fix(shell): isolate mobile drawer and remove desktop sidebar from mobile flow

finding	package	installed → fixed	do this
CVE-2026-63671 (HIGH)	`@nuxtjs/mdc`	0.21.1 → 0.22.1	merge #59 — fix(security): @nuxtjs/mdc ^0.22.2 (CVE-2026-63671) — hold f
CVE-2026-102276 (HIGH)	`brace-expansion`	5.0.9 → 5.0.10, 3.0.7, 2.1.5, 1.1.19	merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s
CVE-2026-102278 (HIGH)	`brace-expansion`	5.0.9 → 5.0.11, 3.0.8, 2.1.6, 1.1.20	merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s
CVE-2026-93687 (HIGH)	`braces`	3.0.3 → ?	no fix PR yet — `npm update braces --package-lock-only`
CVE-2026-92708 (HIGH)	`devalue`	5.8.2 → 5.9.3	no fix PR yet — `npm update devalue --package-lock-only`
GHSA-mcm9-63f2-9j32 (HIGH)	`devalue`	5.8.2 → 5.9.3	no fix PR yet — `npm update devalue --package-lock-only`
GHSA-r9w8-h9r3-54w4 (HIGH)	`devalue`	5.8.2 → 5.9.3	no fix PR yet — `npm update devalue --package-lock-only`
GHSA-x5rw-q4pp-hg5g (HIGH)	`devalue`	5.8.2 → 5.9.3	no fix PR yet — `npm update devalue --package-lock-only`
CVE-2026-84375 (HIGH)	`js-yaml`	4.3.1 → 4.3.2, 3.15.2	no fix PR yet — `npm update js-yaml --package-lock-only`
CVE-2026-85393 (HIGH)	`node-forge`	1.4.0 → ?	no fix PR yet — `npm update node-forge --package-lock-only`
GHSA-rgj7-g3m4-5g8c (HIGH)	`sharp`	0.35.3 → 0.35.4	no fix PR yet — `npm update sharp --package-lock-only`
CVE-2026-84370 (HIGH)	`svgo`	4.0.2 → 2.8.4, 3.3.5, 4.1.0	no fix PR yet — `npm update svgo --package-lock-only`
CVE-2026-19534 (HIGH)	`undici`	8.10.0 → 6.28.1, 7.29.1, 8.10.2	no fix PR yet — `npm update undici --package-lock-only`
CVE-2026-84961 (HIGH)	`undici`	8.10.0 → 7.29.1, 8.10.2	no fix PR yet — `npm update undici --package-lock-only`
CVE-2026-85152 (HIGH)	`undici`	8.10.0 → 8.10.2	no fix PR yet — `npm update undici --package-lock-only`

_{Posted once per head commit by the baseline gate (M2). A Renovate PR that only touches a manifest with no lockfile change is a broken pre-2026-08-06 artifact — check its diff before merging.}

### 🔧 Security-gate fix map  The gate failed on these dependency findings — fastest path to green for each: | finding | package | installed → fixed | do this | |---|---|---|---| | CVE-2026-63671 (HIGH) | `@nuxtjs/mdc` | 0.21.1 → 0.22.1 | merge #59 — fix(security): @nuxtjs/mdc ^0.22.2 (CVE-2026-63671) — hold f | | CVE-2026-102276 (HIGH) | `brace-expansion` | 5.0.9 → 5.0.10, 3.0.7, 2.1.5, 1.1.19 | merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s | | CVE-2026-102278 (HIGH) | `brace-expansion` | 5.0.9 → 5.0.11, 3.0.8, 2.1.6, 1.1.20 | merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s | | CVE-2026-93687 (HIGH) | `braces` | 3.0.3 → ? | no fix PR yet — `npm update braces --package-lock-only` | | CVE-2026-92708 (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | GHSA-mcm9-63f2-9j32 (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | GHSA-r9w8-h9r3-54w4 (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | GHSA-x5rw-q4pp-hg5g (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | CVE-2026-84375 (HIGH) | `js-yaml` | 4.3.1 → 4.3.2, 3.15.2 | no fix PR yet — `npm update js-yaml --package-lock-only` | | CVE-2026-85393 (HIGH) | `node-forge` | 1.4.0 → ? | no fix PR yet — `npm update node-forge --package-lock-only` | | GHSA-rgj7-g3m4-5g8c (HIGH) | `sharp` | 0.35.3 → 0.35.4 | no fix PR yet — `npm update sharp --package-lock-only` | | CVE-2026-84370 (HIGH) | `svgo` | 4.0.2 → 2.8.4, 3.3.5, 4.1.0 | no fix PR yet — `npm update svgo --package-lock-only` | | CVE-2026-19534 (HIGH) | `undici` | 8.10.0 → 6.28.1, 7.29.1, 8.10.2 | no fix PR yet — `npm update undici --package-lock-only` | | CVE-2026-84961 (HIGH) | `undici` | 8.10.0 → 7.29.1, 8.10.2 | no fix PR yet — `npm update undici --package-lock-only` | | CVE-2026-85152 (HIGH) | `undici` | 8.10.0 → 8.10.2 | no fix PR yet — `npm update undici --package-lock-only` | <sub>Posted once per head commit by the baseline gate (M2). A Renovate PR that only touches a manifest with no lockfile change is a broken pre-2026-08-06 artifact — check its diff before merging.</sub>

Rows
Columns

fix(shell): isolate mobile drawer and remove desktop sidebar from mobile flow #67

🔧 Security-gate fix map