[objectstack-fleet]

Fixes #25041

Clause-②: no

What this does

main's scheduled Validate Dependencies run 39536495453 is red at its OSV step: the lockfile matches 12 advisory rows (9 distinct ids, 6 High) in four locked packages, and every one names a fixed release. Every declared range on every path already admits its fix, so this is a re-lock only. pnpm-lock.yaml is the whole diff. It adds no override, no osv-scanner.toml exemption, and no package.json range.

Package	Locked → resolved	Advisories	Path (pnpm why -r)	How
@modelcontextprotocol/sdk	1.31.0 → 1.32.1 (fix 1.32.0)	GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-rvq5-wwqv-78pq	direct ^1.30.1 in @objectstack/mcp, @objectstack/connector-mcp and the private @objectstack/example-showcase	re-lock
follow-redirects	1.16.0 → 1.16.1	GHSA-8r9p-f939-6h3c, GHSA-q3jh-wrc6-jgq8	mongodb-memory-server-core@11.3.0 (^1.16.0) ← mongodb-memory-server ← @objectstack/driver-mongodb devDependencies	re-lock
launch-editor	2.14.1 → 2.14.2	GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw	@changesets/cli@3.0.3 (^2.14.1) ← the root devDependencies	re-lock
vite	8.0.16 → 8.3.4 (fixed lines 8.1.6 / 8.2.4 / 8.3.3)	the same three as launch-editor (vite bundles it)	vitest@4.1.11 (dependency and peer ^6.0.0 || ^7.0.0 || ^8.0.0), @vitest/mocker@4.1.11 (peer, same range), fumadocs-mdx@15.2.3 (optional peer 7.x.x || 8.x.x)	re-lock

Each target is the newest release inside the existing ranges. That is what a targeted pnpm update resolves, and what a fresh downstream install gets. For vite, the three fixed lines come from the advisories' own ranges in the OSV npm database: introduced 8.0.0 fixed 8.1.6, introduced 8.2.0 fixed 8.2.4, introduced 8.3.0 fixed 8.3.3. 8.3.4 sits outside all three. vitest@4.1.11's peer range admits it, and so does its own devDependency: both vitest 4.1.11 and fumadocs-mdx 15.2.3 develop against vite ^8.2.0, so 8.1.6 would sit below what either consumer tests against. If 8.3.4 ever has to be backed off, 8.2.4 is the fix on that line.

How the lockfile was moved, and the route rejected first

• Rejected: a targeted pnpm update. Measured twice, with --no-save, so no package.json moved:
  • The first spelling was pnpm update -r --depth Infinity --no-save follow-redirects launch-editor vite @modelcontextprotocol/sdk. It moved the SDK alone, leaving follow-redirects, launch-editor and vite exactly where they were.
  • The same run moved 12 unrelated packages, at +101/−68 lines: @inquirer/ansi / confirm / core / type, @napi-rs/wasm-runtime 1.2.4 → 1.2.5, node-abi 3.96.0 → 3.99.0, and seroval / seroval-plugins 1.6.8 → 1.6.11. It also added new copies of @babel/runtime, ip-address, nanoid, postcss and set-cookie-parser, and touched the knex, tsup and postcss-load-config snapshots.
  • pnpm update -r --no-save @modelcontextprotocol/sdk alone, at default depth, produced the identical churn.
  • Control: a plain non-frozen pnpm install on the base lockfile leaves 0 changed files, so the churn is update's own.
• Taken: the precedent's recipe (fix(deps): take the fixes for proxy-addr, source-map-js and katex that turn main's OSV scan red #21951). I appended four temporary exact overrides to pnpm-workspace.yaml and ran pnpm install. I then restored the file to its HEAD blob and ran pnpm install again. The second install keeps the four resolutions, because every declared range admits them.
  • The restore is proven, not assumed: git hash-object pnpm-workspace.yaml equals the HEAD blob ecbd0f4bfdeb4c7c03bb43d910c5f2406fbadea7, and git diff HEAD on it is empty.
  • The lockfile's own overrides: section is unchanged, and no importer specifier moved.

