chore(security): patch 15 Dependabot alerts

[PMerlet]

Summary

15 fixed, 4 ignored, 5 deferred, 7 resolutions added, 2 resolutions removed.

Fixed

#	Package	Ecosystem	From → To	Severity	What was bumped
#312	lodash-es	npm	4.17.23 → 4.18.1	high	root resolution lodash-es: ">=4.18.1" (only parent is dev-only @qiwi/multi-semantic-release, which has not yet released a version that pulls in patched lodash-es)
#313	lodash-es	npm	4.17.23 → 4.18.1	medium	same resolution as #312
#317	@hono/node-server	npm	1.19.12 → 1.19.14	medium	root resolution @hono/node-server: ">=1.19.13 <2" (transitive via @modelcontextprotocol/sdk — no parent bump pulls in the patch)
#318	hono	npm	4.12.9 → 4.12.14	medium	root resolution hono: ">=4.12.14" (transitive via @modelcontextprotocol/sdk)
#319	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #318
#320	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #318
#321	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #318
#322	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #318
#323	lodash	npm	4.17.23 → 4.18.1	medium	root resolution lodash: ">=4.18.1" (many transitive chains; runtime path via forest-ip-utils → ip-address)
#324	lodash	npm	4.17.23 → 4.18.1	high	same resolution as #323
#326	langsmith	npm	0.5.11 → 0.5.22	medium	root resolution langsmith: ">=0.5.19" (transitive via @forestadmin/ai-proxy → @langchain/core)
#328	follow-redirects	npm	1.15.11 → 1.16.0	medium	root resolution follow-redirects: ">=1.16.0" (transitive via axios; axios 1.15.x still pins follow-redirects ^1.15.11, so bumping axios alone does not close this alert)
#329	axios	npm	1.13.5 → 1.15.2	medium	bumped direct dep in packages/forest-cloud ^1.13.5 → ^1.15.0; added root resolution axios: ">=1.15.0" to also cover the lerna → nx → axios chain
#334	langsmith	npm	0.5.11 → 0.5.22	medium	same resolution as #326
#335	hono	npm	4.12.9 → 4.12.14	medium	same resolution as #318

Ignored

#	Package	Severity	Reason
#330	@fastify/express	critical	Dev/test/tooling only; exploit requires untrusted input at runtime. @fastify/express is declared as a devDependency and as an optional peerDependency in packages/agent/package.json — it is used only from the agent's test suite and is installed by end-users (not us) at runtime. The only patched version, 4.0.5, depends on express ^5.2.1 + fastify-plugin ^5.0.0 (i.e. Fastify 5), while our tests explicitly target Fastify 2/3/4 via the fastify2, fastify, and fastify4 aliases in packages/agent/package.json. No patched release exists for the 1.x/2.x/3.x lines, so there is no compatible resolution target. Users continue to install their own @fastify/express at runtime; the peer range (^1.1.0 || ^2.0.0 || ^3.0.0 || ^4.0.0) is unchanged.
#331	@fastify/express	critical	Same package/same reason as #330 (middleware auth bypass variant of the path-doubling advisory).
#332	@fastify/express	critical	Same package/same reason as #330 — this alert has manifest_path: yarn.lock but refers to the same install as #330.
#333	@fastify/express	critical	Same package/same reason as #331 — duplicate with manifest_path: yarn.lock.

Deferred (age gate: opened < 7 days ago)

• fix(typing-generator): add simple quote around the collection and field name to support unconventional characters  #336 — @fastify/middie <= 9.3.1 (high, 6.5d)
• fix(decorators): remove useless isRequired field #337 — @fastify/middie <= 9.3.1 (critical, 6.5d)
• docs(api-reference): add more api reference for actions/collections & builder #338 — axios < 1.15.0 (medium, 6.1d — second axios advisory)
• feat: add support for mongoose datasource #339 — uuid < 14.0.0 (medium, <1d)
• feat: add collection hooks #340 — fast-xml-parser < 5.7.0 (medium, <1d)

Resolutions added

All new resolutions were placed at the root package.json. Yarn v1 (packageManager: "yarn@1.22.19") does not honor resolutions fields in non-root workspace package.json files, so workspace-level placement is not available. Parent-scoped syntax ("parent/child": "X") was considered but most of these packages appear via several unrelated chains (see "yarn why" snippets above), which made unconditional root entries the more reliable option.

