chore(security): bundle 22 Dependabot fixes for datasheetsChat (npm)

[benfrank241]

Daily security sweep — bundles the Dependabot fixes for datasheetsChat/package-lock.json onto a human-authored branch so CI actually runs with repo secrets (Dependabot's own branches don't get them).

Closes 22 of the 23 open alerts. One alert has no upstream fix and is backlogged (see below).

Changes

datasheetsChat/package.json + regenerated package-lock.json (via npm install --package-lock-only, not a from-scratch regen).

Direct bumps (fixed version was already in range):

package	before	after
next	15.5.18	15.5.24
postcss	8.5.14	8.5.26

Overrides (transitive — no direct declaration to bump):

package	before	after	note
sharp	0.34.4	0.35.4	within next's own ^0.34.3 || ^0.35.3 range
js-yaml	4.1.1	4.3.1	dev, via eslint
brace-expansion@^1	1.1.14	1.1.18	scoped — minimatch@3 needs the 1.x line
brace-expansion@^2	2.1.0	2.1.4	scoped — minimatch@9/10 need the 2.x line

nanoid moved 3.3.12 → 3.3.18 for free via the postcss bump (no override needed), and next's pinned nested postcss@8.4.31 deduped away entirely.

brace-expansion needed two version-scoped override keys rather than one global entry: the 1.x and 2.x lines are both present under different minimatch majors, so a single global override would have broken one of them.

Alerts closed

#42 #54 #55 #56 #57 #58 #59 #60 #61 #62 #63 #64 #65 #66 #67 #69 #70 #72 #74 #75 #76 #77

Advisory IDs (22)

• next → 15.5.21+: GHSA-q8wf-6r8g-63ch (#56), GHSA-89xv-2m56-2m9x (#61), GHSA-4633-3j49-mh5q (#62), GHSA-68g3-v927-f742 (#63), GHSA-955p-x3mx-jcvp (#64), GHSA-m99w-x7hq-7vfj (#65), GHSA-4c39-4ccg-62r3 (#66), GHSA-p9j2-gv94-2wf4 (#67)
• postcss → 8.5.23+: GHSA-qx2v-qp2m-jg93 (#42), GHSA-6g55-p6wh-862q (#58), GHSA-r28c-9q8g-f849 (#60), GHSA-fxqj-rqcc-2cmp (#70)
• brace-expansion: GHSA-3jxr-9vmj-r5cp (#59, #76), GHSA-mh99-v99m-4gvg (#69), GHSA-rgw5-rvv9-x895 (#77)
• js-yaml: GHSA-h67p-54hq-rp68 (#54), GHSA-52cp-r559-cp3m (#57), GHSA-5p4m-2wfm-xmqj (#72)
• nanoid: GHSA-28wg-ghj8-5hjv (#74), GHSA-2v37-7h3g-55p8 (#75)
• sharp: GHSA-f88m-g3jw-g9cj (#55)

npm audit on this branch: 12 vulnerabilities (4 high, 1 moderate, 7 low) → 7 low, all 7 being the un-fixable @ai-sdk/* chain below.

Needs a human look

• sharp 0.34.4 → 0.35.4. A 0.x minor is a breaking-change slot in semver, and this pulls in the new @img/sharp-* platform binaries (the only packages added by this PR). It stays inside the range next@15.5.24 itself declares, and I smoke-tested the native binding locally — sharp loads and encodes a PNG against libvips 8.18.6. Still worth a second opinion since it's a native dep.
• No major-version bumps otherwise. next stays on 15.5.x.

⚠️ main does not currently build — pre-existing, not caused by this PR

npm run build fails on this branch, and it fails identically on unmodified main. I reproduced it on a clean checkout before touching anything:

./src/app/api/chat/route.ts:134:5
Type error: Type 'LanguageModelV1' is not assignable to type 'LanguageModel'.
  Property 'supportedUrls' is missing in type 'LanguageModelV1' but required in type 'LanguageModelV2'.

tsc --noEmit reports the same 8 errors, byte-identical, before and after this change — this PR introduces zero new type errors. The webpack compile stage passes (✓ Compiled successfully); only the typecheck stage fails.

The cause is a pre-existing mismatch in package.json that predates this sweep: ai@^5.0.68 is paired with @ai-sdk/openai@^1.1.9 / @ai-sdk/react@^1.2.2 / @ai-sdk/groq@^1.1.7, and src/app/api/chat/route.ts is written against the AI SDK v4 API (parameters: instead of inputSchema:, toDataStreamResponse() instead of toUIMessageStreamResponse()). Fixing that is an app-code migration, deliberately not mixed into a security bundle. Tracked separately in the backlog issue.

Note that repo CI here is only the GitLeaks secret scan — there is no build/test workflow — so this does not turn CI red.

npm run lint is also not runnable in either tree: no ESLint config is committed, so next lint drops into an interactive setup prompt. Unchanged by this PR.

Verification performed

• npm ci — clean, no ERESOLVE
• npm run build — compile stage passes; typecheck fails identically to main (above)
• tsc --noEmit — diffed against main: identical, no new errors
• sharp native binding — loads and encodes a PNG (libvips 8.18.6)
• lockfile churn reviewed: the only added packages are the expected @img/sharp-* platform set; no unrelated churn

🤖 Generated with Claude Code