Skip to content

chore(deps): resolve remaining compatible dependency updates - #705

Merged
chirino merged 3 commits into
mainfrom
chore/remaining-dependencies-20261019
Oct 19, 2026
Merged

chore(deps): resolve remaining compatible dependency updates#705
chirino merged 3 commits into
mainfrom
chore/remaining-dependencies-20261019

Conversation

@chirino

@chirino chirino commented Oct 19, 2026

Copy link
Copy Markdown
Owner

Apply the remaining compatible Dependabot updates on current main, including the Undici 7.30.1 security release throughout the TypeScript AI SDK graph. Keep the existing public AI SDK 5 API and documented compatibility holds.

Closes #626. Closes #627. Closes #635.

This branch contains #704's commit, so its security update is preserved in history. #621 was closed because #703 already landed newer Compose image versions.

  • Maven: Quarkus 3.38.3 → 3.39.4 in the reactor and all ten standalone checkpoints; exec-maven-plugin 3.6.3 → 3.6.4. Preserve compiler plugin 3.14.1 because its documented incremental-resource failure remains a hold. The Spring protobuf runtime is already 4.36.2 on main, fixing the stale PR's generated/runtime mismatch.
  • Images: Node 26.8.2 → 26.10.0 in both frontend stages. Defer the three Red Hat digests: vendor publication dates fall inside seven full days and their RHBA advisories contain no CVEs. JDK is eligible October 20 at 21:04 UTC, UBI minimal October 20 at 14:30 UTC, Go toolset October 21 at 21:20 UTC.
  • npm: apply the compatible subset of chore(deps): bump the npm-dependencies group across 14 directories with 31 updates #627, Express 5, AI SDK 5 patch updates, and OpenAI SDK 2 patch updates. Preserve TypeScript 5, Tailwind 3, Astro 5/MDX 4, Streamdown 1, and Undici 7 API compatibility. Avoid stale downgrades of React Query, brace-expansion, and exact Prettier pins.
  • Keep canonical generator and formatter output, including the regenerated chat client and Astro formatting changes. No manual product-code migration.
  • New workaround: the compatible provider-utils SDK still requests vulnerable Undici 5.29.0. Override it to 7.30.1 and verify the SDK/site scenarios; document removal conditions in WORKAROUNDS.md and the pin ledger.

Undici 7.30.1 was published October 15, 2026. It qualifies for the CVE-fix cooldown exception: CVE-2026-87018, CVE-2026-109383, CVE-2026-109829, CVE-2026-109869, CVE-2026-87029, CVE-2026-109841, CVE-2026-109924, CVE-2026-109932. Evidence: https://github.com/nodejs/undici/releases/tag/v7.30.1. Every other changed npm version and every changed Maven artifact passed registry publication-age checks, including transitives. Zod 4.6.7 was excluded in favor of eligible 4.6.6.

Validation:

  • wt exec security-review-20261019 -- task generate
  • wt exec security-review-20261019 -- task test:chat-frontend
  • wt exec security-review-20261019 -- task test
  • npm ci && npm run build in typescript/vercelai and site, through wt exec
  • npm audit --json in typescript/vercelai: zero vulnerabilities after the override
  • Both affected Docker frontend-builder stages built successfully through wt exec
  • Full task test:site: passed, 76 tests in 172.577 seconds
  • git diff --check

Resolving these stale grouped PRs does not claim a clean repository-wide security audit. Remaining npm findings are recorded below; major migrations remain held. The prior Go scan found no reachable vulnerabilities; the unused openpgp package has a module-only GO-2026-5932 finding with no fixed release.

