[chicks-net]

Summary

Resolves 9 of 18 npm audit findings from the earlier security review, without any breaking-change downgrades.

• axios 1.11.0 → 1.20.0 — clears its whole list of fixed advisories (SSRF via NO_PROXY bypass, prototype-pollution-based header/config injection, ReDoS, etc.)
• express 5.1.0 → 5.2.1 — pulls in an updated router/path-to-regexp (fixes the ReDoS in path-to-regexp 8.0.0–8.3.0)
• cors 2.8.5 → 2.8.6, dotenv 17.2.1 → 17.4.2, mime-types ^3.0.1 → ^3.0.2 — trivial patch/minor bumps
• package-lock.json refresh also picked up already-available non-breaking fixes for minimatch/picomatch (dev-tooling ReDoS, not shipped to runtime)

What's left (and why it's not in this PR)

9 vulnerabilities remain (2 critical, 3 high, 4 moderate), all rooted in one chain: node-chartist@1.0.5 (the latest release that exists) depends on jsdom@^9.0.0 (2016-era), which bundles the long-deprecated request package and its old form-data/qs/tough-cookie/uuid.

npm audit fix --force offers to "fix" this by downgrading to node-chartist@0.2.9 — I checked, and that's not a real fix: 0.2.9 depends on an even older jsdom@^7.2.2 that also bundles request. There's no non-vulnerable node-chartist version to move to.

Practical exploitability is low today: this app never passes attacker-controlled URLs through jsdom/request — src/createChart.ts only ever feeds it a static local HTML string for chart rendering, so request's SSRF and friends aren't reachable through anything this service does. Actually eliminating the chain means replacing node-chartist with an actively maintained charting approach, which is a bigger effort — tracking as follow-up, not bundling into this dependency-bump PR.

Test plan

• npx tsc --noEmit — clean
• npx jest — all pass except the same pre-existing network-dependent test that needs a real GitHub TOKEN (fails identically on deploy without this change)
• npm run build succeeds; smoke-tested the built server (GET /, GET /graph without a TOKEN returns the graceful error SVG) against the bumped express/axios
• Diffed the lockfile package-name set against deploy — only the expected transitive shifts (e.g. axios pulling in agent-base/https-proxy-agent for proxy support), nothing unexpected

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates several npm dependencies to remediate a subset of existing npm audit findings, primarily by bumping axios and Express-related packages, and refreshing the lockfile to pick up non-breaking transitive fixes.

Changes:

• Bump direct runtime dependencies: axios → 1.20.0, express → 5.2.1, plus cors, dotenv, mime-types.
• Refresh package-lock.json to align with the new direct versions and pick up updated transitive packages.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates direct dependency versions for axios/express and related runtime packages.
package-lock.json	Regenerates the resolved dependency tree and integrity metadata to match updated deps.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chicks-net]

Heads up: the bumped `dotenv` (17.4.2) prints a console line on every startup like:

◇ injected env (0) from .env // tip: ⌁ auth for agents [www.vestauth.com]

I double-checked this isn't a supply-chain compromise — it's genuine code in dotenv's own lib/main.js (a _getRandomTip() self-promo the maintainer added, advertising their other project). Verified against the real npm registry tarball for 17.4.2 and confirmed no unexpected install scripts. Just a heads-up since it's spammy in prod logs (varies per run — saw both the vestauth tip and a dotenvx.com one) and worth knowing about before someone mistakes it for something malicious.

If it bugs you, dotenv supports quieting it (e.g. DOTENV_CONFIG_QUIET=true / { quiet: true } in newer versions) — happy to wire that up if wanted, but leaving it out of this PR since it's cosmetic, not a security or correctness issue.