NiveditJain · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.13-beta.0 — 2026-10-25
+
+### Dependencies
+
+- Restore the `ai-4`, `langchain-0.3` and `llamaindex-0.11` SDK integration fixtures to the releases they exist to test: `ai@4.3.19`, `@langchain/core@0.3.80` with `@langchain/langgraph@0.4.10`, and `llamaindex@0.11.4`, each with `zod@3.25.76`. Dependabot's grouped security update (#931) reached the zod fix by moving them to `ai@7.0.152`, `@langchain/core@1.3.0` and `llamaindex@0.12.1`, the pin move `SECURITY.md` rules out, so the matrix silently stopped testing three supported floors. `llamaindex-0.11` then stopped installing (`@llamaindex/workflow@1.1.5` peers on `zod@^3.23.8`, so `npm ci` failed `ERESOLVE`), and because global setup installs every fixture first, the `frameworks` and `runtimes` integration shards failed on `main`. #931 also moved the `runtimes` fixture to `zod@4.6.7` while its Deno program still imported `npm:zod@4.6.5`, which Deno could no longer find; it now imports the installed version. `__tests__/ci/ts-sdk-fixture-pins.test.ts` fails on either move before anything installs (#934)
+- Patch the fixable SDK integration fixture advisories with fixture-local `overrides`, moving no pin: `undici` 7.29.1 → 7.30.1 in `ai-5` (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472); `fast-uri` 3.1.8 → 3.1.9 in `llamaindex-0.11` (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp); and in `mastra-1`, `@modelcontextprotocol/server` 2.0.0 → 2.3.0 and `@modelcontextprotocol/client` 2.2.0 → 2.3.0 (GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453, GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw), both pinned exactly by `@mastra/mcp@2.0.0`, each now with its own `@modelcontextprotocol/core@2.3.0` nested under it (#934)
+- `SECURITY.md` accepts zod GHSA-mrhx-c7xc-m3w5 in the five fixtures held to zod 3: `ai-4`, `langchain-0.3` and `llamaindex-0.11`, and the nested copies in `langchain-dup-core` and `mastra-0`. It is fixed only in zod 4.6.6, no zod 3 release carries the fix, and every copy is required at `^3` by the framework release its fixture pins (#934)
+
 ## 1.0.12 — 2026-10-23
 
 The stable release of logging in to FailproofAI Cloud from `config` in your browser, and of Cloud-managed Jev and hybrid policies scoped to agents. Everything below in the `1.0.12-beta.*` sections ships here too.

diff --git a/SECURITY.md b/SECURITY.md
@@ -124,11 +124,15 @@ That splits an alert in one of these lockfiles into two cases:
 |---|---|---|---|
 | [GHSA-rwvc-j5jr-mgvh](https://github.com/advisories/GHSA-rwvc-j5jr-mgvh) (low, CVSS 3.7) | `ai@4.3.19` | `ai-4`, `mastra-0` | A filetype-whitelist bypass on **file upload**. Fixed in `ai@5.0.52` — the major the `ai-4` fixture exists to stay below, and one `@mastra/core@0.24.9` cannot take either (it requires `ai@^4`). Neither fixture uploads a file or exposes an upload surface; each runs one scripted agent against an in-process model. |
 | [GHSA-866g-f22w-33x8](https://github.com/advisories/GHSA-866g-f22w-33x8) (low, CVSS 4.3) | `@ai-sdk/provider-utils@2.2.8` | `ai-4`, `mastra-0` | Unbounded response-body reads in `createJsonResponseHandler` and its siblings. Fixed in `3.0.28`; `2.2.8` ships *inside* `ai@4.3.19`, which uses the v2 API, so the fix is the same blocked major as the row above. Exploiting it needs a hostile **model-provider HTTP response**; these fixtures never call one. |
+| [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5) (high, CVSS 7.5) | `zod@3.25.76` | `ai-4`, `langchain-0.3`, `llamaindex-0.11`; nested in `langchain-dup-core` and `mastra-0` | An array schema keeps every failing element's validation issues, uncapped, so one oversized input can exhaust memory. Fixed only in `4.6.6`: no zod 3 release carries the fix, and `3.25.76` is the newest. Each copy is held to `^3` by the release its fixture pins — `ai@4.3.19` and its `@ai-sdk/*` packages peer on `^3.23.8`, `@langchain/core@0.3.80` (in `langchain-dup-core`, the vendored provider's own copy) and `@langchain/langgraph@0.4.10` depend on `^3.25.32`, `@llamaindex/core@0.6.8` and `@llamaindex/workflow@1.1.5` need `^3.23.8`, and in `mastra-0`, `zod-from-json-schema-v3` (`zod-from-json-schema@0.0.5`, which builds zod 3 schemas for `@mastra/core` and `@mastra/mcp`) depends on `^3.24.2`. Exploiting it needs untrusted input validated against one of those schemas; each fixture validates only its own scripted tool arguments. |
 
