fix: remediate September 2026 security findings

[jmgasper]

Summary

• Upgrade the Storybook toolchain from 7.6.x to 8.6.18. This removes the storybook -> @storybook/cli -> puppeteer-core@2.1.1 -> extract-zip dependency path; extract-zip has no patched release.
• Resolve PostCSS Nano ID to 3.3.18, satisfying GHSA-2v37-7h3g-55p8 / CVE-2026-67213.
• Replace the CodeQL-flagged URL prefix substring check in the campus leaderboard test with a semantic allowlist of expected challenge names.
• Give the GitHub-hosted auth library and the legitimate remark-gfm@4.0.1 alias project-owned scoped names. The auth dependency is pinned to immutable commit 56996006ee5918b3e77fc5a8ab005ae738b4de12; this removes misleading Yarn audit matches against unrelated public registry packages.

Live security inventory

Source	Alert	Severity	Resolution
Dependabot #381	extract-zip <=2.0.1 / GHSA-jmr9-qjv8-65gv	High	Removed the complete transitive path by upgrading Storybook
Dependabot #382	nanoid <3.3.18 / GHSA-2v37-7h3g-55p8	High	Resolved the PostCSS branch to 3.3.18
Code scanning #318	Trivy Nano ID finding	Medium	Lockfile now contains patched 3.3.18 for the affected branch
Code scanning #319	js/incomplete-url-substring-sanitization	High	Removed URL substring sanitization logic from the test

No alerts were dismissed. Existing alerts on dev should close from the corrected source and dependency graph after merge.

Validation

• yarn audit --level moderate --json: 0 info, low, moderate, high, or critical findings across 2,915 dependencies
• yarn why extract-zip: no matching dependency
• yarn why nanoid: affected PostCSS branch is 3.3.18; independent modern branch is 6.0.1
• yarn lint: passed
• yarn run build: passed
• yarn sb:build: passed on Storybook 8.6.18
• Focused changed test: passed
• Full test suite: 22 failed / 276 passed suites and 30 failed / 1,485 passed tests
• Detached origin/dev baseline: exactly the same 22 failed / 276 passed suites and 30 failed / 1,485 passed tests, confirming no new failures
• git diff --check: passed

The existing build and test warnings/failures are baseline behavior and are unrelated to this remediation.

Deployment mapping

This UI repository has no ECR/container-image mapping for this change. No image rebuild or ECR publication is required.

[jmgasper]

Post-push verification is complete:

• All seven reported checks are green: CodeQL Actions analysis, CodeQL JavaScript/TypeScript analysis, aggregate CodeQL gate, Trivy workflow, aggregate Trivy gate, CircleCI build, and CircleCI lint.
• GitHub code-scanning API reports zero open critical/high/medium findings for PR fix: remediate September 2026 security findings #2209.
• CodeQL uploaded two successful analyses for commit 62eaf9c613361bf54d87559b249152bdc34ef384 with no analysis errors; Trivy uploaded its successful merge-ref analysis.
• The original Dependabot TCA-516 optimize certificate for social -> dev #381/TCA-584 Minor Cleanup of Cert view -> TCA-516_optimize-certificate-sharing #382 and code-scanning Feat/game 82 #318/Gamification #319 records remain open on dev until this corrected graph/source is merged. None were dismissed.
• No ECR mapping applies to this UI repository.