fix: dependency security vulnerabilities (DELO-6676)

[ikrascloudinary]

Summary

Vulnerabilities resolved

• @grpc/grpc-js: 1.14.4 → 1.14.5 (minimum required: 1.13.6 / 1.14.5, from DELO-6676 — Improper Certificate Validation, GHSA-m9gg-hp2v-232j)

@grpc/grpc-js is transitive via @opentelemetry/sdk-node → @opentelemetry/otlp-grpc-exporter-base@0.222.0, which declares ^1.14.3.

Dependencies updated

• None — every direct dependency is already at its latest non-breaking version.

Left deliberately untouched (breaking or out of scope for a security-only PR): express 4→5, chai 4→6, chai-http 4→5, config 3→5, dotenv 16→18, got 14→16, rollbar 2→3, sinon 19→22, sinon-chai 3→4, mocha 11→12, and cloudinary 2.10.1→2.11.0 (exact-pinned with a patch-package patch).

Resolutions

• Added @grpc/grpc-js: ^1.14.5: the parent range ^1.14.3 (via @opentelemetry/otlp-grpc-exporter-base) still admits vulnerable 1.14.3/1.14.4. Existing protobufjs, qs, proxy-addr pins kept.

Lockfile

• Only the @grpc/grpc-js entry changes vs master (1.14.4 → 1.14.5). No other transitive bumps.

Package version

• Unchanged; release-please handles it.

Test results

• yarn install --frozen-lockfile clean; patch-package applied the cloudinary patch.
• npm test — 13 passing, no hard crashes or module-resolution errors.
• OpenTelemetry boot smoke-tested OK: node --require ./instrumentation.js.
• Full server boot: /version → 200, Prometheus :6060/metrics → 200 with http_server_* metrics.
• npm ls @grpc/grpc-js --all → single copy at 1.14.5.

Test plan

• npm test passes
• App boots cleanly: node --require ./instrumentation.js start.js (Prometheus exporter on :6060)

🤖 Generated with Claude Code

[lukaszczerpak-cloudinary]

The grpc fix looks right: the lockfile now has a single @grpc/grpc-js entry at 1.14.5, which meets the advisory minimum. A few comments inline.

[lukaszczerpak-cloudinary]

Please drop this manual bump. release-please owns the version, and .release-please-manifest.json is still at 1.3.15. After merge, /version (routes/wpt.js) and the telemetry service version (instrumentation.js) would report 1.3.16 with no matching release or tag, and release-please will later rewrite this from the manifest. This already happened after #246: it bumped to 1.3.16 by hand, and release-please's next release (cefa60f) reset it to 1.3.13, so the deployed version went backwards. The fix: title already triggers a patch release.

[ikrascloudinary]

Dropped in 6b34357. package.json is back at 1.3.15, so release-please does the bump from the fix: title.

[lukaszczerpak-cloudinary]

This fix exists only in the lockfile. The range ^1.14.3 still allows the vulnerable 1.14.3 and 1.14.4, so a later lockfile edit or merge-conflict resolution could quietly bring back 1.14.4 (GHSA-m9gg-hp2v-232j). Could you add a resolutions entry for @grpc/grpc-js (e.g. ^1.14.5), the same way protobufjs, qs and proxy-addr are already pinned?

[ikrascloudinary]

Added "@grpc/grpc-js": "^1.14.5" to resolutions in 6b34357. The lock entry is now "@grpc/grpc-js@^1.14.3", "@grpc/grpc-js@^1.14.5" → 1.14.5, so a re-lock can't fall back to 1.14.4.

[lukaszczerpak-cloudinary]

The lockfile refresh also moved @types/node from 22.20.3 to 26.6.4 (and undici-types from 6.21 to 8.9). CI runs Node 20.16 and .mise.local.toml uses 22.13, so editor and type checks would now accept Node 26 APIs that don't exist at runtime. It's also unrelated to the security fix. Could you keep this at 22.x, or mention the jump in the PR description if it's intentional?

[ikrascloudinary]

Not intentional, reverted in 6b34357. I rebuilt yarn.lock from master and re-ran yarn install, so the only lockfile change vs master is the grpc-js entry. @types/node stays at 22.20.3 / undici-types 6.21.0, and the other incidental bumps are gone too.