Skip to content

deps: periodic dependency update #214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qw-in merged 32 commits into from
Sep 8, 2026
Merged

deps: periodic dependency update #214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
022e847
deps: refresh compatible example and tooling dependencies
qw-in Sep 8, 2026
e532ce6
deps(astro): update fast-uri past GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j…
qw-in Sep 8, 2026
f8bae5c
deps(claude-agent): update fast-uri past GHSA-5jgf-p345-68v8, GHSA-f6…
qw-in Sep 8, 2026
48077e7
deps(claude-agent): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9…
qw-in Sep 8, 2026
9a9edee
deps(express-newman): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-w…
qw-in Sep 8, 2026
6684025
deps(expressjs): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx
qw-in Sep 8, 2026
f36d9c3
deps(firebase-functions): update fast-uri past GHSA-5jgf-p345-68v8, G…
qw-in Sep 8, 2026
5a182b0
deps(firebase-functions): update browserslist past GHSA-73wf-gq98-2v4…
qw-in Sep 8, 2026
44c954b
deps(nestjs): update fast-uri past GHSA-5jgf-p345-68v8, GHSA-f65p-4m7…
qw-in Sep 8, 2026
ea0a80c
deps(nestjs): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx
qw-in Sep 8, 2026
a84e21a
deps(nestjs): update browserslist past GHSA-73wf-gq98-2v4g, GHSA-c83g…
qw-in Sep 8, 2026
3965a6f
deps(nextjs-ai-agent): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-…
qw-in Sep 8, 2026
28c2b87
deps(react-router): update browserslist past GHSA-73wf-gq98-2v4g, GHS…
qw-in Sep 8, 2026
de77afe
deps(tanstack-start): update browserslist past GHSA-73wf-gq98-2v4g, G…
qw-in Sep 8, 2026
4b4e154
deps(fastify): update fastify past GHSA-w2qp-rph6-63g4, GHSA-3m5p-2c4…
qw-in Sep 8, 2026
fed6778
deps(firebase-functions): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5…
qw-in Sep 8, 2026
27dd01a
deps(genkit-agent): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9…
qw-in Sep 8, 2026
25401c7
deps(react-router): update qs past GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9…
qw-in Sep 8, 2026
bc844ef
deps(react-router-middleware): update qs past GHSA-4mjr-xmp4-gh2g, GH…
qw-in Sep 8, 2026
784e657
deps(nextjs-ai-agent): update nanoid past GHSA-28wg-ghj8-5hjv, GHSA-x…
qw-in Sep 8, 2026
9820bd6
deps(nextjs-ai-agent): update undici past GHSA-4cwx-7wf7-3272, GHSA-8…
qw-in Sep 8, 2026
4963e16
deps(google-adk-agent): update @opentelemetry/core past GHSA-8988-4f7…
qw-in Sep 8, 2026
e477928
deps(google-adk-agent): update adm-zip past GHSA-xcpc-8h2w-3j85
qw-in Sep 8, 2026
eab0736
deps(google-adk-agent): update uuid past GHSA-w5hq-g745-h8pq
qw-in Sep 8, 2026
45447c0
deps(genkit-agent): update uuid past GHSA-w5hq-g745-h8pq
qw-in Sep 8, 2026
bf15f16
deps(nextjs-guard-policy): update adm-zip past GHSA-xcpc-8h2w-3j85
qw-in Sep 8, 2026
7cc0773
deps(nextjs-guard-policy): update sharp past GHSA-f88m-g3jw-g9cj
qw-in Sep 8, 2026
17408d3
deps(nextjs-sensitive-info): update adm-zip past GHSA-xcpc-8h2w-3j85
qw-in Sep 8, 2026
aee8f4c
deps(nextjs-sensitive-info): update sharp past GHSA-f88m-g3jw-g9cj
qw-in Sep 8, 2026
3adf65d
deps(node-guard-policy): update adm-zip past GHSA-xcpc-8h2w-3j85
qw-in Sep 8, 2026
d44a571
deps(node-guard-policy): update sharp past GHSA-f88m-g3jw-g9cj
qw-in Sep 8, 2026
8118035
docs: format security override table
qw-in Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 31 additions & 6 deletions OVERRIDES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@ the pin exists, and what would let us delete it.

## genkit-agent: `openai`

| | |
| --- | --- |
| Example | [`examples/genkit-agent`](./examples/genkit-agent) |
| Override | `"openai": "7.8.0"` |
| Parent | `@genkit-ai/compat-oai@1.41.0` (`openai@^4.95.0`) |
| Trigger | Socket **Block** on [PR #201](https://github.com/arcjet/examples/pull/201): `Potential vulnerability: npm openai` at `openai@4.104.0` (medium) |
| | |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Example | [`examples/genkit-agent`](./examples/genkit-agent) |
| Override | `"openai": "7.8.0"` |
| Parent | `@genkit-ai/compat-oai@1.41.0` (`openai@^4.95.0`) |
| Trigger | Socket **Block** on [PR #201](https://github.com/arcjet/examples/pull/201): `Potential vulnerability: npm openai` at `openai@4.104.0` (medium) |

The Genkit demo calls the [Vercel AI
Gateway](https://vercel.com/docs/ai-gateway) through Genkit's
Expand Down Expand Up @@ -59,3 +59,28 @@ Several other examples already pin transitives the same way (for example
`postcss` in the Next.js apps, `uuid` in `firebase-functions`). Those pins
live in the example `package.json`. Add a section above when you introduce
a new override that needs an explanation.

