[acamarata]

Clears the open Dependabot alerts #493 and #506-#517 by fixing the dependencies.

Changes

• undici override >=8.12.2 (8.10.2 -> 8.12.3): #514-#516
• @azure/msal-node new scoped override @azure/msal-node@<7.1.0 -> >=7.1.0 <8.0.0 (5.2.1 -> 7.1.1; only reached through artillery > @azure/identity): #517
• nodemailer override floor >=10.1.4 <11, frontend dep ^10.1.4 (10.0.14 -> 10.2.1): #510-#512
• fast-uri override >=4.2.3 <5 (4.2.1 -> 4.2.3): #506-#509
• serialize-javascript override >=7.1.3 (7.0.5 -> 7.1.4): #513
• @sentry/nextjs: frontend/package.json still declared 10.49.0 (the vulnerable range Dependabot reads); main already resolved 11.9.0 through the override. Manifest now ^11.9.0, lockfile resolution unchanged (#493).

Lockfile: regenerated with pnpm@9.15.4 install --lockfile-only; diff is the targeted bumps plus an appium @appium/logger 2.0.7 -> 2.0.11 peer-suffix dedupe. No package version bumps, no tags.

Verification

• pnpm install --frozen-lockfile: ok
• pnpm audit --audit-level=high: 1 high remaining, already in the ignore list (http-cache-semantics, no fix); none of the targeted packages
• osv-scanner pnpm-lock.yaml: targeted packages gone. Remaining, not in this PR: @tiptap/core 2.27.3, csv-parse 4.16.3, stream-json 1.9.1, http-cache-semantics 4.2.0
• pnpm -r type-check: 169 TS errors in frontend-vite (unbuilt @nself/ui / @nself/auth-core), identical count on clean origin/main; frontend type-check 0 errors on both
• jest (TZ=America/New_York) logger, sentry-utils, email-service-smtp, sender-smtp: 4 suites pass

Already red on main (not touched)

Unit Tests / Type Check / coverage gates (hq quality/debt.yaml D-1475).

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@sentry/nextjs	^11.9.0	Unknown	Unknown
npm/nodemailer	^10.1.4	Unknown	Unknown
npm/@azure/msal-common	16.14.3	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 9 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@azure/msal-node	7.1.1	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 9 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/fast-uri	4.2.3	🟢 8.1	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 3 Found 10/29 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8 CI-Tests 🟢 10 11 out of 11 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 17 contributing companies or organizations
npm/nodemailer	10.2.1	🟢 5.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 0 Found 0/24 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/serialize-javascript	7.1.4	🟢 4	Details Check Score Reason Code-Review ⚠️ 2 Found 7/25 approved changesets -- score normalized to 2 Maintained 🟢 5 6 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Security-Policy ⚠️ 0 security policy file not detected Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/undici	8.12.3	🟢 7.9	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 6 Found 14/22 approved changesets -- score normalized to 6 Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 8 binaries present in source code Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Vulnerabilities 🟢 7 3 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits CI-Tests 🟢 10 22 out of 22 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 58 contributing companies or organizations

Scanned Files

• frontend/package.json
• pnpm-lock.yaml

[github-actions]

Security Scan Results: PASSED

Scanner	Critical	High
SAST	0	0
Dependencies	0	0

[github-actions]

