fix(knowledge-fs): update vulnerable transitive dependencies

knowledge-fs/.harness/changes/2026-08-04-backend-dependency-security-upgrades.md

@@ -0,0 +1,34 @@
+# Backend dependency security upgrades
+
+## What changed
+
+- Raised the workspace override for `fast-uri` from `3.1.4` to `3.1.5`.
+- Added a workspace override for `ip-address` at `10.3.1`.
+- Regenerated `pnpm-lock.yaml` so the `@modelcontextprotocol/sdk` dependency paths resolve the patched releases.
+- Extended the CI workflow regression test to keep both security overrides and lockfile resolutions pinned.
+
+## Why
+
+The production dependency audit began blocking on two high-severity advisories published against the previously locked transitive versions:
+
+- `GHSA-7p8r-x3mc-p8w7` affected `fast-uri` versions before `3.1.5` in the selected major line.
+- `GHSA-mwp4-54f8-5fhr` affected `ip-address` versions through `10.3.0`.
+
+Both patched versions remain within the dependency ranges declared by `ajv` and `express-rate-limit`, so the remediation does not require an MCP SDK or dependency-major upgrade.
+
+## Verification
+
+- Reproduced the failure with `pnpm security:dependencies`; both advisories were reported before the lock update.
+- `pnpm install --frozen-lockfile`: passed.
+- `pnpm security:dependencies`: passed with no high or critical backend production vulnerabilities.
+- `node --test scripts/github-actions-workflow.test.mjs`: passed, 16 tests.
+- `CI=1 pnpm check`: passed.
+- `CI=1 pnpm build`: passed.
+- `CI=1 pnpm lint:backend`: passed.
+- `pnpm exec biome check package.json scripts/github-actions-workflow.test.mjs`: passed.
+- `CI=1 pnpm lint`: remains blocked by 10 pre-existing repository-wide Admin formatting and oversized generated OpenAPI findings outside this dependency-only change.
+
+## Risks and follow-up
+
+- The overrides intentionally pin transitive dependencies until their direct parents advance their minimum versions. Dependabot and the security audit should continue to monitor them.
+- No application behavior or API contract changed.

knowledge-fs/package.json

@@ -4,7 +4,8 @@
   "packageManager": "pnpm@10.33.0",
   "pnpm": {
     "overrides": {
-      "fast-uri": "3.1.4",
+      "fast-uri": "3.1.5",
+      "ip-address": "10.3.1",
       "sharp": "0.35.3"
     }
   },

knowledge-fs/pnpm-lock.yaml

@@ -5,7 +5,8 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  fast-uri: 3.1.4
+  fast-uri: 3.1.5
+  ip-address: 10.3.1
   sharp: 0.35.3
 
 importers:
@@ -1647,8 +1648,8 @@ packages:
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
-  fast-uri@3.1.4:
-    resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==}
+  fast-uri@3.1.5:
+    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
 
   fast-xml-builder@1.2.0:
     resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==}
@@ -1735,8 +1736,8 @@ packages:
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
-  ip-address@10.2.0:
-    resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
+  ip-address@10.3.1:
+    resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==}
     engines: {node: '>= 12'}
 
   ipaddr.js@1.9.1:
@@ -2991,7 +2992,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.4
+      fast-uri: 3.1.5
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -3249,7 +3250,7 @@ snapshots:
   express-rate-limit@8.5.1(express@5.2.1):
     dependencies:
       express: 5.2.1
-      ip-address: 10.2.0
+      ip-address: 10.3.1
 
   express@5.2.1:
     dependencies:
@@ -3286,7 +3287,7 @@ snapshots:
 
   fast-deep-equal@3.1.3: {}
 
-  fast-uri@3.1.4: {}
+  fast-uri@3.1.5: {}
 
   fast-xml-builder@1.2.0:
     dependencies:
@@ -3392,7 +3393,7 @@ snapshots:
 
   inherits@2.0.4: {}
 
-  ip-address@10.2.0: {}
+  ip-address@10.3.1: {}
 
   ipaddr.js@1.9.1: {}
 

knowledge-fs/scripts/github-actions-workflow.test.mjs

@@ -144,10 +144,13 @@ test("root workflow runs explicit local security gates", () => {
 
 test("production dependency security fixes stay locked", () => {
   assert.equal(apiPackageJson.dependencies.sharp, "^0.35.3");
-  assert.equal(packageJson.pnpm.overrides["fast-uri"], "3.1.4");
+  assert.equal(packageJson.pnpm.overrides["fast-uri"], "3.1.5");
+  assert.equal(packageJson.pnpm.overrides["ip-address"], "10.3.1");
   assert.equal(packageJson.pnpm.overrides.sharp, "0.35.3");
-  assert.match(lockfile, /^ {2}fast-uri@3\.1\.4:$/m);
-  assert.doesNotMatch(lockfile, /^ {2}fast-uri@3\.1\.2:$/m);
+  assert.match(lockfile, /^ {2}fast-uri@3\.1\.5:$/m);
+  assert.doesNotMatch(lockfile, /^ {2}fast-uri@3\.1\.4:$/m);
+  assert.match(lockfile, /^ {2}ip-address@10\.3\.1:$/m);
+  assert.doesNotMatch(lockfile, /^ {2}ip-address@10\.2\.0:$/m);
   assert.match(lockfile, /^ {2}sharp@0\.35\.3:$/m);
   assert.doesNotMatch(lockfile, /^ {2}sharp@0\.34\.5:$/m);
 });