[zircote]

Summary

Fixes the two pre-existing failures on main CI.

semgrep / sast-code

Semgrep 1.139.0 crashes on pydantic 2.14 (ImportError: eval_type_backport) on every run. Re-pins reusable-semgrep.yml in quality-gates.yml from 5c856f8 to .github main 63155e10b6f837069f71442f2e49186dd91d6509, which carries modeled-information-format/.github#90 (default Semgrep 1.180.0). Diffing the reusable workflow between the two SHAs shows only the semgrep-version default and an upload-sarif action bump; inputs, outputs, secrets, and permissions are unchanged, so the caller still matches.

release.yml's gate-semgrep gets the same re-pin (from the review pass), so the release attestation doesn't crash the same way and runs the same engine as the merge gate. attest-semgrep still gets the same sarif-artifact/sarif-filename outputs. The quality-gates.yml header comment no longer claims all gates share one pin SHA.

sca / osv-scanner

Adds osv-scanner.toml next to the only lockfile (repo root), modelled on MIF's, with justified [[IgnoredVulns]] for three advisories whose fix can't be reached within upstream ranges:

Advisory	Package	Path	Why it can't be fixed
GHSA-vfj7-8cjw-p6xm	braces 3.0.3	starlight-llms-txt → micromatch	no fixed release exists
GHSA-238p-pmpm-9mq7	katex 0.16.47	astro-mermaid → mermaid	fix 0.18.2, mermaid pins ^0.16
GHSA-rj75-hqrm-r3gf	postcss-selector-parser 6.1.4	starlight → expressive-code → postcss-nested 6.2.0	fix 7.1.6, postcss-nested pins ^6.1.1

braces and postcss-selector-parser only run at build time, on repo-authored input. katex is only reachable through client-side mermaid on math in diagram labels. The site's one diagram is repo-authored and has no math, and the advisory also needs prototype pollution that already exists in the page.

package.json

Removes the stale "sharp@0.35.3": true allowScripts entry. The lock resolves sharp 0.35.5, which has no install script. The esbuild@0.28.1 entry stays because esbuild is still overridden to 0.28.1.

Verification (local)

• osv-scanner scan source -r .: Filtered 3 vulnerabilities from output / No issues found
• actionlint: clean
• rm -rf node_modules && npm ci && npm run build: Complete! (8 pages)
• claude plugin validate .: Validation passed

🤖 Generated with Claude Code