audit: deep full-surface hardening with atomic P1 fixes#24

Closed

ndycode wants to merge 7 commits into

mainfrom

audit/20260301-deep-audit

Commits on Mar 1, 2026

fix(security): harden audit gates and patch vulnerable dependencies
ndycode
committed
fix(request): correct timeout/failover and retry-after handling
ndycode
committed
fix(refresh): preserve in-flight dedupe for stale refresh entries
ndycode
committed
fix(auth): reject code exchange responses without refresh token
ndycode
committed
fix(refresh): add timeout self-healing for stalled refresh operations
ndycode
committed
fix(auth): stop logging raw OAuth token responses

ndycode
and
codex
committed
fix(auth): remove token field names from log metadata

ndycode
and
codex
committed