v1: clear remaining npm audit advisories (ip-address reachable; hono, @hono/node-server, fast-uri, brace-expansion present but unreachable)

[cliffhall]

Summary

npm audit against v1/main reports 7 advisories beyond the js-yaml one in #2072. This issue covers the five that are present in the production dependency tree, plus two dev-only stragglers needed to actually reach a clean audit.

Triage conclusion up front: only one of the five is meaningfully reachable. The other four are installed-but-unexercised. None of them individually forces a v1 release; the value here is a clean npm audit so that a future genuine advisory isn't lost in the noise.

Reachable

ip-address <=10.3.0 (high)

server/src/index.ts:43 builds sandboxRateLimiter from express-rate-limit, which calls new Address6(ip) and new Address6(\${ip}/${ipv6Subnet}`) for IPv6 subnet keying (express-rate-limit/dist/index.mjs:3,6,9`). Two of the three advisories are precisely about CIDR-suffix and IPv4-mapped/NAT64 misclassification.

• GHSA-4xrf-jv44-h6hh — CIDR suffix suppresses special-use classification
• GHSA-22jq-vg5j-6vgg — IPv4-mapped/NAT64 misclassification
• GHSA-mwp4-54f8-5fhr — leading-zero octets decoded as decimal

Realistic impact in this codebase is a rate-limit key bypass on /sandbox, not the SSRF the advisory titles imply: req.ip derives from the socket under default trust-proxy settings and the proxy binds localhost. Worth fixing, modest severity in context.

Present in the production tree but not reachable

Package	Advisory	Why it doesn't bite here
hono <=4.12.33 (mod)	ReDoS in CORS middleware; memo() SSR cross-user disclosure; proxy helper Connection headers; language middleware DoS	All four are in middleware. The inspector has no direct hono usage — it arrives only beneath @hono/node-server, and none of that middleware is wired up.
@hono/node-server <1.19.15 (mod)	Path traversal in serve-static on Windows via encoded backslash (%5C)	The SDK's server/streamableHttp.js imports only getRequestListener. serve-static is never touched.
fast-uri 3.0.0 - 3.1.4 (high)	Host confusion via backslash authority delimiter	Reached via ajv under the SDK for format: "uri" schema checks. Exploitation needs a validated URI to then be trusted for a host decision; no such path exists here.
brace-expansion <=1.1.17 (high)	DoS via unbounded expansion / intermediate arrays	Reached via serve-handler -> minimatch@3.1.5 in client/bin/client.js:6. At serve-handler/src/index.js:59 the call is minimatch(resolvedPath, slashed): the attacker controls the path, but brace-expansion expands the pattern, which comes from config. Not attacker-controlled.

Dev-only

nanoid <3.3.18 and postcss <=8.5.22 both return empty from npm ls --omit=dev (vite/tailwind build chain). Included only so the audit actually reaches zero.

Fix

Every patched release exists within the current major line, so no major upgrades are required:

Package	From	To
ip-address	10.2.0	10.5.0
hono	4.12.30	4.13.3
@hono/node-server	1.19.14	1.19.17
fast-uri	3.1.3	3.1.5
brace-expansion	1.1.16 / 5.0.7	1.1.18 / 5.0.9
nanoid	3.3.16	3.3.18
postcss	8.5.19	8.5.26

@hono/node-server is deliberately held at 1.19.17, not the current 2.1.1 — a major bump has no place on a deprecated branch.

As with #2072, the lock entries are patched in place rather than re-resolved, keeping the diff to the affected packages only.

Verification

npm audit reports 0 vulnerabilities. Build, lint, and all suites pass (539 client + 37 server + 85 CLI). The app starts, serves the client through serve-handler (the brace-expansion path), gates proxy auth correctly, and completes a full MCP tools/list + tools/call round-trip through the CLI. The rate limiter — the ip-address consumer — was exercised directly and observed decrementing (X-RateLimit-Remaining: 89 of 100).