failproofai 1.0.12 → 1.0.13-beta.2

package/.next/standalone/sdk/typescript/CHANGELOG.md

@@ -21,6 +21,58 @@ section is missing or empty is refused before anything is built.
   dependencies. Each lockfile changes by those two packages and nothing else, and
   `npm audit` on both now reports no findings. (#904)
 
+- **`ai-4`, `langchain-0.3` and `llamaindex-0.11` test their own releases again.**
+  Dependabot's grouped security update (#931) reached the zod fix by moving all
+  three off the release they exist to hold: `ai@4.3.19` → `7.0.152`,
+  `@langchain/core@0.3.80` → `1.3.0` (with `@langchain/langgraph@0.4.10` →
+  `1.5.2`) and `llamaindex@0.11.4` → `0.12.1`, each with `zod@3.25.76` → `4.6.7`.
+  `ai-4` and `langchain-0.3` still installed and passed while testing a
+  different major, so the matrix silently lost two supported floors. `llamaindex-0.11`
+  did not install: `@llamaindex/workflow@1.1.5` peers on `zod@^3.23.8`, so
+  `npm ci` failed `ERESOLVE`, and because the global setup installs every fixture
+  before any test runs, the `frameworks` and `runtimes` shards failed on `main`.
+  All three are back on their pre-#931 manifests and lockfiles. #931 also moved
+  the `runtimes` fixture to `zod@4.6.7` while `deno-npm.ts` still imported
+  `npm:zod@4.6.5`, which Deno resolves against the fixture's `node_modules` and
+  could no longer find; it imports `4.6.7` now. A root CI test,
+  `__tests__/ci/ts-sdk-fixture-pins.test.ts`, fails on either move: a fixture named
+  for a release line pinning its framework off that line, or an `npm:` specifier
+  naming a version the fixture does not install. (#934)
+
+- **The four framework floors stay put.** Dependabot's grouped security update
+  #935, opened three minutes after #934 merged, moved `ai-4`, `langchain-0.3` and
+  `llamaindex-0.11` off their releases again (`ai@4.3.19` → `5.0.52`,
+  `@langchain/core@0.3.80` → `1.3.0` with `@langchain/langgraph@0.4.10` →
+  `1.5.2`, `llamaindex@0.11.4` → `0.12.1`, each with `zod@3.25.76` → `4.6.7`), and
+  `mastra-0` too (`@mastra/core@0.24.9` → `1.79.0`, `@mastra/memory@0.15.13` →
+  `1.39.0`). All four are back on their #934 manifests and lockfiles. So that the
+  move stops being proposed rather than being undone a fourth time,
+  `.github/dependabot.yml` gives each floor a security-updates-only entry
+  (`open-pull-requests-limit: 0`) whose `ignore` ranges hold its framework on its
+  line, and zod on 3 where that framework requires it; a fix that stays on the
+  line still arrives. `__tests__/ci/ts-sdk-fixture-pins.test.ts` now also fails
+  when a floor has no such entry, or one that would let the framework leave its
+  line. (#950)
+
+- **The remaining fixable fixture advisories clear, each with an override.** `ai-5`
+  moves `undici` 7.29.1 → 7.30.1 (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685,
+  GHSA-f72v-6w45-q472) and `llamaindex-0.11` moves `fast-uri` 3.1.8 → 3.1.9
+  (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h,
+  GHSA-333x-w4r6-6crp). In `mastra-1`, `@mastra/mcp@2.0.0` pins
+  `@modelcontextprotocol/server` and `@modelcontextprotocol/client` exactly, so the
+  fixture overrides both to `2.3.0` (GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453,
+  GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw); each brings its own
+  `@modelcontextprotocol/core@2.3.0` nested under it, as the client's earlier
+  `2.2.0` override did. Each lockfile changes by those packages alone, and
+  `npm audit` reports no findings in `ai-5` or `mastra-1`. (#934)
+
+- **zod GHSA-mrhx-c7xc-m3w5 stays in the five fixtures held to zod 3.** It is fixed
+  only in `zod@4.6.6`, and no zod 3 release carries the fix. `ai-4`, `langchain-0.3`
+  and `llamaindex-0.11` pin `zod@3.25.76` beside frameworks that require `^3`, and
+  `langchain-dup-core` and `mastra-0` carry a nested copy that the vendored
+  provider's `@langchain/core@0.3.80` and `zod-from-json-schema@0.0.5` require.
+  `SECURITY.md` records it with the two `ai@4` advisories. (#934)
+
 ## 0.0.1-beta.1 — 2026-10-15
 
 ### Features

package/.next/standalone/sdk/typescript/integration/fixtures/ai-4/package-lock.json

