fix(deps): resolve audit failures

package.json

@@ -44,7 +44,7 @@
     "maxmind": "^4.3.29",
     "minio": "^8.0.7",
     "pdfjs-dist": "^4.10.38",
-    "puppeteer": "^23.3.0",
+    "puppeteer": "^25.7.0",
     "puppeteer-extra": "^3.3.6",
     "puppeteer-extra-plugin-block-resources": "^2.4.3",
     "robots-parser": "^3.0.1",
@@ -94,7 +94,7 @@
     },
     "civkit": {
       "minimatch": "^10.2.4",
-      "brace-expansion": "5.0.6"
+      "brace-expansion": "5.0.9"
     },
     "yargs": "^18.0.0"
   },

src/services/puppeteer.ts

@@ -12,9 +12,13 @@ import type {
   HTTPResponse,
   Page,
   Viewport,
-} from "puppeteer";
+} from "puppeteer" with { "resolution-mode": "import" };
 import type { Cookie } from "set-cookie-parser";
-import puppeteer, { TimeoutError } from "puppeteer";
+
+const { default: puppeteer, TimeoutError } =
+  require("puppeteer") as typeof import("puppeteer", {
+    with: { "resolution-mode": "import" },
+  });
 
 import { Defer, Deferred } from "civkit/defer";
 import { AssertionFailureError, ParamValidationError } from "civkit/civ-rpc";

src/services/serp/puppeteer.ts

@@ -9,9 +9,13 @@ import type {
   GoToOptions,
   Page,
   Viewport,
-} from "puppeteer";
+} from "puppeteer" with { "resolution-mode": "import" };
 import type { Cookie } from "set-cookie-parser";
-import puppeteer, { TimeoutError } from "puppeteer";
+
+const { default: puppeteer, TimeoutError } =
+  require("puppeteer") as typeof import("puppeteer", {
+    with: { "resolution-mode": "import" },
+  });
 
 import { Defer } from "civkit/defer";
 import { AssertionFailureError, ParamValidationError } from "civkit/civ-rpc";

tests/security-governance.test.cjs

@@ -79,18 +79,16 @@ test("security-sensitive dependency floors stay above blocked axios and basic-ft
   const axiosRange = packageJson.dependencies.axios.replace(/^[^\d]*/, "");
   const lockedAxiosVersion = packageLock.packages["node_modules/axios"].version;
   const lockedBasicFtpVersion =
-    packageLock.packages["node_modules/basic-ftp"].version;
+    packageLock.packages["node_modules/basic-ftp"]?.version;
 
   assert.ok(
     compareVersions(axiosRange, "1.15.0") >= 0,
     `Expected axios floor >= 1.15.0, received ${packageJson.dependencies.axios}`,
   );
-  assert.doesNotMatch(
+  assert.doesNotMatch(lockedAxiosVersion, /^1\.14\.0$/);
-    lockedAxiosVersion,
-    /^1\.14\.0$/,
-  );
   assert.ok(
-    compareVersions(lockedBasicFtpVersion, "5.2.2") >= 0,
+    !lockedBasicFtpVersion ||
+      compareVersions(lockedBasicFtpVersion, "5.2.2") >= 0,
     `Expected basic-ftp lock >= 5.2.2, received ${lockedBasicFtpVersion}`,
   );
 });