From c468e623cc5ec07c46ab79423a8c2a5e3c60eee0 Mon Sep 17 00:00:00 2001
From: Viren Baraiya <viren@v1r3n.com>
Date: Sat, 20 Jun 2026 10:26:21 -0700
Subject: [PATCH] fix(ts): dedupe overrides block in package.json
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The #270 merge left two "overrides" keys in sdk/typescript/package.json
(one from the HITL/audit branch, one from main). JSON parsers keep only
the last, so the undici pin in the first block was silently shadowed —
the high-severity undici audit fix was surviving only because the
transitive range happened to resolve to the patched 7.28.0, with no
actual pin guarding it.

Consolidate into a single valid overrides block that includes undici
alongside esbuild/ws/uuid. No resolved-version changes (lockfile
unchanged); npm ci + build + 823 unit tests + the
`npm audit --omit=dev --audit-level=high` gate all pass.
---
 sdk/typescript/package.json | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/sdk/typescript/package.json b/sdk/typescript/package.json
index 86becad1..68e944c9 100644
--- a/sdk/typescript/package.json
+++ b/sdk/typescript/package.json
@@ -46,10 +46,6 @@
     "@io-orkes/conductor-javascript": "^3.0.3",
     "dotenv": "^16.0.0"
   },
-  "overrides": {
-    "undici": "^7.28.0",
-    "ws": "^8.21.0"
-  },
   "peerDependencies": {
     "@langchain/core": ">=0.2.0",
     "@langchain/langgraph": ">=0.2.0",
@@ -101,6 +97,7 @@
     "typecheck": "tsc --noEmit"
   },
   "overrides": {
+    "undici": "^7.28.0",
     "esbuild": "^0.28.1",
     "ws": "^8.21.0",
     "@langchain/langgraph": {