[peppescg]

Summary

Picks up the fix for CVE-2026-111497 (Google Brotli decoder 1.0.3–1.2.0, out-of-bounds write on a crafted br stream) everywhere it can be fixed inside this repository, and unblocks task studio:audit, which currently fails on every PR touching apps/.

The audit failure and the Brotli CVE are separate problems. pnpm audit only sees npm packages, so it cannot see Brotli in the Node runtime or libbrotli in the image. The audit went red on its own: the four fast-uri advisories were published on 2026-10-23 between 21:36 and 21:41 UTC. Running pnpm audit on main's unchanged lockfiles now reports 4 vulnerabilities in both apps/ and sdk/typescript/. Main's own pushes skip the Studio job when apps/ is untouched, so only PRs show it.

Four commits:

1. fix(deps): update fast-uri to 3.1.9. fast-uri 3.1.8 reaches the SDK and the Studio BFF through ajv. It matches GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, and GHSA-333x-w4r6-6crp. This is why Renovate chore(deps): update node.js to 88c4f6e - autoclosed #2498 and chore(deps): update javascript dependencies #2499 are red. Only lockfile entries change.
2. chore(studio): refresh vulnerable transitive dev dependencies. Studio's full audit (dev dependencies included, which the CI gate does not cover) also flagged undici, source-map-js, and the router plugin's zod. These move within their existing ranges, with no package.json changes.
3. fix(deps): pick up the Brotli decoder fix. New Chainguard Node digests for Studio and the slack-bot example, Bun 1.4.4 in CI and the SDK release, and Node 24.22.1 for the SDK release build and publish jobs.
4. chore(slack-bot): update proxy-addr and body-parser. The published slack-bot image ships @slack/bolt's express closure: proxy-addr 2.0.8 (GHSA-jqcg-44mw-7w3h, critical) and body-parser 2.4.0 (GHSA-27r3-jxmh-p828, high), both within their existing ranges. No CI job audits the example.

Before | After

Where	Before	After
Studio runtime (apps/Dockerfile)	chainguard/node@13c04f76…: Node 26.12.0, libbrotlidec 1.2.0-r6	@88c4f6e6…: Node 26.12.1, libbrotlidec 1.2.1-r1
slack-bot runtime / builder	@13c04f76… / latest-dev@85a6741a…: libbrotlidec 1.2.0-r6	@88c4f6e6… / latest-dev@13afe2c0…: libbrotlidec 1.2.1-r1
Bun (ci.yml, release-sdk-typescript.yml)	1.4.2	1.4.4 (bundles Brotli 1.2.1)
SDK release build Node	24.7.0	24.22.1
SDK release publish Node / bundled npm	24.18.1 / 11.16.0	24.22.1 / 11.19.1 (still above npm stage's 11.15.0 floor)
fast-uri (Studio, SDK)	3.1.8, 4 advisories, studio:audit red	3.1.9, studio:audit and sdk:audit clean
Studio dev closure	undici 8.11.0, source-map-js 1.2.1, zod 4.6.5	undici 8.12.3, source-map-js 1.2.2, zod 4.6.7
slack-bot production closure	proxy-addr 2.0.7 (critical), body-parser 2.3.0 (high): 15 advisories	proxy-addr 2.0.8, body-parser 2.4.0: 13 advisories (undici, see below)

I read every image digest's package list with crane export; both new Chainguard digests are multi-arch indexes and ship libbrotlidec 1.2.1-r1 and Node 26.12.1 on amd64 and arm64. The Studio build stage (node:26-slim) was already on 26.12.1 on main. The npm 11.17–11.19.1 release notes do not touch npm stage.

Supersedes Renovate #2498. It also covers the slack-bot Chainguard part of #2501, but not #2501's brood-box digest (see below). Renovate's Bun bump in #2499 (1.4.3) predates the fix.

Not fixed here

• brood-box base (build/execution-workload/Dockerfile, mecatui in .ko.yaml, microVM release). Every published ghcr.io/stacklok/brood-box/base digest, including today's latest (dcc40097…, built 2026-10-21 12:08 UTC), ships libbrotlidec 1.2.0-r6 and Node 26.12.0, plus curl and python. Wolfi merged the patch at 17:56 the same day. This is the most exposed image: agents fetch arbitrary URLs from it. It needs a brood-box rebuild first, then a digest bump here. Until then, the microVM release, which resolves brood-box/base:latest at release time, would ship the vulnerable base.
• js-yaml 4.2.0 (Studio contracts codegen): @hey-api/json-schema-ref-parser 1.4.4, the latest release, pins it exactly. Fixing it would need a pnpm override.
• happy-dom 20.x (Studio tests): the fix is only in 21.0.4, a major bump.
• slack-bot undici 7.29.0: 13 advisories, including GHSA-w293-vg96-wgc3 (TLS validation bypass) and several DoS. It is @slack/bolt 5.0.0's auto-installed ^7.0.0 peer, reached through Socket Mode. The importer resolution stays locked even when @slack/socket-mode updates. Fixing it needs a manifest change: declare undici explicitly or move to @slack/bolt 5.1.0.
• slack-bot vite and @vitest/mocker (dev only): need vitest 4.1.11 → 4.1.12 in package.json.
• Floating node-version: '22.x'/'24.x' jobs pick up 22.23.4/24.22.1 once runner tool caches refresh. The 22.14.0 value in the publish job is a floor assertion, not a pin.

Not affected: no Go module depends on Brotli, and net/http decodes only gzip. The distroless Go images have no libbrotli. There are no Python manifests, no Envoy or Istio, and no npm Brotli packages.

Verification

Passing:

• pnpm audit --prod in apps/ (studio:audit) and pnpm audit in sdk/typescript/ (sdk:audit) report no known vulnerabilities. On main, both report 4.
• Studio, after a frozen install on Node 26: biome, typecheck, server tests (255) and web tests (1763) pass.
• go test ./internal/adapter/server -run 'SDK|TypeScript' passes with the updated workflow pins. .github/scripts/relevant-changes_test.sh passes.
• go run ./cmd/mecademo shows the tool call, the permission ask and approval, and the result.
• slack-bot: frozen install, tsc --noEmit, and biome pass.

Failing, all in code this PR does not touch (git diff origin/main --name-only -- environment/ cmd/ is empty):

• slack-bot tests: 11 failures in bridge.test.ts with mecated exited before readiness (-2). No bin/mecated was built in the worktree. The same 11 fail with main's lockfile.
• task lint: 1 issue, environment/microvm/launch_ownership_darwin.go:754:22: G703 (gosec). The file is darwin-only, so the Linux CI lint never sees it.
• task test:race (complete; no data races reported): on this macOS host, environment/microvm, environment/microvm/gitexec, cmd/mecated, cmd/mecatui, deploy/mecatl-execution-kind, internal/adapter/forker, internal/app, internal/executionexecutor, and internal/adapter/server fail. The failures are host-environment problems: microVM and kind, /var vs /private/var canonicalisation, and placement cwd. In internal/adapter/server only placement_composition_test.go fails (cwd does not match the configured session placement), and those tests fail the same way on origin/main. The two SDK workflow tests this PR edits pass.

🤖 Generated with Claude Code