Updated: npm (145 version transitions)
Dependency From To
@ai-sdk/gateway 2.0.149 2.0.164
@ai-sdk/openai 2.0.127 2.0.133
@ai-sdk/provider 2.0.4 2.0.5
@ai-sdk/provider-utils 3.0.37 3.0.41
@astrojs/compiler-binding None 0.4.1
@astrojs/compiler-binding-android-arm64 None 0.4.1
@astrojs/compiler-binding-darwin-arm64 None 0.4.1
@astrojs/compiler-binding-darwin-x64 None 0.4.1
@astrojs/compiler-binding-linux-arm64-gnu None 0.4.1
@astrojs/compiler-binding-linux-arm64-musl None 0.4.1
@astrojs/compiler-binding-linux-x64-gnu None 0.4.1
@astrojs/compiler-binding-linux-x64-musl None 0.4.1
@astrojs/compiler-binding-wasm32-wasi None 0.4.1
@astrojs/compiler-binding-win32-arm64-msvc None 0.4.1
@astrojs/compiler-binding-win32-x64-msvc None 0.4.1
@astrojs/compiler-rs None 0.4.1
@babel/helper-plugin-utils 7.27.1 7.29.7
@babel/plugin-transform-react-jsx-self 7.27.1 7.29.7
@babel/plugin-transform-react-jsx-source 7.27.1 7.29.7
@emnapi/core None 1.11.3
@emnapi/wasi-threads None 1.2.3
@eslint/eslintrc 3.3.6 3.3.7
@hey-api/codegen-core 0.8.2 0.9.1
@hey-api/json-schema-ref-parser 1.4.2 1.4.4
@hey-api/openapi-ts 0.97.3 0.99.0
@hey-api/shared 0.4.5 0.5.0
@napi-rs/wasm-runtime None 1.2.5
@oxc-project/types 0.142.0 0.153.0
@prettier/parse-srcset None 3.1.0
@rolldown/binding-android-arm-eabi None 1.2.13
@rolldown/binding-android-arm64 1.2.2 1.2.13
@rolldown/binding-darwin-arm64 1.2.2 1.2.13
@rolldown/binding-darwin-x64 1.2.2 1.2.13
@rolldown/binding-freebsd-x64 1.2.2 1.2.13
@rolldown/binding-linux-arm-gnueabihf 1.2.2 1.2.13
@rolldown/binding-linux-arm64-gnu 1.2.2 1.2.13
@rolldown/binding-linux-arm64-musl 1.2.2 1.2.13
@rolldown/binding-linux-ppc64-gnu 1.2.2 1.2.13
@rolldown/binding-linux-s390x-gnu 1.2.2 1.2.13
@rolldown/binding-linux-x64-gnu 1.2.2 1.2.13
@rolldown/binding-linux-x64-musl 1.2.2 1.2.13
@rolldown/binding-openharmony-arm64 1.2.2 1.2.13
@rolldown/binding-win32-arm64-msvc 1.2.2 1.2.13
@rolldown/binding-win32-x64-msvc 1.2.2 1.2.13
@rolldown/pluginutils 1.0.0-rc.3 1.0.1
@rolldown/pluginutils None 1.0.0-rc.3
@selderee/plugin-htmlparser2 0.11.0 0.12.0
@tybys/wasm-util None 0.10.4
@types/node 22.19.13 26.6.5
@types/node 22.20.1 26.6.5
@types/node 24.13.3 26.6.5
@types/react 19.2.17 19.3.0
@types/react-dom 19.2.3 19.3.0
@typescript-eslint/eslint-plugin 8.65.0 8.71.1
@typescript-eslint/parser 8.65.0 8.71.1
@typescript-eslint/project-service 8.65.0 8.71.1
@typescript-eslint/scope-manager 8.65.0 8.71.1
@typescript-eslint/tsconfig-utils 8.65.0 8.71.1
@typescript-eslint/type-utils 8.65.0 8.71.1
@typescript-eslint/types 8.65.0 8.71.1
@typescript-eslint/typescript-estree 8.65.0 8.71.1
@typescript-eslint/utils 8.65.0 8.71.1
@typescript-eslint/visitor-keys 8.65.0 8.71.1
accepts 1.3.8 2.0.0
acorn 8.15.0 8.19.0
ai 5.0.255 5.0.273
autoprefixer 10.5.4 10.6.1
balanced-match 1.0.2 4.0.4
balanced-match None 1.0.2
baseline-browser-mapping 2.11.1 2.11.28
body-parser 1.20.6 2.3.0
brace-expansion 1.1.21 5.0.12
brace-expansion None 1.1.21
browserslist 4.28.7 4.29.3
bundle-name 4.1.0 4.1.1
caniuse-lite 1.0.30001806 1.0.30001815
commander 14.0.3 15.0.0
confbox None 0.3.1
content-disposition 0.5.4 2.0.1
content-type 1.0.5 2.1.0
cookie-signature 1.0.7 1.2.2
debug 2.6.9 4.4.3
deepmerge-ts None 8.0.2
default-browser 5.5.0 5.5.1
electron-to-chromium 1.5.396 1.5.452
entities 4.5.0 7.0.1
eslint-plugin-react-refresh 0.4.26 0.5.7
eslint-visitor-keys 4.2.1 5.0.1
eslint-visitor-keys None 4.2.1
esquery 1.6.0 1.7.0
express 4.22.3 5.3.0
exsolve 1.1.0 1.1.3
finalhandler 1.3.2 2.1.1
flatted 3.4.2 3.4.4
fresh 0.5.2 2.0.0
giget 3.3.0 3.3.1
globals 16.5.0 17.13.0
html-to-text 9.0.5 10.0.1
htmlparser2 8.0.2 10.1.0
iconv-lite 0.4.24 0.7.3
ignore 7.0.6 7.0.12
is-promise None 4.0.0
leac 0.6.0 0.7.0
lucide-react 1.26.0 1.55.0
media-typer 0.3.0 1.1.1
merge-descriptors 1.0.3 2.0.0
mime-db 1.52.0 1.54.0
mime-types 2.1.35 3.0.2
minimatch 3.1.5 10.2.6
minimatch None 3.1.5
ms 2.0.0 2.1.3
negotiator 0.6.3 1.1.0
node-releases 2.0.51 2.0.58
ohash 2.0.11 2.0.12
once None 1.4.0
parseley 0.12.1 0.13.1
path-to-regexp 0.1.13 8.4.2
peberminta 0.9.0 0.10.0
pkg-types 2.3.1 2.3.3
postcss 8.5.26 8.5.29
prettier 3.9.6 3.9.10
prettier-plugin-astro 0.14.1 1.1.1
prettier-plugin-tailwindcss 0.5.14 0.8.1
range-parser 1.2.1 1.3.0
raw-body 2.5.3 3.0.2
rc9 3.0.1 3.1.0
readdirp 5.0.0 5.1.1
rolldown 1.2.2 1.2.13
router None 2.2.0
sass-formatter 0.7.9 0.8.0
selderee 0.11.0 0.12.0
semver 7.7.4 7.8.4
send 0.19.2 1.2.1
serve-static 1.16.3 2.2.1
tsx 4.23.2 4.23.13
type-is 1.6.18 2.1.0
typescript-eslint 8.65.0 8.71.1
undici 7.29.1 7.30.1
undici 7.30.0 7.30.1
undici-types 6.21.0 8.9.0
undici-types 7.18.2 8.9.0
update-browserslist-db 1.2.3 1.3.4
