[julianknutsen]

Summary

Unblocks verify on main. It currently fails at Dependency audit, so typecheck, the unit and Postgres lanes, image smoke and e2e never run. Behind the audit there is a second blocker: the browser e2e web server regenerates the aggregate, and that fails on an upstream pack rename.

1. Dependency audit (dec071f)

Advisory	Range	Fix
smol-toml GHSA-r4xh-jqrq-34v2	<=1.8.0	direct ^1.7.1 → ^1.9.1
vite GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22, plus the bundled launch-editor advisories	>=8.0.0 <=8.1.5 (also 8.2.0–8.2.3, 8.3.0–8.3.2)	direct (dev) ^8.0.16 → ^8.3.3 (resolves 8.3.5)
brace-expansion GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr	2.x patched in 2.1.5 / 2.1.6 / 2.1.7	existing override >=5.0.9 → ^2.1.7. The only consumer, minimatch 5.x via @redocly/openapi-core, declares ^2.0.1; a 5.x override breaks it (expand is not a function).
source-map-js GHSA-68fv-2mgg-jv7q (via postcss)	<1.2.2	new override ^1.2.2

The postcss override floor is raised to ^8.5.30, the range vite 8.3.x declares (resolves 8.5.31).

The lockfile churn is minimal. Every advisory has a patched release, so nothing needed an ignore. This follows the approach of #605.

2. Upstream pack rename (811c94e)

gascity-packs renamed contributing to contributing-to-gascity (release 0.5.0, "First release under the new name"). The expected_packs trust list in sources.toml still names the old pack, so bun run generate refuses the source with unexpected pack "contributing-to-gascity" is not declared in expected_packs. That breaks:

• the Playwright web server, which runs bun run generate before starting;
• the hourly aggregate refresh.

This commit renames the trust-list entry and regenerates the committed outputs.

Please review:

• Trust list. This is a change to a trusted publisher's allowlist. It follows the upstream rename and admits no new source.
• Pack key change. The key becomes gascity-packs--contributing-to-gascity, so links that use the old key change.
• Overlap with chore: update aggregate registry #610. The regenerated outputs also pick up upstream releases that chore: update aggregate registry #610 (rolling aggregate refresh) would carry, such as bmad, compound-engineering and gstack. chore: update aggregate registry #610's bot will refresh itself on top of this. No dependabot PR (chore(deps): bump docker/build-push-action from 6 to 7 #29-chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 #32, chore(deps): bump docker/metadata-action from 5 to 6 #40, chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in the build-and-test group across 1 directory #41) touches these packages.

Local verification (each verify step)

• bun install --frozen-lockfile: OK
• bun audit: no vulnerabilities
• bun run generate:check: current
• bun run typecheck: clean
• bun run build: OK
• bun run openapi:check: no drift
• bun run test:unit: 453 pass (re-run on 8dfcac0 after the override fixes, along with every other step listed here)
• Postgres lane (REGISTRY_TEST_REQUIRE_POSTGRES=1, postgres:16): 169 pass
• bun run test:cli: 1 pass. This used a locally installed gc, not the one extracted from the production image.
• bun run test:e2e (Playwright, chromium): 33 pass
• Not run locally: the production image docker build smoke.

🤖 Generated with Claude Code