chore(deps): clear all 35 HIGH Dependabot alerts; drop Node 18 CI lane

[naji247]

Clears every open HIGH-severity Dependabot alert (35 total) in one pass. No source, config, or behavior changes — lockfile/manifest updates, one CI matrix edit, and the removal of a stale npm lockfile. All verification (frozen-lockfile install, builds, typecheck, lint, 174/174 tests, both example apps, extension) passes from a clean state with pnpm 10.

Advisories cleared

Via pnpm-lock.yaml (29 alerts):

Package	Locked before → after	Alerts	Max patched
next	15.5.12 → 15.5.23	#43 #54 #55 #56 #58 #59 #61 #66 #97 #101 #103	15.5.21
fast-uri	3.1.0 → 3.1.5	#91 #92 #108 #118 #119	3.1.5
vite	6.4.1 → 6.4.3 (examples); vitest chain now resolves 7.3.6 (new — see note)	#33 #78	6.4.3
hono	4.12.3 → 4.13.1	#17 #83	4.12.25
postcss	→ 8.5.26 (override)	#95 #96	8.5.18
ws	8.19.0 → 8.21.3	#75	8.21.0
rollup	4.57.1 → 4.62.4	#16	4.59.0
@hono/node-server	1.19.9 → 2.1.0	#20	1.19.10
express-rate-limit	8.2.1 → 8.6.2	#21	8.2.2
path-to-regexp	8.3.0 → 8.4.2	#30	8.4.0
sharp	→ 0.35.3 (override)	#93	0.35.0
ip-address	→ 10.5.0 (override)	#107	10.3.1

Most land via in-range pnpm update; hono, @hono/node-server, express-rate-limit, fast-uri, and path-to-regexp arrive through @modelcontextprotocol/sdk 1.27.1 → 1.30.0. The @hono/node-server 1.x → 2.1.0 jump is in-range per the SDK's own dependency spec (^1.19.9 || ^2.0.5).

Note on vite 7: the base lockfile had no vite 7 at all — vitest's chain sat on vite 6.4.1. This branch introduces vite 7.3.6 into the resolution (in-range per vitest's peer spec); the full verification suite passes on it.

Via package-lock.json deletion (6 alerts): vite #6 #7 #14, ws #13, postcss #104 #105.

An audit script checked all 35 alerts against the tree: every locked version of each flagged package ≥ its advisory's patched version — 35/35 pass, 0 failures.

Why delete package-lock.json

This repo is a pnpm workspace (pnpm-lock.yaml is the real lockfile). The package-lock.json at the root was a stale npm artifact (3,672 lines) that nothing installs from, but Dependabot scans it as a second manifest and double-reports the same vulnerable packages (its 6 alerts are duplicates of pnpm-lock ones). Deleting it removes the false surface permanently.

Why pnpm.overrides

Three packages could not reach patched versions in-range because upstreams pin them exactly or cap them below the fix:

• ip-address: ">=10.3.1" — express-rate-limit exact-pins 10.1.0 → locked 10.5.0
• postcss: ">=8.5.18" — next exact-pins 8.4.31 → locked 8.5.26
• sharp: ">=0.35.0" — next caps at ^0.34.x → locked 0.35.3

These are minimum-version floors, not pins — they can be dropped once upstreams update.

Node 18 CI lane removed

.github/workflows/ci.yml matrix goes [18, 20, 22] → [20, 22]. Node 18 is EOL (April 2025), and the vite ≥7.3.5 in the resolution chain requires Node ≥20.19. This affects dev tooling only — the published packages' runtime support is unchanged.

Follow-up required: webmcp-server publish

packages/webmcp-server/package.json bumps ws ^8.18.0 → ^8.21.0, but that package sits outside the pnpm workspace and has no lockfile here. Consumers only get the fix after maintainers run npm publish for webmcp-server — please treat that as a follow-up to merging this PR.

Supersedes Dependabot PR #45

This PR covers everything #45 addressed (and more); #45 can be closed after this merges.

Expected manifest churn (disclosed)

The plan's bare pnpm update step raised range floors across 5 manifests (root, extension/, examples/nextjs, examples/playground, examples/native-harness) — devDependencies (e.g. typescript ^5.9.3) and runtime dependencies in the private packages: next/react/zod in the examples, @modelcontextprotocol/sdk and ws in the extension. Those packages are all private and never publish, so the raised runtime floors are harmless. The one floor that touched a published surface — root zod-to-json-schema (webmcp-react's only runtime dependency), which the update had raised ^3.24.1 → ^3.25.2 — has been reverted to ^3.24.1; the locked resolution (3.25.2) is unchanged, so npm consumers see no range change. This is pnpm's default manifest rewriting on update, not extra scope creep; the locked versions were already compatible. One over-bump (@biomejs/biome 2.4.2 → 2.5.8, which breaks on schema mismatch) was caught and reverted to the exact pre-existing state — biome.json and src/ have zero diff.

Pre-existing build warnings (unaffected by this PR)

Both appear identically before and after this change:

1. next build (examples/nextjs) — webpack "Critical dependency: Accessing import.meta directly" from src/utils/warn.ts.
2. vite build (examples/playground) — chunk-size warning for a >500 kB bundle.

Maintainer heads-up: husky pre-commit vs pnpm 11

.husky/pre-commit runs bare pnpm lint-staged. Under a global pnpm 11, that aborts: pnpm 11 rejects/ignores the pnpm field in package.json (including the new overrides), attempts a modules purge, and dies on no-TTY. Not fixed in this PR — flagging it as a future migration item (CI does not run the hook; lint was run manually via pnpm 10 and passes).

Verification (clean state, npx -y pnpm@10, pnpm 10.34.5)

Command	Result
install --frozen-lockfile	PASS
build (tsup)	PASS
typecheck (tsc --noEmit)	PASS
lint (biome check .)	PASS
test (vitest run)	PASS — 174/174
extension build + typecheck	PASS
examples/nextjs build	PASS
examples/playground build	PASS