Context: `@sitecore-content-sdk/core` depends on `graphql-request` ^6.1.0 and `graphql` ^16.11.0 as its primary data-fetching layer. Every Content SDK consumer transitively depends on these packages. A supply-chain vulnerability in either would have broad blast radius across all Sitecore head apps.
Steps:
1. Run `npm audit --production` in `packages/core/`
2. Check `graphql-request` and `graphql` on Snyk vulnerability database and GitHub Advisory Database
3. If vulnerabilities found, bump to patched versions
4. If no vulnerabilities found, document the audit date in a comment or security log
Acceptance criteria:
No known vulnerabilities in `graphql-request` or `graphql` at the installed versions
Audit results documented
Risks: None identified.