Repository navigation
[failproofai-legion-902] Patch the nextjs and mastra-0 fixture advisories without moving a pin - #902
Open
dependabot[bot] wants to merge 2 commits into
Conversation
dependabot
Bot
added
dependencies
Contributor
|
Thanks @dependabot[bot] for keeping our dependencies current! 🙌 |
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…updates Bumps the npm_and_yarn group with 2 updates in the /sdk/typescript/integration/fixtures/ai-4 directory: [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) and [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils). Bumps the npm_and_yarn group with 2 updates in the /sdk/typescript/integration/fixtures/mastra-0 directory: [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) and [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Bumps the npm_and_yarn group with 3 updates in the /sdk/typescript/integration/fixtures/nextjs directory: [next](https://github.com/vercel/next.js), [sharp](https://github.com/lovell/sharp) and [source-map-js](https://github.com/7rulnik/source-map-js). Updates `ai` from 4.3.19 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/ai@5.0.52/packages/ai) Updates `@ai-sdk/provider-utils` from 2.2.8 to 3.0.9 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@3.0.9/packages/provider-utils) Removes `ai` Updates `@modelcontextprotocol/sdk` from 1.30.1 to 1.32.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.30.1...1.32.1) Updates `next` from 16.3.6 to 16.4.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.6...v16.4.1) Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@ai-sdk/provider-utils" dependency-version: 3.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ai dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.4.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…h the MCP SDK in range Dependabot's grouped security update moved ai-4 to ai@5.0.52 and mastra-0 to @mastra/core@1.77.0 / @mastra/memory@1.37.1. The mastra-0 tree cannot install: @mastra/mcp@0.14.5 peers on @mastra/core <0.25.0, so `npm ci` fails with ERESOLVE in the global setup of every shard that installs it (frameworks on node 20 and 24, runtimes). Both moves are also the ones SECURITY.md rules out: those fixtures exist to hold ai 4.x and Mastra 0.x, and their ai / provider-utils advisories are already recorded there as accepted. - ai-4, mastra-0: restored to main. - mastra-0: @modelcontextprotocol/sdk 1.30.1 -> 1.32.1 (GHSA-6qxp-vccf-f47h), lockfile only; @mastra/mcp@0.14.5 declares ^1.17.5. - nextjs: ai back to 7.0.111, the ai-7 twin its routes' traces are compared against. next 16.4.1, sharp 0.35.5 and source-map-js 1.2.2 stay; the lockfile differs from main only in those packages. - Both changelogs record it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JKkzQF2V4WUrot3FaXESPH
NiveditJain
force-pushed
the
dependabot/npm_and_yarn/sdk/typescript/integration/fixtures/ai-4/npm_and_yarn-2395d38e74
branch
from
October 15, 2026 15:30
8589b0a to
2a01fe5
Compare
NiveditJain
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot's grouped security update for the TypeScript SDK's integration fixtures, with the parts that broke CI, which
SECURITY.mdalso rules out, taken back out.Why CI was red
All three failing
failproofai-ts-sdk-integrationsshards (frameworks on node 20 and 24, runtimes on node 24) died in global setup on the same error:npm ciinmastra-0hitERESOLVE. Dependabot moved@mastra/coreto 1.77.0 and@mastra/memoryto 1.37.1 but left@mastra/mcp@0.14.5, which peers on@mastra/core >=0.20.1-0 <0.25.0-0.That move, and
ai4.3.19 → 5.0.52 inai-4, are whatSECURITY.mdsays never to do: those fixtures exist to holdai4.x and Mastra 0.x, and theai/@ai-sdk/provider-utilsadvisories against them are already recorded there as accepted. #901 declined the same move from #884.What's in it now
nextjsnext16.3.6 → 16.4.1,sharp0.35.4 → 0.35.5,source-map-js1.2.1 → 1.2.2 (Dependabot's, kept)nextadvisories (fixed in 16.3.8), GHSA-wq5f-xc86-pv6w, GHSA-68fv-2mgg-jv7qmastra-0@modelcontextprotocol/sdk1.30.1 → 1.32.1, lockfile only: inside@mastra/mcp@0.14.5's^1.17.5ai-4,mastra-0mainai,provider-utilsstay accepted inSECURITY.md)nextjs'saistays at 7.0.111. Dependabot also moved it to 7.0.141, which no alert asks for. The fixture's pins must match itsai-7twin, whose trace each route's trace is compared against. Thenextjslockfile now differs frommainonly innext/@next/*,sharp/@img/*andsource-map-js.main, and both changelogs have an entry.Verified locally
Each shard was run the way CI runs it (
npm ci, thennpm run test:integrationwith the shard'sFAILPROOFAI_IT_FIXTURES), in cleannode:20/node:24containers as a non-root user:mastra-0'smcpandmcp-toolsetsscenarios against MCP SDK 1.32.1. (vanilla.test.tsreadssdk/python/skill/, which the first container copy left out; re-run with it present, it passes 9/9 on both.)🤖 Generated with Claude Code
https://claude.ai/code/session_01JKkzQF2V4WUrot3FaXESPH