@@ -6,66 +6,97 @@
     "": {
       "name": "failproofai-it-ai-4",
       "dependencies": {
-        "ai": "7.0.152",
-        "zod": "4.6.7"
+        "ai": "4.3.19",
+        "zod": "3.25.76"
       },
       "devDependencies": {
         "@types/node": "22.20.4"
       }
     },
-    "node_modules/@ai-sdk/gateway": {
-      "version": "4.0.125",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-4.0.125.tgz",
-      "integrity": "sha512-9raNdkENebDxVl4piGntpQgOBHB62K1rC87KceV8kkGOc/g7s6lwbxN7C6QTqXYJaM+h1Lnm64MDgnHAmzUApg==",
+    "node_modules/@ai-sdk/provider": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-1.1.3.tgz",
+      "integrity": "sha512-qZMxYJ0qqX/RfnuIaab+zp8UAeJn/ygXXAffR5I4N0n1IrvA6qBsjc8hXLmBiMV2zoXlifkacF7sEFnYnjBcqg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.33",
-        "@ai-sdk/provider-utils": "5.0.67",
-        "@vercel/oidc": "3.2.0"
+        "json-schema": "^0.4.0"
       },
       "engines": {
-        "node": ">=22"
+        "node": ">=18"
+      }
+    },
+    "node_modules/@ai-sdk/provider-utils": {
+      "version": "2.2.8",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-2.2.8.tgz",
+      "integrity": "sha512-fqhG+4sCVv8x7nFzYnFo19ryhAa3w096Kmc3hWxMQfW/TubPOmt3A6tYZhl4mUfQWWQMsuSkLrtjlWuXBVSGQA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ai-sdk/provider": "1.1.3",
+        "nanoid": "^3.3.8",
+        "secure-json-parse": "^2.7.0"
+      },
+      "engines": {
+        "node": ">=18"
       },
       "peerDependencies": {
-        "zod": "^3.25.76 || ^4.1.8"
+        "zod": "^3.23.8"
       }
     },
-    "node_modules/@ai-sdk/provider": {
-      "version": "4.0.33",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.33.tgz",
-      "integrity": "sha512-C6ylMuAXjgqKJllp6ODIJwUltK/tm3ZmIj4V2fqENP3Y8gif2DyeJSsTcDwFrXppgEKcrBisi/BWx2tYeoeCAw==",
+    "node_modules/@ai-sdk/react": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/react/-/react-1.2.12.tgz",
+      "integrity": "sha512-jK1IZZ22evPZoQW3vlkZ7wvjYGYF+tRBKXtrcolduIkQ/m/sOAVcVeVDUDvh1T91xCnWCdUGCPZg2avZ90mv3g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "json-schema": "^0.4.0"
+        "@ai-sdk/provider-utils": "2.2.8",
+        "@ai-sdk/ui-utils": "1.2.11",
+        "swr": "^2.2.5",
+        "throttleit": "2.1.0"
       },
       "engines": {
-        "node": ">=22"
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^18 || ^19 || ^19.0.0-rc",
+        "zod": "^3.23.8"
+      },
+      "peerDependenciesMeta": {
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@ai-sdk/provider-utils": {
-      "version": "5.0.67",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.67.tgz",
-      "integrity": "sha512-EUzV6GXutGcesWKOY8tRKgijfuv1LUBpqAquMh5k0n74NCjDbca5d5ZG12qhVtM2X5UwM4B2ZMP2XpnAwZlA8Q==",
+    "node_modules/@ai-sdk/ui-utils": {
+      "version": "1.2.11",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/ui-utils/-/ui-utils-1.2.11.tgz",
+      "integrity": "sha512-3zcwCc8ezzFlwp3ZD15wAPjf2Au4s3vAbKsXQVyhxODHcmu0iyPO2Eua6D/vicq/AUm/BAo60r97O6HU+EI0+w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.33",
-        "@standard-schema/spec": "^1.1.0",
-        "@workflow/serde": "4.1.0",
-        "eventsource-parser": "^3.0.8",
-        "undici": "^7.29.0"
+        "@ai-sdk/provider": "1.1.3",
+        "@ai-sdk/provider-utils": "2.2.8",
+        "zod-to-json-schema": "^3.24.1"
       },
       "engines": {
-        "node": ">=22"
+        "node": ">=18"
       },
       "peerDependencies": {
-        "zod": "^3.25.76 || ^4.1.8"
+        "zod": "^3.23.8"
       }
     },
-    "node_modules/@standard-schema/spec": {
+    "node_modules/@dmsnell/diff-match-patch": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "license": "MIT"
+      "resolved": "https://registry.npmjs.org/@dmsnell/diff-match-patch/-/diff-match-patch-1.1.0.tgz",
+      "integrity": "sha512-yejLPmM5pjsGvxS9gXablUSbInW7H976c/FJ4iQxWIm7/38xBySRemTPDe34lhg1gVLbJntX0+sH0jYfU+PN9A==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
+      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8.0.0"
+      }
     },
     "node_modules/@types/node": {
       "version": "22.20.4",
@@ -77,45 +108,39 @@
         "undici-types": "~6.21.0"
       }
     },
-    "node_modules/@vercel/oidc": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@vercel/oidc/-/oidc-3.2.0.tgz",
-      "integrity": "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">= 20"
-      }
-    },
-    "node_modules/@workflow/serde": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/@workflow/serde/-/serde-4.1.0.tgz",
-      "integrity": "sha512-pav4F2BoirECWR7Nf1TKt+2eETcBj7jj4cBefQ8VXQCA6NPkaKeLfj/zMgi+3zYV5ZIBT4GuUiphsj0/b9hPQQ==",
-      "license": "Apache-2.0"
-    },
     "node_modules/ai": {
-      "version": "7.0.152",
-      "resolved": "https://registry.npmjs.org/ai/-/ai-7.0.152.tgz",
-      "integrity": "sha512-cxQaE/17qhgqJcLCespbnyaN3c4IkGuNUtBXKSX1yTvlSsQ7ERV2ygFADMG7d+IWCUuvi7R8DrqAy9DGj0cgkg==",
