Node dependency backlog: 3 critical and 75 high known advisories on stabilisation #1048

Trivy on the node lockfile (2026-10-13, branch base stabilisation 907b300): 3 critical, 75 high, 61 medium, 9 low; almost all have a fix released.

Worst packages: @openzeppelin/contracts 3.4.1 (critical), fastify 4.29.1, node-forge 1.3.3, axios 1.11.0, @modelcontextprotocol/sdk 1.17.1, engine.io 6.6.4, brace-expansion 1.1.12, bigint-buffer 1.1.5 (no fix).

The security gate blocks only advisories a PR adds, so this backlog needs a dependency update PR of its own. Once it is clean, the gate can switch to blocking on any critical/high.

Also: testing/devnet/Dockerfile runs as root and pins :latest.

First pass done (2026-10-13, local branch chore/dependency-advisories from stabilisation, not pushed yet)

Trivy on bun.lock, before → after: critical 3 → 2, high 73 → 21, medium 60 → 21, low 8 → 5. Same-major bumps only.

• Direct: axios ^1.20.0, @modelcontextprotocol/sdk ^1.32.1, node-forge ^1.4.0, lodash ^4.18.1, typeorm ^0.3.31, express ^4.22.3 (needed to lift path-to-regexp 0.1.13).
• Transitive refresh within ranges: ws, engine.io, socket.io-parser, proxy-addr (the critical), form-data, fast-uri, minimatch, brace-expansion, picomatch, tar-fs, tmp, jsonpath, path-to-regexp, underscore.
• Overrides: @openzeppelin/contracts 3.4.2-solc-0.7 (one copy in the tree now), underscore 1.13.8.
• Verified: frozen install, type-check, per-file bun tests for l2ps-messaging, network handlers, l2ps libs and crypto all pass; two pre-existing failures on the base (rateLimiter test, zk proof-verifier needing Postgres) unchanged.

Still open, needs a decision: fastify 4 → 5 (and @fastify/swagger-ui with it), tar 6 → 7 (dev tooling only), toml 3 → 4 (via the anchor packages inside demosdk); no fix released for bigint-buffer, http-cache-semantics and one node-forge advisory. Trivy still counts the openzeppelin critical because it sorts the -solc-0.7 tag below 3.4.2.

Reviewer notes: express 4.22 raises the query-string item cap to 1000; the MCP SDK jump 1.17 → 1.32 is only import-checked (no tests cover src/features/mcp), worth a manual run.

2026-10-13, later: reviewed (no blockers) and pushed as node PR #1049 (base stabilisation). Rollout note in the PR: node-forge 1.4.0 rejects non-canonical ed25519 S scalars that 1.3.3 accepted, so validators should roll together. Postgres-backed migrations not run locally; CI or e2e should cover them before merge. Found in passing, pre-existing: the MCP server's SSE mode is broken on both old and new SDK (double writeHead; SSEServerTransport is deprecated), to track separately.