[rhein1]

Superseded by #446. Its current head a1283ee9a0740f9314220d84d5694c4b450911b2 retains this PR's MCP/Claude SDK repairs, qualifies n8n's audit-clean fixture, records the maintainer-authored inventory hold renewal, and completes the hosted bundle repair. This older draft is closed without merging or deleting its branch, to preserve one dependency prerequisite in the queue.

Summary

• Refresh the MCP lockfile from ip-address@10.4.0 to 10.7.2, and raise its existing fast-uri override and lock from 3.1.7 to patched 3.1.8. Refresh the hosted MCP bundle and reviewed-source integrity manifest because mcp/package.json is an attested source input.
• Refresh the separate Claude SDK conformance lock from fast-uri@3.1.7 to 3.1.8 and ip-address@10.7.0 to 10.7.2.
• Refresh n8n's locked brace-expansion from 1.1.18 to 1.1.21 in three ESLint paths and from 5.0.9 to 5.0.12 at the root.

All replacements fit their existing parent dependency ranges. The Claude SDK and n8n manifests and all direct SDK versions stay unchanged. PR #443's SDK upgrades and separate source-integrity mismatch are outside this change.

Local verification (LUX, Windows, Node 24)

• MCP: npm ci, npm run check, npm test (57 passed, 1 Windows-only SIGTERM skip, 0 failed), npm audit --audit-level=moderate (0 vulnerabilities), packed-install verification, and pack dry run passed.
• Hosted MCP: locked install, check, 15 tests, ordinary build, artifact and reviewed-source integrity verification, and pack dry run passed.
• Claude SDK: npm ci --ignore-scripts, npm audit --audit-level=moderate (0 vulnerabilities), typecheck, 21 tests, and 2 CLI fixture tests passed. The fixtures made no provider call.
• n8n: npm ci, 8 tests, lint, build, production and full dependency audits (0 vulnerabilities), live audit JSON validation, and pack dry run passed. npm run audit:dev itself failed locally because its npm subprocess returned empty stdout on Windows; the same wrapper passed in Linux CI below.
• Repository checks: MCP direct-bypass tests (11 passed), integrations machine surfaces, client distribution, capability status, and integration counts passed. The rename preflight check reports a Windows checkout CRLF byte mismatch; both generated outputs match the tracked files after normalizing CRLF to LF.

Exact-head CI (91359404eeecb4c57a7f0facacac234001a436ef)

• Validate Machine Surfaces passed all three jobs. The aggregate job ran the MCP package (58 tests, zero audit vulnerabilities, packed install), n8n package (8 tests, zero production audit vulnerabilities, clean development audit wrapper, pack dry run), and direct-bypass checks. Adapter conformance ran the Claude SDK audit (zero vulnerabilities), typecheck, 21 tests, and 2 CLI fixture tests.
• Risk Fork passed all 14 jobs. CodeQL passed both analyses. These runs started automatically from the push; no manual reruns were requested.

Follow-up

This draft dependency repair targets main. Drafts #435 and #436 remain on their own earlier heads and need this fix integrated into their branches before their own exact-head Validate Machine Surfaces checks can pass. This PR has not been merged or published.