+      "version": "4.3.19",
+      "resolved": "https://registry.npmjs.org/ai/-/ai-4.3.19.tgz",
+      "integrity": "sha512-dIE2bfNpqHN3r6IINp9znguYdhIOheKW2LDigAMrgt/upT3B8eBGPSCblENvaZGoq+hxaN9fSMzjWpbqloP+7Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/gateway": "4.0.125",
-        "@ai-sdk/provider": "4.0.33",
-        "@ai-sdk/provider-utils": "5.0.67"
+        "@ai-sdk/provider": "1.1.3",
+        "@ai-sdk/provider-utils": "2.2.8",
+        "@ai-sdk/react": "1.2.12",
+        "@ai-sdk/ui-utils": "1.2.11",
+        "@opentelemetry/api": "1.9.0",
+        "jsondiffpatch": "0.6.0"
       },
       "engines": {
-        "node": ">=22"
+        "node": ">=18"
       },
       "peerDependencies": {
-        "zod": "^3.25.76 || ^4.1.8"
+        "react": "^18 || ^19 || ^19.0.0-rc",
+        "zod": "^3.23.8"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        }
       }
     },
-    "node_modules/eventsource-parser": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz",
-      "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==",
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
       "license": "MIT",
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=6"
       }
     },
     "node_modules/json-schema": {
@@ -124,13 +149,78 @@
       "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
-    "node_modules/undici": {
-      "version": "7.30.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
-      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
+    "node_modules/jsondiffpatch": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/jsondiffpatch/-/jsondiffpatch-0.7.6.tgz",
+      "integrity": "sha512-zE9+AXFq+MkTolDor2Cw1nJzLC0aleqPkYf52Kb4Kn4mJcka/gFHpGI2JBVEJCfWOvBl0OoxZS+wuLdislQcqg==",
+      "license": "MIT",
+      "dependencies": {
+        "@dmsnell/diff-match-patch": "^1.1.0"
+      },
+      "bin": {
+        "jsondiffpatch": "bin/jsondiffpatch.js"
+      },
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.19",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/react": {
+      "version": "19.3.0",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.3.0.tgz",
+      "integrity": "sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/secure-json-parse": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-2.7.0.tgz",
+      "integrity": "sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/swr": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/swr/-/swr-2.5.1.tgz",
+      "integrity": "sha512-BRw55e8r0B7SpDN20CAzoQAHl7y1yP7/Zt7oqUjMv0vSt2u2Xnkm88Ws+VypbV9BXHQVuSuyVq7zMjO16wSExw==",
+      "license": "MIT",
+      "dependencies": {
+        "dequal": "^2.0.3",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "peerDependencies": {
+        "react": "^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/throttleit": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/throttleit/-/throttleit-2.1.0.tgz",
+      "integrity": "sha512-nt6AMGKW1p/70DF/hGBdJB57B8Tspmbp5gfJ8ilhLnt7kkr2ye7hzD6NVG8GGErk2HWF34igrL2CXmNIkzKqKw==",
       "license": "MIT",
       "engines": {
-        "node": ">=20.18.1"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/undici-types": {
@@ -140,14 +230,32 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/use-sync-external-store": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.7.0.tgz",
+      "integrity": "sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
     "node_modules/zod": {
-      "version": "4.6.7",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
-      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
+      "version": "3.25.76",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
+    },
+    "node_modules/zod-to-json-schema": {
+      "version": "3.25.2",
+      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
+      "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
+      "license": "ISC",
+      "peerDependencies": {
+        "zod": "^3.25.28 || ^4"
+      }
     }
   }
 }

package/.next/standalone/sdk/typescript/integration/fixtures/ai-4/package.json

@@ -4,8 +4,8 @@
   "type": "module",
   "description": "Integration fixture: Vercel AI SDK 4.x against the packed @failproofai/sdk.",
   "dependencies": {
-    "ai": "7.0.152",
-    "zod": "4.6.7"
+    "ai": "4.3.19",
+    "zod": "3.25.76"
   },
   "devDependencies": {
     "@types/node": "22.20.4"

package/.next/standalone/sdk/typescript/integration/fixtures/ai-5/package-lock.json

@@ -128,9 +128,9 @@
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
     "node_modules/undici": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
-      "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"

package/.next/standalone/sdk/typescript/integration/fixtures/ai-5/package.json

@@ -11,6 +11,6 @@
     "@types/node": "22.20.4"
   },
   "overrides": {
-    "undici": "7.29.1"
+    "undici": "7.30.1"
   }
 }