Coverage after merging fix/advisory-wave4 into main will be

30.15%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src
middleware.ts	0%	0%	0%	0%	100, 100, 108, 116–117, 117–118, 122–123, 123–124, 128–129, 129–130, 133, 141, 143–144, 144, 144, 144–145, 151–152, 152–154, 154, 154, 154–156, 156–157, 157, 157, 16, 162, 164, 172, 179–181, 196, 198, 198, 198, 200, 204, 204, 21, 210, 210, 210, 210, 210, 210, 217, 217, 220, 230, 233, 236–240, 246, 246–247, 254, 256, 26, 262–263, 266, 266–267, 272–273, 278, 282, 282, 282, 282, 282, 284, 288, 290, 290–292, 295, 295–296, 303, 306, 306, 306, 306, 306, 306, 312–313, 313, 313, 317–318, 318, 318–319, 322, 322, 324, 324–325, 325, 325, 325, 325, 331–332, 334–335, 339, 339, 341, 341–345, 349, 349, 349, 349–350, 350, 352–355, 360–361, 365–366, 372, 40, 45, 50, 55, 60, 66–67, 67–68, 70, 70, 70, 78, 85, 92, 99
src/app
error.tsx	0%	100%	0%	0%	16–17, 19, 3–5
layout.tsx	0%	0%	0%	0%	10, 107, 123, 147, 150, 2, 20, 20, 20, 22, 22, 22, 226, 226, 24, 3–5, 8
loading.tsx	0%	100%	0%	0%	1, 7
not-found.tsx	0%	100%	0%	0%	1, 7
page.tsx	0%	0%	0%	0%	3, 35–38, 4, 40, 40, 40, 42–43, 43, 46, 46–48, 5, 52, 52, 52, 52, 52, 54, 54–55, 57, 6, 60–61, 65, 7, 73
src/app/(authenticated)/bookmarks
page.tsx	0%	100%	0%	0%	10–12, 14, 9
src/app/activity
page.tsx	0%	0%	0%	0%	10, 113, 113, 134, 142, 142, 147, 16, 162, 162, 162, 167, 167, 167, 17, 171, 18, 184, 186, 186, 189, 191, 191, 191, 191–193, 198, 205, 205, 210, 210, 222, 229, 229, 58, 74, 77, 80, 80–81, 9, 91–92
src/app/admin
loading.tsx	0%	0%	0%	0%	1, 104, 2–3, 38, 42, 42, 77, 9, 91
page.tsx	0%	0%	0%	0%	100–101, 103–104, 104, 104, 104, 104–105, 109–111, 111, 111, 111, 111–112, 115, 115, 115, 115, 115–116, 17–19, 199, 20–21, 239, 248, 248, 251, 251, 257, 261, 261, 28–29, 3, 30–31, 36, 39, 4, 43, 5, 52, 6–7, 90, 97–99
src/app/admin/advanced
page.tsx	0%	0%	0%	0%	106–110, 112–113, 113, 113, 113, 113–114, 118, 118, 118, 118, 118–119, 14–15, 25–26, 33–38, 392, 394, 41–45, 48, 77
src/app/admin/analytics
page.tsx	0%	0%	0%	0%	100, 100, 100, 100, 100, 103–107, 117, 124–125, 125, 130, 133, 133, 133–135, 135–137, 141, 141, 141–143, 143–145, 15, 154–159, 16, 160, 160, 163, 167–168, 168, 168–169, 169, 169, 17, 171, 171, 171, 173, 177, 18, 181–182, 182–183, 191, 193, 196, 196, 196–197, 200, 200, 208–209, 209–210, 216, 219, 219, 224–226, 226, 226–228, 228, 228, 230, 25, 256–257, 259, 26, 263, 265–266, 269, 271–279, 282, 282, 3, 313, 33, 331, 331, 34–36, 4, 41, 44, 49, 5, 52, 57, 60, 65, 68, 73, 76, 81, 84, 88, 96–98
src/app/admin/audit
page.tsx	0%	0%	0%	0%	116–117, 119–120, 123, 123, 123, 123, 123, 123, 125, 127, 129–130, 132, 134, 136, 138, 140, 143–144, 147, 149, 149, 149, 151, 151, 155, 163, 163, 171, 171, 177, 177, 189, 19, 196–198, 206, 209, 21, 211–212, 215–216, 216, 216, 216, 216–217, 22, 222–223, 225–229, 23, 233–234, 236–240, 243–244, 247–250, 252–255, 258, 258, 258, 258, 258–259, 263–267, 28, 289, 289, 291, 291, 299, 30, 303, 305, 305, 307, 307, 31, 322, 322, 43, 50, 59–60, 67, 7, 73, 79, 8, 80, 88, 9
src/app/admin/audit/security
page.tsx	0%	0%	0%	0%	10, 114, 12, 122, 13, 136, 136, 136, 140, 148, 148, 148, 15,

[github-actions]

PR Checks Summary

Check	Status
Lint & Format	✅ success
Type Check	✅ success
Unit Tests	✅ success
Build	✅ success

---

✅ All checks passed! Ready for review.