Security dependency refresh + EBADENGINE cleanup: npm audit 106 -> 53

[olsonanl]

Refreshes vulnerable dependencies. npm audit: 106 → 57 (critical 15→11, high 59→24).
No first-party code changes — offline test results are identical to pristine alpha.

Also closes out the nine stale dependabot PRs (see bottom).

What changed

Most of the win (49 advisories) came from npm audit fix --package-lock-only, which needed
no package.json edits at all — it just re-resolved in-range transitives. Only three
manifest entries moved:

dep	from	to	why it's safe
ejs	^2.7.4	^3.1.10	Major, but the 2→3 break is removal of old-style <% include x %>. views/ contains zero includes and all 5 templates compile clean under 3.1.10 (verified).
nodemailer	^6.10.1	^9.0.5	Major, but lib/mailer.js uses only createTransport (sendmail / SMTP / auth / tls) and callback-style sendMail — all exercised against 9.0.5. Clears a critical command-injection advisory in a dep added days ago in #190.
nconf	^0.10.0	^0.13.0	Major, but config.js:234 is the sole consumer — one chained argv().env().file().defaults(). Verified identical resolution on 0.13.0.

Deliberately not bumped

npm audit fix --force offers these. Each is a real breaking change, not a version bump:

• redis 2.x → 4+ — v4 removed the callback API. rpc/proteinFamily.js and
  routes/dataRouter.js both use client.get(key, cb) and client.set(k, v, 'EX', ttl).
  Needs a rewrite plus an apicache compatibility check.
• forever / pm2 — process supervisors; grep require('forever') → 0 hits. Their CVEs
  are ops surface, not request path.
• request-promise / request — deprecated upstream, no fix exists. Still used by
  routes/genomePermissionRouter.js and several tests. Retiring means porting to axios
  (already a direct dep at 1.19.0) — worth doing as its own change.
• mocha 7 → 11 — dev-only, needs a test-suite pass.

Where the remaining 57 live

Almost none are reachable from first-party request-path code:

• p3-user tree — 6 of the 11 criticals (bson, plus nested ejs 2.5.9, nconf 0.6.9,
  nodemailer 1.11.0, forever). These are copies inside the p3-user git dependency,
  which pins its own versions, so our upgrades can't reach them. Being fixed upstream in
  p3_user right now — once that lands, re-pin the git SHA here and re-audit.
• pm2 / forever trees — 11. See above.
• npm bundled — 3. Vendored inside the npm dependency's own node_modules.
• axios — the direct dep is already latest (1.19.0) and clean; the alert is
  @pm2/js-api's pinned 0.21.4.

Verification

• app.js loads; config, lib/mailer, lib/indexRetry, lib/solrjs all require clean.
• Offline suites (test-util, test-join, test-distributed): 247 passing / 2 failing —
  numerically identical to a pristine alpha worktree, so no regressions.
• Those 2 failures are pre-existing on alpha and documented in CLAUDE.md:
  test.fastaHeaderFormatter.spec.js ("missing values gracefully") and
  test.config.spec.js ("return current configuration", config-key drift).
• npx eslint on the touched files: 56 errors, unchanged from baseline.
• nodemailer 9.0.5 exercised directly: sendmail transport, SMTP transport, SMTP+auth, and
  callback sendMail all behave as lib/mailer.js expects.

CLAUDE.md

Adds a Dependency Security Maintenance section recording the analysis, the do-not-bump
list with reasons, the re-run procedure (the isDirect / fixAvailable.isSemVerMajor
grouping one-liner), and the two pre-existing test failures so they aren't misread as
regressions later.

Stale dependabot PRs

#117, #118, #123, #124, #125, #126, #128, #129, #133 are obsolete — 2022–2023 vintage,
all targeting master, all CONFLICTING, and every package they name is either already
patched or superseded here. Recommend closing rather than merging. A companion PR applies
this same refresh to master.

🤖 Generated with Claude Code

---

Update: second commit — EBADENGINE cleanup (ports #193 to alpha)

A production npm install on Node 22.4.1 printed 80+ EBADENGINE warnings. Root cause was
two dependencies that should never have been declared:

• npm and install removed. Neither is imported (require('npm') / require('install')
  → 0 hits) and nothing invokes node_modules/.bin/npm. Prod runs from a persistent checkout
  on the system npm, so the vendored npm@11.19.0 was never doing the installing. Both
  arrived incidentally in 84e20f6f, a commit about solrjs that never mentions them.

  Declaring npm vendors the entire npm CLI: 143 of 1339 lockfile entries lived under
  node_modules/npm/, and its subpackages require node: ^20.17.0 || >=22.9.0 — unsatisfied
  by prod's 22.4.1. npm was warning that a vendored copy of itself, which nothing would ever
  execute, didn't match the running Node.

• apicache ^1.6.2 → ^1.6.3. The one remaining warning; 1.6.2 declares
  node: >=8 <=15, 1.6.3 relaxes to >=8. routes/dataRouter.js:15 usage verified unchanged.

Revised totals for this PR

	before	after
npm audit	106	53 (crit 15→11, high 59→22)
EBADENGINE warnings	80+	0
lockfile entries	1336	1191 (−145)

Offline suites still 247 passing / 2 failing, matching pristine alpha exactly.

Confirmed on the live prod checkout after #193 merged: removed 145 packages … 53 vulnerabilities, no EBADENGINE output.

CLAUDE.md gains a "Never declare npm as a dependency" note with the mechanism, and flags
that the repo pins no Node version (no engines, no .nvmrc) so nothing catches this drift.

---

Update: third commit — deprecation warnings

Separate axis from vulnerabilities (npm audit never reports these). Traced each warning to
its source; only one was fixable from this repo:

• uuid ^2.0.1 → ^11.1.1. Root dep, used solely as Uuid.v4() at
  routes/indexer.js:204. That named export is unchanged. uuid 11 is "type": "module", but
  its exports map carries a node.require condition, so plain CJS require('uuid') still
  resolves — verified rather than assumed.

Everything else is transitive and belongs upstream:

warning	source
nodemailer@1.11.0, mailcomposer@2.1.0, buildmail@2.0.0	p3-user's pinned nodemailer 1.x (mailcomposer/buildmail are its deps)
bson@0.2.22	p3-user → ^0.2.17
rimraf@3.0.2	@mapbox/node-pre-gyp, flat-cache, temp, utile
@humanwhocodes/*	eslint@7's own deps

eslint 7 → 8 was attempted and reverted. eslint-config-standard@12 and
eslint-plugin-import@2.22 both pin peer eslint <= 7, so npm fails ERESOLVE. It needs the
whole standard/plugin stack moved together plus a lint re-run — its own change.

request-promise@4.2.2 is a root dep and genuinely deprecated, but retiring it means porting
routes/genomePermissionRouter.js and several tests to axios. Already in the do-not-bump list.

No audit delta (53 → 53; uuid 2 carried a deprecation, not an advisory). Offline suites still
247 passing / 2 pre-existing failures. CLAUDE.md gains a deprecation table with provenance.