Context

The push for v0.3.7 surfaced 21 open Dependabot alerts. 0.3.7 addressed one (axios CVE-2025-62718 via a root overrides bump, credits @stefans71 in #1153), leaving 20 open across several transitive dependencies that need a pass.

Open alerts (as of 2026-04-22)

High (9)

Medium (11)

Low (1)

What to do

For each alert, decide between:

1. Override at root overrides (like we did for axios in fix: override axios to ^1.15.0 for CVE-2025-62718 #1153) — cleanest when the transitive dep's new major version is semver-compatible with the ranges our direct deps allow.
2. Bump the direct dep that pulls the vulnerable transitive — when the transitive is gated by a stale direct dep (e.g. an old @slack/*, drizzle, hono, vite, etc.).
3. Accept and dismiss — when the vulnerable code path is not reachable in our runtime (e.g. a dev-only dep used in tests). Dismiss in the Dependabot UI with a clear reason so the audit trail is preserved.

Suggested batching: do all undici alerts together (shared direct ancestor), all lodash together, all axios together. minimatch / picomatch / path-to-regexp / qs / flatted / follow-redirects / path-to-regexp are likely transitive through tooling (eslint, vite, etc.) and may be dev-only.

Verification

• bun install after each override should not change direct-dep versions
• bun run validate must still pass
• GitHub security tab confirms the alerts close on next dependency graph refresh

Dashboard: https://github.com/coleam00/Archon/security/dependabot