chore(deps): carry dependabot's npm security bumps onto Dev_new_gui (hono 4.13.7 and transitive; supersedes #16171)

[mrveiss]

Refs #16171 (dependabot's original npm security bump, superseded by this PR and closed).

Supersedes #16171 (dependabot's security update, which targets main; PRs here target Dev_new_gui).

Single-issue rationale: this carries one dependabot security update onto the branch PRs actually target. Its scope is exactly that update's lockfiles.

Thinking Path

Dependabot security updates always target the default branch (main), whatever target-branch says, so #16171 couldn't ride the Dev_new_gui trains. Each package dependabot bumped was compared with Dev_new_gui's lockfile, and only those still behind were brought up.

What Changed

• .mcp: hono 4.13.0 → 4.13.7 (GHSA-hxh3-vqpv-xpqv, GHSA-crvj-82cr-hjcx, GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc). fast-uri and qs were already fixed on Dev_new_gui.
• The MCP tools mcp-structured-thinking and mcp-autobot-tracker get hono 4.13.0 → 4.13.7, plus dependabot's transitive bumps (browserslist, electron-to-chromium, node-releases and baseline-browser-mapping).
• autobot-frontend gets joi 18.2.3 → 18.2.8, @redocly/openapi-core 1.34.18 → 1.34.20, and the same transitive bumps.
• libs/autobot-sdk-ts gets the same transitive bumps.
• autobot-slm-frontend was already at target, so it's unchanged.
• Every version, resolved URL and integrity hash comes verbatim from dependabot's commit 7dc04e3a3. Nothing was hand-computed or installed.

Verification

• A per-package table compares Dev_new_gui, dependabot, and applied or skipped; it's in the implementation report.
• No npm install was run locally, and CI's npm ci plus the audit gates are the real check.
• .github/workflows/security.yml is untouched: chore(deps): bump the npm_and_yarn group across 6 directories with 7 updates #16171's allowance edit belonged to main.
• A review is checking each bumped node against dependabot's full node, not just the three fields.

Model Used

Claude Opus 5 as coordinator; devops-engineer subagents on Sonnet.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a3e8b4c1-261a-4d32-9a3f-212ea6fe4f56

