fix(security): patch Cuabot dependencies

[0xjohnnydev]

What users see

Cuabot's lockfile can still install several vulnerable JavaScript packages. These alerts share one Cuabot override and lockfile, so they belong in one review.

What changed

• Kept the existing tar 7.5.21 and brace-expansion 5.0.8 fixes.
• Updated fast-uri to 3.1.5, hono to 4.12.34, and ip-address to 10.3.1.
• Regenerated the Cuabot lockfile without changing application source.
• This draft covers the earlier tar and brace-expansion alerts plus current alerts feat(lume): support bridged networking in release builds #1076–feat(docs): add Slack reporting for interesting docs bot prompts #1091.

Definition of Done

• Cuabot's tar alerts resolve to 7.5.21.
• Cuabot's brace-expansion alerts resolve to 5.0.8, which is newer than the reported fixed version 2.1.4.
• Cuabot's fast-uri, hono, and ip-address alerts resolve to their reported fixed versions.
• The shared package manifest and lockfile agree.
• A maintainer reviews the Node 20 runtime floor for brace-expansion 5.0.8 and advances this draft; automation will not mark it ready or merge it.
• GitHub closes the alerts after the reviewed fix reaches the default branch.

Validation

• pnpm@10.11.0 install --lockfile-only --ignore-scripts
• git diff --check
• Confirmed the lockfile resolves tar 7.5.21, brace-expansion 5.0.8, fast-uri 3.1.5, hono 4.12.34, and ip-address 10.3.1.

Impact

This changes only Cuabot's dependency overrides and lockfile. Human review should focus on the Node 20 requirement and the existing direct Dependabot overlap.

[github-actions]

📦 Publishable packages changed

This comment is status-only. Editing it or adding task-list checkboxes cannot authorize a release.
Only owner-applied release:<service> labels can do that.

• ⏸️ npm/cuabot — no owner-authorized release label

Ask the release owner to apply release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[github-actions]

📦 Publishable packages changed

This comment is status-only. Editing it or adding task-list checkboxes cannot authorize a release.
Only owner-applied release:<service> labels can do that.

• ⏸️ npm/cuabot — no owner-authorized release label

Ask the release owner to apply release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[github-actions]

📦 Publishable packages changed

This comment is status-only. Editing it or adding task-list checkboxes cannot authorize a release.
Only owner-applied release:<service> labels can do that.

• ⏸️ npm/cuabot — no owner-authorized release label

Ask the release owner to apply release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[0xjohnnydev]

This dependency graph is now included in draft #2719. That draft keeps each graph independently validated while giving reviewers one dependency-only change instead of several overlapping drafts. Nothing was merged or marked ready, and this branch is preserved.