chore(deps): weekly lockfile refresh

[github-actions]

Weekly npm update to pull transitive bug-fix releases within
existing semver ranges. Auto-generated by lockfile-refresh.yml.

Review-and-merge: CI on this PR will validate that the tree still
builds; merge manually after a quick scan of the diff. (Unlike
dependabot PRs, lockfile-refresh PRs are authored by
github-actions[bot] and the auto-merge workflow does not gate
on them.)

[allyblockcast]

Ally — Consolidated PR Review

Lens: pr-review-toolkit code-reviewer.

Summary

Looks good. This is a clean automated npm update refresh with all transitive dependency bumps validated.

Key observations:

• ✅ All 14 version changes are strictly upward; no downgrades or downgrades.
• ✅ Direct dependencies (@types/node, tsx) remain within their declared semver ranges.
• ✅ Integrity hashes match npm registry exactly; no tampering.
• ✅ No known CVEs in any bumped versions (advisory check against qs, body-parser, etc. all clear).
• ✅ Transitive constraint changes (e.g., body-parser@2.3.0 pulling content-type@^2.0.0) correctly reflect upstream manifest; npm nested them appropriately.

Recommendations

1. Merge after confirming CI passes (build validation, lint, test suite).
2. No manual fixes required; this refresh is safe.

---

reviewed head: ed083cf

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.

Looks good — this is a mechanical, single-file package-lock.json refresh (173 additions / 155 deletions) with no package.json changes.

Verified:

• Every resolved URL points to registry.npmjs.org (no off-registry or suspicious hosts).
• Integrity hashes are well-formed sha512- values consistent with legitimate npm publishes.
• Version bumps are minor/patch across the board: esbuild platform binaries 0.28.0 → 0.28.1 (lockstep, expected for the esbuild monorepo), body-parser 2.2.2 → 2.3.0, qs, raw-body, content-type, @babel/runtime, @types/node, hono, tsx, eventsource-parser, etc.
• The one newly-added entry, node_modules/body-parser/node_modules/content-type@2.0.0, is a normal nested transitive dep (body-parser pulling a newer content-type than the top-level one) — resolves from the real registry, MIT license, matches the Express org's opencollective funding link. No typosquat/name-confusion risk.
• No new top-level dependencies were introduced; this is within-range npm update output as the PR description states.

reviewed head: e625174

Recommended Action

Safe to merge after CI confirms the tree still builds (no checks are currently reporting on this branch — confirm the build workflow runs before merging).

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.

Reviewed head: 85a617d

Looks good

No Critical or Important issues found. The lockfile refresh keeps registry URLs and integrity hashes aligned, preserves a consistent esbuild version across every platform package, and correctly records the updated transitive dependency graph.

Verification

• npm ci --ignore-scripts completed successfully against the exact PR head.
• npm run check passed.
• npm run build passed.

Strengths

• The change remains narrowly scoped to package-lock.json.
• Package updates stay within the existing manifest ranges.
• No platform-package mismatches, engine regressions, SQL changes, or trust-boundary changes were introduced.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.

Reviewed head: 091f84f

Looks good

No Critical or Important issues found. This remains a mechanical package-lock.json refresh, and the resolved dependency graph is consistent with the existing manifest ranges.

Suggestions (1)

• Run the clean-room Docker install smoke in CI; Docker was unavailable in the review container.

Strengths

• npm ci, npm run check, and npm run build passed against the exact reviewed head.
• npm audit --omit=dev --audit-level=high reported zero vulnerabilities.
• All package sources remain on registry.npmjs.org, all resolved artifacts retain sha512 integrity, and the esbuild platform packages remain version-aligned.
• The @hono/node-server 2.x resolution is explicitly allowed by @modelcontextprotocol/sdk@1.30.0, and its Node 20 engine requirement matches the project minimum.

Recommended Action

Approve this lockfile refresh. The remaining Docker smoke is a non-blocking CI verification gap.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.

Reviewed head: 091f84f

Looks good

No Critical or Important issues found. This remains a mechanical package-lock.json refresh, and the resolved dependency graph is consistent with the existing manifest ranges.

Suggestions (1)

• Run the clean-room Docker install smoke in CI; Docker was unavailable in the review container.

Strengths

• npm ci, npm run check, and npm run build passed against the exact reviewed head.
• npm audit --omit=dev --audit-level=high reported zero vulnerabilities.
• All package sources remain on registry.npmjs.org, all resolved artifacts retain sha512 integrity, and the esbuild platform packages remain version-aligned.
• The @hono/node-server 2.x resolution is explicitly allowed by @modelcontextprotocol/sdk@1.30.0, and its Node 20 engine requirement matches the project minimum.

Recommended Action

Approve this lockfile refresh. The remaining Docker smoke is a non-blocking CI verification gap.