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(security): generate the vault root key from 32 random bytes, not alphanumeric characters (#16405) #16410 fix(security): generate the vault root key from 32 random bytes, not alphanumeric characters (security(secrets): the vault root key is base64 of 32 alphanumeric chars (~190 bits), not 32 random bytes #16405)
• chore(docker): retire the four agent Dockerfiles whose modules no longer exist; agents run in-process (#16361) #16409 chore(docker): retire the four agent Dockerfiles whose modules no longer exist; agents run in-process (chore(docker): four agent Dockerfiles under autobot-infrastructure/autobot-backend/docker/ are built by nothing: wire in or retire #16361)
• fix(tests): stop gating a disk-bound model load on a CPU work budget, and prove it stays offline and import-free (#15055, #15235) #16404 fix(tests): stop gating a disk-bound model load on a CPU work budget, and prove it stays offline and import-free (test(perf): startup benchmarks assert absolute wall-clock budgets and fail on runner load — passed and failed on the same code minutes apart #15055, test(perf): three calibrated budgets are drifting or disk-bound — the startup margin is 1.4x, not the 1.9x its note records #15235)
• fix(ci): keep the drift-checked SLM agent mirror out of the duplication scan (#16401) #16402 fix(ci): keep the drift-checked SLM agent mirror out of the duplication scan (ci(duplication-guard): the SLM scope counts the drift-checked agent mirror, so every agent change fails the absolute pin #16401)
• chore(ci): merge train 2026-09-11-g2, test vehicle, do not merge (#15937) #16400 chore(ci): merge train 2026-09-11-g2, test vehicle, do not merge (Enable the merge queue — no PR merges against a stale base #15937)
• fix(ci): bring CI's pytest environment up to its declared floors, and gate on them (#16264) #16391 fix(ci): bring CI's pytest environment up to its declared floors, and gate on them (ci: the pytest environment sits below two declared floors, and the floor banner tells CI readers the opposite #16264)
• fix(security): the dev proxy stops granting admin without a login, and the session check endpoint is tested (#16382, #16385) #16390 fix(security): the dev proxy stops granting admin without a login, and the session check endpoint is tested (SLM Vite dev-server proxy injects X-Internal-API-Key on /autobot-api with no session check #16382, SLM backend: add direct test coverage for GET /api/auth/me #16385)
• fix(security): the SLM proxy checks the caller's SLM session before it adds the backend key (#16374) #16386 fix(security): the SLM proxy checks the caller's SLM session before it adds the backend key (security(slm): the SLM nginx /autobot-api/ proxy adds the internal API key for every caller, so anyone reaching the SLM host is a backend admin #16374)
• fix(ci): retire the CodeQL suite file nothing loads, and record the real guard behind alert #1030 (#16283, #16302) #16377 fix(ci): retire the CodeQL suite file nothing loads, and record the real guard behind alert feat: Voice conversation mode — Hands-free with VAD (Tier 2) #1030 (ci(security): codeql.yml is disabled, so the reviewed codeql-config.yml exclusions apply to nothing #16283, ci(security): codeql-config.yml's file-scoped query-filters exclude nothing, under either setup #16302)
• fix(security): write the service-key export only to its configured directory, never into a checkout, and keep one (#16348) #16372 fix(security): write the service-key export only to its configured directory, never into a checkout, and keep one (security(service-auth): generate_service_keys.py writes its live-key export relative to the working directory, so a run inside a checkout drops keys into the work tree #16348)
• fix(security): authenticate every skills route, and require admin to change, fetch or execute (#16368) #16370 fix(security): authenticate every skills route, and require admin to change, fetch or execute (security(api): every route in api/skills.py (catalog fetch/install, enable, execute) is unauthenticated, and the router-auth guards can't see feature routers #16368)
• fix(ci): let the system-package retry recover from its own timeout, and fetch before unpacking (#15515) #16367 fix(ci): let the system-package retry recover from its own timeout, and fetch before unpacking (ci(runner): apt provisioning times out (exit 124) three attempts in a row and fails the shard before any test runs #15515)
• fix(guards): tell a baseline entry that matches nothing apart from one that under-matches (#16334) #16365 fix(guards): tell a baseline entry that matches nothing apart from one that under-matches (bug(guards): --audit-baseline says "no longer match anything" for an entry that still matches, so the reader deletes a live exemption #16334)
• fix(ci): stop the regen bot's approved runs cancelling the job that approved them (#16360) #16363 fix(ci): stop the regen bot's approved runs cancelling the job that approved them (ci: the regen bot's own push cancels the job that approves its parked runs, so a PR's CI can silently never run #16360)
• fix(ci): keep line numbers out of the secrets baseline, so a line move no longer rewrites it (#16353) #16362 fix(ci): keep line numbers out of the secrets baseline, so a line move no longer rewrites it (ci(secrets): .secrets.baseline stores a line number per finding, so every PR that shifts lines in a file with findings rewrites it and conflicts with every other such PR #16353)
• test(guards): name the deliberate fixed sleeps, and stop a random temp name deciding a language test (#16255, #16341) #16358 test(guards): name the deliberate fixed sleeps, and stop a random temp name deciding a language test (tests: 32 more fixed sleeps are followed by an assertion, and some decide the outcome by the clock #16255, test(voice): test_no_filename_hint flakes when tempfile's random name forms a language-code token (e.g. _lv_) #16341)
