From defd0f9fa06d1636ec68bb012d19796ee0dee59d Mon Sep 17 00:00:00 2001 From: NiveditJain Date: Sun, 25 Oct 2026 07:27:48 +0530 Subject: [PATCH 1/2] [failproofai-legion-934] Clear the fixable Dependabot alerts and restore the fixture pins #931 moved Dependabot's grouped security update #931 reached the zod fix (GHSA-mrhx-c7xc-m3w5) in three integration fixtures by moving the very release each one exists to hold, the pin move SECURITY.md rules out: ai-4 ai 4.3.19 -> 7.0.152 langchain-0.3 @langchain/core 0.3.80 -> 1.3.0, @langchain/langgraph 0.4.10 -> 1.5.2 llamaindex-0.11 llamaindex 0.11.4 -> 0.12.1 each with zod 3.25.76 -> 4.6.7. ai-4 and langchain-0.3 kept installing and passing against a different major, so two supported floors left the matrix silently. llamaindex-0.11 stopped installing: @llamaindex/workflow@1.1.5 peers on zod@^3.23.8, so `npm ci` fails ERESOLVE (reproduced on node 24 against #931's manifests), and because global setup installs every fixture before any test runs, the frameworks shards (node 20, 24) and the runtimes shard went red on main. vite's module runner then masks the real error as `code.charCodeAt is not a function`. #931 also moved the runtimes fixture to zod 4.6.7 while deno-npm.ts still imported npm:zod@4.6.5, which Deno resolves against the fixture's node_modules and can no longer find; that fails the two "Deno with npm: specifiers" cases on its own. All three fixtures are back on their pre-#931 package.json and lockfile, and deno-npm.ts imports the zod the runtimes fixture installs. __tests__/ci/ts-sdk-fixture-pins.test.ts is the tripwire for both moves: a fixture named for a release line must pin its framework exactly, on that line, in package.json and the lockfile; and every npm: specifier a fixture imports must name the version its lockfile installs. Checked to fail on #931's manifests (ai-4, langchain-0.3, llamaindex-0.11) and on the old specifier. The fixable advisories still open after #931 are cleared with fixture-local overrides (SECURITY.md case 1), re-resolved with `npm install --package-lock-only --ignore-scripts`; each lockfile moves by exactly those packages: ai-5 undici 7.29.1 -> 7.30.1 (3 advisories) llamaindex-0.11 fast-uri 3.1.8 -> 3.1.9 (4 advisories; back with 0.11.4) mastra-1 @modelcontextprotocol/server 2.0.0 -> 2.3.0 and @modelcontextprotocol/client 2.2.0 -> 2.3.0 (4 advisories), both pinned exactly by @mastra/mcp@2.0.0; each brings its own @modelcontextprotocol/core@2.3.0 nested under it, as the client's 2.2.0 override did in #901 `npm audit` now reports nothing in 10 of the 15 fixtures. What remains is zod GHSA-mrhx-c7xc-m3w5 in the five held to zod 3 (ai-4, langchain-0.3, llamaindex-0.11, and nested in langchain-dup-core and mastra-0), plus the two ai@4 advisories SECURITY.md already accepts. zod's only fix is 4.6.6, no zod 3 release carries it, and every copy is required at ^3 by the framework release its fixture pins; `npm audit fix` in mastra-0 changes nothing. SECURITY.md case 2: recorded in its table. Locally, in node:20 and node:24 containers mirroring the CI job: frameworks (node 20 and 24) 1036 passed / 4 skipped each, runtimes 1132 passed, nextjs 60 passed. Root: lint clean, tsc clean, e2e 358 passed / 7 skipped. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01R83BsnFfqDkiHDyhGCnprq --- CHANGELOG.md | 8 + SECURITY.md | 7 +- __tests__/ci/ts-sdk-fixture-pins.test.ts | 89 +++++ sdk/typescript/CHANGELOG.md | 37 ++ .../fixtures/ai-4/package-lock.json | 244 +++++++++---- .../integration/fixtures/ai-4/package.json | 4 +- .../fixtures/ai-5/package-lock.json | 6 +- .../integration/fixtures/ai-5/package.json | 2 +- .../fixtures/langchain-0.3/package-lock.json | 213 ++++++------ .../fixtures/langchain-0.3/package.json | 6 +- .../llamaindex-0.11/package-lock.json | 320 ++++++++++-------- .../fixtures/llamaindex-0.11/package.json | 7 +- .../fixtures/mastra-1/package-lock.json | 42 ++- .../fixtures/mastra-1/package.json | 3 +- .../integration/fixtures/runtimes/deno-npm.ts | 2 +- 15 files changed, 645 insertions(+), 345 deletions(-) create mode 100644 __tests__/ci/ts-sdk-fixture-pins.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 268b05782..fe036144f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## 1.0.13-beta.0 — 2026-10-25 + +### Dependencies + +- Restore the `ai-4`, `langchain-0.3` and `llamaindex-0.11` SDK integration fixtures to the releases they exist to test: `ai@4.3.19`, `@langchain/core@0.3.80` with `@langchain/langgraph@0.4.10`, and `llamaindex@0.11.4`, each with `zod@3.25.76`. Dependabot's grouped security update (#931) reached the zod fix by moving them to `ai@7.0.152`, `@langchain/core@1.3.0` and `llamaindex@0.12.1`, the pin move `SECURITY.md` rules out, so the matrix silently stopped testing three supported floors. `llamaindex-0.11` then stopped installing (`@llamaindex/workflow@1.1.5` peers on `zod@^3.23.8`, so `npm ci` failed `ERESOLVE`), and because global setup installs every fixture first, the `frameworks` and `runtimes` integration shards failed on `main`. #931 also moved the `runtimes` fixture to `zod@4.6.7` while its Deno program still imported `npm:zod@4.6.5`, which Deno could no longer find; it now imports the installed version. `__tests__/ci/ts-sdk-fixture-pins.test.ts` fails on either move before anything installs (#934) +- Patch the fixable SDK integration fixture advisories with fixture-local `overrides`, moving no pin: `undici` 7.29.1 → 7.30.1 in `ai-5` (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472); `fast-uri` 3.1.8 → 3.1.9 in `llamaindex-0.11` (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp); and in `mastra-1`, `@modelcontextprotocol/server` 2.0.0 → 2.3.0 and `@modelcontextprotocol/client` 2.2.0 → 2.3.0 (GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453, GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw), both pinned exactly by `@mastra/mcp@2.0.0`, each now with its own `@modelcontextprotocol/core@2.3.0` nested under it (#934) +- `SECURITY.md` accepts zod GHSA-mrhx-c7xc-m3w5 in the five fixtures held to zod 3: `ai-4`, `langchain-0.3` and `llamaindex-0.11`, and the nested copies in `langchain-dup-core` and `mastra-0`. It is fixed only in zod 4.6.6, no zod 3 release carries the fix, and every copy is required at `^3` by the framework release its fixture pins (#934) + ## 1.0.12 — 2026-10-23 The stable release of logging in to FailproofAI Cloud from `config` in your browser, and of Cloud-managed Jev and hybrid policies scoped to agents. Everything below in the `1.0.12-beta.