chore(deps): consolidate 6 dependabot PRs incl. pdf-parse/argon2 major bumps (2026-07-27 batch 2)

middleware/package.json

@@ -46,15 +46,15 @@
   "description": "Omadia kernel: Anthropic Messages API orchestrator with plugin runtime, persistent memory, multi-channel ingress, and vault-backed credentials.",
   "license": "MIT",
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.111.0",
+    "@anthropic-ai/sdk": "^0.115.0",
     "@aws-sdk/client-s3": "^3.1075.0",
     "@azure/msal-node": "^5.3.1",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "@types/better-sqlite3": "^7.6.13",
     "@types/cookie-parser": "^1.4.10",
     "@types/multer": "^2.1.0",
-    "@types/yauzl": "^2.10.3",
-    "argon2": "^0.43.1",
+    "@types/yauzl": "^3.4.0",
+    "argon2": "^0.45.1",
     "better-sqlite3": "^12.11.1",
     "bonjour-service": "^1.4.3",
     "botbuilder": "^4.23.3",
@@ -81,7 +81,7 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/express": "^5.0.6",
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.1.1",
     "@types/pg": "^8.11.10",
     "@types/ws": "^8.5.13",
     "@types/yazl": "^3.3.1",

middleware/packages/harness-orchestrator/package.json

@@ -29,7 +29,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "mammoth": "^1.8.0",
-    "pdf-parse": "^1.1.1"
+    "pdf-parse": "^2.4.5"
   },
   "devDependencies": {
     "@types/pdf-parse": "^1.1.5"

middleware/packages/harness-orchestrator/src/attachmentExtract.ts

@@ -11,6 +11,12 @@
  * `pdf-parse`, imported dynamically so a missing/odd dependency can never
  * crash module load. Images are deliberately NOT text-extracted here — they
  * flow through the existing brand:// / vision path untouched.
+ *
+ * `pdf-parse` v2+ replaced the v1 callable-default-export API
+ * (`pdf(buffer) -> { text }`) with a class-based API
+ * (`new PDFParse({ data }).getText() -> { text }`); see the `PDFParse`
+ * usage below. The parser must be `destroy()`-ed after use to release the
+ * underlying pdf.js worker/canvas resources.
  */
 
 /** Hard cap on extracted text to protect the turn's token budget. */
@@ -110,10 +116,18 @@ export async function extractAttachmentText(
 
     // 3. .pdf via pdf-parse (dynamic import — historically runs debug code on
     //    top-level import, so we only touch it inside the function + guarded).
+    //    v2+ API: `new PDFParse({ data }).getText()`, must `destroy()` after.
     if (ct === PDF_TYPE || ext === 'pdf') {
-      const pdfParse = (await import('pdf-parse')).default;
-      const result = await pdfParse(bytes);
-      return finalize(result.text ?? '');
+      const { PDFParse } = await import('pdf-parse');
+      const parser = new PDFParse({ data: bytes });
+      try {
+        const result = await parser.getText();
+        return finalize(result.text ?? '');
+      } finally {
+        await parser.destroy().catch(() => {
+          /* best-effort cleanup — never let it mask the real result/error */
+        });
+      }
     }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

middleware/src/auth/passwordHasher.ts

@@ -15,7 +15,7 @@ import * as argon2 from 'argon2';
  * makes a future swap to scrypt/bcrypt or a re-tuning trivial.
  */
 
-const HASH_OPTIONS: argon2.Options = {
+const HASH_OPTIONS: argon2.HashOptions = {
   type: argon2.argon2id,
   memoryCost: 19_456, // 19 MiB
   timeCost: 2,

middleware/test/auth/passwordHasher.test.ts

@@ -14,8 +14,13 @@ describe('passwordHasher (argon2id)', () => {
       hash.startsWith('$argon2id$'),
       `expected argon2id prefix, got: ${hash.slice(0, 16)}`,
     );
-    // Parameters tuple should match passwordHasher.HASH_OPTIONS.
-    assert.match(hash, /m=19456,t=2,p=1/);
+    // Parameters should match passwordHasher.HASH_OPTIONS. Checked
+    // independently (not as a fixed-order tuple) because argon2 0.45
+    // reordered the PHC-string fields from `m=,t=,p=` to `m=,p=,t=`
+    // without changing the actual parameter values.
+    assert.match(hash, /m=19456/);
+    assert.match(hash, /t=2/);
+    assert.match(hash, /p=1/);
   });
 
   it('verify roundtrips a correct password', async () => {

web-ui/package.json

@@ -37,7 +37,7 @@
     "cytoscape-fcose": "^2.2.0",
     "framer-motion": "^12.42.2",
     "lucide-react": "^1.17.0",
-    "monaco-editor": "^0.55.1",
+    "monaco-editor": "^0.56.0",
     "next": "^16.2.12",
     "next-intl": "^4.13.2",
     "react": "^19.2.8",
@@ -73,6 +73,7 @@
     "postcss": "8.5.23",
     "sharp": "0.35.3",
     "brace-expansion": "5.0.8",
-    "minimatch": "10.2.5"
+    "minimatch": "10.2.5",
+    "dompurify": "3.4.12"
   }
 }