Fix security scanning and evidence exports

[RNA4219]

Summary

• update vulnerable root and fixture dependencies, including Vitest, Vite, PostCSS, js-yaml, fast-uri, brace-expansion, body-parser, and qs
• add export sarif --scope security and upload only security-relevant findings to GitHub Code Scanning while retaining the full SARIF artifact
• align the QEG gate fixture with the 0.2 pre-release evidence contract and stop synthesizing release approval evidence
• exclude common Python caches and repository-local generated output from bounded discovery

Why

The repository had newly surfaced Dependabot alerts and was uploading maintainability findings as GitHub Security alerts. The QEG fixture also referenced future output paths and claimed producer-side approval that belongs to the authorized release workflow.

Impact

GitHub Code Scanning receives only auth, payment, validation, data, and security categories. Full SARIF remains available as an artifact. Root and demo fixture dependency installs audit cleanly, and QEG remains the final verdict owner.

Validation

• npm run test:ci:stable: 3,579 passed, 4 skipped
• targeted export/file-utils tests: 177 passed
• fixture integration tests: 44 passed
• demo fixture tests: shop 14 passed, GitHub Actions 3 passed, CI imports 1 passed, auth public-route tests passed
• root and fixture audited installs: 0 known vulnerabilities
• npm run release:validate: passed
• QEG pinned CI runtime 0835903: validate and gate passed
• workflow YAML parsing and git diff --check: passed

The demo GitHub Actions fixture intentionally retains its pre-existing failing build/typecheck/lint signals for CI-analysis coverage.

[github-actions]

code-to-gate PR Review

Gate Verdict

• Status: needs_review
• Readiness: passed
• Findings: 3 total, 0 critical, 0 high

Blocking Reasons

• No blocking reason was found.

Acceptable Risks

• [info] Readiness verdict is passed: All policy conditions met, release ready
• [info] No unsupported claims are present: LLM or imported claims that lack evidence are not present in findings.unsupported_claims.
• [info] Public docs, CLI, schema, and schema coverage are aligned: 8 spec drift checks passed without failures.

Suggested Tests

• [medium] Run src/tests/integration/export.test.ts: Test path matched changed source path. Command: npm test -- src/tests/integration/export.test.ts Source: test-plan-001, src/cli/export.ts
• [medium] Run src/tests/smoke/real-repo-script-smoke.test.ts: Test path matched changed source path. Command: npm test -- src/tests/smoke/real-repo-script-smoke.test.ts Source: test-plan-002, src/tests/smoke/real-repo-script-smoke.test.ts
• [medium] Run src/cli/tests/export-generators.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/export-generators.test.ts Source: test-plan-003, src/cli/export.ts
• [medium] Run src/cli/tests/export-types.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/export-types.test.ts Source: test-plan-004, src/cli/export.ts
• [high] Run src/cli/tests/export.test.ts: Test path matched changed source path. Command: npm test -- src/cli/tests/export.test.ts Source: test-plan-005, src/cli/tests/export.test.ts, src/cli/export.ts
• [high] Run src/core/tests/file-utils.test.ts: Test path matched changed source path. Command: npm test -- src/core/tests/file-utils.test.ts Source: test-plan-006, src/core/tests/file-utils.test.ts, src/core/file-utils.ts
• [high] Define expected behavior for scripts/real-repo-test-contract.sh and add a focused regression or manual black-box check.: No related automated test was found for this changed source file. Source: oracle-gap-001, scripts/real-repo-test-contract.sh
• [high] Define expected behavior for scripts/real-repo-test.sh and add a focused regression or manual black-box check.: No related automated test was found for this changed source file. Source: oracle-gap-002, scripts/real-repo-test.sh

Spec Drift

• No spec drift was found or no spec-drift artifact was provided.

Drift Budget

• No drift budget summary is available.

Evidence Links

• Release readiness: .qh/release-readiness.json schema: release-readiness@v1 hash: 2b7c4109c3f214bf
• Findings: .qh/findings.json schema: findings@v1 hash: 02334e66e55d0f45
• Auto test plan: .qh/test-plan.json schema: test-plan@v1 hash: 56073f9d6ae9edd2
• Spec drift: .qh/spec-drift.json schema: spec-drift@v1 hash: 07b3613acc5ffb5c
• Evidence DAG: .qh/evidence-dag.json schema: evidence-dag@v1 hash: 1550c1b23f9d1913
• QEG evidence input: .qh/qeg-code-to-gate.json schema: ctg.qeg-input/v1 hash: 3679fa56c38f0d18
• Published quality report: https://github.com/RNA4219/code-to-gate/actions/runs/31940928231

Suppression / Baseline Summary

• No baseline summary is available.

Gate Explainability

• No gate explainability summary is available.

---

Generated by code-to-gate v1.5.1