fix-osv-vulnerabilitieslisted

# Fix OSV Vulnerabilities ## Overview For each reported GHSA, check if a patched version exists via the GitHub Advisory API. If a patch exists → upgrade via package manager overrides or direct dependency bump. If no compatible reachable patch exists → collect reachability evidence and request a suppression decision. ## Workflow ```dot digraph fix_osv { "Collect GHSA IDs from scanner output" [shape=box]; "Query GitHub Advisory API for each GHSA" [shape=box]; "Compatible patch reachable?" [shape=diamond]; "Reachability evidence collected?" [shape=diamond]; "Explicit suppression approval?" [shape=diamond]; "Is it a direct dependency?" [shape=diamond]; "Bump version in package.json" [shape=box]; "Add/update overrides (or resolutions)" [shape=box]; "Add IgnoredVulns entry to osv-scanner.toml" [shape=box]; "Run install + verify build" [shape=box]; "Collect GHSA IDs from scanner output" -> "Query GitHub Advisory API for each GHSA"; "Query GitHub Advisory API for each GHSA" -> "Compatible patch reachable?"; "Compatible patch reachable?" -> "Is it a direct dependency?" [label="yes"]; "Compatible patch reachable?" -> "Reachability evidence collected?" [label="no"]; "Reachability evidence collected?" -> "Explicit suppression approval?" [label="yes"]; "Reachability evidence collected?" -> "Stop and report" [label="no"]; "Explicit suppression approval?" -> "Add IgnoredVulns entry to osv-scanner.toml" [label="yes"];