npm audit: 1 critical vulnerability

[TaprootFreak]

Problem

The CI review action reports 1 critical vulnerability via npm audit on every PR. This has been happening consistently since at least January 2026 (confirmed on PRs #3076, #3106, #3119, #3235, #3237).

The vulnerability is in a transitive npm dependency, not in our code.

Impact

• Every PR gets a ❌ Security: 1 critical vulnerabilities comment from the review bot
• This creates noise and desensitizes reviewers to actual security issues

Suggested fix

Run npm audit to identify the affected package and either:

• Update the dependency to a patched version
• Replace the dependency if no fix is available
• Explicitly acknowledge the vulnerability if it's not exploitable in our context