Lockfile diff scope

pnpm-lock.yaml only, +187/−237. The packages: section goes from 1372 to 1367 keys, with 26 removed and 21 added. Every moved entry belongs to the four packages or to vite's own closure:

• the four rows in the table above;
• rolldown 1.0.3 → 1.2.14 (vite 8.3.4 declares ~1.2.12), its 14 platform bindings 1.0.3 → 1.2.14, the new @rolldown/binding-android-arm-eabi 1.2.14, and @oxc-project/types 0.133.0 → 0.154.0;
• dropped: @rolldown/binding-wasm32-wasi 1.0.3 and the chain only it reached. That chain is @napi-rs/wasm-runtime 1.2.4, @emnapi/core 1.10.0, @emnapi/runtime 1.10.0, @emnapi/wasi-threads 1.2.1 and @tybys/wasm-util 0.10.4.
  • npm view rolldown@1.2.14 optionalDependencies declares no wasm32-wasi binding, while 1.0.3 declares one.
  • @emnapi/runtime 1.11.3 stays, because it is the copy @img/sharp-wasm32 already used on the base.

The snapshots: section goes from 1379 to 1374 keys, covering the same names plus the peer-suffix rewrites on vitest, @vitest/mocker and fumadocs-mdx. In the importers section, 3 lines move the SDK version and 80 version strings carry the new vite/rolldown peer suffix (79 vitest, 1 fumadocs-mdx). Nothing else moved.

Local proofs, at 7b0295c723

Proof	Exit	Reading
pnpm install --frozen-lockfile	0
pnpm check:vendor-export-contract-resolve	0	VERDICT: PASS — vendor export contract (registry resolution, installed with npm@11.21.0), 3 edge(s) verified. It governs only the better-auth family, so it passes over the SDK without judging it.
pnpm check:override-consistency	0	9 published-manifest declaration(s) … all resolve to their override targets
pnpm turbo run build --filter=@objectstack/mcp --filter=@objectstack/connector-mcp --concurrency=2 (shared verify lock)	0	VERDICT command-exit 0, 33/33 tasks, 0 cached
test for both packages (shared verify lock)	0	@objectstack/mcp 40 files / 479 tests passed; @objectstack/connector-mcp 4 files / 36 tests passed
typecheck for both packages (tsc --noEmit + check:test-typecheck)	0	both test layers compile at their existing ledger counts (mcp 6 files / 53 errors / 8 pinned signatures; connector-mcp 1 / 5 / 1)

• The vite consumer is those two vitest runs. Resolved from each package, vitest 4.1.11 loads vite 8.3.4, and the installed SDK is 1.32.1.
• The docs build was not run, because it would prove nothing about this change. apps/docs builds through Next, and fumadocs-mdx touches vite only in its dist/vite plugin entry and rolldown only in its type declarations. CI's Build Docs runs the production command.

OSV reading

I measured with OSV-Scanner 2.5.0, the binary the workflow's pinned action image ships. Its sha256 edcfc41d…524e0c matches the release's SHA256SUMS. api.osv.dev answers 403 from this container, so the scan ran offline (--offline-vulnerabilities --download-offline-databases) against the npm database downloaded 2026-10-21 03:59 UTC. Each side ran under its own osv-scanner.toml, with the identical invocation.

• Base dfe60e3a0c: exit 1. The 12 rows are byte-for-byte the scheduled run's, with the sprintf-js exemption filtered.
• This PR 7b0295c723: exit 0, No issues found. The sprintf-js exemption is filtered here too. That is the control that shows the database loaded and matched.
• scripts/osv-base-relative.mjs over both JSON results exits 0: 0 introduced, 0 inherited, 9 resolved.
• One void reading, declared: a first head scan without --download-offline-databases printed No issues found at exit 0 with no Loaded npm local db line, reading the exemption as unused. It had loaded no database, and it is not counted.