vite 8.2.0 8.3.4
wrappy None 1.0.2
zod 4.6.5 4.6.6
Updated: maven (184 version transitions)
Dependency From To
com.fasterxml.jackson.core:jackson-core ['2.21.5', '2.22.0'] 2.22.2
com.fasterxml.jackson.core:jackson-databind ['2.21.5', '2.22.0'] 2.22.2
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml ['2.22.0'] 2.22.2
com.fasterxml.jackson.datatype:jackson-datatype-guava ['2.22.0'] 2.22.2
com.fasterxml.jackson.datatype:jackson-datatype-jdk8 ['2.21.5', '2.22.0'] 2.22.2
com.fasterxml.jackson.datatype:jackson-datatype-joda ['2.22.0'] 2.22.2
com.fasterxml.jackson.datatype:jackson-datatype-jsr310 ['2.21.5', '2.22.0'] 2.22.2
com.fasterxml.jackson.module:jackson-module-parameter-names ['2.22.0'] 2.22.2
io.netty:netty-buffer ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-codec ['4.1.137.Final'] 4.1.138.Final
io.netty:netty-codec-dns ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-codec-haproxy ['4.1.137.Final'] 4.1.138.Final
io.netty:netty-codec-http ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-codec-http2 ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-codec-socks ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-common ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-handler ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-handler-proxy ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-resolver ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-resolver-dns ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-tcnative-classes ['2.0.81.Final'] 2.0.84.Final
io.netty:netty-transport ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.netty:netty-transport-native-unix-common ['4.1.137.Final', '4.2.17.Final'] 4.1.138.Final
io.quarkus.arc:arc ['3.38.3'] 3.39.4
io.quarkus.arc:arc-processor ['3.38.3'] 3.39.4
io.quarkus.qute:qute-core ['3.38.3'] 3.39.4
io.quarkus.qute:qute-generator ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-client ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-client-processor ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-common ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-common-processor ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-common-types ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-jackson ['3.38.3'] 3.39.4
io.quarkus.resteasy.reactive:resteasy-reactive-vertx ['3.38.3'] 3.39.4
io.quarkus.vertx.utils:quarkus-vertx-utils ['3.38.3'] 3.39.4
io.quarkus:quarkus-arc ['3.38.3'] 3.39.4
io.quarkus:quarkus-arc-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-arc-dev ['3.38.3'] 3.39.4
io.quarkus:quarkus-arc-test-supplement ['3.38.3'] 3.39.4
io.quarkus:quarkus-arc-test-supplement-decorator ['3.38.3'] 3.39.4
io.quarkus:quarkus-avro-spi [] 3.39.4
io.quarkus:quarkus-bootstrap-app-model ['3.38.3'] 3.39.4
io.quarkus:quarkus-bootstrap-core ['3.38.3'] 3.39.4
io.quarkus:quarkus-bootstrap-gradle-resolver ['3.38.3'] 3.39.4
io.quarkus:quarkus-bootstrap-json ['3.38.3'] 3.39.4
io.quarkus:quarkus-bootstrap-maven-resolver ['3.38.3'] 3.39.4
io.quarkus:quarkus-bootstrap-maven4-resolver ['3.38.3'] 3.39.4
io.quarkus:quarkus-bootstrap-runner ['3.38.3'] 3.39.4
io.quarkus:quarkus-builder ['3.38.3'] 3.39.4
io.quarkus:quarkus-cache-deployment-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-class-change-agent ['3.38.3'] 3.39.4
io.quarkus:quarkus-classloader-commons ['3.38.3'] 3.39.4
io.quarkus:quarkus-core ['3.38.3'] 3.39.4
io.quarkus:quarkus-core-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-credentials ['3.38.3'] 3.39.4
io.quarkus:quarkus-credentials-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-datasource-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-development-mode-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-devservices ['3.38.3'] 3.39.4
io.quarkus:quarkus-devservices-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-devservices-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-devservices-keycloak ['3.38.3'] 3.39.4
io.quarkus:quarkus-devservices-oidc ['3.38.3'] 3.39.4
io.quarkus:quarkus-devui-deployment-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-api ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-codegen ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-common-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-dev ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-protoc-plugin ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-reflection ['3.38.3'] 3.39.4
io.quarkus:quarkus-grpc-stubs ['3.38.3'] 3.39.4
io.quarkus:quarkus-hibernate-validator-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-ide-launcher ['3.38.3'] 3.39.4
io.quarkus:quarkus-jackson ['3.38.3'] 3.39.4
