[creatornader]

Summary

The October 4, 11, and 18 scheduled scans failed because the lockfile retained vulnerable MCP SDK, fast-uri, and Hono versions. A separate npm audit found vulnerable Vitest, Zod, and ip-address versions.

• Upgrade the affected dependencies and refresh the lockfile. The lockfile audit now reports zero vulnerabilities.
• Run OSV on every pull request, including Dependabot and fork PRs, so vulnerable changes fail before merge.
• Prepare package 0.7.8 and update the supported-version policy.
• Handle npm 12 array output during immutable publish recovery, and check out the exact release tag before running the parser.
• Preserve the platform-specific optional dependency libc selectors in package-lock.json.

Validation

• npm audit --package-lock-only: zero vulnerabilities.
• Lockfile version checks and git diff --check: passed.
• Full test matrix and PR OSV scan: pending GitHub Actions.

Consumer lockfiles

The repository overrides and package-lock only govern this repository install. Existing downstream npm lockfiles still need to be updated by their owners when upgrading Agent Bridge. This package remains a conventional library/CLI distribution; this PR does not vendor its dependency tree.