[V3RON]

Summary

pnpm audit --prod on main reported 22 advisories (1 critical, 9 high). This PR updates ws, hono and @modelcontextprotocol/sdk, and moves their vulnerable transitive dependencies to fixed versions inside the existing ranges. pnpm audit --prod now reports none. Dependabot gets an npm entry.

Changes

Package	Old → new	Closes
ws	8.18.3 → 8.22.0	fragment DoS (high), memory disclosure; reaches the uplink listener
hono	^4.13.5 → ^4.13.13	serveStatic double decode, hono/jsx escaping
@modelcontextprotocol/sdk	1.29.0 → 1.32.1	OAuth, HTTP and task advisories; simlock uses stdio only
proxy-addr, fast-uri, qs, ip-address	lockfile only	1 critical, 5 high, 7 moderate via the SDK
.github/dependabot.yml	new npm entry	weekly, minor and patch grouped

SDK changes on simlock's path: a 10 MB stdio read limit and reworded zod errors (1.30); the src/mcp tests pass unchanged.

Dev-only advisories (15, via oxfmt and Stryker) stay out of scope.

Tests

• src/mcp, src/http, uplink-websocket unit tests passed.
• pnpm test:e2e on gateway-smoke, mcp-session, console-serving passed: real uplinks over ws, the HTTP app, MCP stdio, serveStatic.

Assumptions

• Assumption: which release of each direct package? — the newest (ws 8.22.0, hono 4.13.13, MCP SDK 1.32.1); each is at or above its fix and passed pnpm's minimum release age check.
• Assumption: move the vulnerable transitive packages by override or inside their ranges? — inside their existing ranges in the lockfile; no new overrides, the ip-address override is unchanged.
• Assumption: how does the Dependabot npm group pick packages? — patterns: ["*"] beside update-types, so minor and patch updates share one group and majors stay one PR each; no cooldown.

Review

Spec review: skipped. Code review: 0 blocking, 0 fixed, 0 notes. Claims review: skipped.
Rounds: 1. Tokens: n/a.

One combined review by the maintainer's agent on 2026-10-22 (comment below); no blocking findings.

Rebased onto main e1f2f43 on 2026-10-26 as one commit. No conflicts; pnpm install --frozen-lockfile passes on the merged lockfile.

Written by an agent.

[V3RON]

Review (maintainer's agent, round 1)

No blocking findings.

• Manifest moves are the three the brief named (ws 8.22.0, @modelcontextprotocol/sdk 1.32.1, hono ^4.13.13); the lockfile-only moves of proxy-addr, qs, fast-uri, ip-address stay inside their declared ranges, so no override was needed. I re-ran pnpm audit --prod against this branch's lockfile myself: no known vulnerabilities.
• The MCP SDK notes checked out: the 1.30 stdio message cap and error rewording are the only changes on simlock's path, and the mcp tests pass unchanged.
• Dependabot npm entry groups minor and patch into one weekly PR, majors separate; matches the actions entry's style.

Note, no change needed: the remaining dev-only advisories (tinypool via oxfmt, old vite/vitest via stryker) are tooling, not shipped code; they belong to a toolchain bump, not this PR.