[github-actions]

Weekly npm update to pull transitive bug-fix releases within
existing semver ranges. Auto-generated by lockfile-refresh.yml.

Already validated once: the generating lockfile-refresh job
ran npm ci, npm run check and npm run build against exactly
this lockfile before opening the PR. The PR's own ci run is
created but held at action_required because a bot opened it, so
it posts no check until a maintainer clicks "Approve and run".
Approve it to validate this exact tree on the PR, then merge
manually after a quick scan of the diff. (Unlike dependabot PRs,
lockfile-refresh PRs are authored by github-actions[bot] and
the auto-merge workflow does not gate on them.)

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex. Lockfile-only diff; pr-review-toolkit and gstack/review applied directly to the diff, native-codex in-process (no nested CLI).
Reviewed head: 1fb3c33

Looks good. package-lock.json only (+28 −24): in-range patch/minor bumps — @modelcontextprotocol/sdk 1.32.1→1.32.2, body-parser 2.3.0→2.4.0, fast-uri 3.1.8→3.1.9, hono 4.13.13→4.13.14, ip-address 10.7.4→10.7.5, jose 6.2.12→6.2.13, on-finished 2.4.1→2.4.2. All resolved URLs point at registry.npmjs.org with matching tarball names and fresh integrity hashes.

Critical Issues (0)

Important Issues (0)

Suggestions (0)

Strengths

• Dependency tree stays consistent: body-parser@2.4.0 now wants content-type ^2.1.0, satisfied by the existing nested node_modules/body-parser/node_modules/content-type@2.1.0; iconv-lite ^0.7.3 and qs ^6.16.1 resolve to 0.7.3 / 6.16.1 at top level. Top-level content-type@1.0.5 still serves @modelcontextprotocol/sdk (^1.0.5).
• No new packages, no registry changes, no package.json range edits.

Recommended Action

1. No blocking changes requested.
2. Merge once the remaining required CI checks finish green.

[kkroo]

Landed by kkroo drive session a2176509 at 1fb3c332: Ally 0C/0I at that head, drive-merge-gate PROCEED, one squash merge with a trailer-free message -> a926e4d1.