chore(deps): consolidated dependency batch 2026-08-04

[Weegy]

Consolidates the open Dependabot backlog into one verified batch. Replaces 11 individual PRs; 2 are deliberately excluded and 1 is already obsolete.

Included (11 PRs superseded)

Dependabot PR	Package	From → To	Notes
#594	@modelcontextprotocol/sdk	1.29.0 → 1.30.0	in harness-orchestrator
#593	@aws-sdk/client-s3	3.1095.0 → 3.1102.0	newer than proposed
#589	@azure/msal-node	5.4.2 → 5.4.3	runtime-patches group
#589	bonjour-service	1.4.3 → 1.4.4	runtime-patches group
#589	jose	6.2.4 → 6.2.8	newer than proposed
#591	lucide-react	1.27.0 → 1.28.0
#587	framer-motion	12.42.2 → 12.43.0
#588	jsdom	29.1.1 → 30.0.1	major, devDep
#586	@types/react	19.2.17 → 19.2.18	dev-tooling group
#586	@types/react-dom	19.2.3 → 19.2.4	dev-tooling group
#586	@vitejs/plugin-react	6.0.4 → 6.0.5	dev-tooling group
#592 / #590	node (docker)	22.23.1-slim → 22.23.2-slim
#585	actions/download-artifact	v7 → v8	major

@aws-sdk/client-s3 and jose land one patch beyond what Dependabot proposed — those PRs were cut on 2026-08-03 and newer patches shipped since. Taking the newer resolution rather than pinning backwards.

Also included, beyond Dependabot's scope

Dependabot only offered the node bump for the root and web-ui Dockerfiles. Two more images were still on the old base and would have drifted:

• middleware/sidecars/dev-runner/Dockerfile (2 stages) → 22.23.2-slim
• middleware/sidecars/dev-runner-daemon/Dockerfile → 22.23.2-alpine

All 8 node stages across the 4 Dockerfiles are now on the same patch. Both tags were confirmed to exist on Docker Hub.

Excluded — with reasons

#595 typescript 5.9.3 → 7.0.2 — blocked upstream, recommend close

Hard peer-dependency wall, not a flaky build. typescript-eslint declares:

peer typescript@">=4.8.4 <6.1.0"

That range is unchanged in the newest release (8.66.0), so TypeScript 7 cannot resolve at all — npm ci dies with ERESOLVE before any code is compiled, which is why 4 checks failed rather than 1.

The PR is also stale: it proposes 5.9.3 as the base, but middleware/package.json is already on ^6.0.2. TypeScript 6.0.2 satisfies the peer range; 7.x does not.

Recommend closing #595 and revisiting when typescript-eslint ships TS 7 support.

#596 better-sqlite3 12.11.1 → 13.0.2 — needs a Dockerfile change first

Not a version-compatibility problem — a packaging change. v12 shipped an install hook that fetched a prebuilt binary:

"install": "prebuild-install || node-gyp rebuild --release"

v13.0.2 removes that hook entirely. With binding.gyp still present, npm falls back to compiling from source, and our node:*-slim image has no Python:

npm error command sh -c node-gyp rebuild
npm error gyp ERR! find Python
npm error gyp ERR! stack Error: Could not find any Python installation to use

Adopting v13 means adding python3 / make / g++ to the builder stage. That is a real image-surface change and does not belong in a routine dependency batch — it deserves its own PR and its own review.

#250 cytoscape 3.33.4 → 3.34.0 — already on main, recommend close

web-ui is already at ^3.34.0 / locked 3.34.0. The PR is a no-op left over from June.

Verification

Run locally on node 22.22.3 (.nvmrc), full install from the regenerated lockfiles:

Workspace	Build	Lint	Typecheck	Tests
middleware	pass	0 errors	pass	5502 passed, 0 failed, 4 skipped (5506 total)
web-ui	—	0 errors	pass	552 passed, 0 failed (68 files)

Lint warning counts are unchanged from main (38 in web-ui, 1 in middleware — all pre-existing).

Security audit

This branch introduces no new advisories — verified by auditing main's lockfile side by side, which produced byte-identical output. It then goes further and removes advisories; see "Update: the audit gate" below for the full picture, which supersedes this paragraph.

On the two majors

jsdom 30 requires node ^22.22.2 || ^24.15.0 || >=26.0.0; .nvmrc (22.22.3) and CI (node 22) both satisfy it. It is the vitest environment, so the entire 552-test web-ui suite exercises it — all green.

download-artifact v8 has three breaking changes, checked against the single call site (the macOS update-feed merge job):

• ESM migration — transparent to callers.
• Hash mismatch now errors instead of warning — a correctness improvement; only trips on a genuinely corrupt artifact.
• No longer unzips non-zipped downloads — only affects the new direct-upload path. This repo uploads via actions/upload-artifact@v7 with default compression, so artifacts stay zipped and are extracted exactly as before.

