Clear all open security advisories

[jplock]

GitHub reported 15 open Dependabot alerts against the lockfiles that landed in #46 — 6 high. Dependabot opened 8 PRs for them; this fixes the underlying alerts in one change instead.

The one real major

react-router 7 → 8 in spa/react, and it's the only route to the fix: react-router-dom is capped at 7.18.2, so the patched version only exists in the react-router package. Four imports move (BrowserRouter, Routes, Route, useNavigate).

This was the last outstanding major upgrade in the repo — everything else is now on its current major.

Non-breaking transitive fixes

Package	From → To	Severity
path-to-regexp	8.3.0 → 8.4.2	HIGH — ReDoS
qs	6.15.0 → 6.15.3	MEDIUM — DoS
body-parser	2.2.2 → 2.3.0	LOW

Three needed overrides

For these, npm audit fix --force proposes a multi-major downgrade of the direct dependency — worse than the vulnerability:

postcss  -> Will install next@9.3.3, which is a breaking change        (from 16)
cookie   -> Will install @sveltejs/kit@0.0.30, which is breaking       (from 2.70)
@hono/…  -> Will install @angular/cli@21.0.4, which is breaking        (from 22)

So they pin the patched transitive via npm overrides instead, leaving the direct dependency alone:

Override	Severity
postcss ^8.5.24	HIGH — XSS + path traversal + arbitrary file read
sharp ^0.35.3	HIGH — inherited libvips CVEs
cookie ^0.7.2	LOW
@hono/node-server ^2.0.12	MEDIUM

That last one also resolves the advisory I deliberately left open in #46, where the only offered fix was downgrading the Angular CLI.

Supersedes the Dependabot PRs

Closes #41 and #48–#55. Every version they ask for is now met or exceeded:

PR	Target	Now
#53 path-to-regexp	8.4.2	8.4.2
#50 qs	6.15.3	6.15.3
#51 body-parser	2.3.0	2.3.0
#48 quinn-proto	0.11.16	0.11.16
#54 serde_with	3.21.0	3.21.0
#55 rustls-webpki	0.103.13	0.103.13

#49 and #52 (rand → 0.9.5) no longer apply: jsonwebtoken's rust_crypto backend pulls 0.8.7 and 0.10.2, not the 0.9.x line they target.

Verification

27/27 build and smoke · web, mcp, a2a, native, claims = 69 passed, 0 failures · npm audit clean in all 11 directories · pip-audit clean in all 10 · cargo build --locked clean

🤖 Generated with Claude Code