chore(deps): clear the high-severity advisories blocking audit:ci

[ndycode]

Summary

• npm run audit:ci — a CI gate — has been failing. This clears it.
• Two production dependencies and two transitive dev dependencies carried high-severity advisories.

What Changed

Production:

Package	From	To	Cleared
hono	4.12.21	4.12.33	GHSA-hvrm-45r6-mjfj (JSX context not isolated per request), GHSA-w62v-xxxg-mg59 (XSS via cx() escaping bypass) — both reach <=4.12.26
undici	6.25.0	6.28.0	GHSA-p88m-4jfj-68fv, GHSA-vxpw-j846-p89q, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m (Set-Cookie header injection, WebSocket fragment DoS, keep-alive response-queue poisoning, SameSite downgrade) — all reach <=6.26.0

hono is bumped in both dependencies and overrides; the override is what @openauthjs/openauth resolves through, and npm rejects the install if the two disagree.

undici deliberately stays on the 6.x line. 7.x raises the runtime floor to Node 20 and this package still publishes engines.node >=18.17.0 — 6.28.0 is the first 6.x release clear of all four advisories.

Dev-only, pinned via overrides in the style already used for rollup and minimatch, since both are transitive:

• brace-expansion → 5.0.9 (ReDoS in >=2.0.0 <2.1.3 and >=4.0.0 <5.0.8)
• postcss → 8.5.25 (<=8.5.17, reaching the dev graph through Vite)

SECURITY.md documents each pin's rationale and is machine-checked against package.json by test/documentation.test.ts — that test caught the drift, so the doc is updated in the same commit.

Validation

• npm run audit:ci → exits 0 (was exiting 1)
• npm audit --omit=dev --audit-level=high → found 0 vulnerabilities
• npm run lint
• npm run typecheck
• npm test — 5288 passed, 4 skipped, 0 failed
• npm run build
• npm test -- test/lockfile-version-floor.test.ts

Risk and Rollback

• Risk: low-to-moderate. undici is the only runtime HTTP dependency and backs the rotation proxy's dispatch path, so it is the one to watch; it stays within 6.x and the full suite passes. The other three are a patch bump and two dev-only pins.
• Rollback: revert the commit and reinstall. No code, config schema, or on-disk format changes.

Additional Notes

Worth knowing separately: this repo's GitHub Actions have never actually executed — ci.yml has zero runs and recent workflow runs sit queued for days — so audit:ci failing had never surfaced anywhere. The gate is only meaningful once Actions runs.

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

this pr updates production and development dependency pins to clear high-severity audit findings while preserving node 18 production support.

• bumps hono to 4.12.33 and undici to 6.28.0.
• overrides brace-expansion 5.0.9 and postcss 8.5.25 in the development graph.
• updates the lockfile and security rationale to match the new versions.

Confidence Score: 5/5

the pr appears safe to merge, with no concrete changed-code failure identified.

the runtime packages remain within compatible major versions, the development overrides resolve the current toolchain, and the lockfile and security documentation remain synchronized.

Important Files Changed

Filename	Overview
package.json	updates runtime dependencies and adds development-only security overrides; no concrete compatibility failure was found.
package-lock.json	resolves the requested secure versions consistently, including the documented node engine metadata.
SECURITY.md	keeps dependency-pin rationale synchronized with the manifest changes.

_{Reviews (1): Last reviewed commit: "chore(deps): clear the high-severity adv..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Build and Packaging

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 83d60492-0620-4ced-8210-f606017a5a09

📥 Commits

Reviewing files that changed from the base of the PR and between a2c0cea and 8f01870.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• SECURITY.md
• package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Greptile Review

🧰 Additional context used

📓 Path-based instructions (2)

**/*

📄 CodeRabbit inference engine (AGENTS.md)

Source changes belong in index.ts, lib/, and scripts/; dist/ is generated output and local temporary/cache directories must not be edited.

