Fix open Dependabot/Aikido dependency alerts + workflow permissions

[yosriady]

Summary

Clears the open Dependabot alerts (33) and the Aikido findings for this repo.

Root workspace (pnpm-workspace.yaml overrides):

• js-yaml (HIGH, GHSA-pm4m-ph32-ghv5) — root cause was our own override: the uncapped 'js-yaml@3': '>=3.15.0' rewrote a ^3.x request to "anything ≥3.15.0", which pnpm resolved to the vulnerable 5.2.1. Capped at <4 so it resolves to patched 3.15.0 with the API the dependents expect.
• zod → 4.4.3 (AIKIDO-2026-10706/-10707, prototype pollution + missing input validation, fixed in 4.4.0). zod is never imported here — it only enters as abitype's optional peer, and abitype 1.2.3 accepts ^3 || ^4.
• ws@8 floor → ≥8.21.1, the patched version for CVE-2026-62389. The lock already resolved 8.21.1, so the Aikido ws finding was stale — this just makes the floor explicit. (Close the Aikido ws issue as already-resolved.)

.deepsec scanning workspace (scanner tooling, not shipped): deepsec → ^2.2.9 + overrides for fast-uri ≥3.1.4, hono ≥4.12.27, @hono/node-server ≥2.0.5, undici ≥7.28.0 <8, tar ≥7.5.21 (incl. critical CVE-2026-59873), qs ≥6.15.2, body-parser ≥2.3.0, brace-expansion ≥5.0.8.

Workflow permissions (Aikido SAST): release.yml now sets permissions: {} at workflow level with id-token: write / contents: write granted only to the publish job.

Verification

• ✅ jest 300/300, tsc --noEmit, bob build (module/cjs/types), eslint — all clean
• ✅ pnpm peers check report identical to main (3 pre-existing, unrelated to these changes)
• ✅ Lockfiles grep-verified: js-yaml 3.15.0/4.3.0 only, zod 4.4.3, ws 8.21.1; .deepsec fast-uri 3.1.5, hono 4.12.34, undici 7.29.0, tar 7.5.22, qs 6.15.3, body-parser 2.3.0, @hono/node-server 2.0.12, brace-expansion 5.0.9
• ✅ All resolved versions ≥7 days old (minimumReleaseAge respected)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	deepsec@​2.2.9

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @protobufjs/float is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .deepsec/pnpm-lock.yaml → npm/deepsec@2.2.9 → npm/@protobufjs/float@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm highlight.js is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .deepsec/pnpm-lock.yaml → npm/deepsec@2.2.9 → npm/highlight.js@10.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/highlight.js@10.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm typebox is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .deepsec/pnpm-lock.yaml → npm/deepsec@2.2.9 → npm/typebox@1.1.38 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typebox@1.1.38. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 525cf31ccc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scope the Zod override to abitype

When Expo CLI is invoked, this unqualified override also replaces @expo/cli@57.0.9's direct Zod 3.25.76 dependency with 4.4.3 (see the @expo/cli snapshot in pnpm-lock.yaml), contrary to the comment that Zod enters only through abitype. Because Zod 4 is a breaking major and the reported build/tests do not exercise Expo CLI commands, this can break Expo development tooling even though abitype accepts either major; scope the override to abitype or otherwise preserve Zod 3 for the unrelated Expo consumer.

Useful? React with 👍 / 👎.

[yosriady]

Addressed in c4d9c4f — kept global deliberately, comment rewritten to be accurate. Scoping to abitype>zod would leave the Aikido-flagged zod 3.25.76 resolution alive under @expo/cli, which defeats the finding this PR closes (Aikido flags 3.25.76 itself). Compensating evidence: expo CLI 57.0.9 starts and runs subcommands on zod 4.4.3 (its zod schemas are constructed at import time, so an incompatible API use would throw on startup); expo here is dev tooling for the jest expo mocks — the runnable example app lives in the separate examples repo; jest 300/300 re-run after the override.

[chatgpt-codex-connector]

Avoid forcing the MCP SDK onto Hono Node Server 2

When DeepSec exercises the MCP SDK's Node HTTP transport, this global override replaces @modelcontextprotocol/sdk@1.29.0's previously resolved @hono/node-server@1.19.14 with 2.0.12 even though the MCP SDK itself remains at exactly the same version. This bypasses the SDK's dependency range and forces a breaking server-adapter major underneath already-built SDK code, so peer/install checks cannot establish compatibility; use an MCP SDK release that declares support for v2 or scope a patched compatible version instead.

Useful? React with 👍 / 👎.

[yosriady]

Acknowledged in c4d9c4f but kept, with the risk contained: there is no patched @hono/node-server 1.x (first patched version is 2.0.5 per the advisory), and no @modelcontextprotocol/sdk release pairs with it under the old major, so a scoped 1.x pin would leave the alert open. This workspace is scanner-only tooling (never shipped); the override is now capped at <3 and deepsec 2.2.9 verified booting with node-server 2.0.12 in the tree. Will revisit when deepsec ships an MCP SDK that declares v2 support.

[chatgpt-codex-connector]

Declare the new DeepSec Node requirement

On Node 18 or Node 20—the versions still accepted by the declared pnpm 9 toolchain—the documented .deepsec install can complete with engine warnings and then leave the scanner unusable: DeepSec 2.2.9 now installs the @earendil-works/pi-* 0.81.1 packages, all of which require Node >=22.19.0, while this workspace declares no Node engine or setup version. Add an engines.node constraint/documented setup version or retain a DeepSec version compatible with the previously usable runtimes so users fail before attempting scans.

Useful? React with 👍 / 👎.

[yosriady]

Fixed in c4d9c4f: .deepsec/package.json now declares engines.node: >=22.19.0, matching what the @earendil-works/pi-* 0.81.1 packages require, so installs on Node 18/20 fail before anyone attempts a scan.