ruview @ v3548

Source snapshot validated by the CI pipeline. This entry does not contain firmware bundles.

Changes: weaver: release-range fixes + npm audit (mobile, dashboard, rvagent, ruview-cli) (#2468)

• fix(pose-fusion): mark vendored ruvector-attention-wasm copy private

ui/pose-fusion/pkg/ruvector-attention is a wasm-pack build of ruvector-attention-wasm vendored for the browser demo; the npm package is published from ruvnet/ruvector. The vendored manifest declared the same name without "private", so RuView looked like a second publisher of that name (release:name_collision). Marking it private means it can never be npm-published from this repo. Runtime is unchanged: the demo loads the files by relative path.

Co-Authored-By: claude-flow ruv@ruv.net

• fix(harness): bound @ruvnet/ruview-kernel peer range to ^0.1.0

">=0.1.0" accepted any future major of the optional kernel peer (release:open_range). ^0.1.0 matches the 0.x line the bridge was written against; the ruview umbrella already pins kernel 0.1.0 exactly.

Co-Authored-By: claude-flow ruv@ruv.net

• fix(mobile): refresh lockfile for npm audit advisories, raise axios floor

npm audit fix (no --force) on ui/mobile: critical 1 -> 0, high 20 -> 4 (prod tree: critical 1 -> 0, high 18 -> 4). Fixed include shell-quote (critical), axios, @react-navigation/core, ws, node-forge, form-data, js-yaml, lodash, nanoid, postcss, query-string and others. axios floor raised to ^1.21.0 so the manifest no longer admits the vulnerable range.

Left, and why: @expo/cli, @xmldom/xmldom and zod need expo 58 (a major, coupled to react-native); image-size sits under the nested metro 0.84.3 that RN/Expo pin, and its fix (2.0.3) changes the import shape metro uses. image-size is a bundler dependency, not shipped in the app.

Pre-existing on main and unchanged here: strict npm ci fails on the react 19.2.0 / react-dom 19.2.6 peer pair (install needs --legacy-peer-deps), jest cannot load the react-native 0.85 preset without @react-native/jest-preset, and tsc reports the same 5 errors.

Co-Authored-By: claude-flow ruv@ruv.net

• fix(dashboard): vitest 5 + vite 8 to clear critical dev-tool advisories

dashboard's production tree was already audit-clean; every finding was in dev tooling. Critical: vitest (UI server file read/exec, mocker path traversal) and tinypool (prototype pollution to RCE), fixed only in vitest 5; vite <=6.4.3 high. npm audit: critical 2 -> 0, high 9 -> 0.

vite 8 (Rolldown) rejects the object form of manualChunks, so it becomes the equivalent function; the build emits the same chunk set (index, lit, signals, worker, css) and the same PWA precache.

Co-Authored-By: claude-flow ruv@ruv.net

• fix(rvagent): zod 4.6.7 and MCP SDK 1.32.2 to clear runtime advisories

@ruvnet/rvagent's published runtime admitted vulnerable versions: zod <4.6.6 (memory exhaustion validating oversized constrained collections, GHSA-mrhx-c7xc-m3w5; every tool call is parsed by zod) and @modelcontextprotocol/sdk <=1.31.0 with its express, body-parser, proxy-addr (critical) and hono chain. Floors raised to zod ^4.6.7 and sdk ^1.32.2; ts-jest's handlebars (critical) fixed via the lockfile. npm audit: critical 2 -> 0, high 9 -> 0 (prod: 1/6 -> 0/0).

zod 4 ships its own JSON Schema export, so zod-to-json-schema is dropped. The conversion moves to src/json-schema.ts with io "input" (defaulted fields stay optional) and an override that keeps plain objects closed, as zod-to-json-schema advertised them. The advertised tools/list schemas are unchanged apart from zod 4 adding a regex pattern next to format: uuid. z.record now takes an explicit key schema.

tests/dependency-floor.test.ts fails on main (the suite does not compile against zod 3) and passes here: installed and declared floors, closed objects, defaulted fields optional.

Co-Authored-By: claude-flow ruv@ruv.net

• fix(ruview-cli): refresh lockfile for dev-tool npm audit advisories

Production tree was already clean. npm audit fix (no --force) clears handlebars (critical, via ts-jest), brace-expansion, browserslist and js-yaml: critical 1 -> 0, high 3 -> 0.

Co-Authored-By: claude-flow ruv@ruv.net

• chore(rvagent): 0.2.1

Publishes the zod / MCP SDK floor change so npm consumers stop resolving the vulnerable versions.

Co-Authored-By: claude-flow ruv@ruv.net

• chore(harness): refresh content manifest for the kernel peer range

The harness manifest pins a hash of package.json; regenerated with npm run manifest:update after the ^0.1.0 peer change.

Co-Authored-By: claude-flow ruv@ruv.net

Source commit: a913103052fb192da7bec69ee7d75b6afae51aa9

Container images publish separately through the sensing-server release workflow. Firmware downloads are attached to the dedicated vX.Y.Z-esp32 releases.