fix(deps): patch vulnerable transitive dependencies

[chenyuan99]

Summary

Lockfile-only remediation of vulnerable transitive dependencies. No package.json changes — every bump stays inside the semver ranges already declared, so no declared API surface moves.

Workspace	Before	After
frontend/	4 (3 high, 1 low)	0
functions/	65 (9 high, 56 moderate)	58 (7 high, 51 moderate)
docs/	14 (12 high, 2 moderate)	unchanged — see below

Closes the following Dependabot alerts: brace-expansion (×3), protobufjs (frontend + functions), @babel/core, fast-uri (×3), qs.

Verification

• frontend: npm run build succeeds, 13/13 tests pass
• functions: npx tsc --noEmit clean, 60/60 tests pass

What is deliberately not fixed

Two clusters cannot be remediated by moving forward, and in both cases npm's suggested "fix" is a downgrade that would be worse than the vulnerability.

7 high alerts in functions/ — OpenTelemetry under genkit

npm audit fix --force proposes genkit@0.5.17. The project is on genkit@1.41.0; that is a ~36-minor-version downgrade and would break the agents outright. Upgrading genkit does not help either — 1.41.0 is the latest and still pins @opentelemetry/auto-instrumentations-node@0.49.2 → OTel 1.25.1 / 0.52.1, while the patches are on the OTel 2.x line.

Forcing OTel 2.x through overrides under a genkit that expects the 1.x API risks breaking telemetry at runtime — and the unit tests would not catch it, since they exercise pure tool functions and never touch telemetry.

The trade is not worth it, because none of these advisories are reachable in this application:

Advisory	Requires
propagator-jaeger — DoS via malformed header	The Jaeger propagator to be configured
sdk-node / auto-instrumentations-node — process crash	The Prometheus exporter to be running and exposed
core — unbounded memory in W3C Baggage	Baggage header propagation

functions/src/ai.ts is genkit({ plugins: [googleAI()] }). No Jaeger propagator, no Prometheus exporter, no google-cloud telemetry plugin. These sit in code paths the app never executes.

Recommendation: leave them and revisit when genkit ships an OTel 2.x bump.

12 high alerts in docs/ — puppeteer, sharp, extract-zip under mintlify

docs/ has exactly one devDependency, mintlify, and every alert is its transitive. This workspace is a local documentation-authoring tool (mintlify dev); it is a devDependency and is never deployed.

I tried upgrading to the newest release (4.2.800 → 4.2.819) and it changed nothing: the advisory range for mintlify is >=4.2.146, so every current version is affected, and extract-zip has no patched version published at all. npm's only proposal is mintlify@4.0.422, a downgrade of roughly 400 versions of the docs tooling.

I reverted that experiment rather than leave pointless lockfile churn in the diff.

Recommendation: leave them; they are dev-only and blocked on mintlify upstream. The existing upgrade-docs.yml schedule will pick up a fix when one ships.

Not addressed here

FOSSA's License Compliance check (7 issues) is untouched. The inventory shows GPL-2.0 variants among 33 licenses, but which of them are policy violations is a legal/business judgement, not a technical one — it needs a decision from you before any code change makes sense.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chenyuan99]

The three FOSSA checks are red, but this PR moves them substantially in the right direction. They are red because FOSSA's gate is binary — any remaining vulnerability fails it — and main itself fails the same three.

Check	main 2135411	this PR a0fae8b	delta
Security Analysis	64 vulnerabilities	45	−19
Dependency Quality	51 issues	47	−4
License Compliance	7 issues	7	0

That is the intended outcome of the change, not a regression. Going green would require eliminating all 45, which is blocked upstream — the remaining clusters are OpenTelemetry pinned by genkit@1.41.0 (latest) and puppeteer/sharp/extract-zip pinned by mintlify (every current version is in the advisory range, and extract-zip has no published patch). Both are covered in the PR description, including why npm's proposed "fixes" for each are downgrades that would be worse than the vulnerabilities.

I looked for further safe remediation and did not find any:

• uuid (functions, moderate, <11.1.1) comes via google-gax and teeny-request, which expect v9/v10. Forcing v11 through overrides is a major-version jump across consumers that expect the older API — not worth it for a moderate.
• Python contributes nothing. All 22 Dependabot alerts are npm; there are zero pip alerts, so backend/requirements.txt is not a factor.

One adjacent note: several of the remaining counts come from backend/, which #69 established is unreachable from the running app. If that code is deleted rather than kept, those dependencies — and whatever they contribute to these three checks — go away with it. That decision is still open.

License Compliance is untouched and needs a policy call from you before any code change makes sense; the FOSSA inventory lists 33 licenses including GPL-2.0 variants, but does not say which 7 are flagged as violations.

🤖 Addressed by Claude Code