#22 fix(web): resolve the 14 open Dependabot alerts

[Anonymous]

Originally created by: Thanatos9404

Fixes all 14 open Dependabot alerts in web/package-lock.json. Only web/package.json and the lockfile change.

Alert	Package	Severity	Before → after	Path
[#82]	proxy-addr	critical	2.0.7 → 2.0.8	shadcn CLI (dev)
[#84]	@modelcontextprotocol/sdk	high	1.30.0 → 1.32.1	shadcn CLI (dev)
[#67], [#69], [#73], [#72], [#68], [#66]	undici	high–low	7.29.0 → 7.30.0	shadcn CLI (dev)
[#63], [#64], [#78]	ip-address	moderate	10.5.0 → 10.7.3	shadcn CLI (dev)
[#81]	postcss-selector-parser	moderate	7.1.5 → 7.1.6	shadcn CLI (dev)
[#76]	brace-expansion	moderate	5.0.9 → 5.0.12	shadcn CLI (dev)
[#83]	katex	low	0.16.47 → 0.18.10	@lobehub/icons → @lobehub/ui (runtime)

How

• The 13 development alerts. The patched releases already satisfy the ranges their parents declare, so a targeted npm update refreshes the lockfile with no overrides and no shadcn upgrade.
• KaTeX. Its dependents (rehype-katex, micromark-extension-math, mermaid) still declare ^0.16. @lobehub/ui has itself moved to ^0.18.1, so the fix is an overrides entry "katex": "^0.18.2". It's a range, so future patches still flow in. KaTeX is not in the client bundle.

Verification

• npm ci from the new lockfile; every alerted package resolves to its patched version or later.
• npm audit signatures: 1,176 packages have verified registry signatures, and 219 have provenance attestations.
• npm run lint: 0 errors, with the 23 existing warnings unchanged.
• npm run build: 37 routes.
• Production server smoke test of /, /integrations (which uses the @lobehub icons), /playground, /platform and /docs. All return 200 and render. The only console errors are the Vercel scripts and /api/context 404ing off-Vercel.

Not fixable yet

npm audit also reports braces <= 3.0.3 (GHSA-vfj7-8cjw-p6xm, published 2026-09-18; it's not one of the Dependabot alerts). No patched release exists; 3.0.3 is the latest. It's reachable only through glob handling in dev tooling (the shadcn CLI and ESLint) and needs attacker-controlled glob patterns, which doesn't happen here. It shows up as 8 "high" entries in npm audit because each package that depends on braces is listed separately.

[Anonymous]

Originally posted by: vercel[bot]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
llmslim	Ready	Preview	<relative-time datetime="2026-10-09T03:58:16.813Z">Oct 9, 2026 3:58am UTC</relative-time>

[Anonymous]

Ticket changed by: Thanatos9404

• status: open --> closed