io.quarkus:quarkus-jackson-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-jackson-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-jsonp ['3.38.3'] 3.39.4
io.quarkus:quarkus-jsonp-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-junit ['3.38.3'] 3.39.4
io.quarkus:quarkus-junit-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-junit-config ['3.38.3'] 3.39.4
io.quarkus:quarkus-kubernetes-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-mutiny ['3.38.3'] 3.39.4
io.quarkus:quarkus-mutiny-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-netty ['3.38.3'] 3.39.4
io.quarkus:quarkus-netty-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-client ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-client-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-common-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-dev ['3.38.3'] 3.39.4
io.quarkus:quarkus-oidc-token-propagation-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-panache-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-panache-common-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-proxy-registry ['3.38.3'] 3.39.4
io.quarkus:quarkus-proxy-registry-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-qute ['3.38.3'] 3.39.4
io.quarkus:quarkus-qute-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-config ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-config-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-jackson ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-jackson-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-jaxrs ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-jaxrs-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-oidc-token-propagation ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-client-spi-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-common-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-jackson ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-jackson-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-jackson-common-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-rest-spi-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-security ['3.38.3'] 3.39.4
io.quarkus:quarkus-security-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-security-runtime-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-security-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-context-propagation ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-context-propagation-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-context-propagation-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-health ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-health-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-jwt-build ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-jwt-build-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-openapi ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-stork ['3.38.3'] 3.39.4
io.quarkus:quarkus-smallrye-stork-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-swagger-ui ['3.38.3'] 3.39.4
io.quarkus:quarkus-test-common ['3.38.3'] 3.39.4
io.quarkus:quarkus-test-keycloak-server ['3.38.3'] 3.39.4
io.quarkus:quarkus-tls-registry ['3.38.3'] 3.39.4
io.quarkus:quarkus-tls-registry-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-tls-registry-deployment-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-tls-registry-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-value-registry ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx-deployment-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx-http ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx-http-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx-http-deployment-spi ['3.38.3'] 3.39.4
io.quarkus:quarkus-vertx-latebound-mdc-provider ['3.38.3'] 3.39.4
io.quarkus:quarkus-virtual-threads ['3.38.3'] 3.39.4
io.quarkus:quarkus-virtual-threads-deployment ['3.38.3'] 3.39.4
io.quarkus:quarkus-websockets-next-spi ['3.38.3'] 3.39.4
io.smallrye.certs:smallrye-private-key-pem-parser ['0.9.3'] 0.9.4
io.smallrye.reactive:smallrye-mutiny-vertx-auth-common ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-bridge-common ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-core ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-runtime ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-uri-template ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-web ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-web-client ['3.23.0'] 3.23.1
io.smallrye.reactive:smallrye-mutiny-vertx-web-common ['3.23.0'] 3.23.1
