You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[failproofai-legion-966] Replace #965 and #955, and clear every fixable Dependabot alert - #966
One PR for three jobs: #965 and #955 redone so they install, and every Dependabot alert that has a fix, fixed. 19 alerts are open. 12 close with this PR and 7 stay open, all on framework floors where no fix exists on the line the fixture holds (below).
Nothing here ships. Every changed lockfile belongs to a "private": true integration fixture, and neither published package includes them.
npm ci failed ERESOLVE: @mastra/mcp@2.7.0 peers on @mastra/core >=1.79.0, and #965 left the fixture on 1.68.0. Global setup installs every fixture before any test runs, so all four integration shards went down with it. The job log never says so: vitest crashes while printing the error, and the log shows only code.charCodeAt is not a function. Reproduced by putting #965's manifests back under the harness.
This PR takes the new versions, with what they need:
Package
Was
Now
@mastra/core
1.68.0
1.81.0
@mastra/mcp
2.0.0
2.7.0
@mastra/memory
1.31.0
1.40.0
@modelcontextprotocol/node
2.0.0
2.1.2
@hono/node-server
1.19.17
2.1.6
mastra-1 is not a floor, so moving inside 1.x is fair. ts-sdk-fixture-pins.test.ts still holds it on 1.
nextjs moves @mastra/core to 1.81.0 too, because it compares each route's trace with this fixture's. Nothing enforced that, and Dependabot resolves one directory at a time, so there is now a test.
Three overrides retire. @mastra/mcp 2.7.0 pins fixed @modelcontextprotocol/client and /server releases itself. argparse goes because @mastra/core no longer reaches gray-matter, and left in place it would have forced js-yaml@5 onto the wrong argparse major.
#955 moved @mastra/core from 0.24.9 to 1.80.0. That deletes the floor this fixture exists to hold: SECURITY.md says to close such a PR, and ts-sdk-fixture-pins.test.ts failed on it. It did not install either, because @mastra/mcp@0.14.5 peers on <0.25.0. So that version is not brought across to mastra-0. The 1.x line it reached for is what mastra-1 now tests, at 1.81.0. What is brought across is what #955 was for, the fixes:
Package
Was
Now
How
@hono/node-server
2.1.1
2.1.6
In range
systeminformation
5.33.13
5.33.19
In range
gaxios
7.1.3
7.3.1
Override; gcp-metadata pins it exactly
rimraf, glob, minimatch and 21 more
removed
gaxios after 7.1.3 no longer needs rimraf
nested zod
3.25.76
removed
Override to the fixture's own zod
zod
4.6.6
4.6.7
The release every other zod 4 fixture pins
@mastra/core 0.24.9, @mastra/mcp 0.14.5, @mastra/memory 0.15.13 and ai 4.3.19 resolve exactly as before.
Closing #955 alone would have brought it back. It opened after #950 added ignore: @mastra/* >=1.0.0 to this fixture. Its job log shows why that did not hold: the package being updated was @ai-sdk/provider-utils, which nothing ignored, and removing it ran npm install @mastra/core@1.80.0 --force. The ignore then took only the names out of the PR's description (Filtered dependencies filtered by dependabot.yml config: @mastra/core, @mastra/memory). A range is read for the package being updated, not for a parent moved on its behalf.
So @ai-sdk/provider-utils gets its own >=3.0.0 range on mastra-0 and ai-4. ai-4's job lists the same package and has so far ended at zod's all_versions_ignored before checking it. This can only be fully proven by Dependabot's next run after merge; ai, which has the same nested shape, already logs All updates for ai were ignored from the same kind of range.
The other alerts
deepmerge has no patched release (GHSA-gcqx-w48m-w2h4). llamaindex-0.11, llamaindex-0.12 and nextjs reach it only through html-to-text@9.0.5, and 10.x replaced it with deepmerge-ts. A fixture-local override takes it out of the tree, the way [failproofai-legion-904] Clear the fixable Dependabot alerts: mcp in the SDK lock, sprintf-js in two fixtures #904 removed sprintf-js. The only consumer imports htmlToText, which 10.x still exports. No fixture runs that code, so I drove HTMLNodeParser.parseNodes directly, under ESM and CJS on Node 20 and 24, on both LlamaIndex versions, and got the expected text each time.
