deps: periodic dependency and security update

[qw-in]

Update dependencies to latest minor outside 30d cooldown. Resolve fixable security notices.

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Approved

Rationale: This PR is a dependency and security maintenance update across the examples workspace. Changes fall into two well-scoped categories: (1) minor/patch version bumps of already-used dependencies (Next.js 16.3.1→16.3.4, fastapi 0.138.0→0.141.1, uvicorn 0.49.0→0.52.1, @langchain/openai 1.2.8→1.5.6, @types/node bumps, astro 7.2.2→7.3.2, fastify 5.12.0→5.12.3, npm-check-updates), and (2) overrides pins that force transitive dependencies past specific GHSAs (qs, sharp, adm-zip, uuid, multer, csv-parse, @opentelemetry/core, @opentelemetry/propagator-jaeger, nanoid, undici). Each override is documented in OVERRIDES.md with the parent constraint, GHSA link, and removal condition, matching the commit history. No source code, auth, infra, or CI changes; no secrets introduced; no logic changes. Approving despite Medium risk because the dependency-changes trigger fires purely from package.json edits, but the changes are narrowly scoped to example apps, motivations are documented per-override, and the diff is internally consistent (commits ↔ package.json ↔ OVERRIDES.md).

Summary of Changes

Routine dependency maintenance across example apps: bumps several minor/patch versions (Next.js, fastapi/uvicorn, @langchain/openai, astro, fastify, @types/node, npm-check-updates) and adds npm overrides to force patched versions of transitives flagged by advisories (qs, sharp, adm-zip, uuid, multer, csv-parse, @opentelemetry/core & propagator-jaeger, nanoid, undici). OVERRIDES.md gains a 'Security maintenance overrides' section documenting each pin and its removal condition.

Escalation Triggers

• Dependency Changes: 22 package.json / pyproject.toml files modified with version bumps and new npm overrides entries.

Review Focus Areas

• Confirm that pinning qs to 6.16.0 at the top level (not scoped under express/body-parser) is intentional and does not force an incompatible qs on any other transitive consumer.
  The other qs overrides in this PR (react-router, react-router-middleware, genkit-agent) are also top-level; the OVERRIDES.md entry describes them as express/body-parser motivated, so the broad scope is worth a sanity check.
• Verify at install time that pinning sharp: 0.35.4 and adm-zip: 0.6.0 still satisfies Transformers 4.2.0 / ONNX Runtime peer expectations without warnings.
  OVERRIDES.md notes Transformers requires sharp 0.34.x and ONNX installer pins adm-zip 0.5.x; the override forces newer majors/minors and relies on runtime API compatibility.
• Confirm @nestjs/platform-express still functions with multer: 2.3.0 (four multer GHSAs cited); a quick upload smoke test would validate the pin.
  Nest platform-express pins multer 2.2.0; forcing 2.3.0 could surface API differences even though multer 2.x is generally compatible.

Notes

Purely metadata/dependency changes; no source code touched. OVERRIDES.md documentation is consistent with the commit list and package.json diffs.

Path filtering: 28 files excluded by ignore paths. 23 of 51 files included in review.

