chore(deps): clear undici, fast-uri, vite and zod security alerts

Merged
TH
9d ago
+256-81

Summary

Update undici to 7.30.1, fast-uri to 3.1.9, Vite to 8.3.5 (floor ^8.3.5), and Zod to 4.6.7 across both workspaces. Seven dependency manifests and lockfiles change.

  • undici is bundled into the published build. Move all exact pins together; undici@7 overrides @limrun/api's vulnerable exact pin.
  • fast-uri and Vite affect development tooling.
  • Zod overrides cover the root dev graph and the isolated Expo app. @expo/cli declares Zod 3 without a patched parent upgrade, so the app overrides both majors to ^4.6.6.
  • No permanent compatibility test or gate changes. Expo schema acceptance/rejection passed before removing the temporary test at the author's request. Future Expo/Zod compatibility requires rechecking.

No release-age policy bypass. No CHANGELOG entry.

Closes #143 #144 #145 #146 #147 #148 #149 #152 #155 #158 #159 #160 #161 #162 #163 #166.

Validation

Base 45125d717b; head 92372fd378.

  • pnpm format: passed repository-wide.
  • pnpm test-app:security: passed the existing image-size test.
  • Temporary suite at 4cb43babdc: 5/5 passed, covering Expo CLI’s PluginSchema, DevToolsPluginOutputSchema, and createMCPDevToolsExtensionSchema, including invalid inputs and error formatting.
  • pnpm check:affected --run --head 92372fd378: all runnable checks passed; exactCommit=true (receipt run-rSQXei). Independent delta review: no findings.
  • CI coverage, integration, and native lanes must pass at the new head.
pnpm why -r undici fast-uri vite zod (root) 
fast-uri@3.1.9
└─┬ ajv@8.20.0
  └─┬ @stryker-mutator/core@10.0.0
    ├─┬ @stryker-mutator/vitest-runner@10.0.0
    │ └── agent-device@0.21.32-dev (devDependencies)
    └── agent-device@0.21.32-dev (devDependencies)

undici@7.30.1
├── @agent-device/maestro@0.0.0 (devDependencies)
├── @agent-device/provision-kit@0.0.0 (devDependencies)
├─┬ @ai-sdk/provider-utils@5.0.27
│ ├─┬ @ai-sdk/gateway@4.0.54
│ │ └─┬ ai@7.0.68
│ │   └── agent-device@0.21.32-dev (devDependencies)
│ └── ai@7.0.68 [deduped]
├─┬ @limrun/api@0.64.1
│ ├── @agent-device/provider-limrun@0.0.0 (devDependencies)
│ └── agent-device@0.21.32-dev (devDependencies)
└── agent-device@0.21.32-dev (devDependencies)

vite@8.3.5
├─┬ @vitest/mocker@5.0.4
│ └─┬ vitest@5.0.4
│   ├── @agent-device/daemon@0.0.0 (devDependencies)
│   ├─┬ @stryker-mutator/vitest-runner@10.0.0
│   │ └── agent-device@0.21.32-dev (devDependencies)
│   ├─┬ @vitest/coverage-v8@5.0.4
│   │ ├── agent-device@0.21.32-dev (devDependencies)
│   │ └── vitest@5.0.4 [circular]
│   └── agent-device@0.21.32-dev (devDependencies)
├── agent-device@0.21.32-dev (devDependencies)
└── vitest@5.0.4 [deduped]

zod@4.6.7
├─┬ @ai-sdk/gateway@4.0.54
│ └── ai@7.0.68
├─┬ @ai-sdk/provider-utils@5.0.27
│ ├── @ai-sdk/gateway@4.0.54 [deduped]
│ └── ai@7.0.68 [deduped]
├─┬ @callstack/rspress-preset@0.6.6
│ └── agent-device-docs (devDependencies)
├─┬ @statelyai/graph@2.4.0
│ └── agent-device@0.21.32-dev (devDependencies)
├── ai@7.0.68 [deduped]
└─┬ mutation-server-protocol@0.4.1
  └─┬ @stryker-mutator/core@10.0.0
    ├─┬ @stryker-mutator/vitest-runner@10.0.0
    │ └── agent-device@0.21.32-dev (devDependencies)
    └── agent-device@0.21.32-dev (devDependencies)

Found 1 version of fast-uri
Found 1 version of undici
Found 1 version of vite
Found 1 version of zod
pnpm why zod (examples/test-app, abridged tree) 
zod@4.6.7
├─┬ @expo/cli@58.0.3
│ └── expo@58.0.0-preview.3 (…deep circular expo tree…)
└─┬ expo-build-disk-cache@0.7.4
  ├── @expo/cli@58.0.3 [deduped]
  └── agent-device-test-app@1.0.0 (devDependencies)

Found 1 version of zod