chore: refresh dependencies and security fixes

[steipete]

Summary

• refresh every policy-eligible direct dependency
• move brace-expansion, fast-uri, js-yaml, and nanoid to patched transitive releases
• preserve the Node 24 typings floor and hold TypeScript 7 because it removes the compiler API used by the architecture gate
• add a backslash-authority SSRF regression for the daemon URL fetch guard

Security analysis

The fast-uri advisory does not sit on summarize's runtime fetch path. It is a dev-only dependency of web-ext via addons-linter and Ajv. The SSRF guard uses Node's native WHATWG URL for both host classification and the normalized fetch target, so it does not have the fast-uri/native URL parser split described by GHSA-7p8r-x3mc-p8w7. The added regression proves private backslash-authority targets are rejected before fetch.

The two remaining high advisories are both in image-size 2.0.2, for which no patched version exists. image-size is also dev-only under web-ext/addons-linter. It sizes only packaged extension manifest icons and theme images during lint; summarize does not pass downloaded or user-supplied content into it. The checked-in extension has no ICNS, JXL, HEIF, or HEIC inputs, and Firefox lint completed against the built artifact. The best upstream fix is for addons-linter to replace image-size or validate supported magic before calling it; an override cannot repair the vulnerable parser.

Verification

• pnpm install --frozen-lockfile
• pnpm build
• pnpm check: 555 files passed, 29 skipped; 3,012 tests passed, 43 skipped
• pnpm -C apps/chrome-extension test:chrome: focused pass 3/3; full pass 111 passed, 8 skipped
• pnpm -C apps/chrome-extension test:firefox:lint: 0 errors, 0 notices, 24 existing compatibility/security warnings
• built CLI version and live extraction of https://example.com
• built core library extraction call
• pnpm audit --audit-level high: 2 remaining high advisories, both unpatched image-size findings described above
• structured autoreview: clean, no accepted/actionable findings

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 9:48 AM ET / 13:48 UTC.

ClawSweeper review

What this changes

Refreshes four direct package versions and several patched transitive resolutions, adds a daemon URL-fetch SSRF regression test, and reformats one existing test helper.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: this owner-authored, bounded security-maintenance PR has no actionable correctness finding; two supplied CI runs were still in progress at review time.

Priority: P2
Reviewed head: a3d9f11447601d38c1376a03f39604f05cff3e94

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency refresh with a coherent security regression test and no identified patch defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: Not applicable: this owner-authored PR is outside the external-contributor proof gate; its body nevertheless records build, check, extension, and live extraction validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Not applicable: this owner-authored PR is outside the external-contributor proof gate; its body nevertheless records build, check, extension, and live extraction validation.
Evidence reviewed	5 items	Backslash-authority coverage: The added regression exercises two backslash authority forms and asserts that the daemon guard rejects them before invoking fetch. Current guard boundary: Current main parses with the native URL implementation, normalizes the hostname, and rejects blocked hostnames or addresses; the daemon route applies this guard before URL extraction. Dependency resolution scope: The PR updates markdansi, oxfmt, oxlint, and mediabunny declarations, while the lockfile moves brace-expansion, fast-uri, js-yaml, and nanoid to newer resolved versions.
Findings	None	None.
Security	None	None.

How this fits together

The daemon accepts a page URL for extraction, validates it through the shared network guard, then performs a DNS-pinned fetch. The CLI and Chrome extension consume the workspace dependency manifests and lockfile updated by this PR.

flowchart LR
  A[Daemon summarize request] --> B[Page URL]
  B --> C[Network safety guard]
  C --> D{Public HTTP target?}
  D -->|No| E[Reject request]
  D -->|Yes| F[DNS-pinned fetch]
  F --> G[Content extraction]

Loading

Before merge

• Resolve merge risk (P1) - The supplied test (24) and extension-e2e checks were still in progress at review time, so their exact-head results remain to be confirmed before merge.
• Complete next step (P2) - No discrete repair is needed; allow normal owner review and the remaining checks to complete.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	5 files affected: 2 manifests, 1 lockfile, 2 tests	The functional source behavior is unchanged; the only behavioral addition is focused regression coverage.
Direct version declarations	4 updated	The runtime and tooling update scope is small enough for the existing CLI and extension checks to cover directly.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Retain the narrow dependency refresh and SSRF regression, then merge after the remaining exact-head checks complete successfully.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the narrow dependency refresh and SSRF regression, then merge after the remaining exact-head checks complete successfully.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds regression coverage rather than reporting a user-facing failure; the added cases are source-visible and targeted.

Is this the best way to solve the issue?

Yes: preserving the native URL parsing and shared guard while adding a focused no-fetch assertion is the narrowest maintainable protection for these normalized URL forms.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9fdac4dd6d6e.

Labels

Label changes:

• add P2: This is bounded dependency and security maintenance with limited expected user blast radius.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this owner-authored PR is outside the external-contributor proof gate; its body nevertheless records build, check, extension, and live extraction validation.

Label justifications:

• P2: This is bounded dependency and security maintenance with limited expected user blast radius.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this owner-authored PR is outside the external-contributor proof gate; its body nevertheless records build, check, extension, and live extraction validation.

Evidence

What I checked:

• Backslash-authority coverage: The added regression exercises two backslash authority forms and asserts that the daemon guard rejects them before invoking fetch. (tests/daemon.url-fetch-guard.test.ts:55, a3d9f1144760)
• Current guard boundary: Current main parses with the native URL implementation, normalizes the hostname, and rejects blocked hostnames or addresses; the daemon route applies this guard before URL extraction. (packages/core/src/content/network-guard.ts:102, 9fdac4dd6d6e)
• Dependency resolution scope: The PR updates markdansi, oxfmt, oxlint, and mediabunny declarations, while the lockfile moves brace-expansion, fast-uri, js-yaml, and nanoid to newer resolved versions. (pnpm-lock.yaml:1543, a3d9f1144760)
• History and ownership: Blame attributes the central network-target validation lines to Peter Steinberger's v0.21.10 release commit, and the current PR is also authored by steipete. (packages/core/src/content/network-guard.ts:114, f78eba1590e5)
• Patch hygiene: The branch has one commit directly atop current main and its five-file diff passes Git whitespace checks. (a3d9f1144760)

Likely related people:

• steipete: Peter Steinberger authored the current network-guard validation lines in the v0.21.10 release history and authored this dependency refresh. (role: recent area contributor and dependency owner; confidence: high; commits: f78eba1590e5, a3d9f1144760; files: packages/core/src/content/network-guard.ts, package.json, apps/chrome-extension/package.json)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.