fix(deps): clear the OSV suppressions that expire on 2026-11-30

Delete the hono, @anthropic-ai/sdk (#2754) and sprintf-js ignores, which the
lockfiles no longer match. Override image-size to 2.0.4 (#2753) and chokidar
to 4.0.3 in lib/diagram-render (drops braces), and delete those ignores.
Re-date katex to 2027-01-31: its fix is outside mermaid 11's range
(mermaid-js/mermaid#8388).

html-to-docx 1.8.0 bundles its own image-size 1.x, which the override cannot
reach and whose ICNS parser loops forever. make-pdf --to docx now hands it
only PNG, JPEG, GIF, WebP or SVG bytes. A golden docx test proves the Word
output is unchanged.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/osv-config-wiring.test.ts

@@ -50,4 +50,12 @@ describe("osv-scanner config wiring", () => {
     const page = fs.readFileSync(path.join(ROOT, "lib", "diagram-render", "dist", "diagram-render.html"), "utf8");
     expect(page).not.toMatch(/chokidar|FSWatcher/);
   });
+
+  test("the chokidar override keeps braces (GHSA-vfj7-8cjw-p6xm, no fixed release) out of lib/diagram-render", () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, "lib", "diagram-render", "package.json"), "utf8"));
+    expect(pkg.overrides.chokidar).toMatch(/^4\./);
+    const lock = fs.readFileSync(path.join(ROOT, "lib", "diagram-render", "bun.lock"), "utf8");
+    expect(lock).toMatch(/"chokidar": \["chokidar@4\.\d+\.\d+"/);
+    expect(lock).not.toMatch(/"braces": \["braces@/);
+  });
 });

test/osv-ignore-expiry.test.ts

@@ -58,18 +58,15 @@ describe('OSV suppression expiry', () => {
     for (const text of ['"$SCAN_RESULT" = "failure"', 'gh issue create', 'gh issue comment', 'gh issue close']) expect(run).toContain(text);
   });
 
-  test('the image-size entries name the fixed release and the pin that blocks it (#2753)', () => {
-    const toml = fs.readFileSync(path.join(import.meta.dir, '..', '.osv-scanner.toml'), 'utf8');
-    const entries = toml.split('[[IgnoredVulns]]').slice(1).filter(e => /^id = "GHSA-(?:5p2g-fcmc-qvqq|w3rx-r6r6-pgpr)"/m.test(e));
-    expect(entries).toHaveLength(2);
-    for (const entry of entries) {
-      expect(entry).not.toContain('No fixed version exists');
-      expect(entry).toMatch(/^reason = ".*image-size 2\.0\.3.*\^1\.0\.0.*"$/m);
-      expect(entry).toContain('ignoreUntil = 2026-11-30T00:00:00Z');
-    }
-    // The stated blocker is the lockfile's: html-to-docx asks for image-size ^1.0.0 and resolves a 1.x.
+  test('image-size is overridden to a fixed 2.x and its suppressions are gone (#2753)', () => {
+    const toml = fs.readFileSync(path.join(ROOT, CONFIG), 'utf8');
+    expect(toml).not.toMatch(/GHSA-(?:5p2g-fcmc-qvqq|w3rx-r6r6-pgpr)/);
+    const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+    expect(pkg.overrides['image-size']).toBe('2.0.4');
+    // html-to-docx still asks for ^1.0.0; the override is what moves the lockfile off the affected 1.x.
     const lock = fs.readFileSync(path.join(ROOT, 'bun.lock'), 'utf8');
     expect(lock).toMatch(/"html-to-docx": \["html-to-docx@[^"]+", "", \{ "dependencies": \{[^}]*"image-size": "\^1\.0\.0"/);
-    expect(lock).toMatch(/"image-size": \["image-size@1\.\d+\.\d+"/);
+    expect(lock).toMatch(/"image-size": \["image-size@2\.0\.4"/);
+    expect(lock).not.toMatch(/"image-size": \["image-size@1\./);
   });
 });