[dependabot]

Summary

Release audits reject the shipped versions of qs, @hono/node-server and systeminformation. This updates qs to 6.17.0, systeminformation to 5.33.18, and the MCP node/server dependency chain to resolve @hono/node-server 2.1.5.

Upgrade @modelcontextprotocol/node to 2.1.2 and its required server peer to 2.4.0 (including server's core 2.4.0). Remove the SDK override that pinned node-server to vulnerable 2.0.12; the upstream ranges now share 2.1.5. The MCP client remains at 2.3.0 with its existing patch, and opencli-mcp remains at 0.0.22.

Regenerate the Desktop dependency ledger and Desktop/CLI third-party notices, including the updated MCP node license metadata. No application API or configuration migration is required.

Verification

Verified in Linux x64 with Node 24.22.1 after a clean npm ci and successful application of existing dependency patches:

• Shipped dependency audit: 258 packages, zero moderate-or-higher advisories.
• CLI production audit (npm audit --omit=dev --workspace maka-agent): zero vulnerabilities.
• Desktop artifact budget: 242 package instances; all 7 checker tests passed.
• Desktop and CLI third-party notice checks passed.
• MCP build and all 262 tests passed, including real HTTP, SSE and stdio transport coverage.
• Runtime Host and prerequisite workspace builds passed; both host-resource tests passed. The real Linux graphics, storage and network probes returned valid results.
• npm ls confirmed a shared node-server 2.1.5 and valid affected dependency peers.
• Biome check passed for the four changed manifest/ledger JSON files; git diff --check passed.

Full-repository tests and platform packaging were not run locally; those remain with PR CI. No workflow was manually dispatched or rerun.

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex diagnosed the audit and generated-file failures, updated the necessary dependency chain, regenerated metadata, and ran the targeted verification.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

I reviewed all seven changed files at 7e4c46427dd66750fc29260d94b3d8f16ba2d9b5: the dependency manifests and lock, Desktop artifact ledger, and Desktop/CLI notices. I found no verified P0–P2 issue. The update addresses the shipped dependency audit failures, including the qs failure in current main's npm publication run 40745123402.

The installed tree resolves qs 6.17.0, systeminformation 5.33.18 and a shared @hono/node-server@2.1.5. The MCP node/server peer requirements are satisfied by node 2.1.2 and server 2.4.0, with its matching core 2.4.0; client 2.3.0 and its existing patch remain in place. The regenerated notices correctly identify the node package's Apache-2.0 metadata. No application schema or configuration change is included.

After a clean install and dependency patches, the normal root npm run build:test and Desktop renderer build passed. All 264 MCP/resource tests passed. The actual shipped audit scanned 258 package names with zero moderate-or-higher advisories, and the CLI production audit reported zero vulnerabilities. Both notice inventories, the renderer notice copy, and the artifact budget passed; the budget's seven tests passed and its ledger covers 242 package instances. The normal Linux resource collector returned available, schema-valid CPU, memory, graphics, network and storage results.

A standalone qs regression check used the 6.16.0 tarball whose integrity matches current main's lock. Comma-array stringification with a non-callable own toString throws a TypeError there; the installed 6.17.0 handles the same input. This is a dependency-level check, not a remote exploit or a complete application attack-surface assessment.

A static merge with main 1b75728483076c9b9c73c26602648bbecbe8585b is clean. The three intervening main files do not change the dependency inputs. Exact-head CI, audit, packaging, owner and recovery workflows succeeded; installed CLI checks include Windows, macOS and Linux. The CLI Eval job is skipped by its github.event_name != 'pull_request' condition. Local checks used Linux x64 and Node 22.23.2; I did not repeat the full repository test suite, native desktop acceptance or platform packaging locally. Main's publication failure remains until a validated fix reaches that branch and publication succeeds.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[Astro-Han]

I approve this revision and authorize merging it based on the documented verification and passing CI. I contributed the follow-up changes. Codex submitted this approval at my explicit direction; this is not an independent human review.