SRE-808: upgrade vulnerable npm dependencies (2026-07-13 weekly scan)

[claude]

Requested by Tim Diekmann · Slack thread

Fixes SRE-808. Clears all 29 findings from the 2026-07-13 weekly OSV scan of package-lock.json by bumping 10 flagged packages (11 locked copies) to at-or-above their fixed versions. Nine packages were resolved with a plain lockfile re-resolve — no version ranges changed; one (chrome-devtools-mcp) needed a manifest bump across its 0.x→1.x major. No overrides were added, and the existing overrides block is untouched.

Method follows the team's transitive-dep-upgrade skill: trace every chain to its root, prefer lockfile re-resolve, bump the root parent only when ranges don't admit the fix, overrides as last resort (not needed here).

Per-package notes

Package	Before	After	Chain	Fix
undici	7.24.5	7.28.0	transitive — sole chain via release-it, which exact-pins undici	lockfile re-resolve: release-it 20.0.1 → 20.2.1 (within existing ^20.0.1 range) lifts its pin to 7.28.0
vite	7.3.2	7.3.6	direct devDependency ^7.0.4; all peer ranges (@tailwindcss/vite, @vitejs/plugin-react, vitest, …) admit	lockfile re-resolve
vite (nested)	6.4.2	6.4.3	transitive — @ladle/react dep ^6.0.5	lockfile re-resolve
form-data	4.0.5	4.0.6	transitive — superagent ^4.0.5, @types/superagent ^4.0.0	lockfile re-resolve
dompurify	3.4.2	3.4.12	transitive — mermaid dep ^3.3.1	lockfile re-resolve
mermaid	11.14.0	11.16.0	transitive — streamdown / @streamdown/mermaid dep ^11.12.2	lockfile re-resolve
js-yaml	4.1.1	4.3.0	transitive — cosmiconfig dep ^4.1.0	lockfile re-resolve
brace-expansion	5.0.5	5.0.7	transitive — minimatch dep ^5.0.5	lockfile re-resolve
qs	6.15.0	6.15.3	transitive — express ^6.14.0, body-parser ^6.14.1, superagent ^6.14.1	lockfile re-resolve
chrome-devtools-mcp	0.21.0	1.5.0	direct devDependency ^0.21.0 (nothing else depends on it)	manifest bump ^0.21.0 → ^1.1.0
@babel/core	7.29.0	7.29.7	transitive — @vitejs/plugin-react ^7.29.0, @tanstack/router-plugin ^7.28.5, @ladle/react ^7.26.0, shadcn ^7.28.0, + babel-plugin peers ^7.0.0	lockfile re-resolve

chrome-devtools-mcp 0.x → 1.x (reviewer attention)

This is the one in-major jump. Checked before bumping:

• It is a dev-only tool with no in-repo consumers: not registered in .mcp.json, not referenced by any script, config, or CI workflow. The only mention in the repo is .agents/skills/cli-chrome-axi/SKILL.md, which runs the separate chrome-devtools-axi package via npx -y (fetched at run time, independent of this devDependency).
• The published 1.x package has the identical surface to 0.21.0: same two bins (chrome-devtools, chrome-devtools-mcp), same node engines (^20.19.0 || ^22.12.0 || >=23), and a fully bundled dependency tree (its vulnerable transitives ship inside the tarball, which is why the fix requires the major bump rather than a re-resolve).

Risk looks minimal, but please sanity-check if anyone relies on 0.21-era MCP tool names when launching it manually.

Verification

• Lockfile scan: no flagged vulnerable version remains anywhere in package-lock.json (all locked copies of all 10 packages enumerated and checked).
• npm ci (frozen install): clean.
• npm run check (oxfmt + oxlint type-aware): pass — 0 errors, 11 warnings (pre-existing, no source files touched).
• npm test (vitest): 2439 passed, 7 skipped, 3 failed — the same 3 tests (sandbox-guard.test.ts, petrinaut-events.test.ts) fail identically on unmodified main in this container (sandbox-backend/environment-dependent), confirmed by re-running against the pre-change lockfile; not caused by this change.
• npm run build (client + server-runtime): pass.

Linear: SRE-808

---

Generated by Claude Code