*` sections ships here too. diff --git a/SECURITY.md b/SECURITY.md index b12626175..1efa4c87b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -124,11 +124,14 @@ That splits an alert in one of these lockfiles into two cases: |---|---|---|---| | [GHSA-rwvc-j5jr-mgvh](https://github.com/advisories/GHSA-rwvc-j5jr-mgvh) (low, CVSS 3.7) | `ai@4.3.19` | `ai-4`, `mastra-0` | A filetype-whitelist bypass on **file upload**. Fixed in `ai@5.0.52` — the major the `ai-4` fixture exists to stay below, and one `@mastra/core@0.24.9` cannot take either (it requires `ai@^4`). Neither fixture uploads a file or exposes an upload surface; each runs one scripted agent against an in-process model. | | [GHSA-866g-f22w-33x8](https://github.com/advisories/GHSA-866g-f22w-33x8) (low, CVSS 4.3) | `@ai-sdk/provider-utils@2.2.8` | `ai-4`, `mastra-0` | Unbounded response-body reads in `createJsonResponseHandler` and its siblings. Fixed in `3.0.28`; `2.2.8` ships *inside* `ai@4.3.19`, which uses the v2 API, so the fix is the same blocked major as the row above. Exploiting it needs a hostile **model-provider HTTP response**; these fixtures never call one. | +| [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5) (high, CVSS 7.5) | `zod@3.25.76` | `ai-4`, `langchain-0.3`, `llamaindex-0.11`; nested in `langchain-dup-core` and `mastra-0` | An array schema keeps every failing element's validation issues, uncapped, so one oversized input can exhaust memory. Fixed only in `4.6.6`: no zod 3 release carries the fix, and `3.25.76` is the newest. Each copy is held to `^3` by the release its fixture pins — `ai@4.3.19` and its `@ai-sdk/*` packages peer on `^3.23.8`, `@langchain/core@0.3.80` (in `langchain-dup-core`, the vendored provider's own copy) and `@langchain/langgraph@0.4.10` depend on `^3.25.32`, `@llamaindex/core@0.6.8` and `@llamaindex/workflow@1.1.5` need `^3.23.8`, and in `mastra-0`, `zod-from-json-schema-v3` (`zod-from-json-schema@0.0.5`, which builds zod 3 schemas for `@mastra/core` and `@mastra/mcp`) depends on `^3.24.2`. Exploiting it needs untrusted input validated against one of those schemas; each fixture validates only its own scripted tool arguments. | -Both rows are bounded by the same facts: these are test fixtures — `"private": true`, +Every row is bounded by the same facts: these are test fixtures — `"private": true`, never published, installed with `--ignore-scripts`, and run only in CI against scripted in-process models. Re-check them whenever the supported framework floor -moves; dropping `ai` 4.x from the matrix is what actually retires them. +moves. Dropping `ai` 4.x from the matrix retires the first two rows; the zod row +retires only once `ai` 4.x, LangChain 0.3, LlamaIndex 0.11 and Mastra 0.x have all +left it. ## Maintainer setup (one-time) diff --git a/__tests__/ci/ts-sdk-fixture-pins.test.ts b/__tests__/ci/ts-sdk-fixture-pins.test.ts new file mode 100644 index 000000000..703e30c13 --- /dev/null +++ b/__tests__/ci/ts-sdk-fixture-pins.test.ts @@ -0,0 +1,89 @@ +import { readFileSync, readdirSync } from "node:fs"; +import { join } from "node:path"; + +import { describe, expect, it } from "vitest"; + +/** + * A TypeScript SDK integration fixture named for a release line — `ai-4`, + * `langchain-0.3`, `mastra-0` — exists to hold its framework on that line: the + * pinned release is the subject of the test (SECURITY.md, "Triaging a Dependabot + * alert in an integration fixture"). A move off it still installs and still + * passes, against a different major, so the matrix loses a supported floor with + * every check green. Dependabot security updates have made that move twice + * (#838, #931), both times to reach a fix the fixture could not take. This fails + * on the manifest, before anything installs. + * + * #931 also moved the `runtimes` fixture's zod without the `npm:zod@…` specifier + * its Deno program imports, which Deno resolves against the fixture's + * `node_modules` and so could no longer find. That half is checked here too. + */ + +const fixturesDir = join(__dirname, "..", "..", "sdk", "typescript", "integration", "fixtures"); + +/** The package each fixture-name prefix pins. */ +const FRAMEWORK: Record = { + ai: "ai", + langchain: "@langchain/core", + llamaindex: "llamaindex", + mastra: "@mastra/core", +}; + +const fixtures = readdirSync(fixturesDir, { withFileTypes: true }) + .filter((entry) => entry.isDirectory()) + .map((entry) => entry.name); + +const named = fixtures + .map((name) => /^([a-z]+)-(\d+(?:\.\d+)?)$/.exec(name)) + .filter((match): match is RegExpExecArray => match !== null) + .map(([fixture, prefix, line]) => ({ fixture: fixture!, framework: FRAMEWORK[prefix!], line: line! })); + +const readJson = (fixture: string, file: string) => + JSON.parse(readFileSync(join(fixturesDir, fixture, file), "utf8")) as { + dependencies?: Record; + packages?: Record; + }; + +/** Every `npm:@` a fixture's top-level programs import, once each. */ +const NPM_SPECIFIER = /["']npm:((?:@[\w.-]+\/)?[\w.-]+)@([^"'/]+)/g; +const specifiers = fixtures.flatMap((fixture) => + readdirSync(join(fixturesDir, fixture)) + .filter((file) => file.endsWith(".ts")) + .flatMap((file) => { + const source = readFileSync(join(fixturesDir, fixture, file), "utf8"); + const found = new Set([...source.matchAll(NPM_SPECIFIER)].map(([, name, version]) => `${name}@${version}`)); + return [...found].map((spec) => { + const at = spec.lastIndexOf("@"); + return { fixture, file, name: spec.slice(0, at), version: spec.slice(at + 1) }; + }); + }), +); + +describe("TS SDK integration fixtures named for a release line", () => { + it("finds them", () => { + expect(named.map((f) => f.fixture)).toEqual(expect.arrayContaining(["ai-4", "langchain-0.3", "mastra-0"])); + }); + + it("know which framework each name pins", () => { + expect(named.filter((f) => f.framework === undefined).map((f) => f.fixture)).toEqual([]); + }); + + it.each(named)("$fixture pins $framework exactly, on $line", ({ fixture, framework, line }) => { + const pinned = readJson(fixture, "package.json").dependencies?.[framework!]; + expect(pinned, `${fixture}: ${framework} in package.json`).toMatch(/^\d+\.\d+\.\d+$/); + expect(pinned!.startsWith(`${line}.`), `${fixture} pins ${framework}@${pinned}`).toBe(true); + const locked = readJson(fixture, "package-lock.json").packages?.[`node_modules/${framework}`]?.version; + expect(locked, `${fixture}: ${framework} in package-lock.json`).toBe(pinned); + }); +}); + +describe("TS SDK integration fixtures' npm: specifiers", () => { + it("finds the Deno program's", () => { + expect(specifiers.map((s) => s.name)).toEqual(expect.arrayContaining(["ai", "zod"])); + }); + + it.each(specifiers)("$fixture/$file imports npm:$name@$version, the version it installs", (spec) => { + const { fixture, name, version } = spec; + const locked = readJson(fixture, "package-lock.json").packages?.[`node_modules/${name}`]?.version; + expect(locked, `${fixture}: ${name} in package-lock.json`).toBe(version); + }); +}); diff --git a/sdk/typescript/CHANGELOG.md b/sdk/typescript/CHANGELOG.md index 8f31a590c..1e8a63332 100644 --- a/sdk/typescript/CHANGELOG.md +++ b/sdk/typescript/CHANGELOG.md @@ -21,6 +21,43 @@ section is missing or empty is refused before anything is built. dependencies. Each lockfile changes by those two packages and nothing else, and `npm audit` on both now reports no findings. (#904) +- **`ai-4`, `langchain-0.3` and `llamaindex-0.11` test their own releases again.