[SavioBS629]

Summary

Bumps dependencies to resolve High-severity advisories reported by npm audit. All fixes were applied via in-range npm update or minimal non-breaking direct-dependency range bumps. No npm overrides were added and no breaking major bumps were performed.

Included (fixed)

Package	Old → New	Advisory
sharp	0.35.4 → 0.35.5	GHSA-wq5f-xc86-pv6w / CVE-2026-96889 (librsvg)
zod	4.4.3 → 4.6.7	GHSA-mrhx-c7xc-m3w5 (memory exhaustion)
vite (dev)	7.3.6 → 7.3.7	GHSA-587h-7wmj-h5pm (launch-editor fs.existsSync bypass)
body-parser (transitive)	2.2.2 → 2.4.0	GHSA-27r3-jxmh-p828 (DoS via trailing bytes)
source-map-js (transitive)	1.2.1 → 1.2.2	GHSA-68fv-2mgg-jv7q (event-loop DoS)
follow-redirects (transitive)	1.16.0 → 1.16.2	GHSA-8r9p-f939-6h3c (header leak)

Already satisfied (no change needed)

• axios (GHSA-c29m-xwm3-cm6r / CVE-2026-101903): already on the latest 1.x (1.21.0); not flagged by npm audit.
• brace-expansion (GHSA-6j4f-fj2g-mc7p): installed versions already patched; not flagged.
• undici (GHSA-w293-vg96-wgc3): installed versions already patched; not flagged.

Deferred

• @modelcontextprotocol/sdk (GHSA-6qxp-vccf-f47h): MCP SDK bump pulled out — needs a dedicated OAuth/transport test pass. Will be handled in a separate PR.

Not included (excluded)

Package	Advisory	Reason
extract-zip	GHSA-jmr9-qjv8-65gv (symlink traversal)	Only fixable via a breaking major bump of webdriverio (9 → 10, isSemVerMajor). Not in-range; excluded to avoid a breaking change.
basic-ftp	GHSA-c475-qrg2-pj4r (quadratic ReDoS)	Same: only reachable via the webdriverio 9 → 10 major bump (or a forbidden override). Excluded.

Validation

• npx tsc passes clean; eslint passes clean.
• Test suite: the only failing tests are pre-existing fake-timer/polling timeouts that fail identically on a pristine main checkout (same 27 tests), so they are unrelated to these bumps.
• npm audit after the change: all included target advisories clear; only the two excluded webdriverio-chain advisories remain.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 2b5606f2-4d20-48c4-ae5b-a9054d31296f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}