[cdbartholomew]

Routine dependency maintenance for the root npm workspace lockfile. It follows up on #5311 for two advisories published after that PR was opened.

Closes Dependabot alerts #1848 #1849

Package	Before	After	Alert
shell-quote	1.10.0	1.12.0	#1848
sharp	0.35.4	0.35.5 (+ @img/sharp-* platform packages, libvips 1.3.3 → 1.3.4)	#1849

Both are in-range updates under the existing overrides ("shell-quote": ">=1.9.0", "sharp": ">=0.35.4"), so package.json is unchanged. The lockfile was regenerated with npm 11 (npx npm@11 update sharp shell-quote --package-lock-only), because npm 10.9.x mishandles overrides in workspaces. npm 11 also records libc on the new sharp platform entries.

Verification (npm 10.9.2 npm ci from the committed lockfile)

• sharp smoke test: create → PNG → resize → WebP succeeds. sharp.versions reports 0.35.5 / vips 8.18.7
• shell-quote smoke test: parse / quote round-trip
• npm run build: typescript client, hindsight-control-plane (Next.js), hindsight-all-npm, agent-sdk, and hindsight-docs (docusaurus build) all pass. The control-plane and docs CSS output is byte-identical to before
• npm test: control-plane 289/289, all-npm, agent-sdk all pass

[cdbartholomew]

Merging over a known, pre-existing build-docs failure. It is unrelated to this lockfile-only change.

build-docs fails at its first step, node hindsight-docs/scripts/check-integrations.mjs, before any dependency is installed:

[integrations] ❌ Changelog pages not linked from their doc page:
  agno — add [View Changelog →](/changelog/integrations/agno)

Why this is pre-existing:

• It reproduces on a clean checkout of main at 8830bbb (node hindsight-docs/scripts/check-integrations.mjs prints the same two lines). It was introduced when the agno changelog page landed on main without a link from the integration doc page. docs(agno): link the changelog from the integration page #5303 is the fix.
• The same job fails with the identical message on unrelated PRs that touch none of these files: fix(transfer): run the bank-write validator on document import into an existing bank (#5137) #5308 (job 112321153492), fix(consolidation): pin source_fact_ids to the batch and report actions that cite none (#5273) #5307 (job 112323143459), fix(llm): route OpenRouter structured-output calls only to upstreams that support response_format #5304 (job 112318987646) and fix(recall): don't decay the post-rerank temporal boost by rank (#4939) #5295 (run 37471346110).
• The job was re-run once on this PR and failed again with the same message.

Every other check that ran on this PR passed, including the job(s) that cover the changed lockfile.