[simulieren]

Why

Security update for the SDK and integration dependencies after #1.

Where	Package	From	To	Reason
java/	jackson-databind / jackson-core	2.17.2	2.22.4	16 GitHub advisories (7 high), all fixed in 2.22.3 or later
java/	junit-jupiter (test)	5.10.3	5.14.4	latest 5.x
dotnet/	System.Text.Json	8.0.5	8.0.6	latest 8.0 patch
dotnet/	xunit (test)	2.9.2	2.9.3	patch
n8n/	n8n-workflow (dev, types only)	^1.82.0	^2.46.0	form-data, lodash, uuid advisories
js/, zapier/	lockfile refresh			in-range updates

Important

n8n-workflow is a dev dependency used for types only, and the peer range stays *. At runtime the node uses the n8n-workflow of the n8n install. The npm latest tag still points to 2.16.0 from April, and n8n publishes current releases under stable. The node builds and its tests pass against 2.46.

Still open

Warning

• Zapier: zapier-platform-cli and zapier-platform-core 19.2.1 carry 52 advisories (3 critical: tar, simple-git), almost all through the CLI's dev tooling. The fix is 19.3.0, released 2026-10-30. The local npm config has min-release-age=7, so it can be installed from 2026-11-06.
• n8n: 3 high findings remain (zod through @n8n/expression-runtime). They are fixed only in the 2.47.0 beta.
• js: 3 moderate findings (minimatch < 11 through openapi-typescript > @redocly/openapi-core). openapi-typescript 7.13.0 is the latest version. It only reads our own openapi.json at codegen time.

Python (uv lock --upgrade, pip-audit) and PHP (composer audit on a fresh resolve) have no findings, so nothing changed there.

Checks

java     mvn verify on Java 11 and 21 (Docker)      pass
dotnet   dotnet test, 14 passed; list --vulnerable  none
php      phpunit 13 tests; composer audit           none
js       typecheck, 21 tests, build                 pass
n8n      build + 3 tests                            pass
zapier   6 tests                                    pass

Spec sync

Commit bf18d2f syncs openapi.json and js/src/schema.ts with the live API, which gained additional_code on import duties (simulieren/hscode-sveltekit#113). Without it the spec-drift job fails.