Summary

• Adds exact security override pins (same major, all published ≥7 days ago) for transitive deps with reachable advisories:
  • @xmldom/xmldom 0.8.13 → 0.8.15 — used by samlify/xml-crypto (SAML ACS, pre-auth), mammoth and officeparser. Fixes quadratic-time parsing (an 80k-attribute element took ~7s to parse, now 77ms) and the requireWellFormed serializer bypasses
  • axios 1.19.0 → 1.20.0 (Daytona, Twilio) — fetch adapter ignored maxRedirects: 0, plus the prototype-pollution gadgets
  • follow-redirects 1.16.0 → 1.16.1 — cross-origin credential stripping with array-form headers
  • shell-quote 1.10.0 → 1.12.0 — @daytona/sdk resolved the vulnerable copy (quote() newline-after-comment injection)
  • proxy-addr 2.0.7 → 2.0.8, qs 6.15.2 → 6.16.0 (express/body-parser in the MCP and A2A SDKs; stripe, twilio)
  • joi 17.13.6 → 17.13.8 (isoDate ReDoS), @grpc/grpc-js 1.14.4 → 1.14.6
• Lockfile diff is only these 8 packages; no other resolution moved
• Held back (need a major version, or a fix only exists in a different major): image-size (pptxgenjs, 2.x), file-type (officeparser, 21.x), uuid 9, katex, postcss-selector-parser; dev/build-only: js-yaml 3, csv-parse 4, vite, esbuild, braces, source-map-js, moment, http-cache-semantics

Type of Change

• Bug fix (security)

Testing

• Red → green PoCs: one PoC per advisory, resolving each package exactly the way the app loads it (nested copies under @daytona/sdk, twilio, samlify, express).
  • On staging's lockfile, 7 PoCs are vulnerable: xmldom element-name injection, xmldom quadratic attributes, axios fetch redirect bypass, shell-quote injection, proxy-addr spoofing, qs arrayLimit bypass, joi isoDate ReDoS.
  • On this branch, all 7 are fixed.
  • The follow-redirects array-header leak did not reproduce on either version.
• Differential behaviour run: 41 cases run through the same entry points on staging and this branch. 41/41 identical.
  • samlify SP/IdP round trip, configured like @better-auth/sso: assertion- and message-signed valid responses, plus tampered NameID, wrapped assertion, wrong signer, unsigned and malformed XML all rejected identically.
  • mammoth text and HTML, and officeparser on docx/pptx/odt.
  • qs: stripe indices/repeat stringify and body-parser extended parse.
  • shell-quote quote/parse.
  • axios over the HTTP adapter: JSON, form, params, same- and cross-origin redirects, 303, maxRedirects: 0, loop, 500, timeout, fetch adapter.
  • Twilio RequestClient and Daytona SDK get (found and 404) against a local server.
  • proxy-addr trust matrix (8 configs × 10 addresses), joi schemas, grpc-js unary with metadata and error.
• vitest: 76 files covering SSO routes and application, file parsers, SMS, Daytona sandbox and MCP. 764/764 pass.
• bun audit: 56 → 24 advisories; both criticals are gone.
• biome check. Full type-check, audits and the suite run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)