chore(deps): resolve remaining compatible dependency updates

.codex/dependency-pins.json

@@ -76,25 +76,25 @@
       "pinnedVersion": "9.8@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21",
       "location": "Dockerfile",
       "class": "temporary cooldown",
-      "reason": "The replacement 9.8 digest sha256:60fd6fb2998c40ad0d6561c34e83588b986a0cf7771f64e5e5c295ba87101f9b was built 2026-10-14T20:46:01Z and remains inside the seven-day cooldown.",
+      "reason": "Red Hat published this digest in RHBA-2026:83180 on October 14 at 21:20 UTC. The advisory lists no CVEs; wait seven full days before updating.",
       "introducedBy": "dependency-update",
       "introducedAt": "2026-09-25",
-      "reviewAfter": "2026-10-21T20:46:01Z",
+      "reviewAfter": "2026-10-21T21:20:03Z",
       "blockedVersion": "9.8@sha256:60fd6fb2998c40ad0d6561c34e83588b986a0cf7771f64e5e5c295ba87101f9b",
-      "blockedPublishedAt": "2026-10-14T20:46:01Z"
+      "blockedPublishedAt": "2026-10-14T21:20:03Z"
     },
     {
       "ecosystem": "docker",
       "name": "registry.access.redhat.com/ubi9/ubi-minimal",
       "pinnedVersion": "latest@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93",
       "location": "Dockerfile",
       "class": "temporary cooldown",
-      "reason": "The replacement digest sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661 was built 2026-10-13T13:35:56Z and remains inside the seven-day cooldown.",
+      "reason": "Red Hat published this digest in RHBA-2026:82293 on October 13 at 14:30 UTC. The advisory lists no CVEs; wait seven full days before updating.",
       "introducedBy": "dependency-update",
       "introducedAt": "2026-09-25",
-      "reviewAfter": "2026-10-20T13:35:56Z",
+      "reviewAfter": "2026-10-20T14:30:14Z",
       "blockedVersion": "latest@sha256:c4c285d42941ebb2bd4da878479008e1e4536bb599aad1dbe568f89de9053661",
-      "blockedPublishedAt": "2026-10-13T13:35:56Z"
+      "blockedPublishedAt": "2026-10-13T14:30:14Z"
     },
     {
       "ecosystem": "go",
@@ -155,32 +155,6 @@
       "blockedPublishedAt": "2026-09-25",
       "reviewAfter": "next dependency update"
     },
-    {
-      "ecosystem": "npm",
-      "name": "ai",
-      "pinnedVersion": "5.0.255",
-      "location": "typescript/examples/vecelai/*/package.json overrides",
-      "class": "temporary cooldown",
-      "reason": "5.0.266 was published 2026-09-24 and remains inside the seven-day cooldown.",
-      "introducedBy": "dependency-update",
-      "introducedAt": "2026-09-25",
-      "blockedVersion": "5.0.266",
-      "blockedPublishedAt": "2026-09-24T18:50:22Z",
-      "reviewAfter": "next dependency update"
-    },
-    {
-      "ecosystem": "npm",
-      "name": "@ai-sdk/openai",
-      "pinnedVersion": "2.0.127",
-      "location": "typescript/examples/vecelai/*/package.json overrides",
-      "class": "temporary cooldown",
-      "reason": "2.0.130 was published 2026-09-24 and remains inside the seven-day cooldown.",
-      "introducedBy": "dependency-update",
-      "introducedAt": "2026-09-25",
-      "blockedVersion": "2.0.130",
-      "blockedPublishedAt": "2026-09-24T18:50:22Z",
-      "reviewAfter": "next dependency update"
-    },
     {
       "ecosystem": "npm",
       "name": "prettier",
@@ -241,12 +215,12 @@
       "pinnedVersion": "1.24-3.1789373085",
       "location": "java/quarkus/examples/chat-quarkus/Dockerfile",
       "class": "user-defined",
-      "reason": "The 1.24-3.1789566911 tag is old enough, but the affected Docker build did not finish: Maven quarkus:go-offline remained silent for more than four minutes. Keep the current image until a full build passes.",
+      "reason": "The proposed image was published October 13 at 21:04 UTC according to the Red Hat catalog, later than its build date. Keep the existing image until the seven-day cooldown expires and the affected Docker build passes.",
       "introducedBy": "dependency-update",
       "introducedAt": "2026-09-25",
-      "blockedVersion": "1.24-3.1789566911",
-      "blockedPublishedAt": "2026-09-16",
-      "reviewAfter": "next dependency update with Docker build verification"
+      "blockedVersion": "1.24-3.1791779575",
+      "blockedPublishedAt": "2026-10-13T21:04:11Z",
+      "reviewAfter": "after 2026-10-20T21:04:11Z, with a successful full Docker build"
     },
     {
       "ecosystem": "npm",
@@ -430,7 +404,7 @@
     {
       "ecosystem": "npm",
       "name": "undici",
-      "pinnedVersion": "7.x (currently 7.30.0)",
+      "pinnedVersion": "7.x (currently 7.30.1)",
       "location": "typescript/vercelai/package.json",
       "class": "user-defined",
       "reason": "Undici 8.10.2 fails the Unix-domain-socket response-resumption tutorial with InvalidArgumentError: invalid onRequestStart method. Keep the 7.x dispatcher API; compatible 7.x security patches remain eligible after release-age checks.",
@@ -439,6 +413,110 @@
       "blockedVersion": "8.10.2",
       "reviewAfter": "when the Undici 8 dispatcher migration passes the Unix-domain-socket site scenarios",
       "verification": "task test:site"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "ai",
+      "pinnedVersion": "5.x (currently 5.0.273)",
+      "location": "typescript/vercelai/package.json and TypeScript example package.json files",
