fix: remove vulnerable build dependencies

[joshuajbouw]

Summary

Remove the vulnerable build-tool dependency graph before publishing 0.2.0, and make dependency auditing a dedicated CI check.

Security impact

• removes the critical @bytecodealliance/weval → decompress@4.2.1 archive-extraction path (GHSA-mp2f-45pm-3cg9, GHSA-h39j-r5qq-r9mm)
• upgrades away from the affected esbuild development-server line (GHSA-67mh-4wv8-2f99)
• pins componentize-js@0.19.3 and compatible @bytecodealliance/jco@1.17.8 so downstream installs of @unicity-astrid/build also resolve the audit-clean graph
• upgrades esbuild to the patched 0.25.x line

CI policy

• adds a separate Dependency audit job
• uses a clean npm ci install
• runs npm audit --audit-level=low, failing on any reported severity
• after this check exists, it will be added to the active main ruleset as a required status check

Validation

• fresh npm ci
• npm audit --audit-level=low — 0 vulnerabilities
• full workspace build against committed contracts a268eb3 — 14.02 MB example, 178 host imports
• npm test — 9/9 passed
• npm package dry-runs for @unicity-astrid/build@0.2.0 and @unicity-astrid/sdk@0.2.0
• installed the build tarball in a fresh downstream project — 0 vulnerabilities
• git diff --check

Release state

0.2.0 has not been published to npm, and no remote v0.2.0 tag or GitHub Release exists. After this merges, the first v0.2.0 tag can point directly at the corrected main; no tag deletion or movement is needed.

[Copilot]

Pull request overview

This PR updates the workspace’s build-tool dependency graph to remove known vulnerable transitive paths ahead of the 0.2.0 release, and adds a dedicated CI job to enforce ongoing dependency auditing.

Changes:

• Upgraded esbuild across the workspace to ^0.25.12.
• Pinned @bytecodealliance/componentize-js to 0.19.3 and added/pinned compatible @bytecodealliance/jco 1.17.8 to keep downstream installs audit-clean.
• Added a separate GitHub Actions “Dependency audit” job that runs npm ci and fails on any npm audit findings at --audit-level=low.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/astrid-sdk/package.json	Bumps esbuild devDependency to the patched 0.25.x line.
packages/astrid-build/package.json	Pins componentize-js and adds pinned jco, plus upgrades esbuild, to remove vulnerable transitive dependencies for downstream consumers.
package-lock.json	Updates the lockfile to reflect the new pinned/updated dependency graph and removes the vulnerable weval → decompress chain.
CHANGELOG.md	Documents the security-related dependency/toolchain upgrades and the audit CI policy addition.
.github/workflows/ci.yml	Adds a dedicated “Dependency audit” job running npm ci + npm audit --audit-level=low.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.