fix(deps): clear remaining npm audit advisories

[cliffhall]

Fixes #2074 — stacked on #2073 (base is fix/v1-js-yaml-override-bump; GitHub will retarget this to v1/main automatically once #2073 merges). Both PRs touch the same overrides block and lock, so independent branches would conflict.

Together with #2073 this brings npm audit from 8 advisories to 0.

Triage

Only one of the five production-tree advisories is meaningfully reachable. Full analysis in #2074; summary:

Reachable — ip-address <=10.3.0 (high). server/src/index.ts:43 builds sandboxRateLimiter from express-rate-limit, which calls new Address6(ip) for IPv6 subnet keying. Two of the three advisories are exactly about CIDR-suffix and IPv4-mapped/NAT64 misclassification. Impact in context is a rate-limit key bypass on /sandbox, not the SSRF the titles imply — req.ip derives from the socket under default trust-proxy settings and the proxy binds localhost.

Present but unexercised — 4:

Package	Why it doesn't bite
hono <=4.12.33	All four advisories are in middleware; none of it is wired up. Arrives only beneath @hono/node-server.
@hono/node-server <1.19.15	Path traversal in serve-static on Windows. SDK imports only getRequestListener.
fast-uri 3.0.0-3.1.4	Reached via ajv for format: "uri" checks; the result is never trusted for a host decision.
brace-expansion <=1.1.17	Via serve-handler -> minimatch@3.1.5. At serve-handler/src/index.js:59 the attacker controls the path; brace-expansion expands the pattern, which comes from config.

Dev-only — 2: nanoid, postcss (vite/tailwind build chain). Included only so the audit actually reaches zero.

Change

All patched releases exist within the current major line — no majors:

Package	From	To
ip-address	10.2.0	10.5.0
hono	4.12.30	4.13.3
@hono/node-server	1.19.14	1.19.17
fast-uri	3.1.3	3.1.5
brace-expansion	1.1.16 / 5.0.7	1.1.18 / 5.0.9
nanoid	3.3.16	3.3.18
postcss	8.5.19	8.5.26

@hono/node-server is deliberately held at 1.19.17, not the current 2.1.1 — a major bump has no place on a deprecated branch.

Lock entries were patched in place rather than re-resolved: 9 entries, 30 lines. A full re-resolve would instead churn 164 packages including production deps.

Verification

• npm audit -> 0 vulnerabilities
• npm run build and npm run lint both pass
• Tests: 539 client + 37 server + 85 CLI, all passing
• App starts; client served through serve-handler (the brace-expansion path) HTTP 200; proxy auth gates correctly (401 / 200)
• Rate limiter exercised directly — the ip-address consumer — and observed decrementing: X-RateLimit-Limit: 100, X-RateLimit-Remaining: 89
• Full MCP tools/list + tools/call round-trip through the CLI against a live stdio server

Note on branch policy

AGENTS.md directs agents to file an issue rather than open a PR against v1/main. Opened at the explicit direction of a maintainer (@cliffhall), with #2074 filed and tracked on the Inspector V1 board alongside it.

Not included

The allowScripts block npm 11.19 writes to package.json is unrelated and deliberately left out of both PRs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH

[Copilot]

Pull request overview

Updates v1 transitive dependencies to patched releases, complementing #2073 to eliminate reported npm advisories.

Changes:

• Adds targeted dependency overrides for eight packages.
• Updates nine lockfile entries without broad dependency churn.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds patched-version overrides.
package-lock.json	Locks corresponding patched releases and metadata.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.