v0.0.10

Dependency security updates. No code, tool, or API changes. Clears every high-severity advisory in the tree: 9 vulnerabilities → 3, 5 high → 0.

package	from → to
undici	8.3.0 → 8.9.0	runtime — HTTP client for every outbound Loomio call
body-parser	→ 2.3.0	transitive
fast-uri	→ 3.1.4	transitive
postcss	→ 8.5.23	transitive
hono	→ 4.12.32	transitive
vite	→ 8.1.5	transitive (dev)

The undici fixes are the ones that matter here — response-queue poisoning via keep-alive socket reuse, cross-user information disclosure via a shared-cache whitespace bypass, and a Set-Cookie SameSite downgrade — because this is a multi-user service funnelling every caller through one upstream identity over pooled keep-alive connections.

Supersedes Dependabot PRs #5, #6, #8, #10, #11, #12.

Three advisories left unfixed — deliberately, all unreachable

• @hono/node-server path traversal in serve-static on Windows. The connector uses the express/stdio transports, never hono, never serves static files, and ships in a Linux container. npm's proposed fix downgrades @modelcontextprotocol/sdk to 1.24.3 — breaking the core dependency to patch a bundled framework we never invoke.
• esbuild dev-server file read on Windows — devDependency, absent from the production image (npm ci --omit=dev).

Verification

130 tests / typecheck / lint / build, plus a live check against a real Loomio instance — which is what actually exercises the undici upgrade, since the unit suite mocks undici. Bearer auth, paginated reads, probe-based list_groups, and get_user_activity aggregation all returned real data.

See CHANGELOG.md.