io.vertx:vertx-auth-common ['4.5.32'] 4.5.34
io.vertx:vertx-bridge-common ['4.5.32'] 4.5.34
io.vertx:vertx-core ['4.5.32'] 4.5.34
io.vertx:vertx-grpc ['4.5.32'] 4.5.34
io.vertx:vertx-grpc-client ['4.5.32'] 4.5.34
io.vertx:vertx-grpc-common ['4.5.32'] 4.5.34
io.vertx:vertx-grpc-server ['4.5.32'] 4.5.34
io.vertx:vertx-http-proxy ['4.5.32'] 4.5.34
io.vertx:vertx-uri-template ['4.5.32'] 4.5.34
io.vertx:vertx-web ['4.5.32'] 4.5.34
io.vertx:vertx-web-client ['4.5.32'] 4.5.34
io.vertx:vertx-web-common ['4.5.32'] 4.5.34
org.aesh:aesh ['3.16.8'] 3.17.5
org.aesh:readline ['3.16.4'] 3.17.2
org.aesh:readline-api ['3.16.4'] 3.17.2
org.aesh:terminal-api ['3.16.4'] 3.17.2
org.aesh:terminal-detect ['3.16.4'] 3.17.2
org.aesh:terminal-tty ['3.16.4'] 3.17.2
org.codehaus.mojo:exec-maven-plugin 3.6.3 3.6.4
org.graalvm.sdk:nativeimage ['23.1.2'] 25.0.4.1
org.graalvm.sdk:word ['23.1.2'] 25.0.4.1
quarkus.platform.version (BOM and plugin, reactor and 10 checkpoints) 3.38.3 3.39.4
Updated: docker (1 version transitions)
Dependency From To
node (two frontend-builder stages) 26.8.2-alpine@sha256:ef24c5053d50fdc3e4e56eb4e7ddb7861874ab0fdc797046ba897581deb8e868 26.10.0-alpine@sha256:0b36e8c136b94cd4fcf02188228e76c31ad5872eef3fec8cbd2eee500cfd9e80
In Cooldown
  • registry.access.redhat.com/ubi9/go-toolset: 9.8@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21; skip 9.8@sha256:60fd6fb2998c40ad0d6561c34e83588b986a0cf7771f64e5e5c295ba87101f9b; published 2026-10-14T21:20:03Z; review 2026-10-21T21:20:03Z.
  • registry.access.redhat.com/ubi9/ubi-minimal: latest@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93; skip latest@sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661; published 2026-10-13T14:30:14Z; review 2026-10-20T14:30:14Z.
  • registry.access.redhat.com/ubi9/openjdk-25: 1.24-3.1789373085; skip 1.24-3.1791779575; published 2026-10-13T21:04:11Z; review after 2026-10-20T21:04:11Z, with a successful full Docker build.
  • zod: 4.6.6; skip 4.6.7; published 2026-10-12T16:29:37.778Z; review 2026-10-19T16:29:37.778Z.
Pinned/Held
  • uv 0.12.13 (temporary cooldown, .github/workflows/ci.yml test-site setup-uv version): setup-uv otherwise installs the latest uv release; 0.12.20 was published inside the seven-day cooldown. The prior cooldown has expired; this security PR batch preserves the existing Go, image, and CI tool versions. Review: next general dependency update.
  • uv exclude-newer 2026-10-07T13:08:05.687960Z (temporary cooldown, python/uv.lock and Python doc-checkpoint uv.lock files except langchain/01-basic-agent): Keep security lockfile resolution on releases published at least seven full days before the 2026-10-14 update. Review: next dependency update.
  • maven-compiler-plugin 3.14.1 (user-defined, java/pom.xml): 3.15.x deletes generated sources and copied resources; incremental rebuilds drop META-INF/spring auto-config metadata, silently breaking downstream Spring Boot auto-configuration. Hold reason documented in java/pom.xml comment. Review: explicit approval required.
  • astro 5.x (range ^5.7.10 in site/package.json) (user-defined, site/package.json): astro 7.x upgrade backed out: build fails with breaking Sätteri markdown processor change — @astrojs/markdown-remark was removed from astro 7.x default markdown pipeline and the site's astro.config.mjs uses the old remarkPlugins API. Not a cooldown hold; this is a compatibility hold requiring site config migration. Review: when site/astro.config.mjs is migrated to astro 7 Sätteri markdown API.
  • lucide-react 0.x (resolved 0.562.0) (user-defined, frontends/developer/package.json): Developer frontend remains on the 0.x API pending a tested migration to 1.x; the chat frontend already uses 1.x. Review: when developer frontend is migrated to lucide-react 1.x.
  • streamdown 1.6.11 (user-defined, frontends/developer/package.json, frontends/chat-frontend/package.json): Streamdown 2.x requires an API compatibility review in both frontends before migration. Review: when frontends are migrated to Streamdown 2.x.
  • registry.access.redhat.com/ubi9/go-toolset 9.8@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21 (temporary cooldown, Dockerfile): Red Hat published this digest in RHBA-2026:83180 on October 14 at 21:20 UTC. The advisory lists no CVEs; wait seven full days before updating. Review: 2026-10-21T21:20:03Z.
  • registry.access.redhat.com/ubi9/ubi-minimal latest@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93 (temporary cooldown, Dockerfile): Red Hat published this digest in RHBA-2026:82293 on October 13 at 14:30 UTC. The advisory lists no CVEs; wait seven full days before updating. Review: 2026-10-20T14:30:14Z.
