[aviggiano]

Summary

• Resolve seven High/Critical production dependency advisories found by the live package gate: two in MCP SDK, one in body-parser, two in DOMPurify, one in Zod, and one in npm's bundled Undici.
• Pin fixed versions in both the repository's pnpm graph and the independently npm-installed generated Smithers controller. Move the controller's frozen resolution cutoff past the fixed releases.
• Migrate exact prior generated 0.35 and 0.34 manifests, plus the stock 0.32 manifest, to the secure pins during non-force init.
• Refresh the pinned npm bundle patch to Undici 6.29.1 from the published package, then update the operator npm closure digest and regression expectations.
• Leave Vite unchanged for chore(deps-dev): bump vite from 7.3.6 to 7.3.7 #1325. Add no advisory exceptions.

Validation

• pnpm install --frozen-lockfile --config.optimistic-repeat-install=false
• pnpm -w security:dependency-advisories — passes against the live registry with only the repository's preexisting documented exception
• pnpm -w build
• node --test packages/runtime/dist-test/test/operator-npm.test.js — 3 passed
• node --test packages/runtime/dist-test/test/smithers-package.test.js — 10 passed
• Focused runtime init/cutoff tests — 4 passed
• bun test ./scripts/ci/dependency-advisories.test.ts — 21 passed
• pnpm -w format:check and focused Prettier check
• Generated controller npm install --package-lock-only --before=2026-10-25T00:00:00Z resolves MCP SDK 1.32.0, body-parser 2.4.0, DOMPurify 3.4.17, and Zod 4.6.6

The pinned npm package currently ships an older Undici copy; its pnpm patch carries the published 6.29.1 files that npm includes in its pruned bundle.

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues were found.

Summary

Updates dependency pins in both the pnpm workspace and the separately installed Smithers controller.

• Workspace installs use fixed releases of four production dependencies.
• Smithers controller installs use the fixed dependency releases.
• The operator's pinned npm bundle contains Undici 6.29.1.

The earlier generated-controller Zod finding is addressed. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Updated dependency pins] --> B[pnpm workspace install]
  A --> C[Generated controller manifest]
  C --> D[npm install with fixed cutoff]
  E[Recognized older manifest] --> F[Non-force init migration]
  F --> C
  G[Patched npm bundle] --> D

Loading

_{Reviews (3) · Last reviewed commit: "chore: refresh security lockfile after p..." · Reviewed by Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T19:36:31.276333Z	07a81e2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	zod@​4.4.3 ⏵ 4.6.6		+16		+1

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07a81e2319

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Propagate the security pins to generated controllers

These workspace overrides secure only the repository's pnpm installation. When ultrafuzz run provisions the production Smithers controller, operatorControllerProjectRoot writes renderSmithersPackageJson() and installs it independently with npm; that manifest's REQUIRED_SMITHERS_OVERRIDES still contains only Effect pins and directly pins Zod 4.4.3. Consequently, the dependency-advisory gate passes while newly installed workflow controllers retain the vulnerable Zod version and the old cutoff-selected MCP SDK/body-parser/DOMPurify versions. Mirror these fixes into the generated manifest, its resolution cutoff, and the migration path for existing .smithers/package.json files.

Useful? React with 👍 / 👎.