Nested zod 3 leaves mastra-0 and langchain-dup-core, which SECURITY.md had listed as held there. @mastra/mcp and @mastra/schema-compat call zod-from-json-schema-v3 only when the root zod has no toJSONSchema, which a zod 4 root does. @langchain/core@0.3.80 imports only zod/v3 and zod/v4/core, which zod 4 also ships. langchain-dup-core still nests its second @langchain/core, which is what it exists to test.
All 7 are already accepted in SECURITY.md. Re-checked today: each locked version is still the newest stable release on its line, so each fix is a major its fixture exists to stay below or whose framework cannot take it. No code path in these fixtures reaches them with untrusted input.
GitHub will keep listing them as open. Clearing them would take dropping ai 4.x, LangChain 0.3, LlamaIndex 0.11 and Mastra 0.x from the SDK's supported range, or dismissing the alerts. This PR does neither; both are a maintainer's call.
Verified locally
All in the CI job's own commands, in node:20 and node:24 containers:
Job
Result
Supply Chain, the gate's exact arguments on ghcr.io/google/osv-scanner-action:v2.5.0
No issues found, exit 0
Same scanner over all 15 fixture lockfiles as well
Only the 7 above
failproofai-ts-sdk-integrationsframeworks, Node 20 and Node 24
1036 passed, 4 skipped; same as main
failproofai-ts-sdk-integrationsruntimes, Node 24
1132 passed under Node, Bun and Deno
failproofai-ts-sdk-integrationsnextjs, Node 24
60 passed across five next build variants; same as main
bun run test:run
8847 passed, 11 skipped, in 2 of 3 runs: main's 8836 plus the 11 new tests. The third hit a timing flake in envelope-budget.test.ts (33 ms against a 28 ms bound on a busy machine; 351/351 run alone, and this PR touches nothing it exercises). main flaked once in 3 runs too, on publish-command.test.ts
bun run test:e2e
375 passed, 7 skipped
bun run lint, tsc --noEmit
0 errors, and the same 5 existing warnings
CI agrees on all 28 checks, with the same counts. test passes 8858 of 8858 in all three env configs, so the envelope-budget flake above was this machine's load.
Each new assertion in ts-sdk-fixture-pins.test.ts was broken on purpose to confirm it fails: the provider-utils range removed from mastra-0, widened past the fix on ai-4, the old mastra-0 lockfile with its nested zod restored, and nextjs one release behind its twin.
Supersedes #965 and #955. Both are closed with a link here.
…965 and #955#965 moved @mastra/mcp to 2.7.0 in mastra-1, which peers on @mastra/core
>=1.79.0 while the fixture stayed on 1.68.0, so `npm ci` failed ERESOLVE and
took down every shard that installs it. #955 moved @mastra/core to 1.80.0 in
mastra-0, off the floor that fixture holds, and @mastra/mcp@0.14.5 cannot
install beside that either.
mastra-1 takes the new versions with what they need: @mastra/core 1.81.0,
@mastra/mcp 2.7.0, @mastra/memory 1.40.0. That brings
@modelcontextprotocol/node 2.1.2 and @hono/node-server 2.1.6, and retires the
@modelcontextprotocol/client, @modelcontextprotocol/server and argparse
overrides. nextjs moves @mastra/core with it, because it compares each route's
trace with this fixture's.
mastra-0 stays on Mastra 0.x. @hono/node-server and systeminformation move in
range. An override moves gaxios 7.1.3 -> 7.3.1, which gcp-metadata pins exactly
and which no longer needs rimraf, so rimraf, glob, minimatch and 21 more
packages leave the tree.
deepmerge has no patched release. llamaindex-0.11, llamaindex-0.12 and nextjs
reach it only through html-to-text 9, and html-to-text 10 replaced it with
deepmerge-ts, so an override takes it out of the tree.
mastra-0 and langchain-dup-core drop their nested zod 3 by overriding zod to
their own zod 4. @mastra/mcp and @mastra/schema-compat read
zod-from-json-schema-v3 only under a zod 3 root, and @langchain/core@0.3.80
imports only zod/v3 and zod/v4/core, which zod 4 also ships.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KYzGfYysR6TiCoMXnAMbW6
#955 opened after .github/dependabot.yml ignored `@mastra/*` on mastra-0, and
moved @mastra/core to 1.80.0 anyway. Its job log shows why: the package being
updated was @ai-sdk/provider-utils, which nothing ignored, and removing it ran
`npm install @mastra/core@1.80.0 --force`. The ignore then only took those names
out of the PR's description. A range is read for the package being updated, not
for a parent moved on its behalf.