Test plan

• middleware: build, lint, typecheck, full test suite (5502 pass / 0 fail)
• web-ui: lint, typecheck, full test suite (552 pass / 0 fail)
• Audit compared against main — no new high/critical
• Both docker tags confirmed to exist upstream
• Docker images build — middleware (build, no push) and web-ui (build, no push) both green
• audit (web-ui) — green (was red before bfcf880)
• audit (middleware) — green (was red before af4d8f0)
• npm ci verifies the hand-pinned fast-uri integrity hash against the real tarball
• npm ls fast-uri — no invalid/overridden markers

main is currently red on both audit jobs. This branch is green on both — it does not merely avoid regressing the gate, it repairs it.

---

Update: the audit gate, and why main is also red

The first CI run on this branch failed both audit (high+critical block) jobs. That is not a regression from this branch — main is red on the same gate (run 30887391724 on 1e72b007, 2026-08-04 07:20Z). The three runs before it were green.

What changed is npm's side, not ours. The gate carries a deliberate bypass:

if grep -q 'audit endpoint returned an error' audit-stderr.log; then ... exit 0

npm's audit registry endpoint had been erroring, so that bypass swallowed every result. It recovered on 2026-08-04, the gate started returning real data, and pre-existing advisories became blocking for the first time. The gate was effectively dark for a while — worth knowing independently of this PR.

Fixed here: brace-expansion (commit bfcf880)

Both workspaces pinned brace-expansion to exactly 5.0.8 via overrides — a fix from an earlier batch. A new advisory now covers that version:

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation — vulnerable >=4.0.0 <5.0.9

Because the pin was exact, it held the vulnerable version in place and npm update could not move it. Bumping the pin to 5.0.9 clears the entire cascade:

Workspace	High advisories before	After
web-ui	15	0 — gate passes
middleware	4	1 (then 0, see fast-uri below)

web-ui's 15 were almost entirely phantom depth: the whole eslint / typescript-eslint / eslint-config-next tree was flagged only transitively via brace-expansion → minimatch. One pin bump clears all of them.

Also fixed here: fast-uri (commit af4d8f0)

The last middleware advisory was fast-uri@3.1.4 (vulnerable >=3.0.0 <3.1.5, host confusion via backslash authority introducer), reached through ajv@8.20.0, which requires fast-uri: ^3.0.1. ajv is already at its latest release, so there is no upstream fix to take.

This one needed care, because npm refuses to re-apply a changed override to an already-locked transitive dependency. npm update, npm install, and even a clean rm -rf node_modules && npm install all keep 3.1.4 — while npm ls simultaneously reports:

fast-uri@3.1.4 invalid: "3.1.5" from node_modules/ajv overridden

npm knows about the override and declines to act on it. The only npm-native way to force it is deleting the lockfile and regenerating — which does produce 3.1.5, but also rewrites 75 unrelated package versions, including:

• @hono/node-server 1.19.17 → 2.1.0 (major, runtime HTTP server — undeclared, so it floats freely on a regen)
• vite 8.1.5 → 8.2.0, rolldown 1.1.5 → 1.2.2, tsx 4.23.1 → 4.23.5
• typescript-eslint 8.65.0 → 8.66.0
• a hoisting change moving ajv@8 out of the root into five per-workspace copies

Smuggling a @hono/node-server major into a dependency-hygiene batch is exactly the kind of unreviewed breaking change this PR exists to prevent. So instead the override is set to 3.1.5 and the single lockfile entry is edited to exactly what a correct resolution would produce — three lines: version, resolved, integrity.

This is not taken on trust. The integrity hash is the registry's own for 3.1.5, and npm ci verifies it against the downloaded tarball — a wrong hash would fail the install outright. Afterwards npm ls fast-uri reports no invalid markers, so the tree and the declared override agree.

Blast radius: 28 changed lockfile entries vs main, not 75.

Verified beyond the gate: ajv relative $ref resolution — the code path that actually delegates to fast-uri — still resolves and still rejects correctly on 3.1.5.

Recommended follow-ups (not in this PR)

1. A deliberate middleware lockfile regeneration, reviewing the @hono/node-server 1.19 → 2.1 major on its own merits. The lockfile has drifted well behind the declared ranges — a regen moves 75 packages. That is worth doing intentionally, once, rather than discovering it inside an unrelated PR.
2. Close chore(deps,middleware)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /middleware #595 (typescript 7) and chore(deps,web-ui)(deps): bump cytoscape from 3.33.4 to 3.34.0 in /web-ui #250 (cytoscape, already on main).
3. Config gap: the typescript major-ignore lives only in the /web-ui npm block. The /middleware block lacks it, which is why chore(deps,middleware)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /middleware #595 was raised despite the comment already documenting that TS 7 is blocked. It will regenerate every Monday until the ignore is mirrored.
4. Config gap: the docker ecosystem covers only / and /web-ui. middleware/sidecars/dev-runner/Dockerfile and .../dev-runner-daemon/Dockerfile are unmanaged and had silently drifted — this PR bumps them by hand, but they will drift again.
5. The audit bypass deserves a second look. It is reasonable in intent, but it hid a real result set for as long as the endpoint was down. A warning annotation that is impossible to miss, or a periodic non-bypassed run, would make the blind spot visible.