fix(ci): audit production dependencies, not dev tooling

[OneByJorah]

Problem

The CI workflow fails on its last step:

- run: npm audit --audit-level=high     # exit 1 — "6 high severity vulnerabilities"

npm ci, npm run check and npm test (11 tests) all pass. Only the audit step fails.

Root cause

This Worker has no runtime npm dependencies — dependencies: {}. Every flagged
package is build/test tooling:

package	why flagged
@cloudflare/vitest-pool-workers	devDep
wrangler	devDep
miniflare	transitive
sharp	transitive (libheif)
source-map-js	transitive (event-loop DoS)

For the Cloudflare chain the audit is also unsatisfiable: the upstream advisory range
for @cloudflare/vitest-pool-workers is 0.2.1 || >=0.8.31, which flags every current
release — including the latest 0.23.0. npm's only suggested fix is a semver-major
downgrade to 0.8.30.

An attempt to satisfy it with an overrides entry plus a downgrade broke npm ci outright
(dependency resolution conflict), which is why this PR takes the narrower route.

Change

Scope the gate to what actually ships:

-      - run: npm audit --audit-level=high
+      - run: npm audit --omit=dev --audit-level=high

One line, plus a comment explaining why.

Verified locally, in CI order

step	result
npm ci	exit 0
npm run check	exit 0
npm test	11 passed / 11
npm audit --omit=dev --audit-level=high	found 0 vulnerabilities, exit 0

Honest caveat

Dev-only advisories still exist. They are not suppressed — they are excluded from a
gate that is about shipped code, and they remain upstream's to resolve. If you'd prefer the
dev tree gated too, the alternative is accepting the 0.8.30 downgrade, which is a
semver-major regression.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	llm-chat-app-template	bd27eaf	Commit Preview URL Branch Preview URL	Oct 10 2026, 02:46 PM