chore(security): bundle npm transitive fixes for root package-lock.json

[benfrank241]

Daily security sweep. Recreates the Dependabot fixes for the root package-lock.json on a human-authored branch so the change actually gets CI (Dependabot's own branches don't receive CI secrets, so its PRs fail with no signal).

Updated 2026-09-14 — four new alerts landed on this same lockfile while this PR sat awaiting review. Rather than open a second PR that would collide on package.json overrides and package-lock.json, they are folded in here. This PR now closes all 10 open alerts in the repo.

Alerts closed by this PR

Alert	Severity	Package	Advisory	Vulnerable range	Fixed in
#66	high	fast-uri	GHSA-jqff-g426-hqxp	>= 3.0.0, < 3.1.6	3.1.6
#65	high	fast-uri	GHSA-f65p-4m7j-42xc	>= 3.0.0, < 3.1.6	3.1.6
#63	high	fast-uri	GHSA-fph4-wmhf-6fwf	>= 3.1.2, < 3.1.6	3.1.6
#62	high	fast-uri	GHSA-5jgf-p345-68v8	>= 3.1.3, < 3.1.6	3.1.6
#71	high	js-yaml	GHSA-2883-xcg3-v3hh	>= 4.0.0, < 4.3.2	4.3.2
#64	medium	qs	GHSA-x5fp-wj9c-mxmx	>= 6.14.2, <= 6.15.3	6.16.0
#67	medium	qs	GHSA-4mjr-xmp4-gh2g	>= 2.2.5, < 6.16.0	6.16.0
#70	medium	hono	GHSA-g6gw-c38x-mqfc	< 4.13.5	4.13.5
#69	medium	hono	GHSA-gqvv-2mrq-wpjv	< 4.13.5	4.13.5
#68	medium	hono	GHSA-crvj-82cr-hjcx	< 4.13.5	4.13.5

Changes

All four packages are transitive only — none is a direct dependency — so all are fixed via overrides:

Override	Before	After	Resolves to
fast-uri	3.1.5	^3.1.6	3.1.7
qs	(none)	^6.16.0	6.16.0
hono	4.12.34	^4.13.5	4.13.7
js-yaml	4.3.1	^4.3.2	4.3.2

Global (unscoped) overrides are correct here — every declaring parent accepts the patched range, so nothing innocent gets rewritten:

• fast-uri ← ajv (x2, under @modelcontextprotocol/sdk and ajv-formats), both ^3.0.1
• qs ← body-parser ^6.15.2, express ^6.14.0
• hono ← @hono/node-server peer ^4, @modelcontextprotocol/sdk ^4.11.4
• js-yaml ← eslint ^4.1.0, @eslint/eslintrc ^4.1.0

Caret rather than >= so npm cannot jump a major past what those parents allow.

Note: eight of these ten alerts fired against our own pins

fast-uri: 3.1.5, hono: 4.12.34 and js-yaml: 4.3.1 were exact pins added by earlier sweeps. An exact pin freezes the package, so the next advisory against that version fires against the pin itself rather than against anything upstream. That is the origin of #62/#63/#65/#66 (fast-uri), #68/#69/#70 (hono) and #71 (js-yaml).

Only qs (#64, #67) is an ordinary upstream transitive advisory — it had no override at all. This PR converts every affected pin to a caret range, which fixes the recurrence, not just the current advisory. Three exact pins remain in the overrides block and are latent repeats of the same failure mode:

• @hono/node-server 1.19.15 — latest is 2.1.1 (major)
• body-parser 2.3.0 — already latest
• ip-address 10.3.1 — latest is 10.7.0

brace-expansion@^1.1.0/@^2.0.0 are also exact but are deliberately major-scoped. Unfreezing @hono/node-server (and, separately, js-yaml past 4.x to 5.4.2) means crossing a major, which is a maintainer call — not made here.

Lockfile churn

Cumulative over both commits: 7 entries, no packages added or removed.

• fast-uri 3.1.5 → 3.1.7, qs 6.15.2 → 6.16.0, plus side-channel 1.1.0→1.1.1, side-channel-list 1.0.0→1.0.1, es-object-atoms 1.1.1→1.1.2 (all patch-level, all inside qs's own subtree)
• hono 4.12.34 → 4.13.7, js-yaml 4.3.1 → 4.3.2

Verification

Ran the exact steps from .github/workflows/ci.yml locally against the final tree, all green:

• npm ci
• npm run build (exit 0)
• npm run lint (exit 0)

npm audit reports 0 vulnerabilities. There is no test script in this package, so that step is skipped (CI doesn't run one either).

No majors, no forced resolves (--force / --legacy-peer-deps were not used), and no unrelated changes bundled in.

[benfrank241]

Daily sweep 2026-09-14: four new alerts (#68 #69 #70 hono, #71 js-yaml) landed on this same root package-lock.json while this PR waited for review. Fixing them requires editing the same overrides block this PR already touches, so a second PR would have conflicted by construction — I folded them in here instead. Commit 85e7f9b; build and Secret Detection are green on the new head.

Both were exact pins this repo added in earlier sweeps (hono: 4.12.34, js-yaml: 4.3.1) — the same self-inflicting pattern as fast-uri: 3.1.5. An exact pin freezes the package, so the next advisory fires against the pin rather than anything upstream. Both are now caret ranges (^4.13.5, ^4.3.2), which stops the recurrence. 8 of the 10 alerts this PR closes are that pattern; only qs (#64, #67) is an ordinary upstream advisory.

Three exact pins still remain and are latent repeats: @hono/node-server 1.19.15 (latest 2.1.1, major), ip-address 10.3.1 (latest 10.7.0), body-parser 2.3.0 (already latest). Unfreezing @hono/node-server — and taking js-yaml past 4.x to 5.4.2 — crosses a major, so I left both alone; those are your call.