chore: upgrade dependencies for security

apps/background-workers/package.json

@@ -21,15 +21,15 @@
     "adm-zip": "0.5.16",
     "dotenv": "16.4.5",
     "p-queue": "^9.1.0",
-    "undici": "7.21.0"
+    "undici": "7.25.0"
   },
   "devDependencies": {
     "@types/adm-zip": "0.5.7",
     "@types/node": "22.0.0",
     "dotenv-cli": "7.4.2",
-    "eslint": "9.0.0",
-    "tsx": "4.19.0",
+    "eslint": "9.39.4",
+    "tsx": "4.22.0",
     "typescript": "5.6.3",
-    "vitest": "4.0.18"
+    "vitest": "4.1.6"
   }
 }

apps/background-workers/src/workers/card-consolidator.ts

@@ -169,7 +169,7 @@ export class CardConsolidator {
     }
   }
 
-  private async process() {
+  async process(workspaceId?: string, factIds?: string[]) {
     if (this.running) {
       return; // Skip if already running
     }
@@ -184,7 +184,7 @@ export class CardConsolidator {
 
     try {
       // Get facts that haven't been consolidated into knowledge cards
-      const facts = await this.getUnconsolidatedFacts();
+      const facts = await this.getUnconsolidatedFacts(workspaceId, factIds);
 
       if (facts.length === 0) {
         await WorkerLog.create({
@@ -309,13 +309,31 @@ export class CardConsolidator {
     }
   }
 
-  private async getUnconsolidatedFacts(): Promise<any[]> {
+  private async getUnconsolidatedFacts(
+    workspaceId?: string,
+    factIds?: string[],
+  ): Promise<any[]> {
     // Get facts that are not in any knowledge card's fact_ids
     // Only process facts that have a workspace_id (workspace-scoped facts)
+    const bindVars: Record<string, unknown> = {};
+    const filters: string[] = [
+      "fact.trashed == false",
+      'fact.workspace_id != null AND fact.workspace_id != ""',
+    ];
+
+    if (workspaceId) {
+      filters.push("fact.workspace_id == @workspaceId");
+      bindVars.workspaceId = workspaceId;
+    }
+
+    if (factIds && factIds.length > 0) {
+      filters.push("(fact._id IN @factIds OR fact._key IN @factIds)");
+      bindVars.factIds = factIds;
+    }
+
     const aql = `
       FOR fact IN facts
-        FILTER fact.trashed == false
-        FILTER fact.workspace_id != null AND fact.workspace_id != ""
+        FILTER ${filters.join(" AND ")}
         LET inCard = (
           FOR card IN knowledge_cards
             FILTER fact._id IN card.fact_ids
@@ -328,7 +346,7 @@ export class CardConsolidator {
         RETURN fact
     `;
 
-    return await Fact.queryAQL(aql);
+    return await Fact.queryAQL(aql, bindVars);
   }
 
   /**

apps/mcp-server/package.json

@@ -18,30 +18,30 @@
     "@fastify/oauth2": "8.1.2",
     "@fastify/session": "11.0.0",
     "@fastify/swagger": "9.0.0",
-    "@fastify/swagger-ui": "5.0.0",
+    "@fastify/swagger-ui": "5.2.6",
     "@knowledgeplane/api-core": "*",
     "@knowledgeplane/db": "*",
     "@knowledgeplane/file-processor": "*",
-    "@modelcontextprotocol/sdk": "1.20.2",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "@types/jsonwebtoken": "9.0.10",
     "dotenv": "16.4.5",
     "dotenv-cli": "7.4.2",
-    "fastify": "5.0.0",
+    "fastify": "5.8.5",
     "jsonwebtoken": "9.0.2",
     "jwks-rsa": "3.2.0",
     "node-fetch": "3.3.2",
     "openai": "4.20.0",
-    "undici": "7.21.0"
+    "undici": "7.25.0"
   },
   "devDependencies": {
     "@types/node": "22.0.0",
     "@types/pg": "8.11.0",
-    "@vitest/coverage-v8": "4.0.18",
-    "eslint": "9.0.0",
+    "@vitest/coverage-v8": "4.1.6",
+    "eslint": "9.39.4",
     "pino-pretty": "13.1.2",
     "prettier": "3.3.3",
-    "tsx": "4.19.0",
+    "tsx": "4.22.0",
     "typescript": "5.6.3",
-    "vitest": "4.0.18"
+    "vitest": "4.1.6"
   }
 }

