chore(deps): consolidated dependency batch 2026-08-04

.github/workflows/desktop-apps.yml

@@ -568,7 +568,7 @@ jobs:
           node-version: 22
 
       - name: Download the macOS build artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           pattern: omadia-installers-macos-*

Dockerfile

@@ -9,7 +9,7 @@
 # botbuilder (@azure/msal-node family) have post-install hooks that break on
 # Alpine's musl libc without extra build tools. Slim keeps the image small
 # while staying on glibc.
-FROM node:22.23.1-slim AS builder
+FROM node:22.23.2-slim AS builder
 ARG TARGETARCH
 WORKDIR /app
 
@@ -38,7 +38,7 @@ COPY middleware/scripts ./scripts
 RUN npm run build
 
 # --- runtime ----------------------------------------------------------------
-FROM node:22.23.1-slim AS runtime
+FROM node:22.23.2-slim AS runtime
 ARG TARGETARCH
 WORKDIR /app
 

middleware/package.json

@@ -96,8 +96,8 @@
   "overrides": {
     "esbuild": "^0.28.1",
     "axios": "1.18.1",
-    "fast-uri": "3.1.4",
+    "fast-uri": "3.1.5",
     "postcss": "8.5.23",
-    "brace-expansion": "5.0.8"
+    "brace-expansion": "5.0.9"
   }
 }

middleware/packages/harness-orchestrator/package.json

@@ -28,7 +28,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "csv-parse": "^7.0.1",
     "mammoth": "^1.8.0",
     "pdf-parse": "^2.4.5"

middleware/sidecars/dev-runner-daemon/Dockerfile

@@ -10,7 +10,7 @@
 # node >= 22.18 strips the TS types at load time, so no separate build step is
 # needed for this scaffold. `tini` reaps the child processes the daemon spawns;
 # the container runs as a non-root user.
-FROM node:22.23.1-alpine
+FROM node:22.23.2-alpine
 
 RUN apk add --no-cache tini
 

middleware/sidecars/dev-runner/Dockerfile

@@ -19,7 +19,7 @@
 # dev-runner-shim). It has ONLY devDependencies (typescript/tsx/@types/node) and
 # no runtime node_modules, so we compile it with tsc and ship the emitted dist/
 # tree — no bundler, and zero runtime dependency surface in the final image.
-FROM node:22.23.1-slim AS shim-builder
+FROM node:22.23.2-slim AS shim-builder
 WORKDIR /build
 COPY middleware/packages/dev-runner-shim/package.json ./
 # No package-lock.json in the workspace package (the root middleware lockfile
@@ -29,7 +29,7 @@ COPY middleware/packages/dev-runner-shim/ ./
 RUN npm run build
 
 # --- runtime stage ----------------------------------------------------------
-FROM node:22.23.1-slim
+FROM node:22.23.2-slim
 # Pin the Claude CLI to the SAME version as the middleware Dockerfile (repo-root
 # ./Dockerfile ARG CLAUDE_CODE_VERSION). Bump both together — a drift here means
 # a dev job runs a different CLI than the rest of the platform.

web-ui/Dockerfile

@@ -5,13 +5,13 @@
 # Final image ~150 MB (node 22 slim + standalone server + static assets).
 
 # --- deps -------------------------------------------------------------------
-FROM node:22.23.1-slim AS deps
+FROM node:22.23.2-slim AS deps
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci --no-audit --no-fund
 
 # --- builder ----------------------------------------------------------------
-FROM node:22.23.1-slim AS builder
+FROM node:22.23.2-slim AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
@@ -26,7 +26,7 @@ ENV MIDDLEWARE_URL=${MIDDLEWARE_URL}
 RUN npm run build
 
 # --- runtime ----------------------------------------------------------------
-FROM node:22.23.1-slim AS runtime
+FROM node:22.23.2-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1