Files:

• package.json
• SECURITY.md

package.json

📄 CodeRabbit inference engine (README.md)

Keep npm install scripts side-effect-free; postinstall may only print a short notice and must not perform setup or updates.

package.json: Pin security-sensitive dependency overrides in package.json: hono at 4.12.33, rollup at ^4.59.0, brace-expansion at 5.0.9, and postcss at 8.5.25, maintaining the documented advisory coverage.
Pin the runtime undici dependency exactly to 6.28.0; update it only through an explicit deliberate bump, and retain Node 18 compatibility until the supported runtime floor changes.
Preserve the published runtime requirement of Node.js >=18.17.0; do not move to undici 7.x while Node 18 remains supported.

Files:

• package.json

🧠 Learnings (1)

📓 Common learnings

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Run `npm run audit:ci`, `npm run lint`, `npm run typecheck`, `npm test`, and `npm run build` before releases and after dependency changes.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Do not commit authentication files, logs, or cache artifacts.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Do not share `~/.codex/` directories because they may contain OAuth credentials and account metadata.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Enable debug or request-body logging only for short-lived troubleshooting sessions; treat `CODEX_PLUGIN_LOG_BODIES=1` output as sensitive.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Keep the OAuth flow PKCE-based and protect locally stored refresh tokens through lifecycle management and account-health isolation.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Keep the runtime rotation proxy loopback-only and authenticated with a local client key by default; support explicit opt-out via `codex-multi-auth rotation disable` or `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: For vulnerabilities, do not open a public issue; contact the maintainer privately and include the description, reproduction steps, impact assessment, and optional mitigation.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Coordinate security disclosure timing and prepare fixes before public disclosure; provide reporter attribution unless anonymity is requested.

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-08-02T09:55:41.802Z
Learning: Treat OpenAI outages, account or subscription limitations, expected upstream rate limiting, and requests to bypass OpenAI terms or controls as out of scope for repository vulnerability reports.

🔇 Additional comments (5)

package.json (3)

178-183: LGTM!

---

195-195: 🩺 Stability & Availability | ⚡ Quick win

verify the brace-expansion override on node 18.

package-lock.json:2145 records brace-expansion@5.0.9 with engines.node set to 20 || >=22, but package.json:156 publishes >=18.17.0. if a supported node 18 environment uses engine-strict, this override can make npm install fail before the audit and test commands run. verify the node 18 install path. otherwise, use a compatible dev-graph version or document node 20 as a development requirement.

as per coding guidelines, preserve the published node 18 compatibility requirement.

Source: Coding guidelines

---

196-196: LGTM!

SECURITY.md (2)

87-89: LGTM!

---

83-83: 📐 Maintainability & Code Quality

no action needed.

SECURITY.md:83 documents ^4.59.0, while lib/package.json:187 uses exact 4.59.0; this documents the intended minimum, not an override mismatch.

---

📝 Walkthrough

minor security maintenance. production dependencies hono and undici now clear high-severity advisories and retain node.js 18 compatibility. no data-loss, architectural, or concurrency risks are introduced; validation passes, but no dependency-specific regression tests or windows-specific coverage are reported.

• updates hono to 4.12.33 and undici to 6.28.0 in package.json.
• adds overrides for brace-expansion 5.0.9 and postcss 8.5.25 in package.json.
• documents the security pins and advisories in SECURITY.md.
• keeps the existing rollup pin unchanged.
• npm run audit:ci reports no production vulnerabilities.
• linting, typechecking, tests, build, and lockfile validation pass.
• no application code, configuration schema, or on-disk format changes are included.

Walkthrough

updated security-related dependency pins in package.json and documented the corresponding rationale in SECURITY.md.

Changes

dependency security updates

Layer / File(s)	Summary
update dependency pins and rationale package.json:178, package.json:194, SECURITY.md:82	updated hono and undici, added brace-expansion and postcss overrides, and documented the advisory coverage. no regression tests are included. windows edge cases and concurrency risks are not applicable to these manifest-only changes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• ndycode/codex-multi-auth#67: updates the hono dependency and override for security advisories.
• ndycode/codex-multi-auth#476: updates the same hono dependency and override.
• ndycode/codex-multi-auth#515: updates the same dependency, override, and SECURITY.md rationale.

Suggested labels: bug

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	the title uses the required conventional commit format, valid type, lowercase imperative summary, and stays within 72 characters.
Description check	✅ Passed	the description clearly covers the changes, validation, risk, rollback, and notes, but omits the template's docs and governance checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/security-bump-hono-undici

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/security-bump-hono-undici

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}