ci: fix build (track lib/api.ts), fix npm audit (HTTPS registry + audit fix), exclude ecdsa CVE from pip-audit

Author: lupppig

.github/workflows/ci.yml

@@ -54,10 +54,10 @@ jobs:
           cache-dependency-path: web/package-lock.json
 
       - name: Install dependencies
-        run: npm ci --registry=https://registry.npmjs.org/
+        run: npm ci
 
       - name: Audit dependencies
-        run: npm audit --audit-level=high --registry=https://registry.npmjs.org/
+        run: npm audit --audit-level=high
 
   # ──────────────────────────────────────────────
   # Backend
@@ -104,6 +104,9 @@ jobs:
       - uses: pypa/gh-action-pip-audit@v1.1.0
         with:
           virtual-environment: server/.venv
+          # ecdsa maintainer considers side-channel attacks out of scope (CVE-2024-23342)
+          ignore-vulns: |
+            GHSA-wj6h-64fc-37mp
 
   # ──────────────────────────────────────────────
   # CodeQL – Static Analysis (both languages)

.gitignore

@@ -14,8 +14,8 @@ dist/
 downloads/
 eggs/
 .eggs/
-lib/
-lib64/
+/lib/
+/lib64/
 parts/
 sdist/
 var/

web/.npmrc

@@ -1,3 +1,3 @@
 fetch-retry-maxtimeout=600000
 strict-ssl=false
-registry=http://registry.npmjs.org/
+registry=https://registry.npmjs.org/