  • github.com/speakeasy-api/openapi v1.25.1 (temporary cooldown, go.mod): v1.25.3 was published 2026-09-25 and remains inside the seven-day cooldown. The prior cooldown has expired; this security PR batch preserves the existing Go, image, and CI tool versions. Review: next general dependency update.
  • uvicorn 0.53.0 (temporary cooldown, python/uv.lock (--upgrade-package pin)): Existing lockfile resolution retained because this batch targets security fixes and expired frontend pins. The prior version-specific cooldown has expired. Review: next general dependency update.
  • protobuf 6.x (constrained by <7.0.0) (user-defined, python/langchain/pyproject.toml: protobuf>=6.31.1,<7.0.0): Major version constraint <7.0.0 in pyproject.toml prevents upgrade to protobuf 7.x; requires API compatibility audit before updating Review: explicit migration to protobuf 7 API with compatibility testing.
  • openai 2.48.0 (user-defined, python/uv.lock (transitive via langchain-openai, openai<3.0.0)): openai 3.x is a breaking major version; langchain-openai constrains openai<3.0.0; requires compatibility migration Review: langchain-openai upgrades its openai constraint to support 3.x.
  • io.quarkiverse.langchain4j:quarkus-langchain4j-bom 1.13.3 (temporary cooldown, java/pom.xml: quarkus-langchain4j.version): 1.14.0 was published 2026-09-25 and remains inside the seven-day cooldown. Review: next dependency update.
  • prettier 3.9.8 (temporary cooldown, Taskfile.yml, site/package.json, typescript/examples/vecelai/*/package.json): 3.9.9 was published 2026-09-23 and remains inside the seven-day cooldown. Review: after 2026-09-30.
  • prettier-plugin-astro 0.14.1 (temporary cooldown, site/package.json): 1.1.0 was published 2026-09-24 and remains inside the seven-day cooldown. Review: next dependency update, verify major version API compat.
  • seroval 1.6.7 (temporary cooldown, frontends/developer/package.json overrides): 1.6.8 selected by the router lockfile refresh was published 2026-09-29 and remains inside the seven-day cooldown. Review: after 2026-10-06.
  • seroval-plugins 1.6.7 (temporary cooldown, frontends/developer/package.json overrides): 1.6.8 selected by the router lockfile refresh was published 2026-09-29 and remains inside the seven-day cooldown. Review: after 2026-10-06.
  • registry.access.redhat.com/ubi9/openjdk-25 1.24-3.1789373085 (user-defined, java/quarkus/examples/chat-quarkus/Dockerfile): The proposed image was published October 13 at 21:04 UTC according to the Red Hat catalog, later than its build date. Keep the existing image until the seven-day cooldown expires and the affected Docker build passes. Review: after 2026-10-20T21:04:11Z, with a successful full Docker build.
  • dompurify 3.4.16 (temporary cooldown, frontends/chat-frontend/package-lock.json, frontends/developer/package-lock.json): The newer Dependabot target is inside the seven-day cooldown and has no qualifying fixed-release CVE evidence. The retained version satisfies the relevant security advisory. Review: next dependency update.
  • smol-toml 1.9.0 (temporary cooldown, site/package-lock.json): The newer Dependabot target is inside the seven-day cooldown and has no qualifying fixed-release CVE evidence. The retained version satisfies the relevant security advisory. Review: next dependency update.
  • langgraph-sdk 0.4.6 (temporary cooldown, python/uv.lock and Python doc-checkpoint uv.lock files): The newer Dependabot target is inside the seven-day cooldown and has no qualifying fixed-release CVE evidence. The retained version satisfies the relevant security advisory. Review: next dependency update.
  • langgraph-checkpoint 4.2.0 (temporary cooldown, python/uv.lock and Python doc-checkpoint uv.lock files): The newer Dependabot target is inside the seven-day cooldown and has no qualifying fixed-release CVE evidence. The retained version satisfies the relevant security advisory. Review: next dependency update.
  • langsmith 0.14.4 (temporary cooldown, python/uv.lock and Python doc-checkpoint uv.lock files): The newer Dependabot target is inside the seven-day cooldown and has no qualifying fixed-release CVE evidence. The retained version satisfies the relevant security advisory. Review: next dependency update.
  • truststore 0.10.4 (temporary cooldown, python/uv.lock and Python doc-checkpoint uv.lock files): The newer transitive dependency selected by the LangSmith PR is inside the seven-day cooldown. Resolve LangSmith with the older eligible truststore release. Review: next dependency update.