** + Dependabot's grouped security update (#931) reached the zod fix by moving all + three off the release they exist to hold: `ai@4.3.19` → `7.0.152`, + `@langchain/core@0.3.80` → `1.3.0` (with `@langchain/langgraph@0.4.10` → + `1.5.2`) and `llamaindex@0.11.4` → `0.12.1`, each with `zod@3.25.76` → `4.6.7`. + `ai-4` and `langchain-0.3` still installed and passed while testing a + different major, so the matrix silently lost two supported floors. `llamaindex-0.11` + did not install: `@llamaindex/workflow@1.1.5` peers on `zod@^3.23.8`, so + `npm ci` failed `ERESOLVE`, and because the global setup installs every fixture + before any test runs, the `frameworks` and `runtimes` shards failed on `main`. + All three are back on their pre-#931 manifests and lockfiles. #931 also moved + the `runtimes` fixture to `zod@4.6.7` while `deno-npm.ts` still imported + `npm:zod@4.6.5`, which Deno resolves against the fixture's `node_modules` and + could no longer find; it imports `4.6.7` now. A root CI test, + `__tests__/ci/ts-sdk-fixture-pins.test.ts`, fails on either move: a fixture named + for a release line pinning its framework off that line, or an `npm:` specifier + naming a version the fixture does not install. (#934) + +- **The remaining fixable fixture advisories clear, each with an override.** `ai-5` + moves `undici` 7.29.1 → 7.30.1 (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, + GHSA-f72v-6w45-q472) and `llamaindex-0.11` moves `fast-uri` 3.1.8 → 3.1.9 + (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, + GHSA-333x-w4r6-6crp). In `mastra-1`, `@mastra/mcp@2.0.0` pins + `@modelcontextprotocol/server` and `@modelcontextprotocol/client` exactly, so the + fixture overrides both to `2.3.0` (GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453, + GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw); each brings its own + `@modelcontextprotocol/core@2.3.0` nested under it, as the client's earlier + `2.2.0` override did. Each lockfile changes by those packages alone, and + `npm audit` reports no findings in `ai-5` or `mastra-1`. (#934) + +- **zod GHSA-mrhx-c7xc-m3w5 stays in the five fixtures held to zod 3.** It is fixed + only in `zod@4.6.6`, and no zod 3 release carries the fix. `ai-4`, `langchain-0.3` + and `llamaindex-0.11` pin `zod@3.25.76` beside frameworks that require `^3`, and + `langchain-dup-core` and `mastra-0` carry a nested copy that the vendored + provider's `@langchain/core@0.3.80` and `zod-from-json-schema@0.0.5` require. + `SECURITY.md` records it with the two `ai@4` advisories. (#934) + ## 0.0.1-beta.1 — 2026-10-15 ### Features diff --git a/sdk/typescript/integration/fixtures/ai-4/package-lock.json b/sdk/typescript/integration/fixtures/ai-4/package-lock.json index f39be93d2..7f7927221 100644 --- a/sdk/typescript/integration/fixtures/ai-4/package-lock.json +++ b/sdk/typescript/integration/fixtures/ai-4/package-lock.json @@ -6,66 +6,97 @@ "": { "name": "failproofai-it-ai-4", "dependencies": { - "ai": "7.0.152", - "zod": "4.6.7" + "ai": "4.3.19", + "zod": "3.25.76" }, "devDependencies": { "@types/node": "22.20.4" } }, - "node_modules/@ai-sdk/gateway": { - "version": "4.0.125", - "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-4.0.125.tgz", - "integrity": "sha512-9raNdkENebDxVl4piGntpQgOBHB62K1rC87KceV8kkGOc/g7s6lwbxN7C6QTqXYJaM+h1Lnm64MDgnHAmzUApg==", + "node_modules/@ai-sdk/provider": { + "version": "1.1.3", + "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-1.1.3.tgz", + "integrity": "sha512-qZMxYJ0qqX/RfnuIaab+zp8UAeJn/ygXXAffR5I4N0n1IrvA6qBsjc8hXLmBiMV2zoXlifkacF7sEFnYnjBcqg==", "license": "Apache-2.0", "dependencies": { - "@ai-sdk/provider": "4.0.33", - "@ai-sdk/provider-utils": "5.0.67", - "@vercel/oidc": "3.2.0" + "json-schema": "^0.4.0" }, "engines": { - "node": ">=22" + "node": ">=18" + } + }, + "node_modules/@ai-sdk/provider-utils": { + "version": "2.2.8", + "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-2.2.8.tgz", + "integrity": "sha512-fqhG+4sCVv8x7nFzYnFo19ryhAa3w096Kmc3hWxMQfW/TubPOmt3A6tYZhl4mUfQWWQMsuSkLrtjlWuXBVSGQA==", + "license": "Apache-2.0", + "dependencies": { + "@ai-sdk/provider": "1.1.3", + "nanoid": "^3.3.8", + "secure-json-parse": "^2.7.0" + }, + "engines": { + "node": ">=18" }, "peerDependencies": { - "zod": "^3.25.76 || ^4.1.8" + "zod": "^3.23.8" } }, - "node_modules/@ai-sdk/provider": { - "version": "4.0.33", - "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.33.tgz", - "integrity": "sha512-C6ylMuAXjgqKJllp6ODIJwUltK/tm3ZmIj4V2fqENP3Y8gif2DyeJSsTcDwFrXppgEKcrBisi/BWx2tYeoeCAw==", + "node_modules/@ai-sdk/react": { + "version": "1.2.12", + "resolved": "https://registry.npmjs.org/@ai-sdk/react/-/react-1.2.12.tgz", + "integrity": "sha512-jK1IZZ22evPZoQW3vlkZ7wvjYGYF+tRBKXtrcolduIkQ/m/sOAVcVeVDUDvh1T91xCnWCdUGCPZg2avZ90mv3g==", "license": "Apache-2.0", "dependencies": { - "json-schema": "^0.4.0" + "@ai-sdk/provider-utils": "2.2.8", + "@ai-sdk/ui-utils": "1.2.11", + "swr": "^2.2.5", + "throttleit": "2.1.0" }, "engines": { - "node": ">=22" + "node": ">=18" + }, + "peerDependencies": { + "react": "^18 || ^19 || ^19.0.0-rc", + "zod": "^3.23.8" + }, + "peerDependenciesMeta": { + "zod": { + "optional": true + } } }, - "node_modules/@ai-sdk/provider-utils": { - "version": "5.0.67", - "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.67.tgz", - "integrity": "sha512-EUzV6GXutGcesWKOY8tRKgijfuv1LUBpqAquMh5k0n74NCjDbca5d5ZG12qhVtM2X5UwM4B2ZMP2XpnAwZlA8Q==", + "node_modules/@ai-sdk/ui-utils": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@ai-sdk/ui-utils/-/ui-utils-1.2.11.tgz", + "integrity": "sha512-3zcwCc8ezzFlwp3ZD15wAPjf2Au4s3vAbKsXQVyhxODHcmu0iyPO2Eua6D/vicq/AUm/BAo60r97O6HU+EI0+w==", "license": "Apache-2.0", "dependencies": { - "@ai-sdk/provider": "4.0.33", - "@standard-schema/spec": "^1.1.0", - "@workflow/serde": "4.1.0", - "eventsource-parser": "^3.0.8", - "undici": "^7.29.0" + "@ai-sdk/provider": "1.1.3", + "@ai-sdk/provider-utils": "2.2.8", + "zod-to-json-schema": "^3.24.1" }, "engines": { - "node": ">=22" + "node": ">=18" }, "peerDependencies": { - "zod": "^3.25.76 || ^4.1.8" + "zod": "^3.23.8" } }, - "node_modules/@standard-schema/spec": { + "node_modules/@dmsnell/diff-match-patch": { "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz", - "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==", - "license": "MIT" + "resolved": "https://registry.npmjs.org/@dmsnell/diff-match-patch/-/diff-match-patch-1.1.0.tgz", + "integrity": "sha512-yejLPmM5pjsGvxS9gXablUSbInW7H976c/FJ4iQxWIm7/38xBySRemTPDe34lhg1gVLbJntX0+sH0jYfU+PN9A==", + "license": "Apache-2.0" + }, + "node_modules/@opentelemetry/api": { + "version": "1.9.0", + "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz", + "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==", + "license": "Apache-2.0", + "engines": { + "node": ">=8.0.0" + } }, "node_modules/@types/node": { "version": "22.20.4", @@ -77,45 +108,39 @@ "undici-types": "~6.21.0" } }, - "node_modules/@vercel/oidc": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/@vercel/oidc/-/oidc-3.2.0.tgz", - "integrity": "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug==", - "license": "Apache-2.0", - "engines": { - "node": ">= 20" - } - }, - "node_modules/@workflow/serde": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/@workflow/serde/-/serde-4.1.0.tgz", - "integrity": "sha512-pav4F2BoirECWR7Nf1TKt+2eETcBj7jj4cBefQ8VXQCA6NPkaKeLfj/zMgi+3zYV5ZIBT4GuUiphsj0/b9hPQQ==", - "license": "Apache-2.0" - }, "node_modules/ai": { - "version": "7.0.152", - "resolved": "https://registry.npmjs.org/ai/-/ai-7.0.152.tgz", - "integrity": "sha512-cxQaE/17qhgqJcLCespbnyaN3c4IkGuNUtBXKSX1yTvlSsQ7ERV2ygFADMG7d+IWCUuvi7R8DrqAy9DGj0cgkg==", + "version": "4.3.19", + "resolved": "https://registry.npmjs.org/ai/-/ai-4.3.19.tgz", + "integrity": "sha512-dIE2bfNpqHN3r6IINp9znguYdhIOheKW2LDigAMrgt/upT3B8eBGPSCblENvaZGoq+hxaN9fSMzjWpbqloP+7Q==", "license": "Apache-2.0", "dependencies": { - "@ai-sdk/gateway": "4.0.125", - "@ai-sdk/provider": "4.0.33", - "@ai-sdk/provider-utils": "5.0.67" + "@ai-sdk/provider": "1.1.3", + "@ai-sdk/provider-utils": "2.2.8", + "@ai-sdk/react": "1.2.12", + "@ai-sdk/ui-utils": "1.2.11", + "@opentelemetry/api": "1.9.0", + "jsondiffpatch": "0.6.0" }, "engines": { - "node": ">=22" + "node": ">=18" }, "peerDependencies": { - "zod": "^3.25.76 || ^4.1.8" + "react": "^18 || ^19 || ^19.0.0-rc", + "zod": "^3.23.8" + }, + "peerDependenciesMeta": { + "react": { + "optional": true + } } }, - "node_modules/eventsource-parser": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz", - "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==", + "node_modules/dequal": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz", + "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==", "license": "MIT", "engines": { - "node": ">=18.0.0" + "node": ">=6" } }, "node_modules/json-schema": { @@ -124,13 +149,78 @@ "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==", "license": "(AFL-2.1 OR BSD-3-Clause)" }, - "node_modules/undici": { - "version": "7.30.1", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz", - "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==", + "node_modules/jsondiffpatch": { + "version": "0.7.6", + "resolved": "https://registry.npmjs.org/jsondiffpatch/-/jsondiffpatch-0.7.6.tgz", + "integrity": "sha512-zE9+AXFq+MkTolDor2Cw1nJzLC0aleqPkYf52Kb4Kn4mJcka/gFHpGI2JBVEJCfWOvBl0OoxZS+wuLdislQcqg==", + "license": "MIT", + "dependencies": { + "@dmsnell/diff-match-patch": "^1.1.0" + }, + "bin": { + "jsondiffpatch": "bin/jsondiffpatch.js" + }, + "engines": { + "node": "^18.0.0 || >=20.0.0" + } + }, + "node_modules/nanoid": { + "version": "3.3.19", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz", + "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/react": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/react/-/react-19.3.0.tgz", + "integrity": "sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==", + "license": "MIT", + "peer": true, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/secure-json-parse": { + "version": "2.7.0", + "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-2.7.0.tgz", + "integrity": "sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==", + "license": "BSD-3-Clause" + }, + "node_modules/swr": { + "version": "2.5.1", + "resolved": "https://registry.npmjs.org/swr/-/swr-2.5.1.tgz", + "integrity": "sha512-BRw55e8r0B7SpDN20CAzoQAHl7y1yP7/Zt7oqUjMv0vSt2u2Xnkm88Ws+VypbV9BXHQVuSuyVq7zMjO16wSExw==", + "license": "MIT", + "dependencies": { + "dequal": "^2.0.3", + "use-sync-external-store": "^1.6.0" + }, + "peerDependencies": { + "react": "^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" + } + }, + "node_modules/throttleit": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/throttleit/-/throttleit-2.1.0.tgz", + "integrity": "sha512-nt6AMGKW1p/70DF/hGBdJB57B8Tspmbp5gfJ8ilhLnt7kkr2ye7hzD6NVG8GGErk2HWF34igrL2CXmNIkzKqKw==", "license": "MIT", "engines": { - "node": ">=20.18.1" + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" } }, "node_modules/undici-types": { @@ -140,14 +230,32 @@ "dev": true, "license": "MIT" }, + "node_modules/use-sync-external-store": { + "version": "1.7.0", + "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.7.0.tgz", + "integrity": "sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A==", + "license": "MIT", + "peerDependencies": { + "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" + } + }, "node_modules/zod": { - "version": "4.6.7", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", - "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", + "version": "3.25.76", + "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", + "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" } + }, + "node_modules/zod-to-json-schema": { + "version": "3.25.2", + "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz", + "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==", + "license": "ISC", + "peerDependencies": { + "zod": "^3.25.28 || ^4" + } } } } diff --git a/sdk/typescript/integration/fixtures/ai-4/package.json b/sdk/typescript/integration/fixtures/ai-4/package.json index 6ee89c2b7..e41222162 100644 --- a/sdk/typescript/integration/fixtures/ai-4/package.json +++ b/sdk/typescript/integration/fixtures/ai-4/package.json @@ -4,8 +4,8 @@ "type": "module", "description": "Integration fixture: Vercel AI SDK 4.x against the packed @failproofai/sdk.", "dependencies": { - "ai": "7.0.152", - "zod": "4.6.7" + "ai": "4.3.19", + "zod": "3.25.76" }, "devDependencies": { "@types/node": "22.20.4" diff --git a/sdk/typescript/integration/fixtures/ai-5/package-lock.json b/sdk/typescript/integration/fixtures/ai-5/package-lock.json index 5d93fad95..dbe1e2e63 100644 --- a/sdk/typescript/integration/fixtures/ai-5/package-lock.json +++ b/sdk/typescript/integration/fixtures/ai-5/package-lock.json @@ -128,9 +128,9 @@ "license": "(AFL-2.1 OR BSD-3-Clause)" }, "node_modules/undici": { - "version": "7.29.1", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", - "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", + "version": "7.30.