[santoshkumarradha]

Summary

Raises npm override floors (and two direct patch bumps in examples) and regenerates lockfiles so every open npm Dependabot alert with an upstream fix resolves outside its vulnerable range, across control-plane/web/client, desktop, sdk/typescript, examples/benchmarks/100k-scale/mastra-bench and examples/python_agent_nodes/rag_evaluation/ui.

Refreshed on 2026-10-19 against current main: 28 of the 32 open npm alerts in these projects are cleared. The other four (braces 3.0.3 in web/RAG, sprintf-js 1.1.3 in desktop) have no patched release on npm yet.

The earlier litellm<1.104.0 core cap was dropped. Main already scopes that cap to the langfuse extras, so this PR no longer touches sdk/python.

What moved

Package	To	Projects
brace-expansion	1.1.21 / 2.1.7 / 5.0.12	web (npm + pnpm locks), desktop
source-map-js	1.2.2	web, desktop, sdk/typescript, rag ui
postcss-selector-parser	7.1.6	web, rag ui (no patched 6.x exists)
proxy-addr	2.0.8	sdk/typescript, mastra-bench (critical)
http-cache-semantics	4.3.0	desktop (covers #1097)
undici	6.29.0	desktop
fast-uri	3.1.8	desktop, mastra-bench
tar@7	7.5.21	desktop
diff@4	4.0.4	sdk/typescript
@modelcontextprotocol/sdk	1.31.0	mastra-bench
next	15.5.27	rag ui
sharp	0.35.5	rag ui

Test plan

• npm ci clean in all five projects (Node 22; sdk/typescript on Node 20 like its workflow)
• Web UI npm run build; RAG UI next build; desktop typecheck, 668 tests and a Linux dist:dir package; sdk/typescript lint and 1,057 tests
• postcss-selector-parser 7 sits outside Tailwind 3's declared ^6 range, so the built CSS was compared against main: byte-identical for both the web UI and the RAG UI
• Every lock entry checked against each alert's vulnerable range: reverting the 11 manifest/lock files to main fails all 28, restoring passes all 28
• npm audit before/after per project; remaining findings trace only to braces and sprintf-js
• Runtime probes of the bumped packages (brace expansion, cache policy, URI parsing, source maps, selector round-trips, sharp encode/decode, undici through express/proxy-addr, an MCP 1.31 client/server tool call)
• Dependabot alerts auto-close after merge

🤖 Generated with Claude Code

[github-actions]

Performance

SDK	Memory	Δ	Latency	Δ	Tests	Status
TS	398 B	+14%	3.80 µs	+90%	✓	✗

✓ No regressions detected

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	88.10%	87.40%	↑ +0.70 pp	🟡
sdk-go	93.30%	92.00%	↑ +1.30 pp	🟢
sdk-python	94.72%	93.73%	↑ +0.99 pp	🟢
sdk-typescript	91.84%	90.42%	↑ +1.42 pp	🟢
web-ui	84.90%	84.79%	↑ +0.11 pp	🟡
aggregate	86.08%	85.75%	↑ +0.33 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	0	—	➖ no changes
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.

[AbirAbbas]

Took this over since it had gone stale and conflicted with main. I merged main in (no rebase, your two commits are intact), dropped the core litellm<1.104.0 cap because main now caps it only inside the langfuse extras, and refreshed the floors against today's alert list. That adds proxy-addr (critical, sdk/typescript and mastra-bench), source-map-js, postcss-selector-parser, next, sharp, the MCP SDK, plus tar and diff from npm audit. 28 of the 32 open npm alerts clear. braces and sprintf-js still have no release.

The one override that leaves a declared range is postcss-selector-parser 7.1.6 under Tailwind 3 (which asks for ^6), so I built the web UI and the RAG UI on main and on this branch: the CSS is byte-identical. npm ci, builds and tests pass in all five projects. Details are in the description.

[AbirAbbas]

Approving at f09ad22. All 34 checks are green, npm ci and the builds and tests pass in all five projects, the Tailwind CSS output is byte-identical to main, and 28 of the 32 open npm alerts now resolve to patched versions (the other four have no release yet).