chore(deps): consolidate 6 dependabot PRs incl. pdf-parse/argon2 major bumps (2026-07-27 batch 2)

[Weegy]

Summary

Consolidates 6 Dependabot PRs opened 2026-07-27 (right after PR #513/#514 merged) into a single clean, CI-verified batch, including proactive audit-gate hardening (same pattern as #513).

#	Package(s)	Change	Risk
#515	argon2 (middleware)	0.43.1 → 0.45.1	minor, real code change needed (see below)
#516	pdf-parse (middleware)	1.1.1 → 2.4.5 (major)	full API rewrite, code change needed
#517	monaco-editor (web-ui)	0.55.1 → 0.56.0	no code change needed
#518	@types/yauzl (middleware)	2.10.3 → 3.4.0 (major)	types-only, fixes a pre-existing types/reality mismatch
#519	@types/node (middleware)	25.9.1 → 26.1.1 (major)	types-only, no code change needed
#520	@anthropic-ai/sdk (middleware)	0.111.0 → 0.115.0	no code change needed

Real code changes required

• pdf-parse v2 is a full rewrite by a new maintainer: no longer a callable default export (pdf(buffer) -> {text}), now a class API (new PDFParse({ data }).getText()). Updated middleware/packages/harness-orchestrator/src/attachmentExtract.ts accordingly, with a best-effort destroy() in finally to free the pdf.js worker/canvas. Verified end-to-end with a real PDF through the built dist/.
• argon2 0.45.x renamed argon2.Options → argon2.HashOptions: the stale type name silently fell back to the raw: true overload of hash() (returns Buffer instead of a PHC string), which failed to compile. Fixed the one call site in middleware/src/auth/passwordHasher.ts. Separately, hash()'s PHC-string parameter order changed (m=,t=,p= → m=,p=,t=, same values) — loosened the test's fixed-order regex to check each parameter independently.
• @types/yauzl bump fixes a pre-existing mismatch: the real yauzl dependency was already on ^3.3.2 while its types were still pinned to the v2 shape.

Audit hardening (proactive, same as #513)

monaco-editor pins its bundled dompurify to an exact version (3.4.8), which cleared the 5 pre-existing moderate dompurify advisories but is itself affected by a newer one (CUSTOM_ELEMENT_HANDLING bypass etc., <=3.4.11). Added a dompurify override to 3.4.12 on top of monaco-editor's pin. Result: web-ui now reports 0 vulnerabilities of any severity.

Verification (Node 22.22.3, clean rm -rf node_modules package-lock.json && npm install for both packages)

middleware

• npm run build / typecheck — exit 0
• npm run lint — 0 errors, 1 pre-existing warning
• npm test — 4705 tests, 4701 pass, 0 fail, 4 skipped
• npm audit — 0 info/low, 10 moderate (pre-existing botbuilder/uuid/@modelcontextprotocol/sdk chains, need upstream major bumps, don't block the required gate), 0 high/critical

web-ui

• npm run build / typecheck — exit 0
• npm run lint — 0 errors, 36 pre-existing warnings (unchanged)
• npm test — 306/306 pass
• npm audit — 0 vulnerabilities

Closes #515, closes #516, closes #517, closes #518, closes #519, closes #520.

Test plan

• npm run build (middleware + web-ui)
• npm run typecheck (middleware + web-ui)
• npm test (middleware: 4701/4705, web-ui: 306/306)
• npm run lint (both, no new warnings)
• npm audit (middleware 0 high/critical, web-ui 0 total)
• CI green on this PR

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}