Clear the Dependabot alerts: what's shipped, what's dev-only, and the plan #37

GitHub listed 25 open Dependabot alerts on verifier-plugin when this was written. 7 new undici alerts arrived on 29 October, and PRs 1 to 3 have since fixed 31, so only @stablelib/ed25519 is open. All were labelled "development". That label comes from package.json, where verifier-core is a devDependency, but the plugin bundles verifier-core and its dependencies into dist/. So the real test is what's inside the built plugin (dist/THIRD_PARTY_LICENSES.md lists every bundled package).

In the shipped plugin (5 alerts)

Exposure for fast-uri looks low, and PR 1 (#38) tests it: ajv calls it only while compiling the Open Badges schemas bundled with verifier-core, on those schemas' own addresses, and checking a credential never calls it. A credential's web addresses are checked only as strings: none of the bundled schemas uses format: uri. (Corrected 29 October 2026: this used to say they were checked by a regular expression in ajv-formats.)

Development and CI only, not in the built plugin (27 alerts)

Plan, one small PR each

• PR 1: fast-uri 3.1.9. The only change to shipped code; show the built plugin differs only in fast-uri, and smoke-test the preview. Done in Move fast-uri to 3.1.9 #38; its 4 alerts closed on merge.
• PR 2: patch updates within existing ranges (vite, the vite 7 copy, undici, shell-quote, source-map-js). Lockfile only; vite builds the plugin, so compare the built output before and after. Done in Take the patched dev tools in #37: vite, undici, shell-quote, source-map-js #39; its 22 alerts closed on merge. The newer vite minifies the shipped code differently; side-by-side runs and the smoke test found no change in behaviour.
• PR 3: Vitest 3 → 4 or later. A major upgrade of the test runner the consistency suite depends on (including its pause between tests and the nameless tests' 30 s limit): CI sampled several times, mutation checks that the safety nets still fail when they should. Done in Take Vitest 4.1.12 for the last dev-tool alerts in #37 #41 (Vitest 4.1.12); its 5 alerts closed on merge. The built plugin is byte-identical; the same 105,720 tests pass and deliberate mistakes fail the same tests on both versions; CI passed three runs out of three.
• Upstream: @stablelib/ed25519 stays open until Ed25519Signature2020 path bundles @stablelib/ed25519 1.0.3 (GHSA-x3ff-w252-2g7j) verifier-core#84 is resolved.
• Upstream: zod 3.25.76 (GHSA-mrhx-c7xc-m3w5, high) is bundled through verifier-core but has no open alert here: Dependabot dismissed it automatically (Let a host say its registry list didn't load #21) as development-only. Low impact (a huge crafted credential can exhaust memory; verdicts are unaffected). Tracked in Bound the arrays the credential gate parses (zod GHSA-mrhx-c7xc-m3w5, Dependabot #61, #62) verifier-core#85.

After PRs 1 and 2, 6 alerts remain (all dev-only, plus @stablelib); after PR 3, only @stablelib.

The wallet and verifier-core have their own lockfiles; this issue covers verifier-plugin only. Nothing here reaches the wallet until its verifier-plugin pin is bumped.