  • js-yaml 4.3.2 (unknown legacy, frontends/chat-frontend/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • brace-expansion@^1 1.1.21 (user-defined, frontends/chat-frontend/package.json overrides): Require the CVE-2026-102277 fix on the 1.x dependency branch. Review: when upstream dependency constraints resolve the security fix without an override.
  • brace-expansion@^4 5.0.12 (unknown legacy, frontends/chat-frontend/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • brace-expansion@^5 5.0.12 (unknown legacy, frontends/chat-frontend/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • picomatch >=2.3.2 (unknown legacy, frontends/chat-frontend/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • js-yaml 4.3.2 (unknown legacy, frontends/developer/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • brace-expansion@^1 1.1.21 (user-defined, frontends/developer/package.json overrides): Require the CVE-2026-102277 fix on the 1.x dependency branch. Review: when upstream dependency constraints resolve the security fix without an override.
  • @babel/parser 7.29.9 (unknown legacy, frontends/developer/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • unplugin 3.4.0 (unknown legacy, frontends/developer/package.json overrides): Existing project override; retained during this security update. Review: explicit project review.
  • uv exclude-newer 2026-10-12T13:00:00Z (temporary cooldown, python/examples/langchain/doc-checkpoints/01-basic-agent/uv.lock): Keep the HTTPX2 security lockfile update on releases at least seven full days old at the 2026-10-19 review. Review: next dependency update.
  • undici 7.x (currently 7.30.1) (user-defined, typescript/vercelai/package.json): Undici 8.10.2 fails the Unix-domain-socket response-resumption tutorial with InvalidArgumentError: invalid onRequestStart method. Keep the 7.x dispatcher API; compatible 7.x security patches remain eligible after release-age checks. Review: when the Undici 8 dispatcher migration passes the Unix-domain-socket site scenarios.
  • ai 5.x (currently 5.0.273) (user-defined, typescript/vercelai/package.json and TypeScript example package.json files): The public memory client peer dependency and existing examples use the AI SDK 5 API. Preserve that major version until an explicit SDK 7 migration is tested. Review: explicit compatibility migration or verified compatible patch update.
  • @ai-sdk/openai 2.x (currently 2.0.133) (user-defined, TypeScript example package.json files): The OpenAI provider 2.x API matches the retained AI SDK 5 line; provider 4.x belongs to the SDK 7 migration. Review: explicit compatibility migration or verified compatible patch update.
  • eslint 9.x (currently 9.39.5) (user-defined, frontends/chat-frontend/package.json): The retained hooks plugin 7.0.1 supports ESLint 9; upgrading its recommended rules causes existing effects to fail lint. Review: explicit compatibility migration or verified compatible patch update.
  • @eslint/js 9.x (currently 9.39.5) (user-defined, frontends/chat-frontend/package.json): Keep the recommended core rules aligned with the retained ESLint 9 major. Review: explicit compatibility migration or verified compatible patch update.
  • eslint-plugin-react-hooks 7.0.1 (user-defined, frontends/chat-frontend/package-lock.json): Version 7.1.1 adds recommended checks that reject existing setState effects. A product-code or lint-policy migration is needed before updating. Review: explicit compatibility migration or verified compatible patch update.
  • typescript 5.9.x (currently 5.9.3) (user-defined, frontends/chat-frontend/package.json): The retained typescript-eslint toolchain requires TypeScript below 6.1; the proposed TypeScript 7 update cannot satisfy that peer constraint. Review: explicit compatibility migration or verified compatible patch update.
  • zod 4.6.6 (temporary cooldown, typescript/vercelai/package.json overrides zod@^4): The compatible AI SDK patch update resolves Zod 4.6.7, which has not completed seven full days. Keep the newest eligible Zod 4 release until the next dependency review. Review: 2026-10-19T16:29:37.778Z.
  • @vitejs/plugin-react ^5.1.1 (user-defined, frontends/chat-frontend/package.json): Version 6 removes the babel option required by the React compiler configuration; task test:chat-frontend fails TS2353. Review: when the Vite React compiler configuration is migrated.
  • undici (AI SDK transitive) 7.30.1 (user-defined, TypeScript example overrides and typescript/vercelai/package.json overrides): The compatible AI SDK provider-utils release still requests vulnerable Undici 5.29.0. Use the verified 7.30.1 CVE fix throughout the SDK dependency graph. Review: when the compatible AI SDK no longer depends on vulnerable Undici.
