chore(security): patch 13 Dependabot alerts

[PMerlet]

Summary

13 fixed, 0 ignored, 9 deferred, 7 resolutions added, 2 resolutions removed.

Fixed

Alert	Package	Ecosystem	From → To	Severity	What was bumped
#329	axios	npm	1.13.5 → 1.15.2	medium	bumped direct dep axios in packages/forest-cloud/package.json ^1.13.5 → ^1.15.0; plus root axios resolution to also pin nx's transitive copy
#328	follow-redirects	npm	1.15.11 → 1.16.0	medium	root resolution follow-redirects ^1.16.0 (axios 1.15.2 still declares follow-redirects ^1.15.11, so resolution is still needed)
#326	langsmith	npm	0.5.11 → 0.5.21	medium	root resolution langsmith ^0.5.18 (transitive via @langchain/core and @langchain/classic)
#324	lodash	npm	4.17.23 → 4.18.1	high	root resolution lodash ^4.18.0 (many parents — unconditional narrow-enough)
#323	lodash	npm	4.17.23 → 4.18.1	medium	same resolution as #324
#322	hono	npm	4.12.9 → 4.12.14	medium	root resolution hono ^4.12.12 (transitive via @modelcontextprotocol/sdk)
#321	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #322
#320	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #322
#319	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #322
#318	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #322
#317	@hono/node-server	npm	1.19.12 → 1.19.14	medium	root resolution @hono/node-server ^1.19.13 (transitive via @modelcontextprotocol/sdk)
#313	lodash-es	npm	4.17.23 → 4.18.1	medium	root resolution lodash-es ^4.18.0 (transitive via @qiwi/multi-semantic-release)
#312	lodash-es	npm	4.17.23 → 4.18.1	high	same resolution as #313

Ignored

None. All eligible alerts were actionable.

Deferred

Nine alerts opened less than 7 days ago; deferred to the next run:

• chore: allow to create alpha and beta branches specific for a package #330, fix(datasource-sequelize): serialize record to transform date to iso string  #331, chore: create firebase package directory #332, chore(firebase): add new empty classes for firebase #333 — @fastify/express (critical) — created 2026-04-16
• feat(firebase): allow to declare collections and their schema #335 — hono (medium) — created 2026-04-16 (likely already closed by the hono bump here: 4.12.14 >= 4.12.14; Dependabot will confirm on merge)
• fix(typing-generator): add simple quote around the collection and field name to support unconventional characters  #336, fix(decorators): remove useless isRequired field #337 — @fastify/middie (high, critical) — created 2026-04-16
• docs(replaceFieldWriting): improve the documentation for the replaceFieldWriting #334 — langsmith (medium) — created 2026-04-16 (likely already closed: 0.5.21 >= 0.5.19)
• docs(api-reference): add more api reference for actions/collections & builder #338 — axios (medium) — created 2026-04-17 (likely already closed: 1.15.2 >= 1.15.0)

Resolutions added

Alert(s)	Package + pinned range	Parent chain tried	Why bump wasn't viable	package.json	Form
#329	axios ^1.15.0	direct bump in packages/forest-cloud applied	direct bump done; resolution still needed because lerna > nx > axios@1.13.5 is still vulnerable	root package.json	unconditional (two unrelated parent chains — forest-cloud and lerna/nx)
#328	follow-redirects ^1.16.0	axios bumped to 1.15.2; still declares follow-redirects ^1.15.11	no ancestor of follow-redirects pulls in 1.16.0 without override	root package.json	unconditional (only parent is axios; narrow enough)
#326	langsmith ^0.5.18	could scope to @langchain/core/langsmith + @langchain/classic/langsmith, but two parents	two unrelated parent chains	root package.json	unconditional
#323, #324	lodash ^4.18.0	many unrelated parents (sequelize, lerna, jsonapi-serializer, inquirer, ...)	no single parent bump covers all chains	root package.json	unconditional (last-resort per spec: many unrelated chains)
#318–#322	hono ^4.12.12	tried scoped @modelcontextprotocol/sdk/hono first — yarn 1 silently ignored the deeply-scoped key (hono stayed at 4.12.9 after install)	scoped form not honored by yarn 1 for three-segment scoped paths	root package.json	unconditional fallback
#317	@hono/node-server ^1.19.13	same scoped-key issue as hono	same as above	root package.json	unconditional fallback
#312, #313	lodash-es ^4.18.0	only @qiwi/multi-semantic-release chain	could scope to @qiwi/multi-semantic-release/**/lodash-es but there's no other lodash-es anywhere, so scope is effectively the same	root package.json	unconditional

Resolutions removed

File	Package + version	Reason
root package.json	lerna/js-yaml: 4.1.1	Stale — yarn 1 emitted Resolution field "js-yaml@4.1.1" is incompatible with requested version "js-yaml@4.1.0" and ignored the pin. Removing it leaves the lerna chain at js-yaml@4.1.0 (unchanged).
root package.json	@lerna/create/js-yaml: 4.1.1	Same as above. Verified by removing and re-running yarn install: js-yaml@4.1.0 still resolves for the lerna chain, no change.

Kept after audit (verified still active): tar, lerna/**/glob, micromatch, semantic-release, qs. Removing any one of these caused a downgrade of some transitive copy below the pinned floor, or an install failure (semantic-release).

Risks

• axios 1.13.5 → 1.15.2: patch-and-minor bumps; release notes document the cloud-metadata SSRF fix and internal CSRF-token helper tightening. No public-API breakage. Used in forest-cloud for HTTP calls to the Forest Admin API; those calls use a fixed base URL, so the header-injection vector is not exploitable here anyway — this is a defensive bump.
• follow-redirects 1.15.11 → 1.16.0: minor bump; only user is axios internals for redirect handling. No app-observable change.
• hono 4.12.9 → 4.12.14: minor-range bump; fixes cookie parsing, IPv4-mapped IPv6 matching, path traversal in toSSG(), repeated-slash middleware bypass in serveStatic. We don't use toSSG(), serveStatic, getCookie, setCookie, or ipRestriction() directly — hono is only pulled in by @modelcontextprotocol/sdk as an HTTP adapter. No behavior change expected for our usage.
• @hono/node-server 1.19.12 → 1.19.14: same story — patches the serveStatic bypass; not a code path we hit.
• langsmith 0.5.11 → 0.5.21: patch-range bump over several releases; fixes internal __proto__ guard in a lodash set() call. No public-API breakage. Used only inside @langchain/core tracing.
• lodash 4.17.23 → 4.18.1: minor bump; _.template code-injection and _.unset/_.omit prototype-pollution fixes. No API surface change.
• lodash-es 4.17.23 → 4.18.1: same as lodash above; only consumed by @qiwi/multi-semantic-release (dev-only tooling).

None of the bumps touch peer-dep ranges that would ripple into neighbor packages.

Manual testing

Covered by CI.

Validation

✅ CI green — 24 checks passed, 3 skipped (release/publish gated on merge), 0 failures.

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.