deps: refresh toolchain without vulnerable transitives

.github/workflows/ci.yml

@@ -9,9 +9,23 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 20
+          cache: pnpm
+      - name: Install
+        run: pnpm install --frozen-lockfile
+      - name: Reject known vulnerabilities
+        run: pnpm audit --audit-level=low
+
   lint:
     name: Biome Lint
     runs-on: ubuntu-latest

.github/workflows/code-quality.yml

@@ -10,7 +10,6 @@ on:
 permissions:
   actions: read
   contents: read
-  pull-requests: write
   id-token: write
 
 concurrency:

package.json

@@ -3,16 +3,6 @@
   "version": "0.1.0",
   "private": true,
   "description": "StagePilot tool-calling reliability runtime, benchmark lab, and hosted-service prototype",
-  "type": "module",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/KIM3310/stage-pilot"
-  },
-  "author": "Doeon Kim (StagePilot extensions)",
-  "homepage": "https://github.com/KIM3310/stage-pilot#readme",
-  "bugs": {
-    "url": "https://github.com/KIM3310/stage-pilot/issues"
-  },
   "keywords": [
     "ai-sdk",
     "tool-calling",
@@ -21,9 +11,17 @@
     "stagepilot",
     "benchmark"
   ],
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "homepage": "https://github.com/KIM3310/stage-pilot#readme",
+  "bugs": {
+    "url": "https://github.com/KIM3310/stage-pilot/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/KIM3310/stage-pilot"
+  },
+  "license": "Apache-2.0",
+  "author": "Doeon Kim (StagePilot extensions)",
+  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -51,41 +49,44 @@
       "require": "./dist/schema-coerce.cjs"
     }
   },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "files": [
     "dist/**/*"
   ],
   "scripts": {
+    "api:benchlab": "tsx src/bin/benchlab-api.ts",
+    "api:stagepilot": "tsx src/bin/stagepilot-api.ts",
+    "bench:stagepilot": "tsx src/examples/stagepilot-benchmark.ts",
     "build": "pnpm run clean && tsup --tsconfig tsconfig.build.json",
     "build:watch": "pnpm run clean && tsup --watch --tsconfig tsconfig.build.json",
-    "clean": "rimraf dist *.tsbuildinfo",
-    "clean:repo": "bash scripts/clean-local-artifacts.sh",
-    "lint": "pnpm run check",
-    "typecheck": "tsc --noEmit",
-    "test": "NODE_OPTIONS=--disable-warning=ExperimentalWarning vitest run",
+    "changeset": "changeset",
+    "check": "run-p check:*",
     "check:biome": "biome check",
     "check:publication": "node scripts/validate-publication-surface.mjs",
     "check:types": "tsc --noEmit",
-    "check": "run-p check:*",
-    "verify": "pnpm run check && pnpm test && pnpm run build",
-    "fmt:biome": "biome check --write",
-    "fmt": "run-p fmt:*",
-    "changeset": "changeset",
-    "demo:stagepilot": "tsx src/examples/stagepilot-run.ts",
-    "bench:stagepilot": "tsx src/examples/stagepilot-benchmark.ts",
-    "api:stagepilot": "tsx src/bin/stagepilot-api.ts",
-    "api:benchlab": "tsx src/bin/benchlab-api.ts",
-    "exercise:runtime": "node scripts/exercise-runtime-scorecard.mjs",
-    "load:runtime": "tsx scripts/load-runtime.ts",
-    "load:k6": "k6 run scripts/k6-runtime-scorecard.js",
+    "clean": "rimraf dist *.tsbuildinfo",
+    "clean:repo": "bash scripts/clean-local-artifacts.sh",
     "datadog:plan": "node scripts/datadog-assets.mjs plan",
     "datadog:sync": "node scripts/datadog-assets.mjs sync",
+    "demo:stagepilot": "tsx src/examples/stagepilot-run.ts",
     "deploy:stagepilot": "bash scripts/deploy-stagepilot.sh",
-    "smoke:stagepilot": "bash scripts/smoke-stagepilot.sh"
+    "exercise:runtime": "node scripts/exercise-runtime-scorecard.mjs",
+    "fmt": "run-p fmt:*",
+    "fmt:biome": "biome check --write",
+    "lint": "pnpm run check",
+    "load:k6": "k6 run scripts/k6-runtime-scorecard.js",
+    "load:runtime": "tsx scripts/load-runtime.ts",
+    "smoke:stagepilot": "bash scripts/smoke-stagepilot.sh",
+    "test": "NODE_OPTIONS=--disable-warning=ExperimentalWarning vitest run",
+    "typecheck": "tsc --noEmit",
+    "verify": "pnpm run check && pnpm test && pnpm run build"
   },
   "dependencies": {
-    "@ai-sdk/openai": "^3.0.88",
+    "@ai-sdk/openai": "^3.0.91",
     "@ai-sdk/provider": "3.0.14",
-    "@ai-sdk/provider-utils": "4.0.40",
+    "@ai-sdk/provider-utils": "4.0.42",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.79.0",
     "@opentelemetry/core": "^2.10.0",
@@ -97,24 +98,24 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@ai-sdk/openai-compatible": "2.0.62",
-    "@biomejs/biome": "2.5.5",
+    "@ai-sdk/openai-compatible": "2.0.64",
+    "@biomejs/biome": "2.5.7",
     "@changesets/cli": "2.31.1",
-    "@rollup/rollup-darwin-arm64": "^4.62.3",
+    "@rollup/rollup-darwin-arm64": "^4.62.4",
     "@types/node": "^25.9.5",
     "@vitest/coverage-v8": "^4.1.10",
-    "ai": "6.0.236",
+    "ai": "6.0.246",
     "esbuild": "^0.28.1",
-    "globals": "^17.8.0",
+    "globals": "^17.9.0",
     "husky": "^9.1.7",
     "jiti": "^2.7.0",
     "npm-run-all2": "8.0.4",
     "rimraf": "^6.1.3",
     "tsup": "^8.5.1",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.11",
     "typescript": "6.0.3",
-    "ultracite": "7.9.4",
-    "vite": "^8.1.5",
+    "ultracite": "7.10.1",
+    "vite": "^8.2.1",
     "vitest": "^4.1.10",
     "zod": "^4.4.3"
   },
@@ -123,5 +124,10 @@
     "node": "^20.19.0 || >=22.12.0",
     "pnpm": ">=10"
   },
-  "license": "Apache-2.0"
+  "pnpm": {
+    "overrides": {
+      "esbuild": "0.28.1",
+      "undici": "6.28.0"
+    }
+  }
 }