Backed Out
  • eslint: 9.39.5 → 10.12.0. Updated hooks recommended rules reject existing setState effects. Retain the existing lint-rule behavior and matching ESLint peer range instead of changing product code for this dependency update.
  • @eslint/js: 9.39.5 → 10.0.1. Updated hooks recommended rules reject existing setState effects. Retain the existing lint-rule behavior and matching ESLint peer range instead of changing product code for this dependency update.
  • eslint-plugin-react-hooks: 7.0.1 → 7.1.1. Updated hooks recommended rules reject existing setState effects. Retain the existing lint-rule behavior and matching ESLint peer range instead of changing product code for this dependency update.
  • @vitejs/plugin-react: 5.2.0 → 6.1.1. task test:chat-frontend fails TS2353: babel no longer exists in plugin Options. Preserve the existing Babel React compiler configuration.
  • zod: 4.6.5 → 4.6.7. 4.6.7 published 2026-10-12T16:29:37.778Z, inside seven full days at review time.
Unresolved audit findings
  • braces (high): braces vulnerable to stack-exhaustion denial of service through deeply nested patterns. GHSA-vfj7-8cjw-p6xm; affected <=3.0.3.
  • katex (low): KaTeX: Existing prototype pollution can bypass trust restrictions. GHSA-238p-pmpm-9mq7; affected >=0.11.0 <0.18.2.
  • postcss-selector-parser (moderate): PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion. GHSA-rj75-hqrm-r3gf; affected <7.1.6.
  • astro (moderate): Astro: XSS in define:vars via incomplete </script> tag sanitization. GHSA-j687-52p2-xcff; affected <6.1.6.
  • astro (low): Astro: Server island encrypted parameters vulnerable to cross-component replay. GHSA-xr5h-phrj-8vxv; affected <6.1.10.
  • astro (moderate): Astro: XSS via Unescaped Attribute Names in Spread Props. GHSA-jrpj-wcv7-9fh9; affected <6.4.6.
  • astro (moderate): Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298). GHSA-f48w-9m4c-m7f5; affected <7.0.6.
  • astro (low): Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands. GHSA-7pw4-f3q4-r2p2; affected >=3.10.0 <7.0.4.
  • astro (moderate): Astro: Reflected XSS via unescaped View Transition animation properties. GHSA-4g3v-8h47-v7g6; affected >=2.9.0 <=7.0.9.
  • astro (high): Astro: Host header SSRF in prerendered error page fetch. GHSA-2pvr-wf23-7pc7; affected <6.4.6.
  • astro (high): Astro: Reflected XSS via unescaped slot name. GHSA-8hv8-536x-4wqp; affected <6.3.3.
  • astro (critical): Astro: Remote code execution through AVIF image optimization. GHSA-26w7-cxv4-gfx2; affected <7.2.8.
  • astro (moderate): Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base. GHSA-376h-93r7-7g6f; affected <=7.2.3.
  • esbuild (low): esbuild allows arbitrary file read when running the development server on Windows. GHSA-g7r4-m6w7-qqqr; affected >=0.27.3 <0.28.1.
  • postcss-selector-parser (moderate): PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion. GHSA-rj75-hqrm-r3gf; affected <7.1.6.
  • sharp (high): sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591. GHSA-f88m-g3jw-g9cj; affected <0.35.0.
  • sharp (high): sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545. GHSA-rgj7-g3m4-5g8c; affected <0.35.4.
  • sharp (high): sharp : Vulnerability in librsvg dependency CVE-2026-96889. GHSA-wq5f-xc86-pv6w; affected <0.35.5.
  • GO-2026-5932: golang.org/x/crypto/openpgp. Previously verified module-only finding in an unused package; no fixed version; no reachable findings in baseline govulncheck.

dependabot Bot and others added 3 commits October 19, 2026 13:57
@dependabot
chore(deps): bump undici from 7.30.0 to 7.30.1 in /typescript/vercelai
60b440a 
Bumps [undici](https://github.com/nodejs/undici) from 7.30.0 to 7.30.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.30.0...v7.30.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@chirino
chore(deps): apply undici 7.30.1 security fixes from #704
66b0239 
* commit 'refs/remaining-dependencies-20261019/pr-704':
  chore(deps): bump undici from 7.30.0 to 7.30.1 in /typescript/vercelai

Signed-off-by: Hiram Chirino <hiram@hiramchirino.com>
@chirino
chore(deps): resolve remaining compatible dependency updates
892caba 
Signed-off-by: Hiram Chirino <hiram@hiramchirino.com>
@chirino
chirino marked this pull request as ready for review October 19, 2026 14:46
@chirino
chirino merged commit b3c6091 into main Oct 19, 2026
16 checks passed
@chirino
chirino deleted the chore/remaining-dependencies-20261019 branch October 19, 2026 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chirino