SYN-596: Bump dev dependencies to clear all critical CVEs (npm audit + Guardrails)

[samkitsheth95]

Summary

Clears every critical CVE from both scanners, then takes every remaining fix that exists without a major upgrade.

Scanner	Before	After
npm audit critical	10	0
npm audit total	77	59 (highs 32 → 26)
Guardrails critical	2	0
Guardrails total	16	13 (all High)

The two scanners use different advisory databases and disagreed — Guardrails flagged @slack/web-api and sass as critical while npm audit doesn't report them at all, and vice versa for the Stoplight chain. Both lists are now free of criticals.

Changes

Package	From	To	Why
@stoplight/prism-cli	^4.10.0	^5.16.0	6 npm criticals (major)
@stoplight/spectral-cli	^6.4.1	^6.16.3	2 npm criticals
@slack/web-api	^6.7.1	^7.19.0	1 Guardrails critical (major — no 6.x fix exists)
sass	^1.52.1	^1.103.1	1 Guardrails critical
webpack	^5.89.0	^5.109.2	Guardrails High, in-range
@actions/core	^1.8.2	^1.11.1	Guardrails High, in-range
joi	^17.6.0	^17.13.6	Guardrails Medium, in-range
mini-css-extract-plugin	^2.6.0	^2.10.2	Guardrails High, in-range
yaml	^2.3.4	^2.9.0	Guardrails Medium, in-range
terser-webpack-plugin	—	^5.6.1	newly declared, see below
overrides.shell-quote	—	^1.10.0	1 npm critical (transitive-only)
overrides.websocket-driver	—	^0.7.5	1 npm critical (transitive-only)

Context: SYN-596.

Two things worth a reviewer's attention

1. terser-webpack-plugin was a latent config bug. webpack.config.js:4 has always required it directly and uses it at line 36, but it was never declared — it only resolved as a transitive dep of webpack. webpack 5.109.2 no longer pulls it in, so npm run build failed with MODULE_NOT_FOUND until it was declared explicitly. The bump surfaced this rather than caused it; the config was always one dependency-tree change away from breaking.

2. @redocly/cli is deliberately NOT bumped. npm audit fix wants 2.31.5 → 2.48.0. That breaks the docs. 2.48.0 adds an SRI integrity hash to the Redoc CDN <script> tag, and the docs then fail to hydrate with Redoc is not defined — Cypress catches it (links_test + style_test both fail). Since deploy.yml ships that HTML to docs.lob.com, bumping it would publish a blank docs site. Left pinned; docsTest stays green.

Why guardrails/scan is still red

All 13 remaining are High, and none can be fixed without a major upgrade — 6 have no fix at any version:

No fix exists (already at latest published)	Major upgrade available
@stoplight/prism-cli 5.16.0	ava 4.3.3 → 8.0.1
@stoplight/spectral-cli 6.16.3	css-loader 6.11.0 → 7.1.4
ajv 8.20.0	webpack-cli 4.10.0 → 7.2.2
mini-css-extract-plugin 2.10.2	openapi-to-postmanv2 3.2.1 → 6.3.3
terser-webpack-plugin 5.6.1	css-minimizer-webpack-plugin 4.2.2 → 8.0.0
webpack 5.109.2	@actions/core 1.11.1 → 3.0.1
	webpack-dev-server 4.15.2 → 6.0.0

For the left column Guardrails asks for > <latest>, i.e. a version that does not exist. The right column is a coordinated webpack-toolchain/tooling upgrade that deserves its own ticket rather than riding along in a CVE fix. npm audit additionally lists two Highs with no fix available at all (extract-zip, lodash.pick).

This check cannot go green from this PR. Merging will need a reviewer override.

