fix(api): clear dependency findings and stabilize notification tests (#2077)

## Summary

Clear the production dependency audit and fix the notification test race
that stopped the 4.37.4 release workflow.

## Why This Exists

Work intent: repair [release CI run
34372873045](https://github.com/unraid/api/actions/runs/34372873045) and
ship a follow-up release. The audit reported 19 high and 15 moderate
findings. The notification traversal test failed because a watcher
changed the overview during its assertion.

## Resolution

Update direct dependencies and scoped transitive overrides to patched
versions. Wait for notification service initialization before closing
the watcher in test setup, so initialization cannot create a replacement
watcher after cleanup.

## Reviewer Considerations

- Keep the Tiptap package family aligned and supply its required
y-tiptap peer.
- Upgrade Stylus to remove its vulnerable decoder chain without forcing
an ESM decoder into an older CommonJS caller.
- Use csv-parse 7.0.2 with override syntax shared by pnpm and the npm
release packager. Casbin is its only dependency path, and authorization
and policy tests cover compatibility.
- Keep audit exclusions and production notification behavior unchanged.

## Behavior Changes

Production packages use patched routing, parsing, and editor
dependencies. Notification tests no longer leave a watcher running after
initialization.

## Implementation Summary

Fastify, Undici, DOMPurify, Tiptap, and vulnerable transitive packages
are updated. The latest audit additions are js-yaml 4.3.2 and csv-parse
7.0.2. Both notification test suites wait for initialization before
watcher cleanup, with a regression check for the watcher state.

## Verification

Node 22.18.0 and pnpm 10.15.0:

- Production dependency audit: zero findings.
- Watcher regression: failed before the setup fix and passed afterward.
- Notification suite: 34 passed.
- Focused authentication, authorization, notification, log, and
path-validation suites: 461 passed across 15 files.
- API type check and lint: passed.
- Git diff whitespace check: passed.
- Full builds and cross-package tests run in CI on the updated PR head.

## Risk

Dependency changes affect routing, parsing, and editor code. The
csv-parse override crosses major versions, so authorization tests and
the full CI build are required before release.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Maintenance**
- Updated underlying libraries across the application and shared
packages to newer versions.
- Improved dependency coverage and compatibility for web content
handling, networking, routing, parsing, and UI functionality.
- Added support for collaborative editor functionality in the web
application.

- **Tests**
- Strengthened notification watcher initialization and shutdown coverage
to help ensure reliable notification behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: elibosley

api/package.json

@@ -108,7 +108,7 @@
         "execa": "9.6.0",
         "exit-hook": "4.0.0",
         "fast-xml-parser": "5.8.0",
-        "fastify": "5.8.5",
+        "fastify": "5.12.1",
         "filenamify": "7.0.0",
         "fs-extra": "11.3.1",
         "glob": "11.1.0",
@@ -146,7 +146,7 @@
         "semver": "7.7.2",
         "strftime": "0.10.3",
         "systeminformation": "5.31.7",
-        "undici": "7.28.0",
+        "undici": "7.29.0",
         "uuid": "13.0.2",
         "ws": "8.21.0",
         "zen-observable-ts": "1.1.0",

api/src/unraid-api/graph/resolvers/notifications/notifications.service.spec.ts

@@ -49,13 +49,17 @@ const zeroOverview = (): NotificationOverview => ({
     },
 });
 
-async function disableNotificationsWatcher() {
-    const watcher = Reflect.get(NotificationsService, 'watcher') as {
-        close?: () => Promise<void>;
-    } | null;
-    await watcher?.close?.();
-    Reflect.set(NotificationsService, 'watcher', null);
-    Reflect.set(NotificationsService, 'overview', zeroOverview());
+async function disableNotificationsWatcher(service: NotificationsService) {
+    try {
+        await Reflect.get(service, 'initialization');
+    } finally {
+        const watcher = Reflect.get(NotificationsService, 'watcher') as {
+            close?: () => Promise<void>;
+        } | null;
+        await watcher?.close?.();
+        Reflect.set(NotificationsService, 'watcher', null);
+        Reflect.set(NotificationsService, 'overview', zeroOverview());
+    }
 }
 
 // we run sequentially here because this module's state depends on external, shared systems
@@ -88,7 +92,7 @@ describe.sequential('NotificationsService', () => {
         }).compile();
 
         service = module.get<NotificationsService>(NotificationsService); // this might need to be a module.resolve instead of get
-        await disableNotificationsWatcher();
+        await disableNotificationsWatcher(service);
         vi.spyOn(service, 'paths').mockImplementation(() => testPaths);
 
         await service.deleteAllNotifications();
@@ -218,6 +222,11 @@ describe.sequential('NotificationsService', () => {
         });
     });
 
