deps: adm-zip/sharp high-severity findings via @huggingface/transformers devDependency (no fix available yet)

[carlos-alm]

Summary

While fixing #2254 (production Security audit job failing on fast-uri/hono/ip-address), npm audit (no --omit=dev) surfaces two additional high-severity findings entirely within devDependencies, both with no fix available upstream:

adm-zip  <0.6.0
Severity: high
adm-zip: Crafted ZIP file triggers 4GB memory allocation - https://github.com/advisories/GHSA-xcpc-8h2w-3j85
No fix available
node_modules/adm-zip
  onnxruntime-node  >=1.22.0-dev.20250415-c18e06d5e3
  Depends on vulnerable versions of adm-zip
  node_modules/onnxruntime-node
    @huggingface/transformers  *
    Depends on vulnerable versions of onnxruntime-node
    Depends on vulnerable versions of sharp
    node_modules/@huggingface/transformers

sharp  <0.35.0
Severity: high
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 - https://github.com/advisories/GHSA-f88m-g3jw-g9cj
No fix available
node_modules/sharp

Why this doesn't block #2254 or CI today

• Both chains root at @huggingface/transformers, which is a devDependency in this repo (used for local embedding tests) and a peerDependency (marked optional: true via peerDependenciesMeta) for consumers — it never ships in the production audit surface.
• CI's production job (npm audit --omit=dev --audit-level=high --package-lock-only) correctly excludes this chain.
• CI's devDependency job (npm audit --audit-level=critical --package-lock-only) is deliberately scoped to critical only; these are high, so it stays green.
• npm audit fix reports no fix available for either adm-zip or sharp at the versions pulled in by onnxruntime-node/@huggingface/transformers today.

Suggested follow-up

Periodically re-check npm audit (without --omit=dev) for this chain — a patched onnxruntime-node/adm-zip/sharp release may close it without any local change needed. If @huggingface/transformers bumps its onnxruntime-node pin, re-run npm install and confirm.