The `shared` job's trivy fs scan started failing on CVE-2026-73088 and
CVE-2026-73089 (browserslist 4.28.2, prototype pollution + unbounded DoS,
both fixed in 4.28.7). Because `image` is gated on `shared`, no image was
built and the portal entitlement fix could not deploy.
Not introduced by any code change: `shared` passed on the previous commit
(ac28e22) with the same dependency tree. Trivy refreshes its vulnerability DB
each run, so these advisories were published in between.
Cleared with a pnpm override, the same pattern already used here for nanoid,
postcss, @auth/core and sharp. browserslist is transitive (not a declared
dependency), so an override is the only lever. Lockfile now resolves 4.28.8.
Verified: tsc --noEmit 0, next build 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD
