security: close all 18 open Dependabot alerts

[htilly]

Summary

Closes every currently-open Dependabot security alert (18 total) by bumping the actual vulnerable transitive packages via overrides, plus picks up the routine bumps from the still-open dependency PRs.

Security fixes

• axios ^1.17.0 → ^1.18.1 (override): closes 10 alerts (Bump node from 22.9-slim to 23.1-slim #109, Bump mocha from 10.8.1 to 10.8.2 #111–Bump node from 23.4-slim to 23.5-slim #119)
• undici ^7.28.0 → ^7.29.0 (override): closes 5 alerts (Bump node from 23.7-slim to 23.8-slim #124–Bump @slack/web-api from 7.8.0 to 7.9.1 #128)
• js-yaml: new ^4.3.1 override (mocha pins ^4.1.0, so it never self-updates): closes 2 alerts (Bump chai from 5.1.1 to 5.1.2 #108, Bump node from 23.5-slim to 23.6-slim #120). This goes one patch past what PR chore(deps-dev): bump js-yaml from 4.1.1 to 4.3.0 #304 proposed (4.3.0) — GHSA-5p4m-2wfm-xmqj landed after that PR was opened and isn't fixed until 4.3.1.
• brace-expansion 2.1.1→2.1.4, 5.0.6→5.0.9 (npm update, already permitted by existing minimatch ranges, no override needed): closes Bump mocha from 10.7.3 to 10.8.1 #110 plus two more advisories npm audit flagged that Dependabot hadn't opened a PR for yet (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895).

Also included

Routine bumps from the remaining open Dependabot PRs, superseded by this branch:

• @sefinek/google-tts-api → 2.1.15 (chore(deps): bump @sefinek/google-tts-api from 2.1.13 to 2.1.15 #301)
• @slack/web-api → 7.17.0 (chore(deps): bump @slack/web-api from 7.19.0 to 8.0.0 #296)
• openai → 6.46.0 (chore(deps): bump openai from 6.49.0 to 7.4.0 #300)
• posthog-node → 5.41.0 (chore(deps): bump posthog-node from 5.36.3 to 5.41.0 #299)
• soundcraft-ui-connection → 6.0.4 (chore(deps): bump soundcraft-ui-connection from 6.0.3 to 6.0.4 #292)

Once this merges, Dependabot should auto-close #292, #296, #299, #300, #301, #304, #306 as superseded — worth a manual check if it doesn't.

Out of scope

ip SSRF via sonos (GHSA-2p57-rm9w-gvfp) has no upstream fix (first_patched_version: null) and was already reviewed/dismissed on Dependabot in 2024. npm audit will still show this one after merge.

Testing

• npm audit: down to just the one unfixable ip/sonos finding above
• npm test: 666/666 passing (one unrelated auth-handler.test.mjs timing flake seen once during a background run — confirmed pre-existing on unmodified master too, not caused by this change)

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Pull request overview

This PR aims to close all currently open Dependabot security alerts by updating vulnerable transitive dependencies via npm overrides, while also rolling up routine dependency bumps already proposed in other Dependabot PRs.

Changes:

• Bumped several direct dependencies (e.g., @slack/web-api, openai, posthog-node, soundcraft-ui-connection, @sefinek/google-tts-api).
• Added/updated overrides for vulnerable transitive packages (axios, undici, js-yaml) and refreshed the lockfile to pick up patched transitive versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates direct dependency versions and adds/adjusts overrides to force patched transitive dependency versions.
package-lock.json	Updates the resolved dependency tree to reflect the new direct deps and override-enforced transitive versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.