-Both rows are bounded by the same facts: these are test fixtures — `"private": true`,
+Every row is bounded by the same facts: these are test fixtures — `"private": true`,
 never published, installed with `--ignore-scripts`, and run only in CI against
 scripted in-process models. Re-check them whenever the supported framework floor
-moves; dropping `ai` 4.x from the matrix is what actually retires them.
+moves. The first two rows retire once `ai` 4.x has left the matrix, which takes
+`mastra-0` as well as `ai-4`, because `@mastra/core@0.24.9` requires `ai@^4`. The
+zod row retires only once `ai` 4.x, LangChain 0.3, LlamaIndex 0.11 and Mastra 0.x
+have all left it.
 
 ## Maintainer setup (one-time)
 

diff --git a/__tests__/ci/ts-sdk-fixture-pins.test.ts b/__tests__/ci/ts-sdk-fixture-pins.test.ts
@@ -0,0 +1,91 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+/**
+ * A TypeScript SDK integration fixture named for a release line — `ai-4`,
+ * `langchain-0.3`, `mastra-0` — exists to hold its framework on that line: the
+ * pinned release is the subject of the test (SECURITY.md, "Triaging a Dependabot
+ * alert in an integration fixture"). A move off it still installs and still
+ * passes, against a different major, so the matrix loses a supported floor with
+ * every check green. Dependabot security updates have made that move twice
+ * (#838, #931), both times to reach a fix the fixture could not take. This fails
+ * on the manifest, before anything installs.
+ *
+ * #931 also moved the `runtimes` fixture's zod without the `npm:zod@…` specifier
+ * its Deno program imports, which Deno resolves against the fixture's
+ * `node_modules` and so could no longer find. That half is checked here too.
+ */
+
+const fixturesDir = join(__dirname, "..", "..", "sdk", "typescript", "integration", "fixtures");
+
+/** The package each fixture-name prefix pins. */
+const FRAMEWORK: Record<string, string> = {
+  ai: "ai",
+  langchain: "@langchain/core",
+  llamaindex: "llamaindex",
+  mastra: "@mastra/core",
+};
+
+const fixtures = readdirSync(fixturesDir, { withFileTypes: true })
+  .filter((entry) => entry.isDirectory())
+  .map((entry) => entry.name);
+
+const named = fixtures
+  .map((name) => /^([a-z]+)-(\d+(?:\.\d+)?)$/.exec(name))
+  .filter((match): match is RegExpExecArray => match !== null)
+  .map(([fixture, prefix, line]) => ({ fixture: fixture!, framework: FRAMEWORK[prefix!], line: line! }));
+
+const readJson = (fixture: string, file: string) =>
+  JSON.parse(readFileSync(join(fixturesDir, fixture, file), "utf8")) as {
+    dependencies?: Record<string, string>;
+    packages?: Record<string, { version?: string }>;
+  };
+
+/** Every `npm:<name>@<version>` a fixture's top-level programs import, once each. */
+const NPM_SPECIFIER = /["']npm:((?:@[\w.-]+\/)?[\w.-]+)@([^"'/]+)/g;
+const specifiers = fixtures.flatMap((fixture) =>
+  readdirSync(join(fixturesDir, fixture))
+    .filter((file) => file.endsWith(".ts"))
+    .flatMap((file) => {
+      const source = readFileSync(join(fixturesDir, fixture, file), "utf8");
+      const found = new Set([...source.matchAll(NPM_SPECIFIER)].map(([, name, version]) => `${name}@${version}`));
+      return [...found].map((spec) => {
+        const at = spec.lastIndexOf("@");
+        return { fixture, file, name: spec.slice(0, at), version: spec.slice(at + 1) };
+      });
+    }),
+);
+
+describe("TS SDK integration fixtures named for a release line", () => {
+  it("finds them, every framework's supported floor among them", () => {
+    expect(named.map((f) => f.fixture)).toEqual(
+      expect.arrayContaining(["ai-4", "langchain-0.3", "llamaindex-0.11", "mastra-0"]),
+    );
+  });
+
+  it("know which framework each name pins", () => {
+    expect(named.filter((f) => f.framework === undefined).map((f) => f.fixture)).toEqual([]);
+  });
+
+  it.each(named)("$fixture pins $framework exactly, on $line", ({ fixture, framework, line }) => {
+    const pinned = readJson(fixture, "package.json").dependencies?.[framework!];
+    expect(pinned, `${fixture}: ${framework} in package.json`).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(pinned!.startsWith(`${line}.`), `${fixture} pins ${framework}@${pinned}`).toBe(true);
+    const locked = readJson(fixture, "package-lock.json").packages?.[`node_modules/${framework}`]?.version;
+    expect(locked, `${fixture}: ${framework} in package-lock.json`).toBe(pinned);
+  });
+});
+
+describe("TS SDK integration fixtures' npm: specifiers", () => {
+  it("finds the Deno program's", () => {
+    expect(specifiers.map((s) => s.name)).toEqual(expect.arrayContaining(["ai", "zod"]));
+  });
+
+  it.each(specifiers)("$fixture/$file imports npm:$name@$version, the version it installs", (spec) => {
+    const { fixture, name, version } = spec;
+    const locked = readJson(fixture, "package-lock.json").packages?.[`node_modules/${name}`]?.version;
+    expect(locked, `${fixture}: ${name} in package-lock.json`).toBe(version);
+  });
+});
diff --git a/sdk/typescript/CHANGELOG.md b/sdk/typescript/CHANGELOG.md
@@ -21,6 +21,43 @@ section is missing or empty is refused before anything is built.
   dependencies. Each lockfile changes by those two packages and nothing else, and
   `npm audit` on both now reports no findings. (#904)
 
