The runtimeServerOnly catalog pinned ^1.19.9, which cannot reach the
advisory's fix (2.0.5; no patched 1.x exists). Widen to
^1.19.9 || ^2.0.5, matching the range merged for v1.x in modelcontextprotocol#2549 and
shipped in 1.30.0 — that fix landed on a branch without changesets, so
it could not propagate to the v2 monorepo. The lockfile resolution moves
to 2.0.11, as the v1.x change did. getRequestListener is the only
imported symbol and is unchanged in 2.x; @hono/node-server@2 requires
Node >= 20, which @modelcontextprotocol/node already declares.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The runtimeServerOnly catalog pinned ^1.19.9, which cannot reach the
advisory's fix (2.0.5; no patched 1.x exists). Widen to
^1.19.9 || ^2.0.5, matching the range merged for v1.x in modelcontextprotocol#2549 and
shipped in 1.30.0 — that fix landed on a branch without changesets, so
it could not propagate to the v2 monorepo. The lockfile resolution moves
to 2.0.11, as the v1.x change did. getRequestListener is the only
imported symbol and keeps the same signature and contract in 2.x;
@hono/node-server@2 requires Node >= 20, which @modelcontextprotocol/node
already declares.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(deps): fix moderate/low Dependabot alerts in openclaw-blaxel

All six packages are transitive: hono, @hey-api/openapi-ts, @hono/node-server,
tar, uuid and yaml are pulled in via @blaxel/core and the optional openclaw
peer, none of them declared directly by this repo. Pin the fix via
pnpm-workspace.yaml overrides (their only effective location on pnpm 11, see
9bc4ff6) rather than hand-editing the lockfile:

- hono 4.12.33 -> 4.12.34: single resolved copy, in range for every consumer's
  declared `^4.11.4` (both @modelcontextprotocol/sdk majors). Clears all four
  hono alerts (GHSA-79qm-7rj5-m7r9 low, GHSA-8j4g-w8fx-2239,
  GHSA-f23p-vx2j-j53r, GHSA-54fx-42gc-7vw4 medium) at once.
- @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 (companion bump, no alert of its
  own): openclaw exact-pins the SDK at 1.29.0, whose own manifest range for
  @hono/node-server is `^1.19.9` -- 1.x only, and 1.19.17 is the highest 1.x
  ever published, so no in-range fix exists for that consumer
  (GHSA-frvp-7c67-39w9). 1.30.0 is the SDK's own fix for this: upstream PR
  modelcontextprotocol/typescript-sdk#2549, "widen @hono/node-server past
  GHSA-frvp-7c67-39w9", widened the range to `^1.19.9 || ^2.0.5`. Diffing
  1.29.0 vs 1.30.0's declared deps shows that range widening is the only
  change; bumping the parent lets both branches converge on the
  already-patched @hono/node-server@2.0.12 instead of forcing an override
  across a range proven empty.
- tar 7.5.19 -> 7.5.21 (GHSA-r292-9mhp-454m): openclaw's own exact pin, same
  override pattern already used for undici/js-yaml in this file. Dev-only
  exposure -- only reachable through the optional openclaw peer, never
  through this repo's own dependencies.
- uuid 11.1.0 -> 11.1.1 (GHSA-w5hq-g745-h8pq): in range for @blaxel/core's
  `^11.1.0`. Production-reachable: uuid is imported by @blaxel/core's
  mcp/server.js, sandbox.js and volume/index.js, all on this repo's own call
  path through SandboxInstance/CodeInterpreter.
- yaml 2.8.2 -> 2.8.3 (GHSA-48c2-rrv3-qjmp): in range for @blaxel/core's
  `^2.7.1`. Production-reachable: used by @blaxel/core's cache, settings and
  authentication modules. Deduplicates with the already-patched 2.9.0 copy
  from openclaw.
- @hey-api/openapi-ts 0.92.4 -> 0.97.3 (GHSA-hhx9-57xq-r5rw): in range for
  @hey-api/client-fetch's peer `< 2`. Reviewed every changelog between the
  two (0.93-0.97): all breaking changes are in openapi-ts's own generator
  plugin system (valibot/zod resolver nodes, buildUrl() defaults) -- this
  repo never invokes the generator, and grepping @blaxel/core's compiled
  output confirms @hey-api/openapi-ts is referenced only in a
  "This file is auto-generated by" header comment, never required at
  runtime.

Verified in the lockfile: every package above now resolves to exactly one
copy, at the patched version, with no vulnerable instance left anywhere in
the tree (`pnpm why <pkg> --recursive` + grep of pnpm-lock.yaml for every
remaining `<pkg>@` entry).

`pnpm install --frozen-lockfile` passes. `pnpm run typecheck` reproduces the
same 2 pre-existing src/sandbox.ts errors as untouched main (confirmed before
this change) and is non-blocking in the existing gate; `pnpm run test`
(the undici smoke test added in the prior remediation) passes unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(deps): stop the yaml override from downgrading openclaw's already-patched copy

PR review (Devin + Mendral, independently, same finding): the previous commit
overrode yaml to an exact `'2.8.3'`, which fixed @blaxel/core's vulnerable
2.8.2 copy but also forced openclaw's own exact pin down from 2.9.0 to 2.8.3
-- a real downgrade of a copy that was never vulnerable (GHSA-48c2-rrv3-qjmp
is fixed at 2.8.3; openclaw was already on 2.9.0, past that floor).

Pin the override to '2.9.0' instead: it clears the advisory (>= 2.8.3),
satisfies @blaxel/core's declared `^2.7.1` range, and is byte-identical to
what openclaw already pinned, so there is no downgrade for either consumer.
Both branches now resolve to the single existing 2.9.0 copy instead of a new
2.8.3 generation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>