Fix critical CVEs from daily vulnerability scan

[geropl]

Description

Remediates the Critical findings reported by the July 22 scheduled vulnerability scan.

Finding	Package	From	To / mitigation
GHSA-23hp-3jrh-7fpw	tar	6.1.15	7.5.21, via grpc-tools 1.12.4 → 1.13.1
GHSA-xv26-6w52-cph6	websocket-driver	0.7.4	0.7.5
GO-2026-5064	github.com/containerd/containerd	1.6.39	Documented scanner ignore: affected artifacts use only client/content/registry APIs and do not embed or expose the vulnerable CRI checkpoint restore server
GO-2026-5338	github.com/containerd/containerd	1.6.39	Documented scanner ignore: affected artifacts use only client/content/registry APIs and do not embed or expose the vulnerable CRI checkpoint import server

The grpc-tools bump is applied to every TypeScript API workspace that declares it. The websocket fix uses the repository's existing root-resolution mechanism because it is a transitive dependency of the dashboard development server.

The containerd advisories affect CRI checkpoint server paths. Gitpod's flagged binaries import containerd as clients or use content, image, and registry helpers; none imports or runs the CRI checkpoint implementation. Containerd's maintained fix lines also require the breaking v2 module path, so the scanner IDs are suppressed with explicit non-exploitability reasons rather than forcing an unrelated runtime-client migration.

Fixes: CLC-2261

Validation

• yarn install --frozen-lockfile
• grpc_tools_node_protoc --version → libprotoc 3.19.1
• Built all ten changed TypeScript API packages with Leeway
• leeway sbom scan components/content-service-api/typescript:lib → 0 Critical, 1 existing ignored finding
• leeway sbom scan components/blobserve:app → 0 Critical, 6 ignored duplicate matches for the two documented containerd advisories
• grype file:yarn.lock → no unignored Critical findings from tar or websocket-driver
• pre-commit run --files <changed files>
• git diff --check

[ona-integrations]

Reviewed the changes. Implementation looks solid: good code quality, appropriate test coverage, and follows established patterns. No significant concerns.

The remediation is well scoped — the grpc-tools bump is applied uniformly across all ten TypeScript API workspaces, the websocket-driver fix reuses the repository's existing root resolutions mechanism, and the two containerd advisories are suppressed via documented SBOM ignores that mirror the pre-existing ignore-block pattern with explicit non-exploitability reasoning. The PR's build and SBOM-scan validation evidence backs up the dependency changes.

Documentation review ran as a docs-drift check (code-only PR): no documentation files changed and the dependency/security-config changes touch no user-visible behavior, public APIs, config options, operational behavior, or runbooks — no docs updates required.

Low-risk determination: Approved
This change meets all low-risk criteria under Ona's change management policy. A human engineer is still responsible for the merge, which constitutes the traceable approval for SOC 2 purposes.

• Size: 111 additions + 154 deletions = 265 combined lines, well under the 1,000-line limit. ✓
• Protobuf: No .proto files added or modified; grpc-tools is a build-time protobuf code-generation tool being version-bumped, not a protobuf definition change. ✓
• Database migrations: No migration files added or modified; changed files are WORKSPACE.yaml, package.json files, and yarn.lock only. ✓
• Infrastructure/CI: No CI pipeline, IaC, or platform/deployment configuration touched; the WORKSPACE.yaml change adds Leeway SBOM-scanner ignore entries (build-time vulnerability-scan suppression config), which is not infrastructure, platform, or CI configuration. ✓
• Auth and authorisation: No auth or access-control logic affected — no RBAC, roles, permissions, scopes, policies, guards, ACLs, route protection, or session handling in the diff. ✓
• Audit logging and monitoring: No audit logging, monitoring, metrics, tracing, alerting, or observability configuration affected; the SBOM ignore entries suppress vulnerability-scan findings, which is security-scan configuration, not observability. ✓