So @ai-sdk/provider-utils gets its own range on ai-4 and mastra-0. ai-4 lists the
same package in its job, which has so far ended at zod's all_versions_ignored
before checking it, so the range is there for when that stops being the case.
ts-sdk-fixture-pins.test.ts now fails when a floor installing
@ai-sdk/provider-utils 2 has no such range, when zod 3 appears outside the three
fixtures SECURITY.md accepts it in, or when a nextjs framework pin leaves its
twin, which Dependabot cannot keep together because it resolves one directory at
a time. Each new assertion was broken on purpose to confirm it fails.
SECURITY.md records the fix pattern this work relied on (override the parent to
a release that no longer needs the package) and narrows the zod row to three
fixtures.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KYzGfYysR6TiCoMXnAMbW6
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.
Walkthrough
TypeScript integration fixtures update dependency versions and overrides. Dependabot rules, security guidance, changelogs, and CI checks are updated to reflect and validate the fixture dependency changes.
Fixture manifests update Mastra and Zod versions, add dependency overrides, and remove selected overrides. The SDK changelog records these changes, including html-to-text overrides and removal of nested Zod 3 copies.
Dependabot adds @ai-sdk/provider-utils ignore ranges for ai-4 and mastra-0. Security guidance and changelogs describe transitive dependency handling and limit the documented Zod advisory fixtures to three.
FailproofAI/failproofai#934: Restores TypeScript fixture release pins and adds the original fixture-pin checks that this PR extends.
FailproofAI/failproofai#950: Adds Dependabot ignore ranges and CI assertions for the same fixture floors, which this PR updates.
Suggested reviewers:hermes-exosphere
Merge Risk: Moderate · up to 0b69b
Align the html-to-text override with the SDK’s Node floor, or explicitly raise that floor before merging.
Pre-merge checks: 4 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Description check
The description is thorough and substantive. It states what the PR does (replaces #965 and #955, clears fixable Dependabot alerts, 12 closed and 7 left open), why each change is needed, and which fixt…
Add the 'Type of Change' section and tick the applicable box. This PR is a dependency and fixture maintenance change, so 'Bug fix' is the closest option, but the author should choose. Tick the four checklist items, or state why each one doe…
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title clearly identifies the replacement of PRs #965 and #955 and the Dependabot alert fixes, which are the main changes.
Linked Issues check
The only linked issue is #958, which is closed. Its state is marked as historical context only, so its acceptance criteria are not requirements for this pull request. No active directly linked targets…
Out of Scope Changes check
The changed files match the stated purpose: replacing #965 and #955 with installable fixture updates and clearing fixable Dependabot alerts. The changes are: (1) fixture manifests for mastra-0, mastra…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Full details: Linked Issues check
Explanation
The only linked issue is #958, which is closed. Its state is marked as historical context only, so its acceptance criteria are not requirements for this pull request. No active directly linked targets remain, and no linked-issue coding requirements apply. The PR objectives section reaches the same conclusion.
Full details: Out of Scope Changes check
Explanation
The changed files match the stated purpose: replacing #965 and #955 with installable fixture updates and clearing fixable Dependabot alerts. The changes are: (1) fixture manifests for mastra-0, mastra-1, nextjs, llamaindex-0.11, llamaindex-0.12, and langchain-dup-core, which set the version floors and overrides described in the PR; (2) .github/dependabot.yml ignore ranges for @ai-sdk/provider-utils and @mastra/core, which keep the fixture floors enforced; (3) tests/ci/ts-sdk-fixture-pins.test.ts, which adds assertions for those floors and fixture twins; (4) SECURITY.md, CHANGELOG.md, and sdk/typescript/CHANGELOG.md entries that document the same changes. The changelog text describes this PR's work and does not add unrelated release content. The six fixture lockfiles were excluded from review (rule !**/package-lock.json) and were not inspected. Their content was judged only through the matching manifest changes and the PR description. No unrelated change was demonstrated.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (10 skipped: 10 unsupported.)
