FE-1308: Fix npm vulnerabilities from 2026-08-03 scan in brunch

[claude]

Requested by Tim Diekmann · Slack thread

Closes FE-1308

Weekly vuln-scan fix pass for the 2026-08-03 scan. Lockfile-only change: all bumps are within existing semver ranges via npm update / a targeted release-it bump — no overrides needed.

Fixes

Package	Before	After	Advisories
brace-expansion	5.0.5	5.0.9	GHSA-3jxr-9vmj-r5cp (High), GHSA-mh99-v99m-4gvg (High), GHSA-jxxr-4gwj-5jf2 (Moderate)
undici	7.24.5	7.28.0	GHSA-hm92-r4w5-c3mj (High), GHSA-vmh5-mc38-953g (High), GHSA-vxpw-j846-p89q (High), GHSA-p88m-4jfj-68fv (Moderate), GHSA-pr7r-676h-xcf6 (Moderate), GHSA-35p6-xmwp-9g52 (Low), GHSA-g8m3-5g58-fq7m (Low)
dompurify	3.4.2	3.4.12	GHSA-76mc-f452-cxcm, GHSA-cmwh-pvxp-8882, GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676, GHSA-rp9w-3fw7-7cwq (Moderate), GHSA-c2j3-45gr-mqc4, GHSA-gvmj-g25r-r7wr, GHSA-vxr8-fq34-vvx9 (Low)
js-yaml	4.1.1	4.3.1	GHSA-52cp-r559-cp3m (High), GHSA-h67p-54hq-rp68 (Moderate)
form-data	4.0.5	4.0.6	GHSA-hmw2-7cc7-3qxx (High)
fast-uri	3.1.2	3.1.5	GHSA-4c8g-83qw-93j6 (High), GHSA-v2hh-gcrm-f6hx (High)
qs	6.15.0	6.15.3	GHSA-q8mj-m7cp-5q26 (Moderate)
body-parser	2.2.2	2.3.0	GHSA-v422-hmwv-36x6 (Low)
@babel/core	7.29.0	7.29.7	GHSA-4x5r-pxfx-6jf8 (Low)

The undici fix uses the transitive-dep-upgrade ladder: release-it pins undici exactly, so it is bumped 20.0.1 → 20.2.1 (in-range for ^20.0.1), which moves its undici pin from 7.24.5 to 7.28.0. Incidental in-range companions pulled by these bumps: @babel/* family → 7.29.7/7.29.8, type-is 2.0.1 → 2.1.0, side-channel 1.1.0 → 1.1.1, side-channel-list 1.0.0 → 1.0.1, hasown 2.0.2 → 2.0.4, and a nested content-type@2.0.0 (all advisory-free).

Known remainder (not fixable from this repo)

A second brace-expansion 5.0.6 copy lives at node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion, pinned by pi-coding-agent's own npm-shrinkwrap.json. Root overrides do not penetrate shrinkwrapped subtrees (verified empirically: with "brace-expansion": "^5.0.8" in overrides, npm install still reifies 5.0.6 there). Even the latest pi-coding-agent (0.83.0, published 2026-07-29) ships brace-expansion 5.0.7 in its shrinkwrap — registry evidence: npm view + tarball inspection of package/npm-shrinkwrap.json shows node_modules/brace-expansion: 5.0.7, which fixes GHSA-3jxr but is still < 5.0.8 required for GHSA-mh99-v99m-4gvg. Brunch pins @earendil-works/pi-coding-agent at exactly 0.79.8, so this needs an upstream shrinkwrap refresh (5.0.8+) and/or a deliberate pi-coding-agent version bump as a follow-up.

Excluded (already covered by open PRs)

• seroval, postcss, @hono/node-server override — FE-1286: Bump seroval, postcss and @hono/node-server (security) #383
• vite — Update npm package vite to v7.3.5 [SECURITY] #243 / SRE-808: upgrade vulnerable npm dependencies (2026-07-13 weekly scan) #332
• hono 4.x — Update npm package hono to v4.12.27 [SECURITY] #375
• protobufjs — Update npm package protobufjs to v7.6.5 [SECURITY] #352
• chrome-devtools-mcp — Update npm package chrome-devtools-mcp to v1 [SECURITY] #244

Verification

• npm ls confirms resolved versions for every touched package; no vulnerable versions remain in package-lock.json for touched packages (lock diff shows matching removals for every addition)
• All newly introduced versions checked against the GitHub advisory DB (OSV npm dump from the scan run): no advisories match — should be clean for the Dependencies / Review gate
• Scratch npm ci --ignore-scripts from the updated lockfile passes

🤖 Generated with Claude Code

https://claude.ai/code/session_01WfQz9Y36mQ8J6kRC3zaEtt

---

Generated by Claude Code

[cursor]

PR Summary

Low Risk
No app code changes; semver-range lockfile refreshes for known advisories. Residual risk is limited to nested shrinkwrapped deps and routine regression testing after HTTP/parser-related bumps.

Overview
Lockfile-only pass to clear advisories from the 2026-08-03 npm scan. No package.json or application source changes—resolved versions move within existing semver ranges.

Security-targeted bumps include brace-expansion 5.0.5→5.0.9, dompurify 3.4.2→3.4.12, js-yaml 4.1.1→4.3.1, form-data 4.0.6, fast-uri 3.1.5, qs 6.15.3, and body-parser 2.2.2→2.3.0 (with nested content-type@2.0.0). undici 7.24.5→7.28.0 is pulled by bumping dev dependency release-it 20.0.1→20.2.1, which updates its pinned undici. The @babel/* toolchain cluster aligns to 7.29.7/7.29.8 (including @babel/core) for a low-severity advisory.

Transitive companions from those updates include type-is 2.1.0, side-channel / side-channel-list patches, and hasown 2.0.4. A nested brace-expansion 5.0.6 under @earendil-works/pi-coding-agent shrinkwrap is out of scope for this lockfile and called out for follow-up upstream.

^{Reviewed by Cursor Bugbot for commit d168822. Bugbot is set up for automated code reviews on this repo. Configure here.}