_{Review: a8059d1f | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​16.3.1 ⏵ 16.3.4		+75	+1
	npm/​astro@​7.2.2 ⏵ 7.3.2		+75	+1	+1
	npm/​@​langchain/​openai@​1.2.8 ⏵ 1.5.6	+17
	npm/​npm-check-updates@​19.3.2 ⏵ 19.6.6			+1
	pypi/​uvicorn@​0.49.0 ⏵ 0.52.1	+1
	npm/​fastify@​5.12.0 ⏵ 5.12.3		+3		+1
	pypi/​fastapi@​0.138.0 ⏵ 0.141.1	+1
	pypi/​pydantic-settings@​2.14.2 ⏵ 2.15.0	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (npm metadata) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/package.json) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/LICENSE) From: examples/tanstack-start/package-lock.json → npm/@vitejs/plugin-react@5.2.0 → npm/firebase-functions-test@3.5.0 → npm/@nestjs/cli@11.0.24 → npm/@react-router/dev@7.18.2 → npm/@tanstack/react-start@1.168.46 → npm/caniuse-lite@1.0.30001810 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001810. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm morgan reads NO_COLOR Env Vars: NO_COLOR Location: Package overview From: examples/react-router/package-lock.json → npm/@react-router/serve@7.18.2 → npm/firebase-tools@15.27.0 → npm/morgan@1.12.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/morgan@1.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Debug access: npm multer in module async_hooks Module: async_hooks Location: Package overview From: examples/nestjs/package-lock.json → npm/@nestjs/platform-express@11.2.1 → npm/multer@2.3.0 ℹ Read more on: This package | This alert | What is debug access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing the use of debug will reduce the risk of any reflection and dynamic code execution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/multer@2.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm unifont reads HTTPS_PROXY Env Vars: HTTPS_PROXY Location: Package overview From: examples/astro/package-lock.json → npm/astro@7.3.2 → npm/unifont@0.7.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unifont@0.7.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm unifont reads HTTP_PROXY Env Vars: HTTP_PROXY Location: Package overview From: examples/astro/package-lock.json → npm/astro@7.3.2 → npm/unifont@0.7.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unifont@0.7.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm unifont reads https_proxy Env Vars: https_proxy Location: Package overview From: examples/astro/package-lock.json → npm/astro@7.3.2 → npm/unifont@0.7.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unifont@0.7.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm unifont reads http_proxy Env Vars: http_proxy Location: Package overview From: examples/astro/package-lock.json → npm/astro@7.3.2 → npm/unifont@0.7.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unifont@0.7.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• npm/zod@4.5.4
• npm/next@16.3.4
• npm/undici@8.10.2
• npm/@astrojs/compiler-binding@0.4.0
• npm/@astrojs/compiler-binding-wasm32-wasi@0.4.0
• npm/@bruits/satteri-wasm32-wasi@0.10.5
• npm/astro@7.3.2
• npm/js-yaml@3.15.2
• npm/satteri@0.10.5
• npm/fastify@5.12.3
• pypi/fastapi@0.141.1
• pypi/fastapi@0.141.1

View full report

[qw-in]

@SocketSecurity ignore npm/next@16.3.4

Reviewed flags cover trusted build/runtime loaders, development diagnostics, and unused opt-in uploads. Script URLs are fixed in source; npm ci uses integrity-pinned SWC packages. No Next advisory in npm audit; accepting the unspecified potential-vulnerability flag for this PR.

@SocketSecurity ignore npm/@astrojs/compiler-binding-wasm32-wasi@0.4.0

Optional compiler WASI loader; host access and worker evaluation operate on trusted package-local compiler code, with no request-selected modules.

@SocketSecurity ignore npm/@astrojs/compiler-binding@0.4.0

Native compiler loader with an operator-controlled environment override. The version-pinned pnpm fallback runs only in WebContainers after binding loading fails.

@SocketSecurity ignore npm/@bruits/satteri-wasm32-wasi@0.10.5

Optional Markdown compiler WASI loader; host access and worker evaluation operate on trusted package-local compiler code, with no request-selected modules.

@SocketSecurity ignore npm/astro@7.3.2

Development error overlay: highlighted source comes from Shiki, messages are escaped before HTML formatting, and editor/clipboard actions require clicks.

@SocketSecurity ignore npm/fastify@5.12.3

Maintainer codegen uses a hardcoded schema. Examples consume the shipped validator, with no request-controlled generator inputs.

@SocketSecurity ignore npm/js-yaml@3.15.2

The flagged CLI is unused. Mastra uses safeLoad through gray-matter; the other consumer reads trusted local coverage configuration.

[qw-in]

@SocketSecurity ignore npm/satteri@0.10.5

Expected native Markdown compiler loader; the library-path override is controlled by the host environment, with no request-derived module selection.

@SocketSecurity ignore npm/undici@8.10.2

Bundled llhttp WASM is covered by package integrity and imports only HTTP parser callbacks. The re-encoding script processes a generated bundle during maintainer builds; installation and application runtime do not invoke it.

@SocketSecurity ignore npm/zod@4.5.4

Zod generates validators from application-defined schemas, escaping property keys. Request data is passed as validation input, not generated JavaScript.

@SocketSecurity ignore pypi/fastapi@0.141.1

Unsafe YAML loading and filesystem cleanup belong to upstream documentation tooling in the source archive. That tooling is absent from the installed wheel and application runtime.