What closes the card is the next scheduled (or a workflow_dispatch) Validate Dependencies run on main. This PR's own run takes the base-relative path.

Changeset: skip-changeset, measured

Nothing publishes. No package.json changed, so every published package's declared ranges are byte-identical and a downstream install resolves exactly as before.

• The two published consumers do not bundle the SDK. @objectstack/mcp and @objectstack/connector-mcp (files: ["dist", …]) keep it as an external import: 4 and 3 @modelcontextprotocol/sdk/… import specifiers remain in their built dist. The SDK's own LATEST_PROTOCOL_VERSION = "…" definition appears in 0 of their dist files. The positive control is 6 hits in the SDK's own dist.
• No built dist names the other moved packages. None of the 33 built dist trees names rolldown, launch-editor or follow-redirects, while vite's own dist does, which is the control.
• The other three are dev-only paths. They arrive only through devDependencies (driver-mongodb, the root, vitest) and the private docs app.

Gates

• Derivation. I ran node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 7b0295c723, which derived 19 commands from 1 path. I ran all 19, each exit captured before any pipe.
• --ran reconciliation: 19 derived, 18 run, 1 NOT-MEASURED, 0 UNRUN.
• 18 exited 0: check-changeset-fixed, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, check-dts-emitted --self-test, check-osv-exemptions (+ --self-test), osv-base-relative --self-test, and the pnpm gates check:driver-memory-census, check:dts-closure, check:gitlink-declared, check:lean-entry-closure, check:nul-bytes, check:override-consistency, check:refd-timer-probe, check:sourcemap-no-sources-content, check:vendor-export-contract-resolve and check:watch-hint-literal.
• Partial sweeps: check:dts-closure and check:sourcemap-no-sources-content swept the 33 built packages only.
• NOT MEASURED: pnpm check:dual-build-cjs-loads exits 3 (PREREQUISITE NOT MET, needs a full pnpm build). CI's Build Core and Lint & Repo Gates measure it on the built tree.
• git merge-tree --write-tree origin/main HEAD (origin/main = eddffc3390): exit 0, clean. pnpm-lock.yaml is not routed to the os-regen driver, so this local reading answers GitHub's question. The 2 commits main gained since the base touch none of pnpm-lock.yaml, pnpm-workspace.yaml, the root package.json or osv-scanner.toml.

Acceptance notes

• vite moves three minors, 8.0.16 → 8.3.4, and rolldown 1.0.3 → 1.2.14 with it. Every vitest suite in the repo runs on this pair, so CI's Test Core is the wide reading. Locally, only the two MCP packages' 515 tests ran.
• In this workspace, pnpm update (even depth 0, one direct dependency) re-resolves a fixed set of unrelated packages, and with --depth Infinity it does not move the transitive targets at all. The temporary-override re-lock is the route that keeps a lockfile refresh narrow here. Class: none (tooling behaviour, not a defect of this repo); carrier: none.
• A local offline OSV scan without --download-offline-databases can read green having loaded no database. Read the Loaded npm local db line, or an exemption reading as filtered, before trusting a local "No issues found".
• pnpm install prints ioredis-mock 8.13.1: unmet peer ioredis@^5: found 6.0.0. That warning is already on main, and this diff does not cause it.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-21T04:59Z · head 7b0295c723 · card #25041 (claim 6307613247)

• Form. Draft, base main. The first line is Fixes #25041, then Clause-②: no. Assignee os-warren; labels dependencies, size/xs, skip-changeset. node scripts/pm/check-governed-merges.mjs --pr 25047 → NOT governed. One file, pnpm-lock.yaml (+187/−237). git merge-tree against main eddffc3390 is clean (and again against 662183604c). No other open PR touches the lockfile, the root package.json, pnpm-workspace.yaml or osv-scanner.toml.

