failproofai 1.0.11-beta.4 → 1.0.12-beta.0

package/.next/standalone/sdk/typescript/CHANGELOG.md

@@ -8,10 +8,36 @@ Headings are `## <version> — <YYYY-MM-DD>`, and the section matching the versi
 in `src/version.ts` becomes that release's GitHub Release body. A release whose
 section is missing or empty is refused before anything is built.
 
-## 0.0.1-beta.1 — 2026-09-24
+## 0.0.1-beta.2 — 2026-10-16
 
 ### Fixes
 
+- **`nextjs` and `mastra-1` drop `sprintf-js`.** Every release through `1.1.3`
+  carries GHSA-hp3w-g68c-fv3c and none fixes it, so the fix is to take it out of
+  the tree. Both fixtures reached it only through `@mastra/core@1.68.0` →
+  `gray-matter@4.0.3` → `js-yaml@3.15.2` → `argparse@1.0.10`, and js-yaml 3 loads
+  `argparse` from its `js-yaml` CLI alone, never from the library `gray-matter`
+  calls. A fixture-local `overrides` entry moves `argparse` to `2.0.1`, which has no
+  dependencies. Each lockfile changes by those two packages and nothing else, and
+  `npm audit` on both now reports no findings. (#904)
+
+## 0.0.1-beta.1 — 2026-10-15
+
+### Features
+
+- **OpenTelemetry spans to FailproofAI Cloud, without a network call in your
+  process.** `OtelSpanExporter`, or `instrument("otel", { spanProcessors })` before
+  you construct your provider, writes each finished batch of spans as OTLP/JSON to
+  the local spool (`~/.failproofai/state/spool-otlp`); the failproofai daemon
+  delivers it to Cloud with the machine's key and retries if Cloud is unreachable.
+  `@opentelemetry/sdk-trace-base` is only loaded when you call it.
+
+### Fixes
+
+- **A blank `FAILPROOFAI_HOME` no longer means the current directory.** An empty or
+  whitespace-only value made the exporter and the custom-agents resolver write
+  under the working directory, where the daemon never reads. Blank now means unset.
+
 - **The integration fixtures stop carrying 32 open security advisories.** Nothing
   the published package ships changed — every fixture under `integration/fixtures/`
   is `"private": true` and exists only to run the adapters against real framework
@@ -95,6 +121,18 @@ section is missing or empty is refused before anything is built.
   against the override. This package's own dev lockfile also moves
   `source-map-js` to `1.2.2` (GHSA-68fv-2mgg-jv7q). (#901)
 
+- **`nextjs` and `mastra-0` clear their fixable advisories, again without moving
+  a pin.** `nextjs` moves `next` to `16.4.1` (six advisories, fixed in `16.3.8`),
+  `sharp` to `0.35.5` (GHSA-wq5f-xc86-pv6w) and `source-map-js` to `1.2.2`
+  (GHSA-68fv-2mgg-jv7q). `mastra-0` moves `@modelcontextprotocol/sdk` from
+  `1.30.1` to `1.32.1` (GHSA-6qxp-vccf-f47h), inside the `^1.17.5` range
+  `@mastra/mcp@0.14.5` declares, so only the lockfile changes. Dependabot's
+  version of this PR also moved `ai-4` to `ai@5.0.52` and `mastra-0` to
+  `@mastra/core@1.77.0`, which cannot install beside `@mastra/mcp@0.14.5` and
+  failed every integration shard, and `nextjs`'s `ai` to `7.0.141`, off the
+  `ai-7` twin its routes' traces are compared against. None of those are
+  applied. (#902)
+
 ## 0.0.1-beta.0 — 2026-09-23
 
 ### Added

package/.next/standalone/sdk/typescript/integration/fixtures/mastra-0/package-lock.json

@@ -1026,9 +1026,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.1",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.1.tgz",
-      "integrity": "sha512-H2HxLvC3HDNybePJaLdSrU1hhUK5iQw+WvV1b01myFyI7sdVGe1u/IPTE5D9fGCiJDVtgMV/lmFkQXLmQyIFYA==",
+      "version": "1.32.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.1.tgz",
+      "integrity": "sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==",
       "license": "MIT",
       "dependencies": {
         "@hono/node-server": "^1.19.9 || ^2.0.5",

package/.next/standalone/sdk/typescript/integration/fixtures/mastra-1/package-lock.json

@@ -577,13 +577,10 @@
       "license": "Apache-2.0"
     },
     "node_modules/argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "license": "MIT",
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
     },
     "node_modules/async-mutex": {
       "version": "0.5.0",
@@ -2265,12 +2262,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/sprintf-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
-      "license": "BSD-3-Clause"
-    },
     "node_modules/stream-parser": {
       "version": "0.3.1",
       "resolved": "https://registry.npmjs.org/stream-parser/-/stream-parser-0.3.1.tgz",

package/.next/standalone/sdk/typescript/integration/fixtures/mastra-1/package.json

@@ -13,6 +13,7 @@
     "@types/node": "22.20.4"
   },
   "overrides": {
-    "@modelcontextprotocol/client": "2.2.0"
+    "@modelcontextprotocol/client": "2.2.0",
+    "argparse": "2.0.1"
   }
 }