security: production dependency audit fails on current main #369

Summary

The production-dependency audit on current main fails at the repository's configured high-severity threshold.

Reproduced at 40a3374 with:

npm audit --omit=dev --audit-level=high
exit code: 1
5 vulnerabilities (1 low, 3 moderate, 1 high)

The high-severity finding is fast-uri host-confusion vulnerabilities. The remaining findings include @hono/node-server, hono, and body-parser, reached through the MCP/server dependency tree.

This means the Audit production dependencies step in .github/workflows/static_quality.yml is expected to fail on a new run even though the latest committed workflow previously passed before these advisories/resolutions changed.

Proposed fix

• Refresh the lockfile to pull patched transitive versions where semver ranges permit.
• If the MCP SDK dependency prevents a clean resolution, evaluate the compatible SDK/Hono version rather than blindly using npm audit fix --force.
• Run MCP unit/integration tests and the web-handler tests after the dependency change.
• Keep the production audit gate at high.

Acceptance criteria

• npm audit --omit=dev --audit-level=high exits successfully
• MCP build and tests pass
• Full workspace build and unit tests pass
• Lockfile changes are limited to required dependency remediation
• No audit threshold is weakened or bypassed