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz", + "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/sdk/typescript/integration/fixtures/ai-5/package.json b/sdk/typescript/integration/fixtures/ai-5/package.json index 3016c17ce..6df07b10f 100644 --- a/sdk/typescript/integration/fixtures/ai-5/package.json +++ b/sdk/typescript/integration/fixtures/ai-5/package.json @@ -11,6 +11,6 @@ "@types/node": "22.20.4" }, "overrides": { - "undici": "7.29.1" + "undici": "7.30.1" } } diff --git a/sdk/typescript/integration/fixtures/langchain-0.3/package-lock.json b/sdk/typescript/integration/fixtures/langchain-0.3/package-lock.json index 81800dac4..488c9bd9b 100644 --- a/sdk/typescript/integration/fixtures/langchain-0.3/package-lock.json +++ b/sdk/typescript/integration/fixtures/langchain-0.3/package-lock.json @@ -6,9 +6,9 @@ "": { "name": "failproofai-it-langchain-0-3", "dependencies": { - "@langchain/core": "1.3.0", - "@langchain/langgraph": "1.5.2", - "zod": "4.6.7", + "@langchain/core": "0.3.80", + "@langchain/langgraph": "0.4.10", + "zod": "3.25.76", "zod-to-json-schema": "3.25.2" }, "devDependencies": { @@ -22,71 +22,87 @@ "license": "MIT" }, "node_modules/@langchain/core": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.3.0.tgz", - "integrity": "sha512-ZiS8USsHdO8ZVFh0m8Rs6v2BvqBEvfFicG66zxdF4rGgXSJjk0d0sLnnFZCx3RXPUvP8ybTJgPlNfkJGs1J7BA==", + "version": "0.3.80", + "resolved": "https://registry.npmjs.org/@langchain/core/-/core-0.3.80.tgz", + "integrity": "sha512-vcJDV2vk1AlCwSh3aBm/urQ1ZrlXFFBocv11bz/NBUfLWD5/UDNMzwPdaAd2dKvNmTWa9FM2lirLU3+JCf4cRA==", "license": "MIT", "dependencies": { "@cfworker/json-schema": "^4.0.2", - "@standard-schema/spec": "^1.1.0", + "ansi-styles": "^5.0.0", + "camelcase": "6", + "decamelize": "1.2.0", "js-tiktoken": "^1.0.12", - "langsmith": ">=0.11.0 <1.0.0", + "langsmith": "^0.3.67", "mustache": "^4.2.0", "p-queue": "^6.6.2", - "zod": "^3.25.76 || ^4" + "p-retry": "4", + "uuid": "^10.0.0", + "zod": "^3.25.32", + "zod-to-json-schema": "^3.22.3" }, "engines": { - "node": ">=20" + "node": ">=18" } }, "node_modules/@langchain/langgraph": { - "version": "1.5.2", - "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.5.2.tgz", - "integrity": "sha512-jfVB9x+FH3CqlOYsYSVyuBoElV/J9pRL2nb7gie9Fb53J6rwNxSjTwxtyH3N8eVbZ94QckuFRxom6KTMlFfMOQ==", + "version": "0.4.10", + "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-0.4.10.tgz", + "integrity": "sha512-4gS6Y7aKu82ZhY3y5QVJ0TNaXGNHgsiBm7JNy4eUP42z1/73l2an8lcaQrpHtEF/Lpopwkp8Lz3j3rCnTJNUTg==", "license": "MIT", "dependencies": { - "@langchain/langgraph-checkpoint": "^1.2.1", - "@langchain/langgraph-sdk": "~1.12.6", - "@langchain/protocol": "^0.0.20", - "@standard-schema/spec": "1.1.0" + "@langchain/langgraph-checkpoint": "^0.1.3", + "@langchain/langgraph-sdk": "~0.1.10", + "uuid": "^10.0.0", + "zod": "^3.25.32" }, "engines": { "node": ">=18" }, "peerDependencies": { - "@langchain/core": "^1.1.48", - "zod": "^3.25.32 || ^4.2.0" + "@langchain/core": ">=0.3.58 < 0.4.0", + "zod-to-json-schema": "^3.x" + }, + "peerDependenciesMeta": { + "zod-to-json-schema": { + "optional": true + } } }, "node_modules/@langchain/langgraph-checkpoint": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/@langchain/langgraph-checkpoint/-/langgraph-checkpoint-1.2.1.tgz", - "integrity": "sha512-RD01mi9fYfpIq5fWrW/j2iY7MRUoqKvh1Nj6TMRDBoTGE18E2du75zKDugNxb57N8FWCojaiWGB9Enssnx9Hyg==", + "version": "0.1.3", + "resolved": "https://registry.npmjs.org/@langchain/langgraph-checkpoint/-/langgraph-checkpoint-0.1.3.tgz", + "integrity": "sha512-hCfCqvbAS5iAbKxEtSEQVSQSEkeoAOvDumVZ1RwCFGi5CxV1/3dTnHpQn2DcvKm+M4fchhV7mq++Ej2GB/hSdQ==", "license": "MIT", + "dependencies": { + "uuid": "^10.0.0" + }, "engines": { "node": ">=18" }, "peerDependencies": { - "@langchain/core": "^1.1.48" + "@langchain/core": ">=0.2.31 <0.4.0 || ^1.0.0-alpha" } }, "node_modules/@langchain/langgraph-sdk": { - "version": "1.12.7", - "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.12.7.tgz", - "integrity": "sha512-+tIY6oVDDt9e3LnDKs4Qqe3nFJSY7amDUofro7me0kZ8QbaJhFViQL0LaX30SQhIaHuCLZYMRIluhuFSOPjF8g==", + "version": "0.1.10", + "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-0.1.10.tgz", + "integrity": "sha512-9srSCb2bSvcvehMgjA2sMMwX0o1VUgPN6ghwm5Fwc9JGAKsQa6n1S4eCwy1h4abuYxwajH5n3spBw+4I2WYbgw==", "license": "MIT", "dependencies": { - "@langchain/protocol": "^0.0.20", "@types/json-schema": "^7.0.15", - "p-queue": "^9.0.1", - "p-retry": "^7.1.1" + "p-queue": "^6.6.2", + "p-retry": "4", + "uuid": "^9.0.0" }, "peerDependencies": { - "@langchain/core": "^1.1.48", + "@langchain/core": ">=0.2.31 <0.4.0 || ^1.0.0-alpha", "react": "^18 || ^19", "react-dom": "^18 || ^19" }, "peerDependenciesMeta": { + "@langchain/core": { + "optional": true + }, "react": { "optional": true }, @@ -95,52 +111,6 @@ } } }, - "node_modules/@langchain/langgraph-sdk/node_modules/eventemitter3": { - "version": "5.0.4", - "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz", - "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==", - "license": "MIT" - }, - "node_modules/@langchain/langgraph-sdk/node_modules/p-queue": { - "version": "9.3.5", - "resolved": "https://registry.npmjs.org/p-queue/-/p-queue-9.3.5.tgz", - "integrity": "sha512-Lki/zhXFVmDhesBUn/yHRLW9Bte7mE7xoFHzTR8sIomV7a2z+LxYAPkGvdfidNiu4fKSfjtawixxSHcZci5QcQ==", - "license": "MIT", - "dependencies": { - "eventemitter3": "^5.0.4", - "p-timeout": "^7.0.0" - }, - "engines": { - "node": ">=20" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@langchain/langgraph-sdk/node_modules/p-timeout": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/p-timeout/-/p-timeout-7.0.2.tgz", - "integrity": "sha512-prbX4Z3YszrFNgH+MW5Zoeq3baXrMtP/MQnFeET90UB/GtGcGDQ5Usg9OCy6ETjTTntOw1SL2z9fMPUppN3Guw==", - "license": "MIT", - "engines": { - "node": ">=20" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@langchain/protocol": { - "version": "0.0.20", - "resolved": "https://registry.npmjs.org/@langchain/protocol/-/protocol-0.0.20.tgz", - "integrity": "sha512-sxlkDG2/HGyjDFLTJ8B/o3oglRjOv8iLCFgrV0550/Vym3V6RZ0SUjAQFe8jrLQw8ZXjERy3swJp5OODBSrUYA==", - "license": "MIT" - }, - "node_modules/@standard-schema/spec": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz", - "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==", - "license": "MIT" - }, "node_modules/@types/json-schema": { "version": "7.0.15", "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz", @@ -157,6 +127,24 @@ "undici-types": "~6.21.0" } }, + "node_modules/@types/retry": { + "version": "0.12.0", + "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.0.tgz", + "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==", + "license": "MIT" + }, + "node_modules/ansi-styles": { + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz", + "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==", + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, "node_modules/base64-js": { "version": "1.5.1", "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz", @@ -177,24 +165,33 @@ ], "license": "MIT" }, - "node_modules/eventemitter3": { - "version": "4.0.7", - "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz", - "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==", - "license": "MIT" - }, - "node_modules/is-network-error": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.2.tgz", - "integrity": "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA==", + "node_modules/camelcase": { + "version": "6.3.0", + "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz", + "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==", "license": "MIT", "engines": { - "node": ">=16" + "node": ">=10" }, "funding": { "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/decamelize": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz", + "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/eventemitter3": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz", + "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==", + "license": "MIT" + }, "node_modules/js-tiktoken": { "version": "1.0.21", "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz", @@ -272,18 +269,16 @@ } }, "node_modules/p-retry": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-7.1.1.tgz", - "integrity": "sha512-J5ApzjyRkkf601HpEeykoiCvzHQjWxPAHhyjFcEUP2SWq0+35NKh8TLhpLw+Dkq5TZBFvUM6UigdE9hIVYTl5w==", + "version": "4.6.2", + "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-4.6.2.tgz", + "integrity": "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==", "license": "MIT", "dependencies": { - "is-network-error": "^1.1.0" + "@types/retry": "0.12.0", + "retry": "^0.13.1" }, "engines": { - "node": ">=20" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" + "node": ">=8" } }, "node_modules/p-timeout": { @@ -298,6 +293,15 @@ "node": ">=8" } }, + "node_modules/retry": { + "version": "0.13.1", + "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz", + "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==", + "license": "MIT", + "engines": { + "node": ">= 4" + } + }, "node_modules/undici-types": { "version": "6.21.0", "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", @@ -305,10 +309,23 @@ "dev": true, "license": "MIT" }, + "node_modules/uuid": { + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], + "license": "MIT", + "bin": { + "uuid": "dist/esm/bin/uuid" + } + }, "node_modules/zod": { - "version": "4.6.7", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", - "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", + "version": "3.25.76", + "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", + "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" diff --git a/sdk/typescript/integration/fixtures/langchain-0.3/package.json b/sdk/typescript/integration/fixtures/langchain-0.3/package.json index 13aade767..666376fe2 100644 --- a/sdk/typescript/integration/fixtures/langchain-0.3/package.json +++ b/sdk/typescript/integration/fixtures/langchain-0.3/package.json @@ -4,9 +4,9 @@ "type": "module", "description": "Integration fixture: LangChain.js 0.3 + LangGraph.js 0.4 (the floor of the declared peer range) against the packed @failproofai/sdk.", "dependencies": { - "@langchain/core": "1.3.0", - "@langchain/langgraph": "1.5.2", - "zod": "4.6.7", + "@langchain/core": "0.3.80", + "@langchain/langgraph": "0.4.10", + "zod": "3.25.76", "zod-to-json-schema": "3.25.2" }, "devDependencies": { diff --git a/sdk/typescript/integration/fixtures/llamaindex-0.11/package-lock.json b/sdk/typescript/integration/fixtures/llamaindex-0.11/package-lock.json index cfcd9e825..f0670485f 100644 --- a/sdk/typescript/integration/fixtures/llamaindex-0.11/package-lock.json +++ b/sdk/typescript/integration/fixtures/llamaindex-0.11/package-lock.json @@ -8,8 +8,8 @@ "dependencies": { "@llamaindex/core": "0.6.8", "@llamaindex/workflow": "1.1.5", - "llamaindex": "0.12.1", - "zod": "4.6.7" + "llamaindex": "0.11.4", + "zod": "3.25.76" }, "devDependencies": { "@types/node": "22.20.4" @@ -53,14 +53,53 @@ "node": ">=20.0.0" } }, - "node_modules/@finom/zod-to-json-schema": { - "version": "3.24.11", - "resolved": "https://registry.npmjs.org/@finom/zod-to-json-schema/-/zod-to-json-schema-3.24.11.tgz", - "integrity": "sha512-fL656yBPiWebtfGItvtXLWrFNGlF1NcDFS0WdMQXMs9LluVg0CfT5E2oXYp0pidl0vVG53XkW55ysijNkU5/hA==", - "deprecated": "Use https://www.npmjs.com/package/zod-v3-to-json-schema instead. See issue comment for details: https://github.com/StefanTerdell/zod-to-json-schema/issues/178#issuecomment-3533122539", - "license": "ISC", + "node_modules/@llama-flow/core": { + "version": "0.4.4", + "resolved": "https://registry.npmjs.org/@llama-flow/core/-/core-0.4.4.tgz", + "integrity": "sha512-hwK1EQ+atUG/E7XcDV3KsTaA8op29pb8gbpVurpsqbLnGFkdTT4F/6V7Hy1cC2o/yOY+DKc/rxoIsH1uJS0cZg==", + "license": "MIT", + "peerDependencies": { + "@modelcontextprotocol/sdk": "^1.7.0", + "hono": "^4.7.4", + "next": "^15.2.2", + "p-retry": "^6.2.1", + "rxjs": "^7.8.2", + "zod": "^3.24.2" + }, + "peerDependenciesMeta": { + "@modelcontextprotocol/sdk": { + "optional": true + }, + "hono": { + "optional": true + }, + "next": { + "optional": true + }, + "p-retry": { + "optional": true + }, + "rxjs": { + "optional": true + }, + "zod": { + "optional": true + } + } + }, + "node_modules/@llamaindex/cloud": { + "version": "4.0.12", + "resolved": "https://registry.npmjs.org/@llamaindex/cloud/-/cloud-4.0.12.tgz", + "integrity": "sha512-8AEdPp/RyG0kkzUMqleWvv0olPXeMt8iGKD3LSQ1T4VE/IyCxemS0XMStXJTi1PSN91Gm5/GABKWXzGqBPbSSA==", + "license": "MIT", + "dependencies": { + "p-retry": "^6.2.1", + "zod": "^3.25.7" + }, "peerDependencies": { - "zod": "^4.0.14" + "@llama-flow/core": "^0.4.1", + "@llamaindex/core": "0.6.8", + "@llamaindex/env": "0.1.30" } }, "node_modules/@llamaindex/core": { @@ -75,15 +114,6 @@ "zod-to-json-schema": "^3.23.3" } }, - "node_modules/@llamaindex/core/node_modules/zod": { - "version": "3.25.76", - "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", - "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/colinhacks" - } - }, "node_modules/@llamaindex/env": { "version": "0.1.30", "resolved": "https://registry.npmjs.org/@llamaindex/env/-/env-0.1.30.tgz", @@ -106,6 +136,20 @@ } } }, + "node_modules/@llamaindex/node-parser": { + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/@llamaindex/node-parser/-/node-parser-2.0.8.tgz", + "integrity": "sha512-XCJr611xpx0Ubz9B+96hunzg0w/2rmxT5lCxQ8BoVz18xr8yr9Pq4l3jaKZ7sJoXUwnSs7gLz/rwpGgTkLLmsQ==", + "dependencies": { + "html-to-text": "^9.0.5" + }, + "peerDependencies": { + "@llamaindex/core": "0.6.8", + "@llamaindex/env": "0.1.30", + "tree-sitter": "^0.22.0", + "web-tree-sitter": "^0.24.3" + } + }, "node_modules/@llamaindex/workflow": { "version": "1.1.5", "resolved": "https://registry.npmjs.org/@llamaindex/workflow/-/workflow-1.1.5.tgz", @@ -119,74 +163,6 @@ "zod": "^3.23.8" } }, - "node_modules/@llamaindex/workflow-core": { - "version": "1.3.3", - "resolved": "https://registry.npmjs.org/@llamaindex/workflow-core/-/workflow-core-1.3.3.tgz", - "integrity": "sha512-WJIcD4K2suGbNkwU5CC70jKKrA5tARba42nMs8Pou1RGzmoxqg+K+b7vyLBmiDtImR8P40YLmkayCIRVQPBmsg==", - "license": "MIT", - "peerDependencies": { - "@modelcontextprotocol/sdk": "^1.7.0", - "hono": "^4.7.4", - "next": "^15.2.2", - "p-retry": "^6.2.1", - "rxjs": "^7.8.2", - "zod": "^3.25.0 || ^4.0.0" - }, - "peerDependenciesMeta": { - "@modelcontextprotocol/sdk": { - "optional": true - }, - "hono": { - "optional": true - }, - "next": { - "optional": true - }, - "p-retry": { - "optional": true - }, - "rxjs": { - "optional": true - }, - "zod": { - "optional": true - } - } - }, - "node_modules/@llamaindex/workflow/node_modules/@llama-flow/core": { - "version": "0.4.4", - "resolved": "https://registry.npmjs.org/@llama-flow/core/-/core-0.4.4.tgz", - "integrity": "sha512-hwK1EQ+atUG/E7XcDV3KsTaA8op29pb8gbpVurpsqbLnGFkdTT4F/6V7Hy1cC2o/yOY+DKc/rxoIsH1uJS0cZg==", - "license": "MIT", - "peerDependencies": { - "@modelcontextprotocol/sdk": "^1.7.0", - "hono": "^4.7.4", - "next": "^15.2.2", - "p-retry": "^6.2.1", - "rxjs": "^7.8.2", - "zod": "^3.24.2" - }, - "peerDependenciesMeta": { - "@modelcontextprotocol/sdk": { - "optional": true - }, - "hono": { - "optional": true - }, - "next": { - "optional": true - }, - "p-retry": { - "optional": true - }, - "rxjs": { - "optional": true - }, - "zod": { - "optional": true - } - } - }, "node_modules/@selderee/plugin-htmlparser2": { "version": "0.11.0", "resolved": "https://registry.npmjs.org/@selderee/plugin-htmlparser2/-/plugin-htmlparser2-0.11.0.tgz", @@ -265,6 +241,28 @@ "undici-types": "~6.21.0" } }, + "node_modules/@types/retry": { + "version": "0.12.2", + "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.2.tgz", + "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==", + "license": "MIT" + }, + "node_modules/ajv": { + "version": "8.20.