Issue #309 found high-severity vulnerabilities in the SvelteKit/Svelte/Vite build toolchain even though the production-only audit added in #308 was clean. These developer dependencies process repository input during checks and release builds.
Once #310 has made the complete lockfile clean, change the PR workflow from npm audit --omit=dev to npm audit and update the regression test. This prevents a repeat of the blind spot while retaining the production dependency coverage.
Issue #309 found high-severity vulnerabilities in the SvelteKit/Svelte/Vite build toolchain even though the production-only audit added in #308 was clean. These developer dependencies process repository input during checks and release builds.
Once #310 has made the complete lockfile clean, change the PR workflow from
npm audit --omit=devtonpm auditand update the regression test. This prevents a repeat of the blind spot while retaining the production dependency coverage.