chore(deps): convert package-lock.json to lockfileVersion 3

.github/workflows/ci.yml

@@ -96,9 +96,19 @@ jobs:
         if: "!cancelled() && github.event_name != 'pull_request'"
         run: qlty smells --all
 
-      # osv-scanner declares skip_upstream, so only --all ever sees a lockfile. The root
-      # package-lock.json is too large for qlty to analyze (better-npm-audit gates it in the
-      # audit-* jobs), so in practice this gates src/test/vscode-notebook-perf/package-lock.json.
+      - name: Check lockfiles fit qlty's size limit
+        if: '!cancelled()'
+        run: |
+          status=0
+          for f in $(git ls-files '*package-lock.json'); do
+            size=$(stat -c%s "$f")
+            if [ "$size" -gt 2098000 ]; then
+              echo "::error file=$f::$f is $size bytes; qlty skips files over 2,098,000 bytes, so osv-scanner would not scan it"
+              status=1
+            fi
+          done
+          exit $status
+
       - name: Run qlty dependency scan
         if: '!cancelled()'
         run: qlty check --all --filter=osv-scanner

build/ci/postInstall.js

@@ -140,7 +140,7 @@ function verifyMomentIsOnlyUsedByJupyterLabCoreUtils() {
     const packageLock = JSON.parse(fs.readFileSync(packageLockPath, 'utf8'));
     const packagesAllowedToUseMoment = ['node_modules/@jupyterlab/coreutils', '@jupyterlab/coreutils'];
     const otherPackagesUsingMoment = [];
-    ['packages', 'dependencies'].forEach((key) => {
+    ['packages'].forEach((key) => {
         if (!(key in packageLock)) {
             throw new Error(`Invalid package-lock.json, as it does not contain the key '${key}'`);
         }
@@ -152,7 +152,7 @@ function verifyMomentIsOnlyUsedByJupyterLabCoreUtils() {
             ) {
                 return;
             }
-            ['dependencies', 'requires'].forEach((dependencyKey) => {
+            ['dependencies', 'optionalDependencies'].forEach((dependencyKey) => {
                 if (dependencyKey in packages[packageName]) {
                     const dependenciesOfPackage = packages[packageName][dependencyKey];
                     if ('moment' in dependenciesOfPackage) {

osv-scanner.toml

@@ -0,0 +1,17 @@
+# Accepted risks for the root package-lock.json, scanned by qlty's osv-scanner plugin.
+# Mirrors .nsprc (better-npm-audit), which holds the full assessment: keep both in sync.
+
+[[IgnoredVulns]]
+id = "GHSA-848j-6mx2-7j84"
+ignoreUntil = 2026-10-17
+reason = "CVE-2025-14505 (elliptic): dev-only, via node-stdlib-browser; no patched release. See .nsprc."
+
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"
+ignoreUntil = 2026-11-06
+reason = "CVE-2026-93687 (braces): not shipped, not reachable with untrusted input; no patched release. See .nsprc."
+
+[[IgnoredVulns]]
+id = "GHSA-hp3w-g68c-fv3c"
+ignoreUntil = 2026-11-06
+reason = "CVE-2026-97058 (sprintf-js): not shipped, not reachable; no patched release. See .nsprc."