## Security maintenance overrides

These pins preserve the APIs used by the examples while upstream dependency
constraints still select affected versions. Remove each pin once its parent
accepts the patched release.

| Example | Override | Reason and removal condition | Advisory |
| ------------------------- | -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `firebase-functions` | `qs: 6.16.0` | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later. | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx) |
| `genkit-agent` | `qs: 6.16.0` | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later. | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx) |
| `react-router` | `qs: 6.16.0` | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later. | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx) |
| `react-router-middleware` | `qs: 6.16.0` | Express/body-parser pins keep an affected qs 6 release. Remove once their resolved qs is 6.16.0 or later. | [GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), [GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx) |
| `nextjs-ai-agent` | `@workflow/core > nanoid: 5.1.16` | Workflow 4.8.3 pins nanoid 5.1.6. Remove when Workflow permits nanoid 5.1.16 or later. | [GHSA-28wg-ghj8-5hjv](https://github.com/advisories/GHSA-28wg-ghj8-5hjv), [GHSA-xwg4-73v4-xw9w](https://github.com/advisories/GHSA-xwg4-73v4-xw9w) |
| `nextjs-ai-agent` | `@workflow/world-local`, `@workflow/world-vercel` > `undici: 7.29.0` | Workflow world adapters pin undici 7.28.0. Remove when both permit undici 7.29.0 or later. | [GHSA-4cwx-7wf7-3272](https://github.com/advisories/GHSA-4cwx-7wf7-3272), [GHSA-8xcm-r25x-g524](https://github.com/advisories/GHSA-8xcm-r25x-g524), [GHSA-jr45-8vmc-qm54](https://github.com/advisories/GHSA-jr45-8vmc-qm54), [GHSA-m8rv-5g2x-5cg5](https://github.com/advisories/GHSA-m8rv-5g2x-5cg5), [GHSA-v3r7-h72x-cjcm](https://github.com/advisories/GHSA-v3r7-h72x-cjcm) |
| `google-adk-agent` | `@opentelemetry/core: 2.11.0` | Google ADK 2.0.0 exporter packages pin OpenTelemetry core 2.1.0. Remove when all resolved core versions are 2.8.0 or later. | [GHSA-8988-4f7v-96qf](https://github.com/advisories/GHSA-8988-4f7v-96qf) |
| `google-adk-agent` | `adm-zip: 0.6.0` | Google ADK 2.0.0 pins adm-zip 0.5.16. Remove when ADK permits adm-zip 0.6.0 or later. | [GHSA-xcpc-8h2w-3j85](https://github.com/advisories/GHSA-xcpc-8h2w-3j85) |
| `google-adk-agent` | `uuid: 11.1.1` | Google ADK brings an affected uuid through gaxios. Remove when its resolved uuid is 11.1.1 or later. | [GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq) |
| `genkit-agent` | `uuid: 11.1.1` | Genkit and its Google clients pin uuid 8/9/10. The APIs used here remain available in 11.1.1. Remove when all parents permit uuid 11.1.1 or later. | [GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq) |
| `nextjs-guard-policy` | `adm-zip: 0.6.0` | Rampart uses ONNX Runtime, whose installer pins adm-zip 0.5.x. Remove when ONNX Runtime permits adm-zip 0.6.0 or later. | [GHSA-xcpc-8h2w-3j85](https://github.com/advisories/GHSA-xcpc-8h2w-3j85) |
| `nextjs-guard-policy` | `sharp: 0.35.4` | Rampart uses Transformers 4.2.0, which requires sharp 0.34.x. Remove when Transformers permits sharp 0.35.0 or later. | [GHSA-f88m-g3jw-g9cj](https://github.com/advisories/GHSA-f88m-g3jw-g9cj) |
| `nextjs-sensitive-info` | `adm-zip: 0.6.0` | Rampart uses ONNX Runtime, whose installer pins adm-zip 0.5.x. Remove when ONNX Runtime permits adm-zip 0.6.0 or later. | [GHSA-xcpc-8h2w-3j85](https://github.com/advisories/GHSA-xcpc-8h2w-3j85) |
| `nextjs-sensitive-info` | `sharp: 0.35.4` | Rampart uses Transformers 4.2.0, which requires sharp 0.34.x. Remove when Transformers permits sharp 0.35.0 or later. | [GHSA-f88m-g3jw-g9cj](https://github.com/advisories/GHSA-f88m-g3jw-g9cj) |
| `node-guard-policy` | `adm-zip: 0.6.0` | Rampart uses ONNX Runtime, whose installer pins adm-zip 0.5.x. Remove when ONNX Runtime permits adm-zip 0.6.0 or later. | [GHSA-xcpc-8h2w-3j85](https://github.com/advisories/GHSA-xcpc-8h2w-3j85) |
| `node-guard-policy` | `sharp: 0.35.4` | Rampart uses Transformers 4.2.0, which requires sharp 0.34.x. Remove when Transformers permits sharp 0.35.0 or later. | [GHSA-f88m-g3jw-g9cj](https://github.com/advisories/GHSA-f88m-g3jw-g9cj) |
6 changes: 3 additions & 3 deletions examples/astro/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions examples/claude-agent/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions examples/express-newman/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 5 additions & 4 deletions examples/expressjs/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions examples/fastapi/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
[project]
dependencies = [
"arcjet==1.1.0",
"fastapi[standard]==0.138.0",
"pydantic-settings==2.14.2",
"uvicorn==0.49.0",
"fastapi[standard]==0.141.1",
"pydantic-settings==2.15.0",
"uvicorn==0.52.4",
]
description = "Arcjet FastAPI example app. Arcjet helps developers protect their apps in just a few lines of code. Bot detection. Rate limiting. Email validation. Attack protection. Data redaction. A developer-first approach to security."
name = "app"
Expand Down
Loading
Loading