+      "class": "user-defined",
+      "reason": "The public memory client peer dependency and existing examples use the AI SDK 5 API. Preserve that major version until an explicit SDK 7 migration is tested.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "explicit compatibility migration or verified compatible patch update"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "@ai-sdk/openai",
+      "pinnedVersion": "2.x (currently 2.0.133)",
+      "location": "TypeScript example package.json files",
+      "class": "user-defined",
+      "reason": "The OpenAI provider 2.x API matches the retained AI SDK 5 line; provider 4.x belongs to the SDK 7 migration.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "explicit compatibility migration or verified compatible patch update"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "eslint",
+      "pinnedVersion": "9.x (currently 9.39.5)",
+      "location": "frontends/chat-frontend/package.json",
+      "class": "user-defined",
+      "reason": "The retained hooks plugin 7.0.1 supports ESLint 9; upgrading its recommended rules causes existing effects to fail lint.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "explicit compatibility migration or verified compatible patch update"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "@eslint/js",
+      "pinnedVersion": "9.x (currently 9.39.5)",
+      "location": "frontends/chat-frontend/package.json",
+      "class": "user-defined",
+      "reason": "Keep the recommended core rules aligned with the retained ESLint 9 major.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "explicit compatibility migration or verified compatible patch update"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "eslint-plugin-react-hooks",
+      "pinnedVersion": "7.0.1",
+      "location": "frontends/chat-frontend/package-lock.json",
+      "class": "user-defined",
+      "reason": "Version 7.1.1 adds recommended checks that reject existing setState effects. A product-code or lint-policy migration is needed before updating.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "explicit compatibility migration or verified compatible patch update"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "typescript",
+      "pinnedVersion": "5.9.x (currently 5.9.3)",
+      "location": "frontends/chat-frontend/package.json",
+      "class": "user-defined",
+      "reason": "The retained typescript-eslint toolchain requires TypeScript below 6.1; the proposed TypeScript 7 update cannot satisfy that peer constraint.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "explicit compatibility migration or verified compatible patch update"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "zod",
+      "pinnedVersion": "4.6.6",
+      "location": "typescript/vercelai/package.json overrides zod@^4",
+      "class": "temporary cooldown",
+      "reason": "The compatible AI SDK patch update resolves Zod 4.6.7, which has not completed seven full days. Keep the newest eligible Zod 4 release until the next dependency review.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "blockedVersion": "4.6.7",
+      "blockedPublishedAt": "2026-10-12T16:29:37.778Z",
+      "reviewAfter": "2026-10-19T16:29:37.778Z",
+      "verification": "npm ci && npm run build in typescript/vercelai; task test:site"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "@vitejs/plugin-react",
+      "pinnedVersion": "^5.1.1",
+      "location": "frontends/chat-frontend/package.json",
+      "class": "user-defined",
+      "reason": "Version 6 removes the babel option required by the React compiler configuration; task test:chat-frontend fails TS2353.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "blockedVersion": "6.1.1",
+      "reviewAfter": "when the Vite React compiler configuration is migrated"
+    },
+    {
+      "ecosystem": "npm",
+      "name": "undici (AI SDK transitive)",
+      "pinnedVersion": "7.30.1",
+      "location": "TypeScript example overrides and typescript/vercelai/package.json overrides",
+      "class": "user-defined",
+      "reason": "The compatible AI SDK provider-utils release still requests vulnerable Undici 5.29.0. Use the verified 7.30.1 CVE fix throughout the SDK dependency graph.",
+      "introducedBy": "dependency-update",
+      "introducedAt": "2026-10-19",
+      "reviewAfter": "when the compatible AI SDK no longer depends on vulnerable Undici",
+      "verification": "TypeScript builds and task test:site"
     }
   ],
   "securityExceptions": [
@@ -518,6 +596,26 @@
         "CVE-2026-97031",
         "CVE-2026-97032"
       ]
+    },
+    {
+      "ecosystem": "npm",
+      "name": "undici",
+      "version": "7.30.1",
+      "publishedAt": "2026-10-15T14:18:31.283Z",
+      "cveIds": [
+        "CVE-2026-109383",
+        "CVE-2026-109829",
+        "CVE-2026-109841",
+        "CVE-2026-109869",
+        "CVE-2026-109924",
+        "CVE-2026-109932",
+        "CVE-2026-87018",
+        "CVE-2026-87029"
+      ],
+      "evidenceUrls": [
+        "https://github.com/nodejs/undici/releases/tag/v7.30.1"
+      ],
+      "reason": "Maintainer release notes explicitly identify these CVEs as fixed by the 7.30.1 release."
     }
   ]
 }

