[V3RON]

Summary

pnpm audit --prod on main reported 22 advisories (1 critical, 9 high). This PR updates ws, hono and @modelcontextprotocol/sdk, and moves the SDK's vulnerable transitive dependencies to fixed versions inside their existing ranges. pnpm audit --prod now reports no advisories. It also adds an npm entry to Dependabot so dependencies stop drifting past advisories.

Changes

Package	Old	New	Advisories closed
ws (direct, exact pin)	8.18.3	8.22.0	memory exhaustion DoS from tiny fragments (high, fixed 8.21.0); uninitialized memory disclosure (moderate, fixed 8.20.1). Reaches the gateway's uplink listener (src/ports/uplink-websocket.ts).
hono (direct)	^4.13.5 (4.13.5)	^4.13.13 (4.13.13)	serveStatic decodes the request path twice (GHSA-5r4p-p66f-jhc7, fixed 4.13.11); hono/jsx unescaped strings in boundaries (GHSA-hxh3-vqpv-xpqv, fixed 4.13.7). src/http/server.ts uses serveStatic for the console.
@modelcontextprotocol/sdk (direct, exact pin)	1.29.0	1.32.1	OAuth client credential binding (high, 1.31.0); tasks not tied to session (high); HTTP request batch/body limits (high); HTTP client redirect policy (moderate); bearer audience check (moderate). simlock uses stdio only, so none of these were reachable.
proxy-addr (via SDK → express)	2.0.7	2.0.8	IP spoofing via IPv4-mapped addresses (GHSA-jqcg-44mw-7w3h, critical)
fast-uri (via SDK → ajv)	3.1.5	3.1.9	5 high (host confusion, SSRF, authority injection), 1 moderate (host case)
qs (via SDK → express → body-parser)	6.15.3	6.16.1	2 moderate (array-limit bypass, isBuffer DoS)
ip-address (via SDK → express-rate-limit)	10.5.0	10.7.4	4 moderate (link-local, NAT64, subnet compare, parse diagnostic)
.github/dependabot.yml	n/a	n/a	new npm entry: weekly, directory: /, prefix chore(deps), one group for minor and patch

@hono/node-server (2.0.10, also pinned by the workspace override) and @hono/zod-openapi (1.6.3) did not need to move: both accept hono 4.13.13. The transitive bumps came from pnpm update proxy-addr qs fast-uri ip-address hono, which only changes the lockfile.

MCP SDK 1.29 → 1.32.1 release notes, the parts that touch simlock:

• 1.30.0 adds a 10 MB stdio read buffer limit (#2239). simlock's MCP messages are tool calls and results, far below that.
• 1.30.0 changes how zod validation errors are formatted for tool input (#1503). The src/mcp tests pass unchanged.
• 1.32.0 accepts tools/call without arguments and adds opt-in maxToolInputElements. The other changes (OAuth issuer binding, HTTP redirect policy, task isolation, bearer audience) touch HTTP transports and auth, which simlock does not use.

Remaining advisories

pnpm audit --prod: none.

pnpm audit including dev dependencies still lists 15. They are out of scope here and never ship in the package: tinypool via oxfmt (2 critical); vite, vitest, @vitest/mocker and source-map-js via @stryker-mutator/vitest-runner, which pins its own older vitest (2 high, 7 moderate, 1 low); qs via @stryker-mutator/core → typed-rest-client (3 moderate). The new Dependabot entry will propose updates for these.

Tests

• pnpm exec vitest run --project unit src/mcp src/ports/uplink-websocket.test.ts src/http: 15 files, 352 tests passed.
• pnpm test:changed: 1 file, 6 tests passed.
• pnpm test:e2e e2e/gateway-smoke.test.ts e2e/mcp-session.test.ts e2e/console-serving.test.ts: 3 files, 14 tests passed. These cover a real gateway with worker uplinks over ws, the HTTP app, the MCP stdio server, and console files served through serveStatic.
• The pre-push hook's tsc -p tsconfig.build.json and the e2e typecheck passed.

Assumptions

• Assumption: I picked the newest release of each direct package (ws 8.22.0, hono 4.13.13, MCP SDK 1.32.1). Each is at or above its fix version and passed pnpm's supply-chain (minimum release age) check.
• Assumption: the vulnerable transitive packages should move inside their existing semver ranges in the lockfile. I did not add new pnpm-workspace.yaml overrides. The existing ip-address: ">=10.3.1" override is unchanged.
• Assumption: the Dependabot npm group sets patterns: ["*"] beside update-types, so every package joins the minor+patch group. Majors stay one PR per package. I did not add a cooldown. Dependabot's pnpm 11 lockfile support has not been checked in CI yet.

Written by an agent.

[V3RON]

Review (maintainer's agent, round 1)

No blocking findings.

• Manifest moves are the three the brief named (ws 8.22.0, @modelcontextprotocol/sdk 1.32.1, hono ^4.13.13); the lockfile-only moves of proxy-addr, qs, fast-uri, ip-address stay inside their declared ranges, so no override was needed. I re-ran pnpm audit --prod against this branch's lockfile myself: no known vulnerabilities.
• The MCP SDK notes checked out: the 1.30 stdio message cap and error rewording are the only changes on simlock's path, and the mcp tests pass unchanged.
• Dependabot npm entry groups minor and patch into one weekly PR, majors separate; matches the actions entry's style.

Note, no change needed: the remaining dev-only advisories (tinypool via oxfmt, old vite/vitest via stryker) are tooling, not shipped code; they belong to a toolchain bump, not this PR.