fix(deps): remediate dependency security vulnerabilities (165→16, 4 critical→0)

[Marfuen]

Summary

Comprehensive dependency-security remediation. Reduces bun audit from 165 findings (4 critical / 58 high) → 16 (0 critical / 10 high / 3 moderate / 3 low). Clean single commit off main; all changes stay within declared version ranges and bun.lock is a clean regeneration.

Supersedes #3403 (that branch had the same first phase plus a merge commit; this PR is rebased clean off main and includes the further mitigation). #3403 can be closed.

Severity	Before	After
🔴 Critical	4	0
🟠 High	58	10
🟡 Moderate	84	3
⚪ Low	19	3
Total	165	16

What changed

Direct bumps (the vulnerable instance was the direct dep):

Package	→	Why
better-auth	1.4.22 → ^1.6.13	CVE-2026-53512 (CVSS 9.1) OAuth refresh-token replay; mcp()/oidcProvider is enabled in apps/api
next	→ ^16.2.6	App Router middleware/proxy bypass, SSRF, DoS
axios	→ ^1.16.0	Proxy-Authorization credential leak, prototype pollution
vitest / vite / turbo	in-major	UI-server file read (dev) / fs.deny bypass / —

Dead-dep removal (unused, referenced by no script):

• gitmoji → cascade-drops request, tough-cookie@2.5.0, tar@2.2.2, node-gyp@3
• semantic-release-discord + -notifier → drops discord.js/@discordjs/rest (pinned undici@6). The actual release→Discord notification is a separate webhook GitHub Action, no npm deps — untouched.

Parent bumps: @browserbasehq/stagehand → ^3.7.0 (drops langchain + langsmith), @nestjs/swagger → ^11.4.5 (patched js-yaml).

Overrides for transitive vulns (backcompat-safe): axios, form-data, ws, semver, hono, @hono/node-server, multer, systeminformation, tmp, dompurify, ip-address, postcss, prismjs, qs, effect, protobufjs, linkify-it, mermaid, shell-quote, vite, @opentelemetry/core, @sigstore/core, markdown-it, @babel/core — plus @tiptap/* → 3.22.1 (lockstep pin).

Lockfile regen floats remaining stale transitives to patched in-range: undici 6.27.0 + 7.28.0, js-yaml 3.15.0 + 4.3.0, brace-expansion, minimatch (non-bundled), @sigstore/verify 3.1.1.

undici is deliberately not force-overridden across majors — discord.js/@discordjs/rest used its v6 internals; removing them lets the regen float both majors to patched versions safely.

Verification

• ✅ turbo build — 20/20 tasks pass (caught + fixed a tiptap lockstep break from the regen)
• ✅ Typecheck — 0 production errors (remaining are pre-existing .spec.ts debt on main)
• ✅ apps/api/Dockerfile.multistage builds clean — fresh bun install (oven/bun:1.2.8) + package builds + nest build
• ✅ API image boots past module-load — better-auth 1.6 + Prisma load; container stops only at the expected SECRET_KEY env guard
• ✅ openapi.json not touched (no API endpoint files changed)

Remaining 16 (all dev/build-time or no upstream fix)

tar (electron-builder/giget/npm-bundled), minimatch (npm-bundled), esbuild (dev-server only), uuid (exceljs pins v8, no fix), sigstore (release CI), cookie (disjoint majors), @ai-sdk/provider-utils (low, via stagehand). None are prod-runtime-reachable with a safe fix available.

Follow-up

Tree-shaking (removing unused deps) will be its own PR — knip flags ~124 but it's noisy (confirmed false positives and negatives), so it needs a configured, build-verified pass.

Test plan

• CI build + typecheck
• Smoke-test auth flows (login, OAuth, hosted MCP) — better-auth 1.4→1.6
• Confirm the API Docker image deploys/boots with real env

🤖 Generated with Claude Code

---

Summary by cubic

Cuts bun audit findings from 165 (4 critical) to 16 (0 critical) by upgrading, pinning, and removing dependencies, and fixes a TS mismatch with better-auth 1.6 role statements in the app. No runtime changes; full build, typecheck, and API Docker image verified.

• Dependencies

  • Upgraded key deps: better-auth → ^1.6.23, axios → ^1.16.0; dev tooling (vite/vitest/turbo) to latest in-range; bumped @browserbasehq/stagehand → ^3.7.0 and @nestjs/swagger → ^11.4.5.
  • Removed unused gitmoji, semantic-release-discord, and semantic-release-discord-notifier (drops old undici@6 chain).
  • Added overrides to patch vulnerable transitives and pinned @tiptap/* to 3.22.1; regenerated bun.lock.
  • Result: 0 critical, 10 high, 3 moderate, 3 low; remaining issues are dev/build-time or awaiting upstream fixes.

• Bug Fixes

  • Made mergePermissions accept readonly arrays and cast role.statements accordingly to match better-auth 1.6 types, fixing Next build TypeScript errors.

^{Written for commit a068e84. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Jul 14, 2026 2:55pm
comp-framework-editor	Ready	Preview, Comment	Jul 14, 2026 2:55pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		Jul 14, 2026 2:55pm

[claudfuen]

🎉 This PR is included in version 3.102.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