[Programcode]

Clears 12 of the 14 open Dependabot alerts on main. The other two have no patched release upstream (details below). Only package.json and package-lock.json change, with no SQL, migrations or Edge Function code. supabase/functions/deno.json is untouched, so no Edge Function deploy is needed.

What changed

• tsx 4.19.2 to 4.23.14. tsx 4.19.2 pulled its own esbuild 0.23.1, which is alert 1. Version 4.23.14 uses esbuild ~0.28 and matches the copy e2e already pins. The 4.20 to 4.23 release notes list bug fixes, performance work and the esbuild upgrade, with no breaking changes.
• Override @modelcontextprotocol/server to 2.3.1. e2e 0.17.0 pins 2.2.0 exactly, and e2e 0.21.2 ships with 2.3.1. The one breaking change in 2.3.0 limits a server to one connection at a time. e2e mcp creates one McpServer on stdio, so that change doesn't affect it.
• Override postcss-selector-parser to 7.1.7. Tailwind 3 and @tailwindcss/typography ask for 6.x. The 7.0.0 major only makes insertions during iteration safe. Both CSS bundles built with 7.1.7 are byte-identical (cmp) to the 6.x build from main.
• brace-expansion and source-map-js are lockfile refreshes inside the ranges their parents already allow.
• vite 7.3.6 to 7.3.7 and vitest 4.1.11 to 4.1.12 are patch bumps for advisories npm audit reports that have no Dependabot alert yet: GHSA-rq7h-c2jc-7f22, GHSA-9jrq-w75r-8gcw, the launch-editor advisories on vite, and GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp on @vitest/mocker. @vitest/coverage-v8 pins vitest as an exact peer, so both ranges move to ^4.1.12.

Alerts fixed

#	Severity	Package	Advisory	Now
1	moderate	esbuild (via tsx)	GHSA-67mh-4wv8-2f99	0.28.2
2, 4, 6	high, high, moderate	brace-expansion 5.x	GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr	5.0.12
3, 5, 7	high, high, moderate	brace-expansion 1.x	same three	1.1.21
10	moderate	postcss-selector-parser	GHSA-rj75-hqrm-r3gf	7.1.7
11	high	source-map-js	GHSA-68fv-2mgg-jv7q	1.2.2
14, 15, 16	moderate, high, high	@modelcontextprotocol/server	GHSA-rvq5-wwqv-78pq, GHSA-46jr-4wx8-v453, GHSA-jm63-cq47-j5jp	2.3.1

Not fixed

• fix: enforce AI controls and preserve source provenance #9 braces (high), GHSA-vfj7-8cjw-p6xm. Every published version is vulnerable (<= 3.0.3, and 3.0.3 is the latest). It reaches us through tailwindcss 3, via chokidar 3 and micromatch 4, and only runs at build and dev time. The only fix is the Tailwind 4 migration, which is a separate project.
• feat: add school debate sparring mode #13 sprintf-js (moderate), GHSA-hp3w-g68c-fv3c. Every published version is vulnerable (<= 1.1.3, and 1.1.3 is the latest). It comes from mammoth through argparse@1, which only mammoth's CLI (bin/mammoth) loads. The library code the app imports never loads it, and it isn't in dist/.

Verification (local; GitHub Actions is out of minutes)

npm run verify at b24a82be, with Deno 2.9.6 on PATH so test:edge runs, exited 0:

• docs:check, lint (eslint, knip, repo rules) and typecheck passed.
• npm test: 56 files, 404 tests passed. test:collaboration: 5 files, 30 tests passed. test:edge (Deno): 394 passed, 0 failed.
• build and check-site (47 HTML files, no problems) passed. test:sw passed with every offline check true.
• test:e2e:smoke (desktop Chromium): 43 passed.

The first verify run on this same commit failed at the smoke stage. admin-announcements.spec.ts:40 timed out waiting for the announcement heading on all three attempts, and first-run.spec.ts:165 was flaky. The VPS load average was 15.9 on 8 cores. Run alone, both specs passed (3 of 3), and the second full run passed, so I put this down to load, not the dependency change.

• npm ls --all exits 0. npm audit reports only the braces chain (via tailwindcss 3) and the sprintf-js chain (via mammoth).
• npm run build CSS output is byte-identical to main, with the same file list in dist/.
• tsx services/collaboration/src/index.ts with an empty environment loads and stops at config validation, which is expected. crash.test.ts in test:collaboration spawns the service with --import tsx.
• e2e mcp on SDK 2.3.1 answers initialize and tools/list (open_session, tools, call, close_session).
• No migrations changed, so I skipped the database gate.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Programcode/DebateLab
• Branch: chore/dependabot-alerts
• File: .coderabbit.yaml
• Commit: b24a82b
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Free
• Run ID: 068ca67c-de41-4aa1-a486-d7033c571ca7

📥 Commits

Reviewing files that changed from the base of the PR and between 298fbc1 and b24a82b.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 1

• package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}