PR #577 - usemoss/moss

Summary

Clears most of the open Dependabot alerts in this repo by upgrading vulnerable dependencies across all 52 flagged lockfiles/manifests.

Before: 1,710 open alerts (153 critical, 701 high)
Expected to close: 1,683
Left after merge: 27 (0 critical), all needing a major-version jump or blocked upstream (see below)

"Expected to close" was checked locally. For every open alert, I tested the version now in its lockfile against the advisory's vulnerable range. Dependabot recomputes on merge, so the real count may differ slightly.

How

Python (uv.lock): uv lock -P "<pkg>>=<first_patched>,<cap>" per alerted package. The cap is the next major for transitive deps and the next minor for direct deps, so the bump stays as small as possible.
- Pillow 13, filelock 4.2 and dnspython 2.9 dropped Python 3.10. requires-python moves from >=3.10 to >=3.11 in the 4 voice-agent demos, examples/cookbook/smolagents and apps/livekit-moss-vercel/.../livekit-moss-agent (READMEs updated).
- mcp stays on 1.x (1.30.0). An unbounded upgrade pulled mcp 2.x, which breaks agora-moss imports.
- apps/pipecat-moss/{ollama-local,hume-ollama-local}: pipecat-ai 1.5.0 → 1.14.0, the first release that allows the patched Pillow 13.
JavaScript (npm/pnpm): direct deps bumped within their major. Next.js 16.2.6 → 16.4.1 and 15.x → 15.5.28; vite ^8.1.6; react-router-dom ^7.18.2. Transitive packages go through npm audit fix (non-force), pnpm up --depth Infinity, and overrides / pnpm.overrides / pnpm-workspace.yaml overrides where a parent pins an old version. The existing pinned postcss / fast-uri overrides move to the patched versions.
- vitest 3 → 4 (dev-only) in packages/{mastra-moss,vercel-sdk,n8n-nodes-moss,vitepress-plugin-moss}. The critical tinypool advisories are only fixed in tinypool 2.x, which needs vitest 4. All four packages' tests still pass (see Verification). Drop that part of the second commit if you'd rather not take the major.
- For packages/n8n-nodes-moss, npm audit fix downgraded n8n-workflow 2.x → 1.x, which broke the build. That lock was redone with targeted bumps plus a form-data override instead.

Verification

Python: uv sync --frozen on Python 3.12, plus pytest where tests exist, plus an import smoke check of each top-level module.

Tests pass: agora-moss app (6) and package (12), smolagents (7), mongodb/sqlite/supabase/zeroentropy connectors, pipecat-moss (13), ten-moss (29).
All voice-agent, daytona, cognee, sim, image-search and semantic-cache modules import (missing env vars aside).

JavaScript: npm ci / pnpm install --frozen-lockfile, then each project's build/test/lint/typecheck.

Builds pass: apps/next-js (build, test, lint), apps/moss-llamaindex/frontend, apps/livekit-moss-vercel/agent-react, apps/moss-vscode (build, typecheck), examples/voice-agents/insurance-adjuster/ui, examples/javascript-web, vitepress demo-site, packages/moss-md-indexer.
Build, typecheck and tests pass in packages/{mastra-moss,vercel-sdk,n8n-nodes-moss}; build and tests pass in packages/vitepress-plugin-moss.

Pre-existing failures, not caused by this PR (same result on main):

moss-live-labs/examples/image-search/react-app: tsc fails on import.meta.env typing.
apps/pipecat-moss/{ollama-local,hume-ollama-local}: imports fail because pipecat.processors.aggregators.openai_llm_context no longer exists in pipecat-ai ≥1.x, and moss is not a declared dependency.
apps/elevenlabs-moss: pyaudio needs system portaudio to build.

Left open (27), and why

Alerts	Where	Why skipped
9	`minimatch` (<11.0.1) in next-js, moss-vscode, both promos, javascript examples, image-search react-app, agent-react, vitepress-plugin-moss	Only fixed in minimatch 11 (major). Parents (eslint, typescript-eslint, glob) pin 9.x/10.x.
6	`opentelemetry-api` (<=1.45.0) in the 6 LiveKit voice demos	Needs livekit-agents ≥1.8.7, which needs openai 3.x (major). One alert per lockfile, not worth the jump.
3	`vite` 5.4.21 in `packages/vitepress-plugin-moss`	Comes from vitepress 1.x. Only fixed in vite 6+ (major). Goes away with the vitepress 2 migration.
2	`zod` 3.x in `examples/cookbook/{mastra,vercel-ai-sdk}`	Only fixed in zod 4 (major).
1	`@ai-sdk/provider-utils` 2.2.8 in `examples/cookbook/mastra`	2.x has no patch. Pinned by mastra.
1	`uuid` 10 in `packages/n8n-nodes-moss`	Only fixed in uuid 11 (major). Pinned by n8n-workflow.
1	`dnspython` in `packages/moss-data-connector/moss-connector-mongodb`	2.9 needs Python ≥3.11. This shipped package still supports 3.10.

