[bluetouff]

Scope

Fix the six open Dependabot alerts for devalue, plus six additional vulnerable dependency versions found by the full development/production audit. No audit exceptions, major-version upgrades, payment code, or application feature changes.

Package	Before	After
devalue	5.9.2	5.9.3
fast-uri	3.1.7	3.1.8
http-cache-semantics	4.2.0	4.3.0
sharp	0.35.4	0.35.5
smol-toml	1.7.1	1.9.0
source-map-js	1.2.1	1.2.2
@modelcontextprotocol/client (tests only)	2.0.0	2.2.0

Keep the production MCP server on its existing major version and stdio/read-only boundary. Update generated third-party notices and the exact pnpm overrides/lockfile.

Verification

• Pinned Node 22.23.2 and pnpm 10.34.5; frozen installation succeeded.
• Consumer-resolved regression tests cover all six devalue advisories for both Astro and Svelte. The original dependency failed 12 new cases; patched versions pass.
• Additional coverage: fast-uri encoded-host normalization for all three Ajv consumers, TOML key-scan bounds, indexed source-map offset amplification, wildcard Vary handling, and private/no-store remote-image cache expiry.
• Final targeted security regression suite: 32/32 passed.
• Source/type/lint checks, workspace and artifact tests, static production build, open-source checks, and artifact/secret security checks passed.
• Full dependency audit: zero reported vulnerabilities, without exclusions.
• Playwright: 125 passed, 3 expected skips. The initial all-in-one local command hit an already occupied preview port; the browser gate was executed successfully on an isolated free port.
• Independent read-only investigation and candidate review: no actionable residual bypass or regression.

Boundaries and limitations

This is a dependency/build release, not a claim that every advisory is reachable from public visitors. BLACKPROOF remains a static, local-first AGPL application with no document-upload server.

The http-cache-semantics advisory currently declares versions through 4.2.0 affected but names no patched version. Official 4.3.0 improves Vary handling; it does not rewrite the separately disputed max-stale behavior. Astro's actual consumer does not use that cache-reuse method or forward Set-Cookie, and private/no-store responses receive no reusable expiry. Do not describe this as a universal max-stale algorithm fix.

magicast contains a bundled legacy source-map implementation inside its build-time configuration transformer; a pnpm override cannot rewrite embedded code. Its path is not part of the served static application and no user upload reaches it. Active source-map-js package consumers resolve to 1.2.2.

Production must use the exact successful main-branch CI artifact with verified GitHub provenance, manifest and transfer checksums, followed by operator-run atomic activation and separate HTTPS verification.