chore: dependency security audit on the default branch

[czlonkowski]

Context

Automated dependency scanning has accumulated a backlog of alerts on the default branch. For a project positioning itself around production reliability (Discussion #900), dependency hygiene is part of the product story, not just maintenance.

Tasks

• Triage all open Dependabot alerts: classify by runtime vs dev/build-only dependency and by actual exploitability in this codebase (many alerts in transitive dev dependencies have no runtime exposure).
• Upgrade or pin runtime dependencies with applicable advisories first.
• Batch dev-dependency updates where majors allow; dismiss non-applicable alerts with a stated reason.
• Verify npm run build, npm test, and npm run test:integration pass after upgrades.
• Consider enabling Dependabot grouped security PRs to keep the backlog from re-accumulating.

Acceptance

Zero open critical/high alerts that affect runtime code paths; remaining alerts dismissed with documented reasoning.

[github-actions]

🎯 Agentic Issue Triage

Type: Maintenance / Security Chore
Author: Repository owner (czlonkowski)
Existing label: security ✅

This issue tracks a structured dependency security audit, motivated by Dependabot alert accumulation on the default branch and the project's stated production-reliability positioning (Discussion #900). The issue body already contains a well-defined task checklist and a clear acceptance criterion (zero open critical/high runtime alerts; remaining alerts dismissed with documented reasoning). No spam or bot indicators detected.

---

📦 Dependency Surface Overview

Runtime dependencies (highest priority for security review):

Package	Version pinned	Notes
express	^5.1.0	HTTP server — high-value target
@supabase/supabase-js	^2.57.4	External API client
openai	^4.77.0	External API client
n8n-nodes-base / n8n-core / n8n-workflow	2.27.x	Large transitive graphs
@n8n/n8n-nodes-langchain	2.27.4	LangChain integration
sql.js	^1.13.0	In-process SQLite (WASM)
@modelcontextprotocol/sdk	1.28.0	MCP protocol layer

Dev dependencies: 20 packages — build/test only; no runtime exposure unless bundled.

🔍 Triage Strategy & Suggested Approach

1. Get a current snapshot

   npm audit --json | tee /tmp/audit-snapshot.json
   npm audit --json | python3 -c "import json,sys; d=json.load(sys.stdin); [print(v['severity'], v['via'][0] if isinstance(v['via'][0],str) else v['via'][0].get('name','?'), '—', k) for k,v in d.get('vulnerabilities',{}).items()]"

2. Classify by exposure — for each alert, determine:

   • Is the vulnerable package in dependencies (runtime) or devDependencies (build/test only)?
   • Is the vulnerable code path reachable from the MCP server's actual request handling?
   • For transitive deps of n8n-nodes-base / n8n-workflow: many advisories relate to features (e.g., browser-side rendering, CLI tools) not active in a headless MCP server context.

3. Prioritization order:

   • 🔴 Critical/High in direct runtime deps → fix or pin immediately
   • 🟠 Critical/High in transitive runtime deps → evaluate exploitability; upgrade parent if possible
   • 🟡 Moderate in runtime deps → batch update
   • ⚪ Any severity in dev-only deps → batch update or dismiss with documented reason

4. Dependabot grouped PRs — enabling grouped security updates in .github/dependabot.yml will prevent future backlog accumulation. Example:

   groups:
     dev-dependencies:
       dependency-type: "development"
       update-type: "security"

5. After upgrades, verify:

   npm run build && npm test && npm run test:integration

📋 Suggested Sub-task Checklist

• Run npm audit --json and capture baseline (date-stamp it)
• Categorize each alert: runtime / dev-only / transitive-no-exposure
• Fix or pin direct runtime deps with Critical/High advisories
• Upgrade transitive runtime deps where a parent update is available
• For n8n-* packages: check if the n8n monorepo has already patched the alert upstream; coordinate version bump with the existing npm run update:n8n workflow
• Batch-update dev dependencies (vitest, typescript, etc.) — npm run build && npm test gate
• Dismiss non-applicable Dependabot alerts with a stated reason in the GitHub UI
• Enable Dependabot grouped security PRs in .github/dependabot.yml
• Re-run npm audit and confirm zero Critical/High runtime alerts
• Update CHANGELOG or SECURITY.md to note audit completion

