[abruption]

Summary

Repairs the newly reported Control dependency audit failures independently of #325. Based on main at f19f2b5e9ac17d392375507bc753548cdfc0e751; the feature branch is not included.

• Updates locked Vite 7.3.6 → 7.3.7 and Vitest / @vitest packages 4.1.11 → 4.1.12, within the existing manifest ranges.
• The targeted npm resolution also updates the compatible Vitest subtree: Chai 6.2.2 → 6.3.0 and tinyrainbow 3.1.1 → 3.2.0.
• Changes only control/package-lock.json. Package manifest, direct production pins, application code, workflows, audit thresholds and Node 22/24 engine policy are unchanged. Every changed version's resolved tarball, integrity and engine metadata was compared with its public npm registry metadata.

Closes #326. This should unblock dependency auditing for #325 after normal review/merge and rerunning that PR's checks; no merge or deployment is performed here.

Why production audit includes these packages

Better Auth 1.7.5 declares an optional Vitest peer. The selected Vitest/Vite nodes therefore have devOptional metadata and are not excluded simply by npm audit --omit=dev. This is an audit/dependency-graph finding, not a reproduced exploit or a determination that the deployed Control service exposes a development server.

npm 11.15.0 also recalculated classification metadata for 56 unchanged-version entries: platform optional dependencies lose dev:true, while tsx, @types/node and undici-types become devOptional. The manifest groups and package-node set stay unchanged, but the derived --omit=dev installation/audit set can expand. These flags were not hand-edited or reverted to hide advisories. The existing Rollup 4.63.3 node explicitly declares @napi-rs/lzma-linux-x64-gnu@1.5.1 as an optional dependency; it is not a new package added by this PR. It is not installed on the macOS test host.

Repository development instructions use full npm ci; no live deployment installation was inspected or changed. Existing platform install scripts still apply. This PR does not claim deployed remediation.

Type

• chore / dependency maintenance

Validation

Exact candidate: d011e595dcc164e6f23c67824b4353b7c5e15987.

• macOS arm64, Node 24.16.0, npm 11.15.0: clean install, typecheck, build, 18 Vitest files / 123 tests PASS.
• Python 3.13.7 with relay extras: actual local Node/Python Control contract integration 11 PASS; dependency-audit workflow policy fixtures 4 PASS.
• Before: production audit 3 affected package nodes (2 moderate, 1 high). After: npm audit --omit=dev and full npm audit, both exit 0, zero vulnerabilities. Initial advisory-service timeouts are retained as failed attempts, not interpreted as clean results. The successful audits used bounded network timeouts; existing CI audit commands are unchanged.
• Targeted lock regeneration with --ignore-scripts --no-audit completed successfully; the clean install used --no-audit only to separate installation from the explicit audits above. No registry/policy/global configuration changes or audit suppressions.
• Root package object, package-node set, manifest and directly pinned production package entries verified unchanged; registry SRI/tarball/engine checks and git diff --check pass.
• Independent read-only CLI reviews completed before PR creation; no required code changes identified. Review requests for successful audits and dependency-path evidence were subsequently verified. Linux/macOS Node 22/24 coverage remains subject to this PR's existing CI matrix.

Limits

• The existing Vitest glob selects .test.ts, not the existing TSX UI test file; 123 passing tests are not a claim of that UI coverage.
• No Python/Control version bump, new feature, security-policy change, real agent messaging, global install, operations, merge, tag, release or package publication.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T07:28:33.676956Z	d011e59	PR opened
🔒 Security Review	✅ Completed 2026-10-22T07:34:38.028665Z	d011e59	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.