+    it('keeps the filesystem watcher disabled after initialization', async () => {
+        await Reflect.get(service, 'initialization');
+        expect(Reflect.get(NotificationsService, 'watcher')).toBeNull();
+    });
+
     it('generates unique ids', async () => {
         const notifications = await Promise.all(
             // we break the "rules" here to speed up this test by ~450ms
@@ -620,7 +629,7 @@ describe.concurrent('NotificationsService legacy script compatibility', () => {
         }).compile();
 
         service = module.get<NotificationsService>(NotificationsService);
-        await disableNotificationsWatcher();
+        await disableNotificationsWatcher(service);
     });
 
     it.for([['normal'], ['warning'], ['alert']] as const)(

package.json

@@ -29,11 +29,12 @@
       "ajv@>=7.0.0-alpha.0 <8.18.0": "8.20.0",
       "axios": "1.18.1",
       "body-parser": "2.3.0",
-      "brace-expansion@<1.1.16": "1.1.16",
-      "brace-expansion@>=3.0.0 <5.0.7": "5.0.7",
+      "brace-expansion@<1.1.18": "1.1.18",
+      "brace-expansion@>=3.0.0 <5.0.9": "5.0.9",
+      "csv-parse": "7.0.2",
       "defu": "6.1.7",
       "esbuild": "0.28.1",
-      "fast-uri": "3.1.4",
+      "fast-uri": "3.1.6",
       "fast-xml-parser": "5.8.0",
       "file-type": "22.0.1",
       "flatted": "3.4.2",
@@ -45,24 +46,30 @@
       "js-beautify": "1.15.4",
       "js-cookie": "3.0.8",
       "jiti": "2.7.0",
-      "js-yaml": "4.3.0",
+      "js-yaml": "4.3.2",
       "lodash": "4.18.1",
       "minimatch@<3.1.5": "3.1.5",
       "minimatch@>=9.0.0 <9.0.9": "9.0.9",
       "nuxt": "4.4.8",
       "picomatch@<2.3.2": "2.3.2",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
-      "postcss": "8.5.15",
-      "qs": "6.15.2",
+      "postcss": "8.5.23",
+      "qs": "6.16.0",
       "shell-quote": "1.8.4",
       "protobufjs": "7.6.5",
-      "tar": "7.5.20",
+      "tar": "7.5.21",
       "tmp": "0.2.7",
       "uuid@>=8.0.0 <11.1.1": "11.1.1",
       "uuid@>=11.0.0 <11.1.1": "11.1.1",
       "vue-eslint-parser": "10.4.1",
       "ws": "8.21.0",
-      "yaml": "2.9.0"
+      "yaml": "2.9.0",
+      "find-my-way@>=9.0.0 <9.7.0": "9.7.0",
+      "ip-address@>=10.0.0 <10.3.1": "10.3.1",
+      "nanoid@>=3.0.0 <3.3.18": "3.3.18",
+      "stylus@<0.64.0": "0.64.0",
+      "brace-expansion@>=2.0.0 <2.1.4": "2.1.4",
+      "fastify@>=5.0.0 <5.12.1": "5.12.1"
     },
     "peerDependencyRules": {
       "allowAny": [

packages/unraid-api-plugin-connect/package.json

@@ -62,7 +62,7 @@
         "rxjs": "7.8.2",
         "type-fest": "5.0.0",
         "typescript": "5.9.2",
-        "undici": "7.28.0",
+        "undici": "7.29.0",
         "vitest": "3.2.6",
         "ws": "8.21.0",
         "zen-observable-ts": "1.1.0"
@@ -97,7 +97,7 @@
         "lodash-es": "4.18.1",
         "nest-authz": "2.17.0",
         "rxjs": "7.8.2",
-        "undici": "7.28.0",
+        "undici": "7.29.0",
         "ws": "8.21.0",
         "zen-observable-ts": "1.1.0"
     }

packages/unraid-shared/package.json

@@ -70,7 +70,7 @@
         "lodash-es": "4.18.1",
         "nest-authz": "2.17.0",
         "rxjs": "7.8.2",
-        "undici": "7.28.0",
+        "undici": "7.29.0",
         "ws": "8.21.0"
     }
 }