chore(deps): bump transitive deps to resolve 12 security advisories

[humble-little-bear]

Summary

Raises the pnpm security overrides in pnpm-workspace.yaml (and refreshes pnpm-lock.yaml) to clear all currently fixable GitHub Dependabot alerts, plus additional advisories surfaced by pnpm audit. No application code changed.

All of the affected packages are transitive dev-time dependencies (via eslint → @modelcontextprotocol/sdk → hono/ajv/express-rate-limit chain), except elliptic (see "Not auto-fixed").

Fixed advisories

Package	From → To	Severity	Advisory
js-yaml (3.x)	3.15.0 → 3.15.1	high	GHSA-5p4m-2wfm-xmqj — quadratic CPU in !!omap resolution
js-yaml (4.x)	4.3.0 → 4.3.1	high	GHSA-5p4m-2wfm-xmqj (same advisory, 4.x line)
hono	4.12.27 → 4.12.34	medium	GHSA-f23p-vx2j-j53r / CVE-2026-71850 — memo() retains SSR output across requests
hono	4.12.27 → 4.12.34	medium	GHSA-54fx-42gc-7vw4 / CVE-2026-71848 — algorithmic-complexity DoS in language middleware
hono	4.12.27 → 4.12.34	low	GHSA-79qm-7rj5-m7r9 / CVE-2026-71849 — proxy helper keeps Connection-listed headers
fast-uri	3.1.4 → 3.1.5	high	GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446 — host confusion via backslash authority
ip-address	10.1.1 → 10.3.1	high	GHSA-mwp4-54f8-5fhr / CVE-2026-69192 — leading-zero octal SSRF bypass
ip-address	10.1.1 → 10.3.1	medium	GHSA-4xrf-jv44-h6hh / CVE-2026-69198 — CIDR suffix suppresses special-use classification
ip-address	10.1.1 → 10.3.1	medium	GHSA-22jq-vg5j-6vgg / CVE-2026-54272 — IPv4-mapped/NAT64 misclassification
@hono/node-server	1.19.13 → 2.0.10	medium	GHSA-frvp-7c67-39w9 — path traversal in serve-static on Windows
@hono/node-server	1.19.13 → 2.0.10	moderate	GHSA-9mqv-5hh9-4cgg — memory-leak DoS via aborted WebSocket handshake
brace-expansion (1.x / 5.x)	1.1.16 → 1.1.18, 5.0.7 → 5.0.9	high	GHSA-mh99-v99m-4gvg + GHSA-rgw5-rvv9-x895 — DoS via unbounded expansion length / intermediate arrays

Notes:

• @hono/node-server 2.x is a major line change, so @modelcontextprotocol/sdk was refreshed 1.27.1 → 1.30.0 (still within eslint's declared ^1.8.0 range); SDK ≥1.30.0 officially declares "@hono/node-server": "^1.19.9 || ^2.0.5", making the 2.x override range-compatible.
• minimumReleaseAgeExclude entries were updated to match the newly pinned versions.
• The brace-expansion and GHSA-9mqv-5hh9-4cgg advisories were caught by pnpm audit against the updated lockfile; they did not yet appear in the Dependabot alert list.

Not auto-fixed

Package	Severity	Advisory	Reason
elliptic 6.6.1 (runtime, via @nervosnetwork/ckb-sdk-utils ← @joyid/ckb ← @ckb-ccc/core)	low	GHSA-848j-6mx2-7j84 / CVE-2025-14505 — risky cryptographic primitive	No patched release published: the advisory references >=6.6.2, but the newest version on npm is 6.6.1 (2024-11-13). Needs an upstream elliptic release (and then the @ckb-ccc/core chain to pick it up).

Verification

• pnpm install — lockfile regenerated, resolutions confirmed: hono 4.12.34, ip-address 10.3.1, js-yaml 3.15.1/4.3.1, fast-uri 3.1.5, @hono/node-server 2.0.10, brace-expansion 1.1.18/5.0.9
• pnpm audit — clean except elliptic (above)
• pnpm build — succeeds
• pnpm typecheck — clean
• pnpm test — 36/36 suites, 319 passed / 7 skipped

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b9aa0710-f413-4ddd-8ad2-e558ab079044

📥 Commits

Reviewing files that changed from the base of the PR and between a591136 and 726e888.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Security
  • Updated several third-party packages to patched versions.
  • Tightened package version requirements to address known vulnerabilities.
  • Added additional safeguards for server, parsing, and expansion-related dependencies.

Walkthrough

The pnpm workspace configuration now requires newer patched versions for several dependencies. The release-age exclusions were updated to match the new versions.

Changes

Security Override Updates

Layer / File(s)	Summary
Patched package versions and exclusions pnpm-workspace.yaml	Security overrides now require patched versions of Hono, @hono/node-server, ip-address, js-yaml, brace-expansion, and fast-uri. minimumReleaseAgeExclude now lists the corresponding versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ckb-devrel/offckb#465: Updates overlapping security overrides in pnpm-workspace.yaml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the dependency security updates, unresolved elliptic advisory, and verification results.
Title check	✅ Passed	The title clearly and concisely identifies the dependency updates and their purpose of resolving security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}