Patch 20 transitive advisories to zero

[flyingrobots]

Summary

GitHub reported 20 open Dependabot alerts on main — 7 high, 11 moderate, 2 low — across eight packages. This closes all of them with a lockfile-only change: no package.json edit, so no semver range moves and no breaking upgrade.

npm audit reports 0 vulnerabilities of any severity afterwards.

Where they came from

None are direct dependencies of jedit. Every one arrives through a single door — @modelcontextprotocol/sdk, which pulls in express, ajv, express-rate-limit and a Hono HTTP server:

package	severity	via
fast-uri	high ×6	sdk → ajv
ip-address	high, moderate ×2	sdk → express-rate-limit
hono	moderate ×3, low	sdk → @hono/node-server
@hono/node-server	moderate	sdk
undici	moderate ×3	sdk
qs, body-parser	moderate ×2, low	sdk → express

Worth noting #294 bumped hono 4.12.23 → 4.12.31, but the advisories require 4.12.34 — so it closed none of them.

Follow-up worth discussing (not done here)

@modelcontextprotocol/sdk is declared in jedit's dependencies but imported nowhere — no source import, no dist reference, no dynamic import, no script. Dropping the direct declaration would be correct hygiene.

It would not reduce attack surface, though: @flyingrobots/graft@0.11.1 depends on @modelcontextprotocol/sdk@^1.29.0, so the whole HTTP-server tree arrives through graft either way. Genuinely shrinking the surface for a terminal editor means addressing it in graft. Flagging rather than acting.

Verification

npm run check — 808 tests, 796 pass, 0 fail, quality regressions none.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: ef1790c4-9878-4056-a062-e8c4afd866c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T22:48:12.610457Z	58bfa34	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.