• The re-lock, read in the lockfile diff. The entries that move are:

  • the four targets: @modelcontextprotocol/sdk 1.31.0 → 1.32.1, follow-redirects 1.16.0 → 1.16.1, launch-editor 2.14.1 → 2.14.2, vite 8.0.16 → 8.3.4;
  • vite's own closure: rolldown 1.0.3 → 1.2.14 with its platform bindings, and @oxc-project/types;
  • the wasm32-wasi chain that rolldown 1.2.14 no longer declares (@napi-rs/wasm-runtime, @emnapi/*), which drops out;
  • vitest, @vitest/mocker and fumadocs-mdx, re-keyed only by their vite peer suffix, at unchanged versions.

  No importer specifier moved, and no override or osv-scanner.toml exemption was added. Every declared range admits its fix: the SDK ^1.30.1, vitest 4.1.11's peer ^6||^7||^8, fumadocs-mdx 7.x.x||8.x.x.

• The route is accepted. The dev measured the dispatch's preferred targeted pnpm update: it moved the SDK alone, left the three transitive targets unmoved, and re-resolved 12 unrelated packages. So the PR takes fix(deps): take the fixes for proxy-addr, source-map-js and katex that turn main's OSV scan red #21951's re-lock recipe: temporary exact overrides, install, pnpm-workspace.yaml restored to its HEAD blob (hash-proven), install again. Only the lockfile is committed. vite lands at 8.3.4, the newest in range and above every OSV fixed range. Both vitest 4.1.11 and fumadocs-mdx 15.2.3 develop against vite ^8.2.0.

• The OSV reading. osv-scanner 2.5.0, the action's version with its sha256 checked, ran offline against the npm database downloaded today, with the same invocation on both sides:

  • base dfe60e3a0c: exit 1, the same 12 rows as run 39536495453;
  • head: exit 0, "No issues found", with the sprintf-js exemption still filtered as the control;
  • osv-base-relative.mjs: "0 introduced, 0 inherited, 9 resolved".

  One void reading (a scan that loaded no database) is declared and not counted.

• The dispatch's error, corrected. The claim and dispatch named "the root package.json's pnpm.overrides", which pnpm 10 ignores; the workspace reads overrides from pnpm-workspace.yaml. The dev's option A is taken: this seat's dispatches name pnpm-workspace.yaml's overrides: from now on. It is moot here, because no override was committed.

• Gates.

  • pnpm install --frozen-lockfile exit 0.
  • @objectstack/mcp 479 tests and @objectstack/connector-mcp 36 tests pass, with typecheck under the verify lock. vitest 4.1.11 loads vite 8.3.4 and the SDK 1.32.1.
  • The dev's dispatch-gates union: 19 derived, 18 run, all exit 0, check:vendor-export-contract-resolve included. 1 is NOT MEASURED: check:dual-build-cjs-loads, which needs a full build and which CI runs. --ran reconciles.
  • The changeset is measured as not owed: no package.json moves, both published MCP dists keep the SDK external, and no built dist names rolldown, launch-editor or follow-redirects.
  • Check-runs at 7b0295c723: 46, 35 success, 11 skipped, 0 failing or pending, Validate Package Dependencies and Build Docs (the production docs build, vite 8.3.4 through fumadocs-mdx) included. node scripts/pm/check-expected-skips.mjs --pr 25047 → OK (11 skipped, every one in the roster). No review, no comment.

• After the merge, this seat reads main's next scheduled Validate Dependencies run at its OSV step, the card's done-when, and records it on [finding] main's lockfile matches 12 advisories in 4 packages (@modelcontextprotocol/sdk 1.31.0, follow-redirects 1.16.0, launch-editor 2.14.1, vite 8.0.16), all with a fixed release: the scheduled OSV scan is red #25041.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code