Dependency audit warnings and install-surface clarification

[edithatogo]

Summary

While installing Authentext from source for a manuscript audit, npm install completed but npm audit --json reported 7 vulnerabilities: 6 moderate and 1 high. Issues have now been enabled for this repository, so this issue records the finding and follow-up path.

Environment

• Repository: https://github.com/edithatogo/authentext
• Version in package.json: 3.2.0
• Node: v26.0.0
• npm: 11.12.1
• macOS

Commands run

npm install
npm run sync
npm run validate
npm test
npm run install:mcp-server
npm audit --json

Build/validation/test result:

• npm run sync: passed
• npm run validate: passed
• npm test: passed
• npm run install:mcp-server: registered MCP server path successfully

Original audit findings

npm audit --json summary before PR #53:

{
  "moderate": 6,
  "high": 1,
  "critical": 0,
  "total": 7
}

Reported vulnerable packages included:

• linkify-it high severity: quadratic scan-loop complexity
• markdownlint-cli direct moderate dependency via js-yaml and markdown-it
• brace-expansion
• js-yaml
• markdown-it
• smol-toml
• yaml

Partial fix already submitted

PR #53 applies the non-breaking npm audit fix path:

• Reduce npm audit findings #53

After PR #53, audit findings are reduced to 3 moderate findings, 0 high, 0 critical.

Remaining work

• Evaluate the semver-major markdownlint-cli@0.49.0 update, since that is the remaining direct dependency behind the js-yaml and markdown-it findings.
• Re-run:

npm run sync
npm run validate
npm test
npm audit --json

• Clarify install surface in docs: Authentext does not expose a global authentext shell binary. Its supported surfaces are Agent Skills plus an MCP server.

[edithatogo]

Follow-up: PR #53 addresses the non-breaking audit reductions and removes the high-severity finding. This issue remains open for the residual semver-major markdownlint-cli update and install-surface documentation clarification.

[edithatogo]

Additional context: the remaining markdown-it/markdownlint-cli audit path appears to be covered by open Dependabot PR #50: #50. This issue can track validating/merging that semver-major update plus the install-surface documentation clarification.

[edithatogo]

Resolved by merged PR #230 at 4417398. Fresh
pm ci on updated main audited 278 packages with 0 vulnerabilities, followed by
pm audit --audit-level=moderate with 0 findings. The supported install surface is the Agent Skills package; the former MCP installer is explicitly frozen historical evidence and is not a package script, runtime entry point, CI dependency, or release artifact.