[Ahmustufa]

Replaces #259. Same group bump, with oxlint held at 1.85.0.

Why the PRs are failing, and why it is one problem not five

main itself fails all three security scans. These are not per-PR regressions — they are advisories that landed, and every open PR inherits them:

• Go: four vulnerabilities (GO-2026-6610/6611/6612/6617), all in one module — golang.org/x/net@v0.59.0, fixed in v0.60.0.
• npm: source-map-js (high, GHSA-68fv-2mgg-jv7q) and fast-uri (moderate). Only the high one trips --audit-level=high.

The dependabot PRs are the remedy, not casualties. #260 takes x/net to v0.61.0, clearing all four Go vulns. #259 takes source-map-js to 1.2.2, clearing the high advisory. Each shows red only for the half it does not cover.

The one real break, and why this PR exists

#259 also fails Frontend, because it bundles the group with oxlint 1.85.0 → 1.88.0, and 1.88 adds a Cannot call impure function during render rule that catches four pre-existing findings:

src/features/inbox/inbox-page.tsx:275:83
src/features/inbox/undo-send-pill.tsx:25:12
src/features/inbox/compose-window.tsx:300:41
src/features/inbox/reply-composer.tsx:220:39
Found 0 warnings and 4 errors.

So a high-severity security fix is blocked behind a linter upgrade nobody chose to take on — which is precisely the situation CLAUDE.md pins oxlint to prevent:

Upgrading the pin is now a deliberate act with its own PR, exactly like bumping GOLANGCI_VERSION.

#218 set the precedent by taking the group and holding the pin. This does the same.

What this changes

Every bump from #259 except oxlint, which stays at 1.85.0 (lockfile regenerated to match, verified at node_modules/oxlint = 1.85.0).

The four findings are real and should be fixed, not suppressed — the last pin bump fixed every React Compiler finding rather than silencing it. They belong in an oxlint-1.88 PR with its own review, not smuggled into a dependency chore.

Verification

Gate	Result
npm audit --audit-level=high	passes — one moderate remains, below the gate
source-map-js in lockfile	1.2.2 — the high advisory is cleared
npm run lint (oxlint 1.85.0)	clean
npm run typecheck (tsc -b)	clean
npm test	171 files, 1856 tests passing
npm run build	per-route chunks intact
npm run gen:api	no drift

Suggested order

1. This PR and chore(deps): bump the go-minor-patch group across 1 directory with 19 updates #260 — together they clear the security scans on main, which is what unblocks everything else.
2. feat(sequences): optimistic concurrency for step branch writes #248, then feat(web): yes/no condition nodes on the campaign canvas #245 (it consumes an API that only exists in feat(sequences): optimistic concurrency for step branch writes #248 — merging it first breaks the build).
3. feat(worker): configurable retention for high-volume tables, off by default #244 needs a genuine merge in .env.example, capabilities_test.go and maintenance/cleanup.go.
4. An oxlint 1.88 PR that fixes the four findings.

Closes #259.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VECELVAKe8Xcp7GH9wGR5t