apps/rest-api/package.json

@@ -17,16 +17,16 @@
     "@knowledgeplane/api-core": "*",
     "@knowledgeplane/db": "*",
     "dotenv": "16.4.5",
-    "fastify": "5.0.0",
+    "fastify": "5.8.5",
     "knowledgeplane-background-worker": "*",
-    "undici": "7.21.0"
+    "undici": "7.25.0"
   },
   "devDependencies": {
     "@types/node": "22.0.0",
     "dotenv-cli": "7.4.2",
-    "eslint": "9.0.0",
-    "tsx": "4.19.0",
+    "eslint": "9.39.4",
+    "tsx": "4.22.0",
     "typescript": "5.6.3",
-    "vitest": "4.0.18"
+    "vitest": "4.1.6"
   }
 }

apps/webapp/next-env.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/dev/types/routes.d.ts";
+import "./.next/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

apps/webapp/package.json

@@ -11,7 +11,7 @@
     "@knowledgeplane/aimodel": "*",
     "@knowledgeplane/db": "*",
     "@knowledgeplane/file-processor": "*",
-    "@next/env": "^16.0.4",
+    "@next/env": "16.3.0-canary.19",
     "@tailwindcss/postcss": "^4.1.16",
     "@tanstack/react-query": "^5.62.11",
     "@trpc/client": "^11.9.0",
@@ -24,11 +24,12 @@
     "autoprefixer": "^10.4.21",
     "dotenv": "^16.4.5",
     "md5": "2.3.0",
-    "next": "^16.0.4",
+    "next": "16.3.0-canary.19",
     "next-auth": "^5.0.0-beta.25",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.14",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
+    "react-is": "^19.2.6",
     "recharts": "3.7.0",
     "superjson": "^2.2.5",
     "tailwindcss": "^4.1.16",
@@ -37,8 +38,8 @@
   },
   "devDependencies": {
     "@types/md5": "2.3.6",
-    "@typescript-eslint/parser": "^8.54.0",
+    "@typescript-eslint/parser": "^8.59.3",
     "daisyui": "5.5.18",
-    "eslint": "^9.39.0"
+    "eslint": "^9.39.4"
   }
 }

docs/SPEC.md

@@ -898,6 +898,13 @@ curl -X POST http://localhost:8080/mcp \
 - **Swagger/OpenAPI** documentation
 - **Tailwind CSS** for styling
 
+**Dependency Security Baseline:**
+- Web dashboard uses Next.js `16.3.0-canary.19` to pick up patched Next.js security fixes and the patched nested PostCSS dependency ahead of the next stable release.
+- REST API and MCP server use Fastify `5.8.5`; REST API, MCP server, background workers, and the database package use Undici `7.25.0`.
+- MCP protocol support uses `@modelcontextprotocol/sdk` `1.29.0`; Swagger UI uses `@fastify/swagger-ui` `5.2.6`.
+- Root dependency pins and npm overrides keep transitive security-sensitive packages on patched versions; `npm audit` should report zero known vulnerabilities.
+- A root `eslint.config.cjs` provides ESLint 9 flat-config compatibility for non-webapp workspaces.
+
 **Package Architecture:**
 - `@knowledgeplane/db` - Shared database package with ArangoDB models and connection logic
   - Main export (`@knowledgeplane/db`) - For general Node.js servers (mcp-server, rest-api, background-workers)

eslint.config.cjs

@@ -0,0 +1,50 @@
+const js = require("@eslint/js");
+const tsParser = require("@typescript-eslint/parser");
+
+const globals = {
+  AbortController: "readonly",
+  Buffer: "readonly",
+  clearInterval: "readonly",
+  console: "readonly",
+  fetch: "readonly",
+  globalThis: "readonly",
+  process: "readonly",
+  setInterval: "readonly",
+  setTimeout: "readonly",
+  URL: "readonly",
+};
+
+module.exports = [
+  {
+    ignores: [
+      "**/node_modules/**",
+      "**/.next/**",
+      "**/dist/**",
+      "**/coverage/**",
+      "eslint.config.cjs",
+    ],
+  },
+  {
+    files: ["**/*.{js,cjs,mjs}"],
+    languageOptions: {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      globals,
+    },
+    rules: {
+      ...js.configs.recommended.rules,
+    },
+  },
+  {
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parser: tsParser,
+      parserOptions: {
+        ecmaVersion: "latest",
+        sourceType: "module",
+      },
+      globals,
+    },
+    rules: {},
+  },
+];