[diegosouzapw]

What

Bump omniglyph from a lockfile-pinned 1.0.0 to ^1.0.2 (lock refreshed to 1.0.2).

Only two files change — package.json (range ^1.0.0 → ^1.0.2) and package-lock.json (the omniglyph entry: version/resolved/integrity). The dependency tree is unchanged (gpt-tokenizer ^3.4.0).

Why

The lock pinned omniglyph@1.0.0, so npm ci was installing the pre-fix build. Upstream 1.0.1/1.0.2 resolved all CodeQL alerts (16 polynomial-ReDoS rewrites to linear scans, 2 TOCTOU file-read fixes, 1 ASI fix). No behavior change to the compression path — 1.0.1/1.0.2 touched only regex hot paths and docs. 1.0.2 is also published with SLSA provenance (npm trusted publishing).

"Always latest 1.x / auto-updatable"

• ^1.0.2 already means any future 1.x is eligible — that's the "latest 1.x" declaration at the manifest level.
• The lockfile stays pinned on purpose (reproducible, VPS-validated builds — consistent with this repo's Dependabot policy that freezes npm auto-bumps). Truly unpinning to fetch the newest 1.x on every build would break reproducibility and the supply-chain discipline here, so I did not do that.
• If you want ongoing auto-update PRs for omniglyph specifically (opened by Dependabot, still human-merged and VPS-validated), I can follow up with a small allow carve-out in .github/dependabot.yml. Flagging it as a separate policy decision rather than bundling it here.

Validation

• package.json and package-lock.json remain valid JSON.
• Lock integrity matches the npm registry for omniglyph@1.0.2 (sha512-GGLet99n…).
• Merge is yours to make; no release-freeze label is currently open.