fix: patch vulnerable ScopeGuard dependencies

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [Unreleased]
+
+### Security
+
+- Updated `nanoid` 3.3.16 → 3.3.19 and `yaml` 2.8.1 → 2.8.3 (advisory fixes),
+  `vitest` 4.1.10 → 4.1.11 with its `@vitest/*` packages, `chai` 6.2.2 →
+  6.3.0, `tinyrainbow` 3.1.1 → 3.2.0, `@jridgewell/sourcemap-codec` 1.5.5 →
+  1.6.0. `package.json` raises the `yaml` floor to `^2.8.3` and the `vitest`
+  floor to `^4.1.11` so the safe minimums are protected.
+- Verified on the CI toolchain (Node 22, npm 10): fresh `npm ci`,
+  `npm audit` full and `--omit=dev` both report 0 vulnerabilities,
+  typecheck/test/build pass, and the built worker answers synthetic
+  GET/HEAD with 200, unknown paths with 404, disallowed methods with 405.
+- No behavioral, runtime-rule, or version changes in this update.

PROJECT_PLAN.md

@@ -0,0 +1,21 @@
+# PROJECT_PLAN — ScopeGuard
+
+Client-side scope-drift analyzer for agencies: upload a SOW/scope document and
+a communication export, run deterministic YAML rules, review findings, mark
+in-scope versus change request. All parsing happens in the browser
+(localStorage persistence); no server-side analysis.
+
+Current state (2026-10-02): public, active, version 0.2.0, hosted pilot at
+scopeguard.hlinor.com; React 19 + Vite 8 + TypeScript, Vitest 4 test suite
+(20 tests), single-file Cloudflare-Workers-style bundle built by
+`scripts/prepare-site-worker.mjs`.
+
+Governance: the portfolio agent contract and coordination workflow live
+outside this repository (shared workspace, not published here). Product
+changes go through bounded implementation tasks, independent review, explicit
+Owner acceptance, and a Git-only remote stage.
+
+Security maintenance (SCOPEGUARD-NPM-002): the three confirmed npm advisories
+are closed by targeted updates (nanoid 3.3.19, yaml 2.8.3, vitest 4.1.11 with
+its @vitest/* packages), with dependency floors raised in package.json so the
+safe minimums are protected. No behavioral or runtime-rule changes.

TODO.md

@@ -0,0 +1,10 @@
+# TODO — ScopeGuard
+
+- [ ] SCOPEGUARD-NPM-002 closeout: independent review, Owner acceptance, and
+      the separate Git stage (commit/push/PR) — none of these are done yet;
+      this list must not claim them before the evidence exists.
+- [ ] Keep the hosted pilot link (scopeguard.hlinor.com) in sync with the
+      deployed worker bundle.
+- [ ] Decide the pilot feedback loop for issue #9 (public repo funnel).
+- [ ] Consider lint tooling (none is configured today) once the current
+      dependency-security pass is accepted.

package.json

@@ -16,11 +16,11 @@
     "react-dom": "19.2.8",
     "typescript": "7.0.2",
     "vite": "8.2.0",
-    "yaml": "^2.8.1"
+    "yaml": "^2.8.3"
   },
   "devDependencies": {
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.4",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }