web(deps): resolve SvelteKit cookie audit advisory #54

Evidence

npm ci on main at a85b909 reports three low-severity audit entries which are one dependency chain:

• direct @sveltejs/kit 2.70.3;
• direct @sveltejs/adapter-static 3.0.10, affected through Kit;
• transitive cookie 0.6.0, affected by GHSA-pxg6-pf52-xh8x (cookie accepts out-of-bounds characters in cookie name, path, and domain).

npm audit --json reports no moderate, high, or critical findings. The suggested automated fix incorrectly proposes old semver-major package versions (@sveltejs/kit 0.0.30 or adapter-static 0.0.17), so npm audit fix --force is not an acceptable remedy. Consolebook uses SvelteKit only to build a static SPA; Rust/Axum owns runtime cookies.

Outcome

Evaluate the first compatible Kit release or a safe lockfile/override update that carries cookie >=0.7.0, confirm the static-build threat boundary, and run npm ci, npm audit, npm run check, npm run build, the Rust gates, and browser tests before merging. Do not suppress the advisory without a documented reason.

Execution record (2026-10-15)

• Authority: the maintainer, 2026-10-15, local session: "yes please do so. i'd like to use latest versions of packages here where it makes sense in general". This came in reply to taking web(deps): resolve SvelteKit cookie audit advisory #54 after Dependabot's chore(deps): bump cookie, @sveltejs/adapter-static and @sveltejs/kit in /web #134 failed to install, plus the standing permission to manage PRs end to end, including merging.
• Scope (widened by that instruction): move the web stack to its latest stable releases wherever that makes sense. That covers SvelteKit 3, adapter-static 4, vite-plugin-svelte 7, and their Vite, Svelte, and TypeScript peers, plus the other direct dev dependencies (svelte-check, Playwright, …). The cookie advisory (GHSA-pxg6-pf52-xh8x, Dependabot alert Implement Milestone 1 operable-shell foundation #1) closes as a result. Rust crates, the toolchain, and Actions pins are separate PRs, one per ecosystem. Keeping versions current from now on is mechanical: Dependabot version updates, in their own change.
• Plan:
  1. A scout inventories the outdated packages, their breaking changes, the compatible version set, and the Node minimum.
  2. The implementer migrates from a fixed brief.
  3. An independent reviewer reviews.
  4. A verifier runs the full proof, and the browser suite must pass unchanged unless a breaking change requires otherwise.
  5. The PR merges under the standing permission.
• Next action: take the scout's inventory, then brief the migration.