Full details: Description check
Explanation
The description is thorough and substantive. It states what the PR does (replaces #965 and #955, clears fixable Dependabot alerts, 12 closed and 7 left open), why each change is needed, and which fixtures are affected. It also lists the verification commands and results. It does not follow the repository template exactly: the 'Type of Change' section is missing, and none of the four checklist boxes are ticked. The checklist results are reported in the Verified locally section, but that is not the same as the template's checklist. The Description section is present in substance.
Resolution
Add the 'Type of Change' section and tick the applicable box. This PR is a dependency and fixture maintenance change, so 'Bug fix' is the closest option, but the author should choose. Tick the four checklist items, or state why each one does not apply. The commands listed in the template are npm run lint, npx tsc --noEmit, npm run test:run, and npm run build. The PR reports bun run lint, tsc --noEmit, and bun run test:run, which do not match the template commands exactly. Confirm that npm run build was run, and add it to the checklist or note its result.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
ESLint
If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.
__tests__/ci/ts-sdk-fixture-pins.test.ts
ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.
A rabbit checks each pin in place, Zod and Mastra set their pace. Overrides shift, old copies go, Dependabot learns what ranges show. Lockfile versions pass the test, Then carrots crown the branch’s nest.
@mastra/mcp imports zod-from-json-schema-v3 eagerly and only calls it under a
zod 3 root, and @langchain/core@0.3.80 does load zod/v3, now from zod 4's package.
So "a nested copy that nothing in the fixture loads" was wrong. What holds is that
those consumers do not need the old major.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KYzGfYysR6TiCoMXnAMbW6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
One PR for three jobs: #965 and #955 redone so they install, and every Dependabot alert that has a fix, fixed. 19 alerts are open. 12 close with this PR and 7 stay open, all on framework floors where no fix exists on the line the fixture holds (below).
Nothing here ships. Every changed lockfile belongs to a
"private": trueintegration fixture, and neither published package includes them.#965 →
mastra-1npm cifailedERESOLVE:@mastra/mcp@2.7.0peers on@mastra/core >=1.79.0, and #965 left the fixture on 1.68.0. Global setup installs every fixture before any test runs, so all four integration shards went down with it. The job log never says so: vitest crashes while printing the error, and the log shows onlycode.charCodeAt is not a function. Reproduced by putting #965's manifests back under the harness.This PR takes the new versions, with what they need:
@mastra/core@mastra/mcp@mastra/memory@modelcontextprotocol/node@hono/node-servermastra-1is not a floor, so moving inside 1.x is fair.ts-sdk-fixture-pins.test.tsstill holds it on 1.nextjsmoves@mastra/coreto 1.81.0 too, because it compares each route's trace with this fixture's. Nothing enforced that, and Dependabot resolves one directory at a time, so there is now a test.@mastra/mcp2.7.0 pins fixed@modelcontextprotocol/clientand/serverreleases itself.argparsegoes because@mastra/coreno longer reachesgray-matter, and left in place it would have forcedjs-yaml@5onto the wrongargparsemajor.@hono/node-server2.1.6 came out today with fixes for three more advisories that have not reached Dependabot yet (GHSA-jpvv-r467-5p4w, GHSA-7v5p-43qr-wch5, GHSA-qv5m-9pm6-hqp3). It has npm provenance.#955 →
mastra-0, without the move#955 moved
@mastra/corefrom 0.24.9 to 1.80.0. That deletes the floor this fixture exists to hold:SECURITY.mdsays to close such a PR, andts-sdk-fixture-pins.test.tsfailed on it. It did not install either, because@mastra/mcp@0.14.5peers on<0.25.0. So that version is not brought across tomastra-0. The 1.x line it reached for is whatmastra-1now tests, at 1.81.0. What is brought across is what #955 was for, the fixes:@hono/node-serversysteminformationgaxiosgcp-metadatapins it exactlyrimraf,glob,minimatchand 21 moregaxiosafter 7.1.3 no longer needsrimrafzodzod@mastra/core0.24.9,@mastra/mcp0.14.5,@mastra/memory0.15.13 andai4.3.19 resolve exactly as before.Closing #955 alone would have brought it back. It opened after #950 added