Dockerfile

@@ -1,5 +1,5 @@
 # Build developer frontend
-FROM node:26.8.2-alpine@sha256:ef24c5053d50fdc3e4e56eb4e7ddb7861874ab0fdc797046ba897581deb8e868 AS frontend-builder
+FROM node:26.10.0-alpine@sha256:0b36e8c136b94cd4fcf02188228e76c31ad5872eef3fec8cbd2eee500cfd9e80 AS frontend-builder
 WORKDIR /build
 COPY frontends/developer/package*.json ./
 RUN npm ci

WORKAROUNDS.md

@@ -71,3 +71,9 @@
 - What: Keep the TypeScript memory client on Undici 7.x. Compatible 7.x security patches can still be applied after release-age checks.
 - Why: Undici 8.10.2 fails the Unix-domain-socket response-resumption tutorial with `InvalidArgumentError: invalid onRequestStart method` in the request-handler interface used by Node fetch.
 - Proper fix: Migrate the dispatcher integration to the Undici 8 handler API, then verify the complete Unix-domain-socket site scenarios before lifting the major-version hold.
+
+## AI SDK transitive Undici security override
+
+- What: Override the compatible AI SDK dependency graph to Undici 7.30.1 in the TypeScript library and examples.
+- Why: `@ai-sdk/provider-utils` 3.0.41 requests Undici 5.29.0, which retains known security vulnerabilities. The examples already override this dependency; the library now applies the same security constraint.
+- Proper fix: Adopt a compatible AI SDK release that requests a fixed Undici version, then remove the overrides after the TypeScript and site tests pass.