Per-lockfile breakdown

Lockfile / manifest	Open before	Expected to close	Left
`packages/agora-moss/uv.lock`	25	25	0
`packages/mastra-moss/package-lock.json`	50	50	0
`packages/moss-data-connector/moss-connector-mongodb/uv.lock`	9	8	1
`packages/moss-data-connector/moss-connector-sqlite/uv.lock`	3	3	0
`packages/moss-data-connector/moss-connector-supabase/uv.lock`	28	28	0
`packages/moss-data-connector/moss-connector-zeroentropy/uv.lock`	1	1	0
`packages/moss-md-indexer/example/pnpm-lock.yaml`	33	33	0
`packages/moss-md-indexer/package-lock.json`	46	46	0
`packages/moss-md-indexer/pnpm-lock.yaml`	28	28	0
`packages/n8n-nodes-moss/package-lock.json`	14	13	1
`packages/pipecat-moss/uv.lock`	49	49	0
`packages/ten-moss/uv.lock`	1	1	0
`packages/vercel-sdk/package-lock.json`	13	13	0
`packages/vitepress-plugin-moss/demo-site/documentation/package-lock.json`	8	8	0
`packages/vitepress-plugin-moss/demo-site/documentation/pnpm-lock.yaml`	8	8	0
`packages/vitepress-plugin-moss/demo-site/pnpm-lock.yaml`	9	9	0
`packages/vitepress-plugin-moss/package.json`	1	1	0
`packages/vitepress-plugin-moss/pnpm-lock.yaml`	58	49	9
`apps/agora-moss/uv.lock`	25	25	0
`apps/elevenlabs-moss/uv.lock`	6	6	0
`apps/livekit-moss-vercel/agent-react/package.json`	20	20	0
`apps/livekit-moss-vercel/agent-react/pnpm-lock.yaml`	40	39	1
`apps/livekit-moss-vercel/livekit-voice-agent/livekit-moss-agent/uv.lock`	90	90	0
`apps/moss-llamaindex/frontend/package-lock.json`	28	28	0
`apps/moss-vscode/package-lock.json`	36	35	1
`apps/moss-vscode/promo/package-lock.json`	25	24	1
`apps/next-js/package-lock.json`	62	61	1
`apps/pipecat-moss/hume-ollama-local/uv.lock`	84	84	0
`apps/pipecat-moss/ollama-local/uv.lock`	84	84	0
`apps/vapi-moss/uv.lock`	7	7	0
`examples/cookbook/daytona/uv.lock`	22	22	0
`examples/cookbook/mastra/package-lock.json`	54	52	2
`examples/cookbook/moss-cognee-daytona/uv.lock`	31	31	0
`examples/cookbook/sim/uv.lock`	7	7	0
`examples/cookbook/smolagents/uv.lock`	56	56	0
`examples/cookbook/vercel-ai-sdk/package.json`	1	0	1
`examples/javascript-web/package-lock.json`	10	10	0
`examples/javascript/package-lock.json`	5	4	1
`examples/moss-pikachu/promo/package-lock.json`	27	26	1
`examples/voice-agents/airline-pnr/uv.lock`	93	92	1
`examples/voice-agents/candidate-screening/uv.lock`	96	95	1
`examples/voice-agents/insurance-adjuster/ui/package-lock.json`	31	31	0
`examples/voice-agents/insurance-adjuster/uv.lock`	84	83	1
`examples/voice-agents/mortgage-lending/uv.lock`	84	83	1
`moss-live-labs/examples/advanced-voice-agent/uv.lock`	91	90	1
`moss-live-labs/examples/image-search/backend-py/uv.lock`	3	3	0
`moss-live-labs/examples/image-search/react-app/package-lock.json`	20	19	1
`moss-live-labs/examples/image-search/setup-py/uv.lock`	3	3	0
`moss-live-labs/examples/semantic-cache/uv.lock`	4	4	0
`moss-live-labs/examples/voice-agent/uv.lock`	84	83	1
`moss-live-labs/python/uv.lock`	3	3	0
`package-lock.json`	10	10	0
Total	1710	1683	27

Summary by CodeRabbit

Chores
- Updated framework, tooling, and supporting package versions across the app and examples.
- Python-based voice agent and cookbook examples now require Python 3.11 or newer; Python 3.10 is no longer supported.
Documentation
- Updated setup prerequisites to reflect the Python 3.11 minimum.