deps: periodic dependency update

[qw-in]

Periodic dependency and security update

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Approved

Rationale: This PR is a periodic dependency/security maintenance update. Changes are limited to package.json/pyproject.toml version bumps and npm overrides entries that pin transitive dependencies past known GHSA advisories, plus a documentation update in OVERRIDES.md that clearly explains each pin and its removal condition. No application code is touched. The dependency-changes trigger fires, but each override maps to a specific published advisory and the reasoning is documented per pin. Version bumps are minor/patch updates to well-known packages (fastify 5.12.0→5.12.3, fastapi 0.138→0.141, uvicorn 0.49→0.52, @langchain/openai 1.2.8→1.5.6, @types/node, npm-check-updates, gunicorn). Reviewer confidence is high enough to approve at Medium risk; the risk that lingers is dependency-update-inherent (transitive graph changes not visible without lockfiles).

Summary of Changes

Periodic security/dependency maintenance across the example apps: minor version bumps for fastify, fastapi/uvicorn, gunicorn, @langchain/openai, @types/node, npm-check-updates, and new npm overrides pinning qs, nanoid, undici, uuid, adm-zip, sharp, and @opentelemetry/core past a set of documented GHSA advisories. OVERRIDES.md is updated with a table explaining each new pin and its removal condition.

Escalation Triggers

• Dependency Changes: Modifies package.json in 12 example projects plus the root, and two pyproject.toml files, bumping direct dependency versions and adding npm overrides for transitive dependencies.

Review Focus Areas

• Confirm that @workflow/core, @workflow/world-local, and @workflow/world-vercel still function correctly with the forced nanoid 5.1.16 and undici 7.29.0 versions (major/minor bumps of transitives via overrides can occasionally introduce API breakage).
  npm overrides bypass the parent package's declared version constraints, so any assumption the parent made about the pinned version is worth spot-checking.
• Verify @opentelemetry/core 2.11.0 is compatible with the Google ADK OpenTelemetry exporters, and that uuid 11.x's API surface is compatible with gaxios' usage.
  The OVERRIDES.md note says ADK pins core 2.1.0; forcing 2.11.0 is a substantial version jump for a shared instrumentation library.
• Confirm sharp 0.35.4 works with Rampart's Transformers 4.2.0 at runtime (OVERRIDES.md notes Transformers requires sharp 0.34.x).
  Overriding to a version the parent explicitly does not allow can cause runtime failures; a smoke run of the guard example is worth doing before merge.

Notes

The commit log mentions browserslist and undici updates that would live in lockfiles; those files are not present in the filtered diff, which is expected and not a description accuracy issue.

Path filtering: 21 files excluded by ignore paths. 16 of 37 files included in review.

_{Review: e4994679 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​gunicorn@​26.0.0 ⏵ 26.2.0	+1
	npm/​@​langchain/​openai@​1.2.8 ⏵ 1.5.6	+17
	npm/​npm-check-updates@​19.3.2 ⏵ 19.6.6			+1
	pypi/​uvicorn@​0.49.0 ⏵ 0.52.4	+1
	npm/​fastify@​5.12.0 ⏵ 5.12.3		+3		+1
	pypi/​fastapi@​0.138.0 ⏵ 0.141.1	+1
	pypi/​pydantic-settings@​2.14.2 ⏵ 2.15.0	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (npm metadata) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/package.json) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/LICENSE) From: examples/nestjs/package-lock.json → npm/@vitejs/plugin-react@5.2.0 → npm/firebase-functions-test@3.5.0 → npm/@nestjs/cli@11.0.24 → npm/@react-router/dev@7.18.2 → npm/@tanstack/react-start@1.168.46 → npm/caniuse-lite@1.0.30001810 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001810. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• npm/fastify@5.12.3
• pypi/fastapi@0.141.1
• pypi/fastapi@0.141.1
• pypi/gunicorn@26.2.0
• pypi/gunicorn@26.2.0

View full report

[qw-in]

@SocketSecurity ignore pypi/gunicorn@26.2.0 npm/fastify@5.12.3 pypi/fastapi@0.141.1

Gunicorn: unchanged, unused Django configuration example. Fastify: unchanged maintainer build script generating validators from a hardcoded schema. FastAPI: upstream docs tooling, excluded from the wheel and unused here.