chore(security): bundle 21 Dependabot alerts for root package-lock.json

[benfrank241]

Recreates Dependabot's fixes for the root package-lock.json on a human-authored branch so CI actually runs with secrets. One PR for the single npm bundle (root lockfile).

All 8 affected packages are transitive — none is a direct dependency in package.json — so each is pinned through overrides rather than a manifest bump.

Version changes

Package	Before	After	Scope
brace-expansion (v1 tree)	1.1.13	1.1.18	dev + runtime
brace-expansion (v2 tree)	2.0.3	2.1.4	runtime
@hono/node-server	1.19.13	1.19.15	runtime
body-parser	2.2.2	2.3.0	runtime
fast-uri	3.1.2	3.1.5	runtime
hono	4.12.25	4.12.34	runtime
ip-address	10.1.1	10.3.1	runtime
js-yaml	4.1.1	4.3.1	dev

No major-version bumps. Every change stays within its current major.

brace-expansion exists in the tree at two majors at once (v1 under eslint/glob/minimatch@3, v2 under minimatch@9). A single global override would have forced v1 consumers onto v2, so this uses npm's version-selector override keys — "brace-expansion@^1.1.0" and "brace-expansion@^2.0.0" — to patch each branch independently.

Only other lockfile churn is content-type 2.0.1 → 2.1.0, pulled in by body-parser@2.3.0.

Alerts closed

Alert	Severity	Package	Advisory
#60	high	brace-expansion	GHSA-3jxr-9vmj-r5cp
#59	medium	@hono/node-server	GHSA-frvp-7c67-39w9
#58	high	js-yaml	GHSA-5p4m-2wfm-xmqj
#57	high	brace-expansion	GHSA-mh99-v99m-4gvg
#56	medium	hono	GHSA-f23p-vx2j-j53r
#55	low	hono	GHSA-79qm-7rj5-m7r9
#54	medium	hono	GHSA-54fx-42gc-7vw4
#53	high	fast-uri	GHSA-7p8r-x3mc-p8w7
#52	high	ip-address	GHSA-mwp4-54f8-5fhr
#51	medium	hono	GHSA-8j4g-w8fx-2239
#50	medium	ip-address	GHSA-4xrf-jv44-h6hh
#49	medium	ip-address	GHSA-22jq-vg5j-6vgg
#46	high	brace-expansion	GHSA-3jxr-9vmj-r5cp
#45	high	js-yaml	GHSA-52cp-r559-cp3m
#44	high	fast-uri	GHSA-v2hh-gcrm-f6hx
#43	high	fast-uri	GHSA-4c8g-83qw-93j6
#42	medium	hono	GHSA-w62v-xxxg-mg59
#41	medium	hono	GHSA-xgm2-5f3f-mvvc
#40	medium	hono	GHSA-hvrm-45r6-mjfj
#38	low	body-parser	GHSA-v422-hmwv-36x6
#37	medium	js-yaml	GHSA-h67p-54hq-rp68

That is all 21 open alerts (9 high, 10 medium, 2 low).

Also pre-empted (no alert open yet): GHSA-rgw5-rvv9-x895 — brace-expansion DoS via unbounded intermediate arrays, affecting <1.1.18 and >=2.0.0 <2.1.4. Landing on the patched versions for #57/#60 (1.1.17 / 2.1.2) would have left this one live immediately, so both overrides go to the current maintenance tips instead. npm audit on this branch reports 0 vulnerabilities.

Worth a human eye

express-rate-limit@8.3.2 (transitive via @modelcontextprotocol/sdk) declares an exact ip-address@10.1.0; the override lifts it to 10.3.1. This is the same mechanism the pre-existing "ip-address": "10.1.1" override already used, and upstream express-rate-limit@8.6.2 has itself moved to ip-address: ^10.2.0, so v10.2+ is compatible with its usage — but the pin is worth knowing about.

Verification (local, green)

Commands derived from this repo's package.json scripts and .github/workflows/ci.yml:

• npm ci — clean, 0 vulnerabilities
• npm run build — tsc clean, exit 0
• npm run lint — eslint src/**/*.ts clean, exit 0

No test script exists in this repo, so that step was skipped.

No --force, no --legacy-peer-deps, no lockfile regeneration from scratch. The lockfile was updated with npm install --package-lock-only (--ignore-scripts only to stop the prepare hook running tsc before deps existed; it does not affect resolution).

🤖 Generated with Claude Code