• fix(ci): gate the frontend npm audit on one report, retry it, and report 'could not check' apart from advisories (#16337) #16357 fix(ci): gate the frontend npm audit on one report, retry it, and report 'could not check' apart from advisories (ci(security): the npm audit gate fails an audit-endpoint error exactly like a high advisory — retry, and report 'could not check' distinctly #16337)
• fix(docker): retry apt fetches and fail apt-get update on a lost index, set once for every image (#16291) #16356 fix(docker): retry apt fetches and fail apt-get update on a lost index, set once for every image (ci(docker): an unreachable Ubuntu mirror surfaces as a misleading 'held broken packages' error; apt steps neither retry nor fail on index errors #16291)
• feat(slm): Redis control and detailed health live in the SLM only; remove the unreachable user-GUI copies (#16245, #16252) #16352 feat(slm): Redis control and detailed health live in the SLM only; remove the unreachable user-GUI copies (tech-debt(frontend): move SettingsPanel's detailed system health and Redis service management into the SLM #16245, bug(frontend): RedisServiceControl calls /api/service-monitor/services/* and no mounted router serves those paths #16252)
• fix(code-sync): delete files removed from source through the updater, and check drift across every file (#16310, #16322) #16351 fix(code-sync): delete files removed from source through the updater, and check drift across every file (deploy: the builtin updater never removes files deleted from source, so deleted modules pile up on every host #16310, deploy: ansible synchronize never deletes files removed from source on remote fleet nodes #16322)
• fix(pre-commit): run detect-secrets serially and refresh the baseline's line numbers (#16343) #16349 fix(pre-commit): run detect-secrets serially and refresh the baseline's line numbers (pre-commit: detect-secrets runs in parallel batches that race on .secrets.baseline, so large commits and base merges can't commit #16343)
• fix(kb): make three summarisation paths do what they claim (#14840, #15700, #16110) #16345 fix(kb): make three summarisation paths do what they claim (context-overflow summarization can never succeed — _get_gateway imports a module and a symbol that do not exist #14840, sec(kb): the chat-to-knowledge summariser interpolates whole transcripts unframed, and the result is persisted to the knowledge base #15700, bug(kb): summary quality is scored against text[:200] — a 300-word summary judged on a 200-character window #16110)
• ci(python-suite): queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (#16320) #16328 ci(python-suite): queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (ci: queue python-suite shards FIFO across PRs (queue: max), so one PR's suite finishes before the next starts #16320)
• docs(env): move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (#16317) #16318 docs(env): move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (docs: the generated env-var table and its count line live in CLAUDE_RULES.md, so every env-var PR conflicts with every other #16317)
• fix(terminal): render TerminalModals in TerminalWindow, with each action reporting the parent's real outcome (#16285) #16313 fix(terminal): render TerminalModals in TerminalWindow, with each action reporting the parent's real outcome (fix(terminal): TerminalModals reports success after a fixed delay, and nothing renders it; TerminalWindow still has the modals inline #16285)
• refactor(slm-backend): retire the 7 dead SLM monitoring modules whose function is live elsewhere (#16282) #16308 refactor(slm-backend): retire the 7 dead SLM monitoring modules whose function is live elsewhere (tech-debt(slm-backend): 11 of the 12 modules in monitoring/ are imported by no live code #16282)
• feat(auth): one permission vocabulary, key scopes as bundles, /me permissions, and API-key scope enforcement (#16270, #16040) #16298 feat(auth): one permission vocabulary, key scopes as bundles, /me permissions, and API-key scope enforcement (auth: extend Permission to cover chat, teams and webhooks, define key scopes as permission bundles, and return effective permissions from /me #16270, API key scopes are stored and displayed but never enforced — keys inherit full user authority #16040)
• feat(slm): nodes report their GPUs in the heartbeat, and the SLM serves them per node (#16280, #16281) #16292 feat(slm): nodes report their GPUs in the heartbeat, and the SLM serves them per node (feat(slm-agent): report per-node GPU telemetry in the heartbeat, from one shared nvidia-smi/rocm-smi parser #16280, feat(slm-backend): serve per-node GPU state (GET /api/monitoring/gpu/nodes) and the autobot_gpu_* series Grafana already queries #16281)
• fix(llc): kill an agent's whole process tree on cancel, timeout or stall (#13097, #13099) #16284 fix(llc): kill an agent's whole process tree on cancel, timeout or stall (LLC adapters: agent cancel/timeout orphans the whole subprocess tree #13097, LLC adapters: no stall or first-output watchdog — a hung run holds a slot for the full 3600s timeout #13099)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[mrveiss]

CI red: Check PR links to its issue fails because the branch name implies a link this PR's body doesn't state in the recognised form. The branch is issue-16171-mcp-npm-security, so the check expects Closes #16171 or Refs #16171 somewhere in the body. The body says "Supersedes #16171" — not a keyword the check recognises, even though #16171 is itself a PR (now closed), not an issue.

Fix: add a line the check accepts, e.g.:

Refs #16171 (superseded by this PR; #16171 targeted main and is closed)

That satisfies the linkage textually without implying #16171 needed fixing as an issue.

[mrveiss]

Content review: approve. Pure lockfile bump (hono 4.13.0→4.13.7 + transitive deps across 4 package-lock.json files), no source changes. closingIssuesReferences=[] matches body (Refs #16171 only, no Closes). Ready.