chore(deps): clear the four transitive advisories failing the audit gate

[giswqs]

Why

The CI audit job (npm audit --omit=dev --audit-level=high) is currently red on main, not just on one PR. Four new advisories landed against transitive dependencies of @modelcontextprotocol/sdk. Every open PR inherits the failure, so this unblocks the branch generally.

The part that was not just a lockfile refresh

npm audit fix cleared three of the four. fast-uri needed a package.json change: the overrides entry pinned it to exactly 3.1.4, which #1378 added as the fixed version for the previous fast-uri advisory. GHSA-7p8r-x3mc-p8w7 covers 3.0.0 - 3.1.4, so that pin was actively holding the vulnerable version in place against the resolver.

Moved it to ^3.1.5 rather than re-pinning an exact version, so the next patch flows in on its own instead of needing this same manual fix a third time. That also matches the caret style of the other four overrides.

Versions moved

Package	From	To	Advisory
fast-uri	3.1.4	3.1.5	GHSA-7p8r-x3mc-p8w7 (high)
ip-address	10.2.0	10.4.0	GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg (high)
@hono/node-server	1.19.14	2.0.12	GHSA-frvp-7c67-39w9 (moderate)
hono	4.12.28	4.12.34	GHSA-8j4g-w8fx-2239 (moderate)

On the @hono/node-server major

This is the only bump worth a second look. It is not a forced incompatibility: the SDK declares "@hono/node-server": "^1.19.9 || ^2.0.5", so 2.x is a range it explicitly supports, and >=2.0.5 is the floor the advisory fixes at, so the 1.x line has no patched release to move to. npm ls --omit=dev --all reports no invalid tree entries.

Verification

• npm audit --omit=dev --audit-level=high (the exact CI command): 0 vulnerabilities, exit 0. Previously exit 1.
• npm audit --omit=dev at all severities: 0 vulnerabilities.
• npm run build, npm run test:frontend (4943 passing, 1 skipped), npm run test:worker: all pass.
• pre-commit on the changed files: passes.

No source changes, only package.json and package-lock.json.

Summary by CodeRabbit

• Chores
  • Updated the fast-uri package override to use a compatible 3.1.5-or-later version range.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c36bf633-c757-4bfa-b773-05b14e403c25

📥 Commits

Reviewing files that changed from the base of the PR and between 2a9d98e and 00abd2c.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The package configuration updates the fast-uri override from exact version 3.1.4 to the compatible range ^3.1.5.

Changes

Dependency override

Layer / File(s)	Summary
Update fast-uri override package.json	The override changes from 3.1.4 to ^3.1.5.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: copilot

Poem

A rabbit checks the package line,
And finds a newer range to bind.
fast-uri hops from four to five,
With caret ears, it stays alive.
One small change, the build can shine.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency updates that address four transitive audit advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/audit-fix-transitive-advisories

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

No inline comments needed — nothing in this diff rises to a reportable finding.

Code review

Bugs: None. This is a lockfile/manifest-only dependency bump (package.json + package-lock.json); no source code changed.

Security: The change is itself a security fix — it resolves four transitive advisories (fast-uri GHSA-7p8r-x3mc-p8w7, ip-address GHSA-mwp4-54f8-5fhr/GHSA-4xrf-jv44-h6hh/GHSA-22jq-vg5j-6vgg, @hono/node-server GHSA-frvp-7c67-39w9, hono GHSA-8j4g-w8fx-2239). Verified each requirer's semver range in package-lock.json (@hono/node-server: ^1.19.9 || ^2.0.5; hono: ^4.11.4; fast-uri: ^3.0.1 in three places; ip-address: ^10.2.0) — all are satisfied by the bumped versions, so no invalid-tree risk. Confidence: high.

Performance: N/A — no runtime code touched.

Quality: The fast-uri override change from an exact pin (3.1.4) to a caret range (^3.1.5) is a reasonable fix — the prior exact pin was actively blocking the vulnerable version from being replaced by npm's resolver, and the caret form matches the style of the other overrides in the block. The @hono/node-server major bump (1.x → 2.x) is justified in the PR body by the SDK's declared peer range and Node engine compatibility (repo requires Node ≥22, package requires ≥20). Confidence: high.

CLAUDE.md: No violations. This falls under normal dependency-update conventions (Dependabot/CI audit gate); no lockfiles requiring special handling (e.g. backend/geolibre_server/uv.lock) are touched, and no catalogs that need regeneration (whitebox-menu-catalog.ts) apply here since geolibre-wasm/maplibre-gl-* packages aren't part of this diff.

[Copilot]

Pull request overview

Unblocks the CI audit gate by updating transitive dependencies (primarily via @modelcontextprotocol/sdk) to versions that clear newly published advisories, without changing application source code.

Changes:

• Updates the root overrides for fast-uri from a vulnerable pin (3.1.4) to a patch-range (^3.1.5) so future patches flow automatically.
• Refreshes the lockfile to pick up fixed transitive versions (fast-uri@3.1.5, ip-address@10.4.0, hono@4.12.34, @hono/node-server@2.0.12).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adjusts fast-uri override to ^3.1.5 to avoid holding a vulnerable patch in place.
package-lock.json	Updates resolved transitive dependency versions to advisory-fixed releases (including @hono/node-server 2.x).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🔍 Cloudflare PR preview

Item	Value
Site	https://d6aa915b.geolibre-preview.pages.dev
Demo app	https://d6aa915b.geolibre-preview.pages.dev/demo/
Commit	00abd2c

[github-actions]

🔍 GitHub Pages PR preview

Item	Value
Site	Deploy failed. See the job log.
Demo app	Unavailable
Commit	00abd2c