+- **`ai-4`, `langchain-0.3` and `llamaindex-0.11` test their own releases again.**
+  Dependabot's grouped security update (#931) reached the zod fix by moving all
+  three off the release they exist to hold: `ai@4.3.19` → `7.0.152`,
+  `@langchain/core@0.3.80` → `1.3.0` (with `@langchain/langgraph@0.4.10` →
+  `1.5.2`) and `llamaindex@0.11.4` → `0.12.1`, each with `zod@3.25.76` → `4.6.7`.
+  `ai-4` and `langchain-0.3` still installed and passed while testing a
+  different major, so the matrix silently lost two supported floors. `llamaindex-0.11`
+  did not install: `@llamaindex/workflow@1.1.5` peers on `zod@^3.23.8`, so
+  `npm ci` failed `ERESOLVE`, and because the global setup installs every fixture
+  before any test runs, the `frameworks` and `runtimes` shards failed on `main`.
+  All three are back on their pre-#931 manifests and lockfiles. #931 also moved
+  the `runtimes` fixture to `zod@4.6.7` while `deno-npm.ts` still imported
+  `npm:zod@4.6.5`, which Deno resolves against the fixture's `node_modules` and
+  could no longer find; it imports `4.6.7` now. A root CI test,
+  `__tests__/ci/ts-sdk-fixture-pins.test.ts`, fails on either move: a fixture named
+  for a release line pinning its framework off that line, or an `npm:` specifier
+  naming a version the fixture does not install. (#934)
+
+- **The remaining fixable fixture advisories clear, each with an override.** `ai-5`
+  moves `undici` 7.29.1 → 7.30.1 (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685,
+  GHSA-f72v-6w45-q472) and `llamaindex-0.11` moves `fast-uri` 3.1.8 → 3.1.9
+  (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h,
+  GHSA-333x-w4r6-6crp). In `mastra-1`, `@mastra/mcp@2.0.0` pins
+  `@modelcontextprotocol/server` and `@modelcontextprotocol/client` exactly, so the
+  fixture overrides both to `2.3.0` (GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453,
+  GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw); each brings its own
+  `@modelcontextprotocol/core@2.3.0` nested under it, as the client's earlier
+  `2.2.0` override did. Each lockfile changes by those packages alone, and
+  `npm audit` reports no findings in `ai-5` or `mastra-1`. (#934)
+
+- **zod GHSA-mrhx-c7xc-m3w5 stays in the five fixtures held to zod 3.** It is fixed
+  only in `zod@4.6.6`, and no zod 3 release carries the fix. `ai-4`, `langchain-0.3`
+  and `llamaindex-0.11` pin `zod@3.25.76` beside frameworks that require `^3`, and
+  `langchain-dup-core` and `mastra-0` carry a nested copy that the vendored
+  provider's `@langchain/core@0.3.80` and `zod-from-json-schema@0.0.5` require.
+  `SECURITY.md` records it with the two `ai@4` advisories. (#934)
+
 ## 0.0.1-beta.1 — 2026-10-15
 
 ### Features