🔗 Relevant Resources

• GitHub Docs: Dependabot grouped security updates
• [npm audit documentation]((docs.npmjs.com/redacted)
• [OWASP Dependency Check]((owasp.org/redacted) — alternative static analysis
• Socket.dev — supply-chain risk analysis for npm packages
• Previous related (closed) issue: Security Audit Report: czlonkowski/n8n-mcp #265 — Security Audit Report (v2.15.5)

💡 Additional Notes

• The n8n packages (n8n-nodes-base, n8n-core, n8n-workflow) carry large transitive dependency graphs; many historical advisories in those graphs relate to browser-side or CLI code paths that are not reachable in a headless MCP server context. Each dismissal should document why the path is unexposed.
• express ^5.1.0 is still in RC/stable-v5 territory; worth checking if any advisories are v5-specific or v4 carry-overs.
• sql.js (WASM SQLite) is used as a universal DB adapter — its attack surface is limited to in-process query execution, which is controlled by the application layer.

Generated by Agentic Triage for issue #903 · ● 278.5K · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/issue-triage.md@13377ddf7e35c2b6e47aa58f45acb228fba902c8

[czlonkowski]

Audit complete

Baseline: 67 open Dependabot alerts (3 critical / 27 high / 29 medium / 8 low).

Runtime-reachable → fixed (PR #906)

• form-data CRLF injection (<4.0.6). The form-trigger handler (src/triggers/handlers/form-handler.ts) puts request-supplied filenames/field names into a multipart body on the /form/<webhookId> path. Bumped the direct dependency ^4.0.5 → ^4.0.6. Build green, form-handler suite 48/48.

Everything else → not runtime-reachable

All remaining alerts originate in the n8n node-package graph (@n8n/n8n-nodes-langchain, n8n-nodes-base, n8n-core, n8n-workflow) — AWS SDK (fast-xml-parser), Milvus (thrift), gRPC, IMAP (utf7/semver), nodemailer, tar, hono, undici, etc. n8n-mcp loads these only to introspect node metadata during npm run rebuild; the server never executes those nodes at runtime, so the vulnerable code paths are unreachable. These four packages are already Dependabot-ignored and clear via npm run update:n8n.

Two version-match-but-path-not-reached cases documented individually:

• qs — express consumes qs.parse (req.query), not the affected qs.stringify comma/encodeValuesOnly path; we never call qs directly.
• uuid — direct dep already at the fixed 11.1.1; only older transitive copies matched.

Actions taken

• ✅ PR fix(security): dependency audit — form-data CRLF fix + grouped security PRs (#903) #906 — form-data ^4.0.6 + Dependabot grouped security updates (applies-to: security-updates, split runtime/dev) so the backlog can't re-accumulate one-PR-per-CVE.
• ✅ All 67 alerts dismissed as not_used with per-category documented reasoning. Zero open alerts remain.

Acceptance met: zero open critical/high alerts affecting runtime code paths; remainder dismissed with documented reasoning. Closing tracked to the #906 merge.

Conceived by Romuald Członkowski - www.aiadvisors.pl/en

[edgarfloresguerra2011-a11y]

If you're doing a dependency security audit — consider also running behavioral testing on the MCP server itself.

Sentinel is a 6-layer audit pipeline that:

• L1.5: Static analysis (deps, secrets, licenses)
• L1.6: Pattern-based behavioral analysis
• L2 v2.0: Active probe (60+ adversarial inputs: path traversal, SSRF, SQL injection, command injection, prompt injection, credential access)
• L2.5: gVisor sandbox (userspace kernel isolation)

8,764 MCP servers audited. 3 removed for leaking env vars. The audit code is open: https://github.com/edgarfloresguerra2011-a11y/marketnow

Full methodology: https://marketnow.site/security