ignore: @mastra/* >=1.0.0to this fixture. Its job log shows why that did not hold: the package being updated was@ai-sdk/provider-utils, which nothing ignored, and removing it rannpm install @mastra/core@1.80.0 --force. The ignore then took only the names out of the PR's description (Filtered dependencies filtered by dependabot.yml config: @mastra/core, @mastra/memory). A range is read for the package being updated, not for a parent moved on its behalf.So
@ai-sdk/provider-utilsgets its own>=3.0.0range onmastra-0andai-4.ai-4's job lists the same package and has so far ended at zod'sall_versions_ignoredbefore checking it. This can only be fully proven by Dependabot's next run after merge;ai, which has the same nested shape, already logsAll updates for ai were ignoredfrom the same kind of range.The other alerts
deepmergehas no patched release (GHSA-gcqx-w48m-w2h4).llamaindex-0.11,llamaindex-0.12andnextjsreach it only throughhtml-to-text@9.0.5, and 10.x replaced it withdeepmerge-ts. A fixture-local override takes it out of the tree, the way [failproofai-legion-904] Clear the fixable Dependabot alerts: mcp in the SDK lock, sprintf-js in two fixtures #904 removedsprintf-js. The only consumer importshtmlToText, which 10.x still exports. No fixture runs that code, so I droveHTMLNodeParser.parseNodesdirectly, under ESM and CJS on Node 20 and 24, on both LlamaIndex versions, and got the expected text each time.mastra-0andlangchain-dup-core, whichSECURITY.mdhad listed as held there.@mastra/mcpand@mastra/schema-compatcallzod-from-json-schema-v3only when the root zod has notoJSONSchema, which a zod 4 root does.@langchain/core@0.3.80imports onlyzod/v3andzod/v4/core, which zod 4 also ships.langchain-dup-corestill nests its second@langchain/core, which is what it exists to test.@modelcontextprotocol/nodemastra-1@hono/node-servermastra-1@hono/node-servermastra-0systeminformationmastra-0glob,minimatchmastra-0deepmergellamaindex-0.11,llamaindex-0.12,nextjszodmastra-0,langchain-dup-coreminimatchsdk/typescriptWhat stays open: 7 alerts
ai4.3.19 (low)ai-4,mastra-0@ai-sdk/provider-utils2.2.8 (low)ai-4,mastra-0zod3.25.76 (high)ai-4,langchain-0.3,llamaindex-0.11All 7 are already accepted in
SECURITY.md. Re-checked today: each locked version is still the newest stable release on its line, so each fix is a major its fixture exists to stay below or whose framework cannot take it. No code path in these fixtures reaches them with untrusted input.GitHub will keep listing them as open. Clearing them would take dropping
ai4.x, LangChain 0.3, LlamaIndex 0.11 and Mastra 0.x from the SDK's supported range, or dismissing the alerts. This PR does neither; both are a maintainer's call.Verified locally
All in the CI job's own commands, in
node:20andnode:24containers:ghcr.io/google/osv-scanner-action:v2.5.0No issues found, exit 0failproofai-ts-sdk-integrationsframeworks, Node 20 and Node 24mainfailproofai-ts-sdk-integrationsruntimes, Node 24failproofai-ts-sdk-integrationsnextjs, Node 24next buildvariants; same asmainbun run test:runmain's 8836 plus the 11 new tests. The third hit a timing flake inenvelope-budget.test.ts(33 ms against a 28 ms bound on a busy machine; 351/351 run alone, and this PR touches nothing it exercises).mainflaked once in 3 runs too, onpublish-command.test.tsbun run test:e2ebun run lint,tsc --noEmitCI agrees on all 28 checks, with the same counts.
testpasses 8858 of 8858 in all three env configs, so theenvelope-budgetflake above was this machine's load.Each new assertion in
ts-sdk-fixture-pins.test.tswas broken on purpose to confirm it fails: theprovider-utilsrange removed frommastra-0, widened past the fix onai-4, the oldmastra-0lockfile with its nested zod restored, andnextjsone release behind its twin.Supersedes #965 and #955. Both are closed with a link here.
🤖 Generated with Claude Code
https://claude.ai/code/session_01KYzGfYysR6TiCoMXnAMbW6
Summary by CodeRabbit
Chores
Documentation
Tests