security: clear all high-severity Dependabot alerts (ws, fast-uri, protobufjs, fast-xml-builder)

[willwashburn]

Summary

Lockfile-only bumps that clear all four high-severity Dependabot alerts plus one moderate, with zero impact on how relay works. Every entry below is a pure transitive (or already-in-range direct) dep update — no package.json, no source, no API changes.

ws 8.20.0 → 8.21.0 (moderate)

• GHSA-58qx-3vcg-4xpx — Uninitialized memory disclosure (CVSS 4.4)

Existing constraints (^8.18.3 in root + packages/sdk, ^8.0.0 in packages/openclaw) already permit 8.21.0.

fast-uri 3.1.0 → 3.1.2 (high)

• GHSA-q3j6-qgpj-74h6 — Path traversal via percent-encoded dot segments (CVSS 7.5)
• GHSA-v39h-62p7-jpjc — Host confusion via percent-encoded authority delimiters (CVSS 7.5)

protobufjs 7.5.5 → 7.6.1 (high)

• GHSA-66ff-xgx4-vchm — Code injection through bytes-field defaults in generated toObject code
• GHSA-2pr8-phx7-x9h3 — DoS from crafted field names in generated code
• GHSA-fx83-v9x8-x52w — Prototype injection in generated message constructors
• GHSA-75px-5xx7-5xc7 — Code-generation gadget after prototype pollution
• GHSA-jvwf-75h9-cwgg — Process-wide DoS through unsafe option paths
• GHSA-685m-2w69-288q — DoS through unbounded protobuf recursion
• GHSA-q6x5-8v7m-xcrf — Overlong UTF-8 decoding
• GHSA-jggg-4jg4-v7c6 — DoS via unbounded recursive JSON descriptor expansion

fast-xml-builder 1.1.5 → 1.2.0 (high)

• GHSA-5wm8-gmm8-39j9 — Attribute-value quote bypass (CVSS 6.1)
• GHSA-45c6-75p6-83cc — Comment-value regex bypass

What changed

• package-lock.json only — no package.json files modified, no source code touched.
• Generated via npm update <pkg> --package-lock-only.
• All bumps are semver-compatible (patch or minor) on transitive or already-allowed direct deps.

Impact on relay

None. None of these packages are imported directly anywhere in relay's source — protobufjs, fast-uri, and fast-xml-builder are pure transitive deps, and ws stays within the existing ^8.x constraint.

Verification

$ npm audit            # before this PR: 21 vulns (3 high, 18 moderate)
$ npm audit            # after  this PR: 16 vulns (0 high, 16 moderate)

All five fixed packages (ws, fast-uri, protobufjs, @protobufjs/utf8, fast-xml-builder) are no longer listed.

Test plan

• CI passes (typecheck + builds + tests)
• npm audit reports no high-severity vulnerabilities

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7707e2b5-4500-408c-8a32-54eb05f9a5af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/compassionate-meitner-knD6s

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}