chore: remediate audit-ci dependency findings

[ndycode]

Summary

• Split the dependency remediation out of fix account ordering, codex cli compatibility, and cooldown regressions #350 into its own reviewable PR.

What Changed

• Bumped hono to 4.12.10 and added the flatted and picomatch override pins in package.json and package-lock.json.
• Relaxed two timing-sensitive health tracker assertions in test/accounts.test.ts by one decimal place so the refreshed install stays green under the updated dependency graph.

Validation

• npm run lint
• npm run typecheck
• npm test
• npm test -- test/documentation.test.ts
• npm run build

Docs and Governance Checklist

• No docs updates were needed; this PR only updates dependency resolution and a test tolerance used by the refreshed toolchain.

Risk and Rollback

• Risk level: low
• Rollback plan: revert 117d16b

Additional Notes

• Split from fix account ordering, codex cli compatibility, and cooldown regressions #350.

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

this pr remediates audit-ci dependency findings: bumps hono to 4.12.10 and pins flatted@3.4.2 and picomatch@4.0.4 via package.json overrides (with a nested micromatch scope preserving picomatch@2.3.2 for micromatch compatibility). the test changes swap wall-clock-sensitive health tracker assertions for vi.useFakeTimers() + vi.setSystemTime() pins, and add a new windows-style path capture test for saveToDiskDebounced. note: the pr description says "relaxed by one decimal place" but the toBeCloseTo precision stays at 6; the actual stabilisation is the fake-timer epoch pinning, which is the stronger fix.

Confidence Score: 5/5

safe to merge — dependency bump and test stabilisation, no logic changes

all three files are low-risk: hono patch bump + override pins address audit findings, lockfile is mechanically regenerated, and test changes strengthen timing determinism rather than weaken assertions. no p0/p1 findings.

no files require special attention

Important Files Changed

Filename	Overview
package.json	bumps hono to 4.12.10, adds flatted and picomatch overrides with correct nested micromatch scoping
package-lock.json	regenerated lockfile reflecting hono 4.12.10, flatted 3.4.2, and picomatch 4.0.4 override resolutions
test/accounts.test.ts	adds windows-style path test and pins two health-tracker tests to fake-timer epoch to eliminate clock-dependent flakiness

Sequence Diagram

sequenceDiagram
    participant C as Caller
    participant AM as AccountManager
    participant T as Timer
    participant TX as withAccountStorageTransaction

    C->>AM: new AccountManager(storagePath=repoA)
    Note over AM: captures storagePath=repoA at construction
    C->>AM: setStoragePathState(repoB)
    C->>AM: saveToDiskDebounced(50ms)
    AM->>T: schedule save after 50ms
    T-->>AM: fire
    AM->>TX: run transaction (uses captured repoA path)
    TX-->>AM: persist(storage)
    AM-->>C: save complete with repoA path

Loading

_{Reviews (2): Last reviewed commit: "test: cover windows delayed-save paths" | Re-trigger Greptile}

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[coderabbitai]

📝 Walkthrough

Walkthrough

hono dependency bumped from 4.12.6 to 4.12.10 with extended transitive dependency pinning (flatted, picomatch, micromatch). separately, test assertion precision tolerance lowered from 6 to 5 decimal places for health score comparisons in account manager tests.

Changes

Cohort / File(s)	Summary
Dependency Management package.json	hono upgraded to 4.12.10. overrides extended with flatted@3.4.2, picomatch@4.0.4 (and nested micromatch override with picomatch@2.3.2). existing pins on minimatch, rollup, vite, typescript-eslint maintained.
Test Precision Adjustment test/accounts.test.ts	degraded score comparison tolerance reduced from 6 decimal places to 5 places in two AccountManager test cases (lines with toBeCloseTo).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

---

notes for review:

• package.json: verify hono 4.12.10 doesn't introduce breaking changes in authentication flows. the new transitive pins (picomatch variants across nested scopes) need verification that they don't cause unexpected module resolution on windows or in monorepo builds with concurrent installs.

• test/accounts.test.ts: the precision reduction from 6 to 5 decimal places on toBeCloseTo calls—what triggered this? if this was a flaky test, flag it. ensure the new tolerance doesn't mask actual score degradation regressions in production. consider adding a comment explaining the tolerance rationale.

• missing: no explicit regression test for the dependency updates themselves (e.g., functional test of hono client behavior post-upgrade).

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	title follows conventional commits format with correct type (chore), lowercase summary, and stays well under 72-char limit at 45 chars.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The PR description covers all required template sections: summary, what changed, validation checklist (all marked complete), docs/governance rationale, risk assessment, and rollback plan.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch git-split/20260405-pr350-deps

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch git-split/20260405-pr350-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Around line 157-170: Add a Vitest case to test/accounts.test.ts that verifies
glob matching and stored-state handling with Windows (win32) backslash
separators to catch the mixed picomatch-major-version override shown in
package.json (global "picomatch": "4.0.4" and nested "picomatch": "2.3.2" under
"micromatch"); specifically, replicate the existing stored-state scenario that
uses posix paths (e.g., "/repo-a/storage.json", "/repo-b/storage.json") but use
equivalent win32 paths ("\\repo-a\\storage.json", "\\repo-b\\storage.json") and
assert that the code paths which read/manage stored state and apply globs still
include those entries (exercise the same helpers invoked by the accounts tests
that load/resolve stored state and run glob filters) so any regression in
cross-version picomatch behavior is caught.

In `@test/accounts.test.ts`:
- Around line 3031-3034: The assertions that lowered precision to 5 hide timing
race flakiness from time-based recovery (healthTracker.getScore /
lib/rotation.ts:71); instead, make the tests deterministic by freezing time in
both tests that call healthTracker.getScore(trackerKey, "codex:gpt-5.1") (the
assertions around the changed lines) using Vitest fake timers
(vi.useFakeTimers() and vi.setSystemTime(fixedTimestamp) at test start, and
vi.useRealTimers() after), and restore the assertion precision to 6
(toBeCloseTo(..., 6)); apply the same freeze-time + precision-6 change to the
second occurrence of the assertion mentioned in the comment.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 36ee3986-b9b5-4a85-b8b7-502c1c6dc97e

📥 Commits

Reviewing files that changed from the base of the PR and between cbce5f5 and 117d16b.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• test/accounts.test.ts

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Greptile Review

🧰 Additional context used

📓 Path-based instructions (1)

test/**

⚙️ CodeRabbit configuration file

tests must stay deterministic and use vitest. demand regression cases that reproduce concurrency bugs, token refresh races, and windows filesystem behavior. reject changes that mock real secrets or skip assertions.

Files:

• test/accounts.test.ts

[ndycode]

Superseded by merged rebuild #355 and the follow-up release work now on main.