fix: remove stale release dependencies

[tonyketcham]

Drop unused Apollo 3 and GraphQL server packages from the stable package. Update Apollo Server, GraphQL, and lodash-es to supported releases, and keep test-only picomatch out of the published runtime set.\n\nTest plan: pnpm verify; clean tarball install; npm audit and CLI smoke checks.

Depends-On: #236

[tonyketcham]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	release: prepare Flatbread 1.0	#236
2	fix: remove stale release dependencies	#237	👈
3	fix: harden stable package payloads	#238
4	fix: make core declarations portable	#239
5	docs: record upstream release limits	#240
6	chore: move proof to its own repository	#241
7	fix: retarget Cursor agents at external Proof	#242
8	feat: brand agent memory as Proof and the runner as Oven	#244

[tonyketcham]

Revision history

#	Type	Changes	Reason	Date
1	initial	d50f852		2026-08-12 18:16 UTC
2	rebase	d50f852 → 034f313 (rebase only)		2026-08-12 18:16 UTC

[cursor]

Review skipped

Verdict: SKIP — dependency-only update.

Changed files are package.json dependency bumps/removals, pnpm-lock.yaml, and a CHANGELOG.md note. No source, tests, CLI, or public-contract code changed, so the adversarial review DAG was not run.

  

_{Sent by Cursor Automation: Flatbread PR Review}

[cursor]

CI Root Cause

Status: third-party-failure

Failing checks:

• lint (22.x, ubuntu-latest): pnpm install --frozen-lockfile failed downloading sharp@0.31.3 libvips (socket hang up / 503)
• integration-sveltekit (22.x, ubuntu-latest): same install-time sharp-libvips failure (socket hang up)
• integration-sveltekit (20.x, windows-latest): same install-time sharp-libvips failure (503 Service Unavailable)
• integration-nextjs (20.x, windows-latest): same install-time sharp-libvips failure (socket hang up)

Evidence:

• All four jobs died in Run pnpm install --frozen-lockfile while fetching https://github.com/lovell/sharp-libvips/releases/download/... for sharp@0.31.3 (and sometimes sharp@0.30.7).
• Errors seen: socket hang up, Status 503 Service Unavailable.
• Sibling matrix cells on the same SHA (034f313) passed: lint 20.x, build 20/22, test 20/22, and the other integration OS/Node cells (including windows 22.x).
• PR #237 only changes dependency cleanup (package.json / lockfile / CHANGELOG); no source or test logic that would cause an install download failure.

Resolution steps:

1. Re-run the failed jobs (or the whole Pipeline workflow) once GitHub Releases / sharp-libvips downloads are healthy.
2. If install flakes keep clustering on sharp@0.31.3 libvips fetches, consider caching native sharp binaries in CI or pinning/updating the transitive sharp versions that still pull old libvips releases.
3. No branch code change is required for this failure class.

No code changes were made because this failure is not caused by the branch.

  

_{Sent by Cursor Automation: Flatbread - Fix CI}