Alert(s)	Package + pin	Parent chain considered	Why no parent bump	Placed in	Form
#312, #313	lodash-es: ">=4.18.1"	@qiwi/multi-semantic-release → semantic-release → lodash-es	No upstream release of @qiwi/multi-semantic-release or semantic-release yet pulls patched lodash-es	root package.json	unconditional
#317	@hono/node-server: ">=1.19.13 <2"	@modelcontextprotocol/sdk → @hono/node-server; also @langchain/mcp-adapters → @modelcontextprotocol/sdk → @hono/node-server	Latest @modelcontextprotocol/sdk still pins a sub-1.19.13 @hono/node-server. Upper bound <2 avoids the major 2.0.0 which is a breaking change for MCP	root package.json	unconditional
#318–#322, #335	hono: ">=4.12.14"	Same MCP SDK chain as above	Same reason as @hono/node-server	root package.json	unconditional
#323, #324	lodash: ">=4.18.1"	~17 distinct hoisted chains (lerna, jsonapi-serializer, inquirer, sequelize, markdown-link-check, semantic-release, prettier-eslint, forest-ip-utils→ip-address, …)	Parent bump is not feasible with this many unrelated ancestors	root package.json	unconditional (multiple chains)
#326, #334	langsmith: ">=0.5.19"	@forestadmin/ai-proxy → @langchain/core → langsmith and … → @langchain/community → @langchain/classic → langsmith	Our pinned @langchain/core@1.x / @langchain/community@1.1.19 still resolve to langsmith < 0.5.19	root package.json	unconditional (two chains)
#328	follow-redirects: ">=1.16.0"	@forestadmin/forest-cloud → axios → follow-redirects	Bumping axios to 1.15.2 does not fix this — axios 1.15.x still depends on follow-redirects ^1.15.11, which yarn resolves to 1.15.11 (vulnerable)	root package.json	unconditional
#329	axios: ">=1.15.0" (plus direct dep bump in packages/forest-cloud/package.json)	@forestadmin/forest-cloud → axios (direct) and lerna → nx → axios (transitive)	Direct bump handles forest-cloud; a root resolution also covers the lerna/nx chain which we don't own	packages/forest-cloud/package.json (direct) + root package.json (resolution)	direct dep + unconditional resolution

Resolutions removed

File	Entry removed	Why removal is safe
root package.json	"lerna/js-yaml": "4.1.1"	Stale. Yarn was emitting Resolution field "js-yaml@4.1.1" is incompatible with requested version "js-yaml@4.1.0" and ignoring it. After removal, a fresh yarn install still resolves js-yaml to 4.1.0 everywhere (unchanged) and the warning disappears.
root package.json	"@lerna/create/js-yaml": "4.1.1"	Stale, same reason as above (same warning, same behavior).

Risks

• lodash 4.17.23 → 4.18.1 — 4.18 is a security-patch minor; no API removals touched. The _.template / prototype-pollution fixes are behavioral hardening.
• lodash-es 4.17.23 → 4.18.1 — same as lodash above.
• hono 4.12.9 → 4.12.14 — patch-range bumps within 4.12.x; fixes are middleware-slash-handling, path-traversal in toSSG, IP-range match correctness, cookie-name validation, and JSX attribute handling. Hono is only used transitively by the MCP SDK; we do not call Hono APIs directly.
• @hono/node-server 1.19.12 → 1.19.14 — minor patch within 1.19.x, no API surface we touch.
• langsmith 0.5.11 → 0.5.22 — minor-range bump; the 0.5.19 release fixes prototype-pollution in _deepCopy and 0.5.22 tightens streaming-token output parsing. We consume langsmith only transitively via @langchain/core.
• follow-redirects 1.15.11 → 1.16.0 — minor bump; patches authentication-header leakage on cross-origin redirects. Used transitively by axios.
• axios 1.13.5 → 1.15.2 — minor-range bump across 1.13 → 1.15. 1.15.0 restricts cloud-metadata exfiltration and adds NO_PROXY hostname normalization; no breaking changes to request/response APIs we call. The direct bump in packages/forest-cloud changes the minimum resolved axios from 1.13.x to 1.15.x.
• @fastify/express: not bumped — see "Ignored" above.

No behavior changes beyond the patched vulnerabilities are expected for any of the above.

Manual testing

Covered by CI.

Validation

✅ CI green

Note

Patch 15 Dependabot security alerts by updating vulnerable dependencies

• Adds overrides in package.json for lodash, lodash-es, hono, @hono/node-server, langsmith, follow-redirects, and axios to enforce patched minimum versions.
• Bumps axios in packages/forest-cloud/package.json from ^1.13.5 to ^1.15.0.
• Removes overrides for @lerna/js-yaml and @lerna/create/js-yaml (no longer needed).

^{Macroscope summarized aa16c89.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.