chore(security): patch 32 Dependabot alerts - #1988

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

32 fixed, 0 ignored, 50 deferred, 7 resolutions added, 0 resolutions removed, 6 could-not-auto-fix. | label: 🔒 security applied

Fixed

Ignored

None this run.

Deferred

Alerts opened less than 7 days ago, deferred to the next run:

#578, #579, #580, #581, #582, #584, #585, #586, #588, #589, #590, #591, #592, #593, #594, #595, #596, #597, #598, #599, #600, #602, #603, #604, #605, #606, #607, #608, #609, #610, #611, #612, #613, #614, #615, #616, #617, #618, #619, #620, #621, #622, #623, #624, #625, #626, #627, #628, #629, #630

Resolutions added

Resolutions updated in place (not new): **/express-rate-limit/ip-address ^10.3.1 → ^10.7.1; axios ^1.18.0 → ^1.20.0; **/@actions/http-client/undici ^6.28.0 → ^6.28.1; **/node-gyp/undici ^6.28.0 → ^6.28.1; **/@semantic-release/github/undici ^7.29.0 → ^7.29.1; **/@oclif/core/minimatch/brace-expansion ^2.1.4 → ^2.1.7; **/filelist/minimatch/brace-expansion ^2.1.4 → ^2.1.7; **/@fastify/ajv-compiler/fast-uri ^3.1.6 → ^3.1.8 (workflow-executor docker); **/fast-json-stringify/fast-uri ^3.1.6 → ^3.1.8 (workflow-executor docker); **/ajv/fast-uri ^3.1.6 → ^3.1.8 (workflow-executor docker).

Resolutions removed

None this run — a redundancy sweep was out of scope for this patch batch (every existing pin was verified still-present in the resolved tree, none stale).

Could not auto-fix

Common blocker: Bumping sanitize-html from 2.17.5 → 2.17.7 (first attempt) and 2.17.6 (second attempt) both fail CI: both patched versions declare htmlparser2@^12.0.0, which is a pure-ESM package (type: module) and Jest (CommonJS) chokes on import { Parser } from "./Parser.js". Fix requires either (a) adding transformIgnorePatterns + ESM Jest wiring to every workspace that transitively imports sanitize-html (goes beyond "minor test adjustments tied to a specific bump"), or (b) overriding htmlparser2 back to ^10.1.0 via a resolution — but sanitize-html 2.17.6+ was written against the 12.x API, so this could silently misbehave at runtime. Leaving at 2.17.5 pending a human decision.

Risks

Per bump, from upstream CHANGELOGs:

• axios 1.19 → 1.20 — exclusively security + bug fixes; no breaking API changes. Our usage in forest-cloud is simple HTTP posts; low risk.
• ip-address 10.5.0 → 10.7.3 — stricter classifier semantics for IPv6 link-local, NAT64, and cross-family subnet comparisons. Code that previously treated non-link-local addresses as link-local (incorrectly) will now classify them correctly — this is a behavior fix, not a regression. datasource-sql's use via socks only touches hostname resolution, not these classifier methods.
• undici 6.28.0 → 6.29.0 / 7.29.0 → 7.30.0 — adds TLS cert validation back into BalancedPool and fixes Set-Cookie leakage. Transitive via node-gyp, @actions/http-client, @semantic-release/github; no direct usage in our code.
• @nestjs/platform-fastify 11.1.28 → 11.2.7 — adds middleware path-scoping security fix. Nest is a devDep in agent (tests only) and a regular dep in private _example; not shipped.
• moment 2.29.4 → 2.31.0 — stricter locale name validation. Our only usage is via sequelize's date formatting; no locale paths are user-controlled.
• brace-expansion — pure DoS fixes (quadratic/recursive). All usages are transitive via minimatch under eslint, jest, lerna, nx, @oclif/core, @redocly/openapi-core, etc. Low risk.
• markdown-it 14.3.0 → 14.3.2 — linkify quadratic DoS fix. Only used by dev-dep typedoc on our own source code — never user-controlled markdown.
• fast-uri 3.1.6 → 3.1.8 (workflow-executor docker) — host-case normalization fix for percent-encoded octets. Transitive via fastify's ajv/fast-json-stringify chain; no direct consumer in our code.

Manual testing

Covered by CI (unit + integration suites per workspace, Docker build smoke tests under packages/*/docker/smoke-test.sh). The two regenerated docker lockfiles will be re-exercised by the Docker build steps with --frozen-lockfile.

Pre-push lint note: yarn eslint packages/workflow-executor/docker/build-deps-manifest.js reports 10 pre-existing errors (@typescript-eslint/no-var-requires, no-continue, padding-line-between-statements, no-use-before-define) that are not in lines I touched. Scope rule says leave pre-existing issues alone. Prettier passed on all changed files.

Validation

✅ CI green (Actions + commit statuses; app-based checks not monitored)