[api] audit fixes: account tests, dependencies and security hardening (#54)

* test(accounts): cover three username changes

* chore(deps): update vulnerable runtime dependencies

* fix(security): bound uploads and validate token subjects strictly

---------

Co-authored-by: Nexi (CWN) <communityshieldofficial@gmail.com>

packages/hono-helpers/package.json

@@ -12,7 +12,7 @@
 	},
 	"dependencies": {
 		"@hono/standard-validator": "0.2.2",
-		"hono": "4.12.27",
+		"hono": "4.13.5",
 		"http-codex": "0.6.7",
 		"workers-tagged-logger": "1.0.1",
 		"zod": "4.4.3"

packages/jwt/package.json

@@ -11,7 +11,7 @@
 	},
 	"dependencies": {
 		"@repo/domain": "workspace:*",
-		"hono": "4.12.27"
+		"hono": "4.13.5"
 	},
 	"devDependencies": {
 		"@cloudflare/workers-types": "4.20260630.1",

packages/jwt/src/jwt.ts

@@ -52,8 +52,12 @@ export async function validateAndGetAccountId(
 	const accountId = await getAccountIdFromToken(token, secret)
 	if (!accountId) return null
 
-	const id = Number.parseInt(accountId, 10)
-	return Number.isNaN(id) ? null : id
+	// `parseInt("42junk", 10)` is 42, which lets a malformed subject select a real
+	// account. Token subjects are canonical positive base-10 account ids: reject
+	// partial parses, signs, decimals, leading zeroes and values outside JS's safe range.
+	if (!/^[1-9]\d*$/.test(accountId)) return null
+	const id = Number(accountId)
+	return Number.isSafeInteger(id) ? id : null
 }
 
 /**

packages/workspace-dependencies/package.json

@@ -36,7 +36,7 @@
 	"dependencies": {
 		"esbuild": "0.28.1",
 		"slugify": "1.6.9",
-		"wrangler": "4.105.0",
+		"wrangler": "4.128.0",
 		"yaml": "2.9.0",
 		"zod": "4.4.3",
 		"zx": "8.8.5"