objectstack-ai · os-trump · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026
diff --git a/.changeset/osv-advisory-bumps-2026-09.md b/.changeset/osv-advisory-bumps-2026-09.md
@@ -0,0 +1,19 @@
+---
+"@objectstack/plugin-email": patch
+"@objectstack/plugin-hono-server": patch
+---
+
+Take the fix for the fifteen OSV advisories that turned `Validate Package Dependencies` red on every PR.
+
+The advisory database moved; the lockfile did not. `origin/main`'s `pnpm-lock.yaml` is byte-identical to the tree that scanned GREEN the day before and RED the day after, so this is a repo-wide condition rather than any PR's regression, and every one of the fifteen names a published fix version — the take-the-fix path `osv-scanner.toml`'s header describes, not the exemption path. That ledger keeps its zero entries and is untouched here, as is `.github/workflows/validate-deps.yml`.
+
+Two published packages change what a downstream install resolves, which is what this changeset grades:
+
+- **`@objectstack/plugin-email`** declares `nodemailer` `^9.1.1` (was `^9.0.5`), clearing GHSA-2x7j-588g-ccc2 (7.5), GHSA-cc9r-2j5m-2m83 (6.5), GHSA-wmmp-3585-3rmp (6.5) — all fixed in 9.1.0 — and GHSA-8m3c-c648-2xjj (5.9), fixed in 9.1.1. The range takes the higher of the two fix lines so one floor covers all four. The 10.x major is deliberately not taken.
+- **`@objectstack/plugin-hono-server`** declares `hono` `^4.13.5` (was `^4.13.2`), clearing GHSA-crvj-82cr-hjcx (5.9), GHSA-g6gw-c38x-mqfc (5.3) and GHSA-gqvv-2mrq-wpjv (6.5).
+
+No exported symbol, payload key or accept/reject behaviour of ours moves — the published surface is unchanged and both grade `patch`.
+
+The rest of the sweep releases nothing and is named here only so the set is readable in one place: the `sharp` override target lifts to `^0.35.4` (GHSA-rgj7-g3m4-5g8c, 8.9) and the `hono` override target to `^4.13.5`, both target-only lifts whose selectors already sit at the compatibility boundary; the private docs app takes `next` 16.3.3 (GHSA-2xp9-vwfh-vxw4 9.5 and GHSA-p293-qw3h-jr36 9.0, the two Criticals); and the `vitest` devDependency line takes 4.1.11 across the workspace, with `@vitest/coverage-v8` moved in lockstep because its peer on `vitest` is exact (GHSA-82fw-gwwq-j7x9, 5.9, which flagged both `vitest` and `@vitest/mocker`).
+
+`hono` was flagged at TWO resolved versions and both are gone: the override lift is what collapses them. The transitive copy `@modelcontextprotocol/sdk` pulled sat exactly on the old `^4.12.34` floor and so was never re-resolved, while our own three declarations floated up to 4.13.2; `^4.13.5` excludes the floor, both edges re-resolve, and the tree now holds one `hono`. A bump that moved only our declarations would have left the transitive copy flagged and the gate red.
diff --git a/apps/docs/package.json b/apps/docs/package.json
@@ -18,7 +18,7 @@
     "fumadocs-ui": "16.14.4",
     "lucide-react": "^1.31.0",
     "mermaid": "^11.16.0",
-    "next": "16.3.1",
+    "next": "16.3.3",
     "next-themes": "^0.4.6",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",

diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json
@@ -28,6 +28,6 @@
     "@objectstack/formula": "workspace:*",
     "@objectstack/objectql": "workspace:*",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }
diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json
@@ -46,6 +46,6 @@
     "@objectstack/service-messaging": "workspace:*",
     "@playwright/test": "^1.62.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }
diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json
@@ -37,6 +37,6 @@
     "@objectstack/trigger-record-change": "workspace:*",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }
diff --git a/examples/embed-objectql/package.json b/examples/embed-objectql/package.json
@@ -17,6 +17,6 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }
diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json
@@ -26,9 +26,9 @@
   },
   "devDependencies": {
     "@objectstack/runtime": "workspace:*",
-    "hono": "^4.13.2",
+    "hono": "^4.13.5",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "description": "Hono adapter for ObjectStack — edge-compatible REST API server for Cloudflare Workers, Deno, Bun, and Node.",
   "keywords": [

diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json
@@ -24,7 +24,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json
@@ -24,7 +24,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json
@@ -24,7 +24,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -140,7 +140,7 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "repository": {
     "type": "git",

diff --git a/packages/client-react/package.json b/packages/client-react/package.json
@@ -34,7 +34,7 @@
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/client/package.json b/packages/client/package.json
@@ -39,7 +39,7 @@
     "@objectstack/service-automation": "workspace:*",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json
@@ -32,7 +32,7 @@
     "@objectstack/lint": "workspace:*",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json
@@ -28,7 +28,7 @@
     "@objectstack/service-automation": "workspace:*",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json
@@ -27,7 +27,7 @@
         "@objectstack/service-automation": "workspace:*",
         "@types/node": "^26.2.0",
         "typescript": "^6.0.3",
-        "vitest": "^4.1.10"
+        "vitest": "^4.1.11"
     },
     "keywords": [
         "objectstack",

diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json
@@ -27,7 +27,7 @@
     "@objectstack/service-automation": "workspace:*",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json
@@ -25,7 +25,7 @@
     "@objectstack/service-automation": "workspace:*",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -33,7 +33,7 @@
     "@types/node": "^26.2.0",
     "esbuild": "^0.28.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "@objectstack/spec": "workspace:*",

diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json
@@ -34,7 +34,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "yaml": "^2.9.0"
   },
   "repository": {

diff --git a/packages/drivers/driver-memory/package.json b/packages/drivers/driver-memory/package.json
@@ -29,7 +29,7 @@
     "@types/sql.js": "^1.4.11",
     "sql.js": "^1.14.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/drivers/driver-mongodb/package.json b/packages/drivers/driver-mongodb/package.json
@@ -32,7 +32,7 @@
     "mongodb-memory-server": "^11.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/drivers/driver-sql/package.json b/packages/drivers/driver-sql/package.json
@@ -50,7 +50,7 @@
     "@types/node": "^26.2.0",
     "better-sqlite3": "^13.0.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/drivers/driver-sqlite-wasm/package.json b/packages/drivers/driver-sqlite-wasm/package.json
@@ -41,7 +41,7 @@
     "@types/node": "^26.2.0",
     "@types/sql.js": "^1.4.11",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "author": "ObjectStack",
   "repository": {

diff --git a/packages/drivers/driver-turso/package.json b/packages/drivers/driver-turso/package.json
@@ -48,7 +48,7 @@
     "@types/node": "^26.2.0",
     "better-sqlite3": "^13.0.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "author": "ObjectStack",
   "repository": {

diff --git a/packages/formula/package.json b/packages/formula/package.json
@@ -26,7 +26,7 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/lint/package.json b/packages/lint/package.json
@@ -49,7 +49,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "zod": "^4.4.3"
   },
   "keywords": [

diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -38,7 +38,7 @@
     "@objectstack/metadata-core": "workspace:*",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json
@@ -58,7 +58,7 @@
     "fast-check": "^4.9.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "author": "ObjectStack",
   "repository": {

diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json
@@ -45,7 +45,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "author": "ObjectStack",
   "repository": {

diff --git a/packages/metadata-protocol/package.json b/packages/metadata-protocol/package.json
@@ -52,7 +52,7 @@
     "mysql2": "^3.23.3",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "author": "ObjectStack",
   "repository": {

diff --git a/packages/metadata/package.json b/packages/metadata/package.json
@@ -96,7 +96,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "author": "ObjectStack",
   "repository": {

diff --git a/packages/objectql/package.json b/packages/objectql/package.json
@@ -40,7 +40,7 @@
   "devDependencies": {
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/observability/package.json b/packages/observability/package.json
@@ -28,7 +28,7 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json
@@ -80,7 +80,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json
@@ -26,7 +26,7 @@
     "@types/node": "^26.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json
@@ -28,7 +28,7 @@
     "@types/node": "^26.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json
@@ -29,7 +29,7 @@
     "@types/node": "^26.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/organizations/package.json b/packages/plugins/organizations/package.json
@@ -31,7 +31,7 @@
     "@types/node": "^26.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json
@@ -36,7 +36,7 @@
     "@types/node": "^26.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json
@@ -30,7 +30,7 @@
     "@types/node": "^26.2.0",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json
@@ -47,10 +47,10 @@
     "@objectstack/plugin-hono-server": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
     "@types/node": "^26.2.0",
-    "hono": "^4.13.2",
+    "hono": "^4.13.5",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",