fix(security): refresh vulnerable runtime dependencies

cli/package-lock.json

@@ -15,7 +15,7 @@
         "@types/node": "22.19.0",
         "commander": "15.0.0",
         "esbuild": "0.28.2",
-        "tar": "7.5.20",
+        "tar": "7.5.21",
         "typescript": "5.2.2"
       },
       "engines": {
@@ -573,9 +573,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.20",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz",
-      "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==",
+      "version": "7.5.21",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.21.tgz",
+      "integrity": "sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {

cli/package.json

@@ -27,7 +27,7 @@
     "esbuild": "0.28.2",
     "typescript": "5.2.2",
     "@types/node": "22.19.0",
-    "tar": "7.5.20"
+    "tar": "7.5.21"
   },
   "license": "Apache-2.0",
   "repository": {

package.json

@@ -116,6 +116,10 @@
       "@codemirror/view": "6.39.16",
       "proxy-addr": "2.0.8",
       "websocket-driver": "0.7.5",
+      "body-parser": "1.20.9",
+      "lodash": "4.18.1",
+      "protobufjs": "7.6.1",
+      "undici@6": "6.29.1",
       "brace-expansion@1": "1.1.21",
       "brace-expansion@2": "2.1.7"
     }
@@ -127,7 +131,7 @@
     "@grpc/proto-loader": "^0.8.0",
     "@keyv/sqlite": "^4.0.1",
     "@otplib/preset-default": "^12.0.1",
-    "body-parser": "^1.20.3",
+    "body-parser": "^1.20.9",
     "celebrate": "^15.0.3",
     "chokidar": "^4.0.1",
     "compression": "1.8.2",
@@ -148,10 +152,10 @@
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "keyv": "^5.2.3",
-    "lodash": "^4.17.21",
-    "multer": "2.4.0",
+    "lodash": "^4.18.1",
+    "multer": "2.5.0",
     "node-cron": "4.6.0",
-    "nodemailer": "^10.0.9",
+    "nodemailer": "^10.1.4",
     "p-queue-cjs": "7.3.4",
     "proper-lockfile": "^4.1.2",
     "ps-tree": "^1.2.0",
@@ -162,11 +166,11 @@
     "sqlite3": "npm:@whyour/sqlite3@1.1.4",
     "toad-scheduler": "^3.0.1",
     "typedi": "^0.10.0",
-    "undici": "^7.9.0",
+    "undici": "^7.30.1",
     "uuid": "^11.0.3",
     "winston": "^3.17.0",
     "winston-daily-rotate-file": "^5.0.0",
-    "tar": "7.5.20"
+    "tar": "7.5.21"
   },
   "devDependencies": {
     "@ant-design/icons": "^5.0.1",