fix(deps): remediate Vanta/Dependabot medium advisories (ENG-5578)

[StephenTangCook]

Summary

Clears all 13 medium-severity Dependabot findings tracked in ENG-5578.

Every affected package is a transitive dev/build or Cloudflare Worker dependency — none of them reach the published dist/ bundle, whose only runtime dependencies remain ajv and ajv-formats. The fixes are pnpm.overrides entries, following the pattern this repo already uses for fast-uri and ws.

Type of change

• Docs / chore (no runtime change)

Changes

Advisory	Package	Before → After	Source
CVE-2026-54286/54287/54288/54289 (<4.12.25) CVE-2026-59895/59896/59897 (<4.12.27)	hono	4.12.21 → 4.12.33	@modelcontextprotocol/sdk (declares ^4.11.4)
GHSA-frvp-7c67-39w9 (<2.0.5)	@hono/node-server	1.19.14 → 2.0.12	@modelcontextprotocol/sdk
CVE-2026-53550	js-yaml	3.14.2 → 3.15.1 4.1.1 → 4.3.1	ajv-cli (3.x); json-schema-to-typescript / @apidevtools/json-schema-ref-parser (4.x)
CVE-2026-9678 / CVE-2026-9679 (>=7.0.0 <7.28.0)	undici	7.24.8 → 7.29.0	miniflare (pins exactly)
CVE-2026-53632 (8.0.0–8.0.15)	vite	8.0.12 → 8.0.16	auto-installed peer of vitest / agents

Two things reviewers should look at:

• @hono/node-server had to cross a major. There is no patched 1.x — 2.0.5 is the only fix. So worker's @modelcontextprotocol/sdk moves ^1.29.0 → ^1.30.0, which widened its own range to ^1.19.9 || ^2.0.5 specifically for this advisory (sdk#2549). 1.30.0 is a semver-minor with no breaking changes.
• @modelcontextprotocol/sdk is also overridden to ^1.30.0 because agents@0.13.0 pins it to exactly 1.29.0. Without that override the tree carries two SDK copies and worker typecheck fails on incompatible McpServer types across them (Types have separate declarations of a private property '_serverInfo'). This was caught and fixed before pushing.

vite is declared as an explicit devDependency in both workspaces rather than only overridden: it is an auto-installed peer of vitest, and pnpm will not re-resolve an auto-installed peer from an overrides entry alone. It is pinned to ~8.0.16 to keep the bump inside 8.0.x.

Incidental lockfile churn: rolldown picks up a second copy (1.0.3 from vite, 1.2.1 for @rolldown/plugin-babel's peer). Dev-tooling only — nothing imports it at runtime, and the Worker is bundled by wrangler/esbuild.

demo/ is unaffected (separate lockfile, installed with --ignore-workspace; its vite is 6.4.3, outside the advisory range, and it has no js-yaml/undici/hono).

Testing

• pnpm test passes — 20 files, 499 tests (also verified under Bun via bun --bun run vitest run)
• pnpm typecheck passes (root and worker)
• pnpm lint passes
• pnpm validate-schema passes
• Added or updated tests under test/ covering the change — n/a, dependency-only change

Additional CI-equivalent checks run locally against a clean pnpm install --frozen-lockfile:

• pnpm run test:coverage — 95.36% statements, unchanged
• pnpm run generate:types → src/types.generated.ts byte-identical (86,512 bytes), so the js-yaml 4.x bump does not perturb generated output
• pnpm run build → dist/standalone-validator.js byte-identical (873,648 bytes)
• pnpm exec esbuild --bundle --format=esm --platform=neutral ... scripts/smoke-worker.ts — clean
• pnpm run build:demo — clean
• worker: typecheck + 33 tests pass

Not run locally: the Deno smoke job (deno is not installed in this environment). It consumes the built dist/ artifacts, which are byte-identical to main, so it carries no new risk.

Schema changes

n/a — src/slack-block-kit.schema.json is untouched.

Checklist

• Commit messages follow Conventional Commits
• Public API changes are reflected in README.md — n/a, no public API change
• No secrets, tokens, or sample tenant data committed

Follow-up

Per the issue's acceptance criteria, the Vanta test should be rerun after this merges. Note the push warning reports 31 total alerts on main (13 high, 13 moderate, 5 low) — this PR addresses the 13 medium/moderate findings enumerated in ENG-5578; the high and low findings are out of scope here.

🤖 Generated with Claude Code

https://claude.ai/code/session_0154iDBUE6SWF9Q6uHSz1xqd

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}