≥9 days, stalling the dependabot queue. Root causes verified locally with the exact CI commands.

Healed (lockfile bumps only, zero suppressions)

Composer (7 prod advisories, 3 packages): guzzlehttp/guzzle 7.11.1→7.13.2 (CVE-2026-55767, CVE-2026-55568), guzzlehttp/psr7 2.11.0→2.12.5 (CVE-2026-55766), web-token/jwt-library 4.1.3→4.1.7 (PKSA-237v-kv6c-dpkr HIGH, PKSA-66dc-42nb-26yy HIGH, +2 medium).

npm (parkhub-web): astro→6.4.8 (GHSA-2pvr-wf23-7pc7 SSRF high, GHSA-jrpj-wcv7-9fh9) + nested vite→7.3.6 (GHSA-fx2h-pf6j-xcff high) — these, not #548's dev-scope form-data, were the npm-audit-high blockers. Plus undici→7.28.0, ws→8.21.1 (required relaxing a stale exact-pin override storybook>ws 8.20.1→^8.21.0), form-data→4.0.6, js-yaml, joi, @babel/core→7.29.7, yaml-language-server→1.23.0 (eliminates nested yaml@2.7.1 → the GHSA-48c2-rrv3-qjmp ignore is now moot and REMOVED — osv-scanner.toml ignore ledger is empty).

Root package-lock.json: @babel/core→7.29.7.

Verified after (worktree, exact CI commands)

• composer audit --locked --no-dev: clean; dev-inclusive: clean.
• npm audit prod-high: 0 (root and parkhub-web); dev-inclusive total: 0 on both lockfiles.

Still red after this PR (settings, not code — separate action)

• trivy-fs / trivy-image die at Set-up-job: setup-trivy v0.2.6's NESTED action SHAs aren't in the repo's selected-actions allowlist (actions/cache/restore + cache/save @9255dc7a…, actions/checkout @8e8c483d…). Allowlist addition required.
• build(deps): bump the actions group across 1 directory with 15 updates #558 startup_failure: same allowlist mechanism for its 15 bumped action SHAs; YAML is valid.

Dependabot dispositions after merge

#546/#547/#548 superseded (close) · #545 keep (resources/js tree, unscanned but alerted) · #556/#557 rebase (feature bumps) · #558 rebase after allowlist.

[Copilot]

Pull request overview

Updates dependency lockfiles and OSV Scanner configuration to clear current Composer/npm audit blockers from the July 2026 advisory wave, without introducing suppressions.

Changes:

• Bumped Composer-locked packages (notably guzzle and web-token/jwt-library) to patched versions.
• Updated parkhub-web npm lockfile to pull in patched transitive deps (Astro/Vite/Undici/ws/etc.) and relaxed the Storybook ws override.
• Removed the now-unneeded OSV Scanner ignore entry and documented its resolution.

Reviewed changes

Copilot reviewed 2 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
parkhub-web/package.json	Relaxes Storybook ws override range to allow patched versions.
parkhub-web/package-lock.json	Locks updated parkhub-web dependency tree to versions that clear npm audit findings.
package-lock.json	Updates root lockfile to include patched dependency versions (notably Babel toolchain).
osv-scanner.toml	Removes resolved ignore entry and documents why the ledger is now empty.
composer.lock	Locks updated Composer dependency versions that address reported advisories.

Files not reviewed (1)

• parkhub-web/package-lock.json: Generated file

Comments suppressed due to low confidence (2)

parkhub-web/package.json:95

• Extra trailing blank lines at EOF add noise to diffs and may conflict with formatters that expect a single newline at end-of-file. Trim the trailing empty lines.
  parkhub-web/package-lock.json:17942
• Extra trailing blank lines at EOF add noise to diffs and may conflict with formatters that expect a single newline at end-of-file. Trim the trailing empty lines.