fix(deps): remediate dependency security vulnerabilities (165→44, 4 critical→0)

[Marfuen]

Summary

Remediates dependency security vulnerabilities across the monorepo. Reduces bun audit findings from 165 (4 critical / 58 high) to 44 (0 critical / 17 high) — every finding that is safely fixable is fixed; the rest are documented residuals (multi-major breakage risk or no upstream fix).

bun.lock was regenerated with bun install (no hand-editing).

Severity	Before	After
🔴 Critical	4	0
🟠 High	58	17
🟡 Moderate	84	19
⚪ Low	19	8
Total	165	44

What changed

Direct bumps (the vulnerable instance was the direct dep):

Package	From → To	Why
better-auth	1.4.22 → ^1.6.13	CVE-2026-53512 (CVSS 9.1) OAuth refresh-token replay; mcp()/oidcProvider plugin is enabled in apps/api
next	^16.2.0 → ^16.2.6	middleware/proxy bypass (auth-bypass), SSRF, DoS
axios	^1.9.0/^1.12.2 → ^1.16.0	proxy-auth credential leak, prototype-pollution MitM
vitest	^3.2.4 → ^3.2.6	UI-server file read (dev)
vite	^6.3.5 → ^6.4.3	server.fs.deny bypass
turbo	^2.9.6 → ^2.10.5	—

Root overrides for transitive vulns (backcompat-safe versions only): axios, vitest/@vitest/{coverage-v8,ui}, form-data, ws, semver, hono, @hono/node-server, multer, systeminformation, tmp, dompurify, ip-address, postcss, prismjs, qs, effect, protobufjs, linkify-it, mermaid, shell-quote, vite.

Verified fixes (independently confirmed — CVE, CVSS, EPSS, reachability)

Package	CVE	Sev	CVSS	EPSS	Fixed at	Scope / reachability
better-auth	CVE-2026-53512	🔴 crit	9.1	n/a	1.6.13	prod — mcp/oidcProvider live with confidential client (auth.server.ts:560)
form-data	CVE-2025-7783	🔴 crit	9.4	1.7%	4.0.6	crit hits dev-only 2.3.3; prod 4.0.5 was high-CRLF only
shell-quote	CVE-2026-9277	🔴 crit	9.2	0.8%	1.8.4	dev-only (concurrently)
vitest	CVE-2026-47429	🔴 crit	9.8	n/a	3.2.6	dev-only (UI server); @vitest/ui was the straggler
next	CVE-2026-44578 (+3)	🟠 high	8.6	38.8%	16.2.6	prod — self-hosted standalone, middleware auth gate
axios	CVE-2026-44494	🟠 high	8.7	1.0%	1.16.0	transitive-prod (firecrawl, fleetctl); direct already clean
systeminformation	CVE-2026-26318	🟠 high	8.8	1.2%	5.31.6+	transitive (host-metrics); needs 5.31.6+ (not 5.30.8)
multer	CVE-2026-5079	🟠 high	7.5	0.3%	2.2.0	prod — 5 auth-gated upload endpoints
ws	CVE-2026-48779	🟠 high	7.5	0.8%	8.21.0	transitive, outbound-only
hono	CVE-2026-54290	🟠 high	7.1	0.3%	4.12.25	not reachable (no first-party import)
protobufjs	CVE-2026-48712	🟠 high	7.5	0.3%	7.6.1	transitive telemetry
dompurify	CVE-2026-47423	🟠 high	8.2	n/a	3.4.7+	transitive; sanitizes internal markup

Residuals (intentionally NOT changed — 44 findings remain)

All are transitive dev/build-chain (DoS/ReDoS, low real-world risk) or cannot be forced without breaking a runtime consumer:

• undici (high) — discord.js/@discordjs/rest pin undici@6 and use its internals; forcing v7 would break them. Affected 7.25.0 is via @vercel/sandbox (not imported); no SOCKS5 usage.
• tar (high) — vulnerable copies are 2.2.2/6.2.1 in dev/build chains (electron-builder, node-gyp); forcing v7 breaks v2/v6 API consumers.
• minimatch, brace-expansion, semver@5, uuid, tough-cookie, cookie, js-yaml — multi-major; only an old-major copy is vulnerable and forcing a single version would downgrade/break other-major consumers.
• markdown-it, @babel/core — no fixed version published upstream yet.
• request — deprecated/EOL, no fix; dev-only.
• langsmith, sigstore/@sigstore/*, @opentelemetry/core, esbuild, @ai-sdk/provider-utils — dev/build-chain or need a coordinated upstream bump.

Verification

• ✅ All production/source code typechecks clean across every workspace (turbo typecheck). framework-editor errors were stale @trycompai/ui dist — cleared after rebuild.
• ✅ @trycompai/app completes a full Next.js production build with the new deps.
• ⚠️ The 41 remaining typecheck errors are pre-existing .spec.ts test debt on main — proven: this PR changes 0 source files and 0 test files (only 9 package.json + bun.lock), and the deps behind those errors (jest, @types/node, trigger.dev) are byte-identical to main.

Test plan

• CI typecheck / build
• Smoke-test auth flows (login, OAuth, hosted MCP) given the better-auth 1.4→1.6 bump
• Confirm discord.js notifications still work (undici left at v6 deliberately)

🤖 Generated with Claude Code

---

Summary by cubic

Reduces security findings by upgrading dependencies and adding safe root overrides across the monorepo. bun audit goes from 165 (4 critical / 58 high) to 44 (0 critical / 17 high).

• Dependencies

  • Direct bumps: better-auth ^1.6.13, next ^16.2.6, axios ^1.16.0, vitest ^3.2.6, vite ^6.4.3, turbo ^2.10.5.
  • Root overrides pull fixed versions, including vitest/@vitest/{coverage-v8,ui} ^3.2.7, systeminformation ^5.31.17, dompurify ^3.4.12, protobufjs ^7.6.3, mermaid ^11.15.0, plus form-data, ws, multer, shell-quote, vite, and more.
  • undici@6 left as-is to avoid breaking discord.js consumers.
  • Regenerated bun.lock via bun install; no source file changes.

• Migration

  • Run bun install and build as usual.
  • Smoke-test auth flows (due to better-auth 1.4→1.6).
  • Verify Discord notifications still function (intentional undici@6).

^{Written for commit 02f16e5. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Error		Jul 14, 2026 2:14pm
comp-framework-editor	Ready	Preview, Comment	Jul 14, 2026 2:14pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		Jul 14, 2026 2:14pm

[claudfuen]

🎉 This PR is included in version 3.102.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