Test plan

Verified on Node 24.15.0 (per .node-version), compared against unmodified main:

• rm -rf node_modules && npm ci then build — clean-install path works, lockfile is self-sufficient
• npm run pretty:check — pass
• npm run spectral (CI gate) — 0 errors
• npm run bundle — pass
• npm run build — exit 0, webpack 5.109.2 compiled
• npm run redoc — pass; output matches main apart from randomized email obfuscation (s vs s). Operations (274) and paths (252) unchanged
• npm run docsTest (Cypress) — 18/18 pass, same as main
• npx prism mock lob-api-public.yml — boots on 5.16.0, serves all routes
• tests/setup.js deep imports (prism-cli/dist/operations, prism-http/dist/client) still resolve across the 4.x→5.x major; drove the client end-to-end and confirmed correct spec-driven negotiation
• node actions/contract_tests/goalieruns.js av — exit 0; exercises @slack/web-api 7.x (new WebClient + chat.postMessage, both unchanged in 7.x), @actions/core 1.11.1 and joi 17.13.6
• yaml 2.9.0 parses (used by scripts/yml-version-bump.js)

Reviewer notes

• Two majors here (prism-cli 4→5, @slack/web-api 6→7). Both verified at their actual call sites as above.
• docs/chunks/bundle.js intentionally not committed. Rebuilding changes only terser's minification style (17:()=>{} → shorthand 17(){}, 52 bytes smaller, both valid JS). deploy.yml runs npm run build and force-adds only dist/ and docs/index.html, so this artifact is regenerated on deploy and left out to keep the diff to dependencies.
• Contract tests need a real token. Locally without LOB_API_TEST_TOKEN, addresses_test.js fails 5 — but main fails 10 under identical conditions, so these are missing-secret artifacts, not regressions. Worth confirming on the first CI run with real tokens, since monitor.yml also runs these against production every 30 min.
• sass 1.103.1 adds legacy-JS-API deprecation warnings via sass-loader (11 warnings, 0 errors). Compiled CSS is unchanged. Silencing them means upgrading sass-loader — out of scope.
• overrides requires npm ≥8.3 while engines says ≥7.9. CI uses Node 24 / npm 11 so this is fine in practice, though the floor is now technically understated.

🤖 Generated with Claude Code

[guardrails]

⚠️ We detected 13 security issues in this pull request:

Vulnerable Libraries (13)

Severity	Details
High	pkg:npm/ava@4.3.3 (t) upgrade to: > 4.3.3
High	pkg:npm/css-loader@6.11.0 (t) upgrade to: > 6.11.0
High	pkg:npm/@stoplight/prism-cli@5.16.0 upgrade to: > 5.16.0
High	pkg:npm/webpack-cli@4.10.0 (t) upgrade to: > 4.10.0
High	pkg:npm/@stoplight/spectral-cli@6.16.3 upgrade to: > 6.16.3
High	pkg:npm/openapi-to-postmanv2@3.2.1 (t) upgrade to: > 3.2.1
High	pkg:npm/css-minimizer-webpack-plugin@4.2.2 (t) upgrade to: > 4.2.2
High	pkg:npm/ajv@8.20.0 (t) upgrade to: > 8.20.0
High	pkg:npm/mini-css-extract-plugin@2.10.2 upgrade to: > 2.10.2
High	pkg:npm/terser-webpack-plugin@5.6.1 upgrade to: > 5.6.1
High	pkg:npm/@actions/core@1.11.1 upgrade to: > 1.11.1
High	pkg:npm/webpack-dev-server@4.15.2 (t) upgrade to: 5.2.6
High	pkg:npm/webpack@5.109.2 upgrade to: > 5.109.2

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[derekprovance-lob]

Summary

Deps-only PR that does what it says: independently verified 0 criticals on npm audit (59 total, matching the table), the ticket's three lob-openapi criticals (jsonpath-plus, shell-quote, websocket-driver) all resolve fixed in the lockfile, build/spectral/prism deep imports all pass on a clean install. The terser-webpack-plugin declaration is a real latent-bug fix, and the @redocly/cli pin rationale checks out. Good to go; Guardrails staying red is expected and will need the documented override.