[telivity-otaip]

What does this PR do?

Raises direct ranges and pnpm overrides to patched versions so the security alerts behind Dependabot PRs #167 and #168, plus the other same-major highs and moderates, are fixed in one lockfile. Merge this instead of those two PRs. They fail CI on pnpm audit --audit-level=high because of browserslist and fast-uri, which those diffs do not touch, and merging them separately would conflict on pnpm-lock.yaml.

Supersedes #167 and #168.

Type of change

• Bug fix
• New agent or adapter
• Enhancement to existing agent
• Domain logic correction
• Documentation
• Infrastructure / CI
• Refactor (no behavior change)

Checklist

• pnpm test passes (all tests, not just mine)
• pnpm typecheck passes
• pnpm lint passes with zero errors
• No any types without a justification comment
• No floating point for currency — use string-based decimal or decimal.js
• Agent spec in agents/specs/ updated if behavior changed
• New domain logic has a source (IATA doc, ATPCO category, industry reference, or operational experience cited in comment)
• Tests encode domain knowledge, not just expect(result).toBeDefined()

Domain impact

N/A

Resolved

Package	From	To	Why
browserslist	4.28.2	4.29.3	Two high alerts (OOM, prototype write)
fast-uri	4.1.2	4.2.2	Five high alerts, including port injection
fastify	5.8.5	5.12.7	#167 trust-proxy spoofing, plus later 5.12 patches
vitest / @vitest/mocker	4.1.9	4.1.12	#168 path traversal; 4.1.12 hardens the mocker
hono	4.12.27	4.13.13	CORS ReDoS, query-after-fragment, toSSG traversal
ip-address	10.4.0	10.7.4	NAT64 SSRF
qs	6.15.2	6.16.1	array-limit, isBuffer DoS, stringify DoS
baseline-browser-mapping	2.10.27	2.11.29	process-termination DoS
brace-expansion	5.0.9	5.0.12	recursion DoS
proxy-addr	2.0.7	2.0.8	critical IPv4-mapped IPv6 spoofing
source-map-js	1.2.1	1.2.2	event-loop DoS
@modelcontextprotocol/sdk	1.30.0	1.32.1	OAuth credential leak
@humanfs/node	0.16.7	0.16.8	symlink copy escape
postcss-selector-parser	6.1.2	6.1.4	low AST-recursion DoS on the 6.x line

CI failure

pnpm audit --audit-level=high exited 1 on braces <=3.0.3 (GHSA-vfj7-8cjw-p6xm). The advisory lists no patched release (latest npm version is still 3.0.3). Tailwind 3 loads it through micromatch while matching content globs and through chokidar 3 for the CLI watcher, so dropping the package breaks examples/platform-ui.

pnpm.auditConfig.ignoreGhsas now lists only that GHSA. pnpm audit --audit-level=high exits 0 and still reports it as ignored.

Still open

• moderate postcss-selector-parser <7.1.6 (GHSA-rj75-hqrm-r3gf). The fix is 7.1.6, a major above the 6.x line Tailwind 3 depends on. The 6.x DoS is patched at 6.1.4. This moderate does not fail --audit-level=high.

Test plan

• pnpm audit --audit-level=high exits 0 (braces reported as ignored; one moderate remains).
• Earlier on this branch: lint, build, verify:dist, gen:manifest --check, typecheck, and pnpm test passed after pnpm run data:download.