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", + "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, "node_modules/base64-js": { "version": "1.5.1", "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz", @@ -361,6 +359,28 @@ "url": "https://github.com/fb55/entities?sponsor=1" } }, + "node_modules/fast-deep-equal": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", + "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", + "license": "MIT" + }, + "node_modules/fast-uri": { + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fastify" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/fastify" + } + ], + "license": "BSD-3-Clause" + }, "node_modules/html-to-text": { "version": "9.0.5", "resolved": "https://registry.npmjs.org/html-to-text/-/html-to-text-9.0.5.tgz", @@ -396,6 +416,18 @@ "entities": "^4.4.0" } }, + "node_modules/is-network-error": { + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.2.tgz", + "integrity": "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA==", + "license": "MIT", + "engines": { + "node": ">=16" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/js-tiktoken": { "version": "1.0.21", "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz", @@ -405,6 +437,12 @@ "base64-js": "^1.5.1" } }, + "node_modules/json-schema-traverse": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", + "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", + "license": "MIT" + }, "node_modules/leac": { "version": "0.6.0", "resolved": "https://registry.npmjs.org/leac/-/leac-0.6.0.tgz", @@ -415,17 +453,19 @@ } }, "node_modules/llamaindex": { - "version": "0.12.1", - "resolved": "https://registry.npmjs.org/llamaindex/-/llamaindex-0.12.1.tgz", - "integrity": "sha512-/tXXITk/iVGBycOFaDhev6dgTBIr6Ycu4FoPIt6A5JcEAiB6ujONjiV36flVXUR8JdqwMtS767XMjV+36nV4yQ==", + "version": "0.11.4", + "resolved": "https://registry.npmjs.org/llamaindex/-/llamaindex-0.11.4.tgz", + "integrity": "sha512-mU0wd0jGRQpYRq+vRrnvc3CZdgnkSWAAjRrnqX6wpb0ED6yOVUEbHzlmdGus5kgC0J8rpmW8BTXC1voszjmCxQ==", "license": "MIT", "dependencies": { - "@llamaindex/core": "0.6.22", + "@llamaindex/cloud": "4.0.12", + "@llamaindex/core": "0.6.8", "@llamaindex/env": "0.1.30", - "@llamaindex/node-parser": "2.0.22", - "@llamaindex/workflow": "1.1.24", + "@llamaindex/node-parser": "2.0.8", + "@llamaindex/workflow": "1.1.5", "@types/lodash": "^4.17.7", - "@types/node": "^24.0.13", + "@types/node": "^22.9.0", + "ajv": "^8.17.1", "lodash": "^4.17.21", "magic-bytes.js": "^1.10.0" }, @@ -433,59 +473,6 @@ "node": ">=18.0.0" } }, - "node_modules/llamaindex/node_modules/@llamaindex/core": { - "version": "0.6.22", - "resolved": "https://registry.npmjs.org/@llamaindex/core/-/core-0.6.22.tgz", - "integrity": "sha512-/BXyemkvpxMaUhOkbwJ2PTvzKjSWkL8+6QLpz/n+pk8xBwMMe1GVBgli/J57gCyi8GbrlBafBj6GaPOgWub2Eg==", - "dependencies": { - "@finom/zod-to-json-schema": "3.24.11", - "@llamaindex/env": "0.1.30", - "@types/node": "^24.0.13", - "magic-bytes.js": "^1.10.0", - "zod": "^4.1.5" - } - }, - "node_modules/llamaindex/node_modules/@llamaindex/node-parser": { - "version": "2.0.22", - "resolved": "https://registry.npmjs.org/@llamaindex/node-parser/-/node-parser-2.0.22.tgz", - "integrity": "sha512-uj5O89WShAAyiSZ8f8tU7hnLJ6pSmlY2a6hkAOs8odkUgT87dEqaPHpsK7w0iJdEFiob7GoLeRhv2K624FooXg==", - "dependencies": { - "html-to-text": "^9.0.5" - }, - "peerDependencies": { - "@llamaindex/core": "0.6.22", - "@llamaindex/env": "0.1.30", - "tree-sitter": "^0.22.0", - "web-tree-sitter": "^0.24.3" - } - }, - "node_modules/llamaindex/node_modules/@llamaindex/workflow": { - "version": "1.1.24", - "resolved": "https://registry.npmjs.org/@llamaindex/workflow/-/workflow-1.1.24.tgz", - "integrity": "sha512-VyKsbRkFlnT5dRNKbgLXQV+ZpQ+CAFgmC9LaZv6hD/fIKo6wq1wQW/ZqLZgZt569xeHgxmrXPB6KHdqn/AhPbQ==", - "dependencies": { - "@llamaindex/workflow-core": "^1.3.2" - }, - "peerDependencies": { - "@llamaindex/core": "0.6.22", - "@llamaindex/env": "0.1.30" - } - }, - "node_modules/llamaindex/node_modules/@types/node": { - "version": "24.19.2", - "resolved": "https://registry.npmjs.org/@types/node/-/node-24.19.2.tgz", - "integrity": "sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ==", - "license": "MIT", - "dependencies": { - "undici-types": ">=7.24.0 <7.24.7" - } - }, - "node_modules/llamaindex/node_modules/undici-types": { - "version": "7.24.6", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", - "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", - "license": "MIT" - }, "node_modules/lodash": { "version": "4.18.1", "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz", @@ -520,6 +507,23 @@ "node-gyp-build-test": "build-test.js" } }, + "node_modules/p-retry": { + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-6.2.1.tgz", + "integrity": "sha512-hEt02O4hUct5wtwg4H4KcWgDdm+l1bOaEy/hWzd8xtXB9BqxTWBBhb+2ImAtH4Cv4rPjV76xN3Zumqk3k3AhhQ==", + "license": "MIT", + "dependencies": { + "@types/retry": "0.12.2", + "is-network-error": "^1.0.0", + "retry": "^0.13.1" + }, + "engines": { + "node": ">=16.17" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/parseley": { "version": "0.12.1", "resolved": "https://registry.npmjs.org/parseley/-/parseley-0.12.1.tgz", @@ -548,6 +552,24 @@ "url": "https://ko-fi.com/killymxi" } }, + "node_modules/require-from-string": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", + "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/retry": { + "version": "0.13.1", + "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz", + "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==", + "license": "MIT", + "engines": { + "node": ">= 4" + } + }, "node_modules/selderee": { "version": "0.11.0", "resolved": "https://registry.npmjs.org/selderee/-/selderee-0.11.0.tgz", @@ -592,9 +614,9 @@ "peer": true }, "node_modules/zod": { - "version": "4.6.7", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", - "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", + "version": "3.25.76", + "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", + "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" diff --git a/sdk/typescript/integration/fixtures/llamaindex-0.11/package.json b/sdk/typescript/integration/fixtures/llamaindex-0.11/package.json index 64ea49431..9be52cdba 100644 --- a/sdk/typescript/integration/fixtures/llamaindex-0.11/package.json +++ b/sdk/typescript/integration/fixtures/llamaindex-0.11/package.json @@ -6,10 +6,13 @@ "dependencies": { "@llamaindex/core": "0.6.8", "@llamaindex/workflow": "1.1.5", - "llamaindex": "0.12.1", - "zod": "4.6.7" + "llamaindex": "0.11.4", + "zod": "3.25.76" }, "devDependencies": { "@types/node": "22.20.4" + }, + "overrides": { + "fast-uri": "3.1.9" } } diff --git a/sdk/typescript/integration/fixtures/mastra-1/package-lock.json b/sdk/typescript/integration/fixtures/mastra-1/package-lock.json index ddadb2cd4..2066c8509 100644 --- a/sdk/typescript/integration/fixtures/mastra-1/package-lock.json +++ b/sdk/typescript/integration/fixtures/mastra-1/package-lock.json @@ -329,15 +329,15 @@ } }, "node_modules/@modelcontextprotocol/client": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.2.0.tgz", - "integrity": "sha512-LxCou/CSYQ6dwEnjhLZY0KnEuc8V4UJ3IEQCl/uR2yHobSQIEdJKUlKLRYRF5i5FqRGHy1eK7une3aAWDHLtig==", - "license": "MIT", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/client/-/client-2.3.0.tgz", + "integrity": "sha512-pbHtGj6EeFCHngFE8gtNPaKrsj8Mb1IMw45BLcaPML/m2WTxI7pyYmeNQvaux88Lw8BSO5r7nyRbUyIkICmGrg==", + "license": "Apache-2.0", "dependencies": { - "@modelcontextprotocol/core": "2.2.0", + "@modelcontextprotocol/core": "2.3.0", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", - "eventsource-parser": "^3.0.0", + "eventsource-parser": "^3.0.8", "jose": "^6.1.3", "pkce-challenge": "^5.0.0", "zod": "^4.2.0" @@ -347,10 +347,10 @@ } }, "node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.2.0.tgz", - "integrity": "sha512-iLhmprRmWI8EcosOA3wVvww22z02NkgqhV4fBH6f/odQBsi7xnJc0HGmi21yWO+/iKw2yzqVE127Zhna5/+JXw==", - "license": "MIT", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.3.0.tgz", + "integrity": "sha512-09BHFaNVBe5pB2AhzCfLj0cqmsKLERvZQ4FblzP90UMGLaXVqdZPByFjURwsUYCmxonUW2yAwgTTvle+8O2/8w==", + "license": "Apache-2.0", "dependencies": { "zod": "^4.2.0" }, @@ -426,12 +426,24 @@ } }, "node_modules/@modelcontextprotocol/server": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server/-/server-2.0.0.tgz", - "integrity": "sha512-YhHWdHfpFMQfd0prsEnxKeS3Qz3ytIGmsS0sth4KDjnacIT7hxk6hXHkJ9KysxlkvTM+WZAtQbbcUhdoP4Hvtw==", - "license": "MIT", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server/-/server-2.3.0.tgz", + "integrity": "sha512-+6b0LdsQLmHsvS7J6sQJ4weTpzUn61fU1JKS+321/+IyDYoHW5CR2Tgqcs6GgAAQvlesCo6yX3xttgmx+XGtJw==", + "license": "Apache-2.0", + "dependencies": { + "@modelcontextprotocol/core": "2.3.0", + "zod": "^4.2.0" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/core/-/core-2.3.0.tgz", + "integrity": "sha512-09BHFaNVBe5pB2AhzCfLj0cqmsKLERvZQ4FblzP90UMGLaXVqdZPByFjURwsUYCmxonUW2yAwgTTvle+8O2/8w==", + "license": "Apache-2.0", "dependencies": { - "@modelcontextprotocol/core": "2.0.0", "zod": "^4.2.0" }, "engines": { diff --git a/sdk/typescript/integration/fixtures/mastra-1/package.json b/sdk/typescript/integration/fixtures/mastra-1/package.json index 9052260d6..19ca944a3 100644 --- a/sdk/typescript/integration/fixtures/mastra-1/package.json +++ b/sdk/typescript/integration/fixtures/mastra-1/package.json @@ -13,7 +13,8 @@ "@types/node": "22.20.4" }, "overrides": { - "@modelcontextprotocol/client": "2.2.0", + "@modelcontextprotocol/client": "2.3.0", + "@modelcontextprotocol/server": "2.3.0", "argparse": "2.0.1" } } diff --git a/sdk/typescript/integration/fixtures/runtimes/deno-npm.ts b/sdk/typescript/integration/fixtures/runtimes/deno-npm.ts index b2817635b..f0a7e8521 100644 --- a/sdk/typescript/integration/fixtures/runtimes/deno-npm.ts +++ b/sdk/typescript/integration/fixtures/runtimes/deno-npm.ts @@ -8,7 +8,7 @@ import * as failproofai from "npm:@failproofai/sdk"; import { telemetry, wrapModel } from "npm:@failproofai/sdk/ai"; import { generateText, stepCountIs, tool } from "npm:ai@6.0.288"; import { MockLanguageModelV3 } from "npm:ai@6.0.288/test"; -import { z } from "npm:zod@4.6.5"; +import { z } from "npm:zod@4.6.7"; const usage = (input: number, output: number) => ({ inputTokens: { total: input, noCache: input, cacheRead: undefined, cacheWrite: undefined }, From 6655b3ea0be9f5a14b4325385ba876ede483798a Mon Sep 17 00:00:00 2001 From: NiveditJain Date: Sun, 25 Oct 2026 07:41:28 +0530 Subject: [PATCH 2/2] [failproofai-legion-934] Require every framework floor in the pin test, and name mastra-0 in the ai@4 retirement Review on #934 (CodeRabbit): - The pin test's discovery check required ai-4, langchain-0.3 and mastra-0 but not llamaindex-0.11, so deleting that fixture would drop its case with every assertion still passing. It now requires all four supported floors. - SECURITY.md said dropping ai 4.x retires the two ai@4 rows. Both also cover mastra-0, whose @mastra/core@0.24.9 requires ai@^4, so the ai-4 fixture leaving is not enough; the text now says mastra-0 must go too. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01R83BsnFfqDkiHDyhGCnprq --- SECURITY.md | 7 ++++--- __tests__/ci/ts-sdk-fixture-pins.test.ts | 6 ++++-- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1efa4c87b..5d34e1468 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -129,9 +129,10 @@ That splits an alert in one of these lockfiles into two cases: Every row is bounded by the same facts: these are test fixtures — `"private": true`, never published, installed with `--ignore-scripts`, and run only in CI against scripted in-process models. Re-check them whenever the supported framework floor -moves. Dropping `ai` 4.x from the matrix retires the first two rows; the zod row -retires only once `ai` 4.x, LangChain 0.3, LlamaIndex 0.11 and Mastra 0.x have all -left it. +moves. The first two rows retire once `ai` 4.x has left the matrix, which takes +`mastra-0` as well as `ai-4`, because `@mastra/core@0.24.9` requires `ai@^4`. The +zod row retires only once `ai` 4.x, LangChain 0.3, LlamaIndex 0.11 and Mastra 0.x +have all left it. ## Maintainer setup (one-time) diff --git a/__tests__/ci/ts-sdk-fixture-pins.test.ts b/__tests__/ci/ts-sdk-fixture-pins.test.ts index 703e30c13..ef846d057 100644 --- a/__tests__/ci/ts-sdk-fixture-pins.test.ts +++ b/__tests__/ci/ts-sdk-fixture-pins.test.ts @@ -59,8 +59,10 @@ const specifiers = fixtures.flatMap((fixture) => ); describe("TS SDK integration fixtures named for a release line", () => { - it("finds them", () => { - expect(named.map((f) => f.fixture)).toEqual(expect.arrayContaining(["ai-4", "langchain-0.3", "mastra-0"])); + it("finds them, every framework's supported floor among them", () => { + expect(named.map((f) => f.fixture)).toEqual( + expect.arrayContaining(["ai-4", "langchain-0.3", "llamaindex-0.11", "mastra-0"]), + ); }); it("know which framework each name pins", () => {