[jeffdupont]

What

• Dependency audit in CI: new make audit target (yarn audit --groups dependencies, runtime deps only) and a Dependency audit CI job that runs it.
• Dependabot: .github/dependabot.yml with npm daily at the workspace root (one yarn.lock covers every packages/* workspace) and github-actions weekly, both with a 7-day cooldown. Same shape as go-ai-sdk (go-ai-sdk#3) and python-ai-sdk (python-ai-sdk#176).
• Lockfile re-resolution so the new job passes. Every finding came through @launchdarkly/ai-openai-agents → @openai/agents → @modelcontextprotocol/sdk. Each package was re-resolved within its existing range, and no package.json changed:

Package	Was	Now
@modelcontextprotocol/sdk	1.29.0	≥1.31.0
proxy-addr (critical)	2.0.7	≥2.0.8
fast-uri	3.1.5	≥3.1.8
hono	4.13.1	4.13.13
ip-address	10.4.0	≥10.7.1
qs	6.15.2	≥6.16.0

yarn audit on runtime deps: 44 advisories (2 critical, 17 high) → 0.

Not in this PR

GitHub still shows 8 alerts after this lands, all in test and build tooling: vitest / @vitest/mocker 4.1.9 (fixed in 4.1.11), source-map-js via vite → postcss, sprintf-js via @microsoft/api-extractor (no fix yet), and esbuild 0.27.7 (low). The new job skips dev dependencies on purpose. These can go in a follow-up PR, or wait for Dependabot to open them.

Verified locally

• yarn audit --groups dependencies → 0 vulnerabilities found
• yarn install --frozen-lockfile, core build, yarn typecheck, yarn test (all workspaces) pass
• Pre-commit hooks (biome lint, biome check) pass

Not verified: the CI run itself (this PR's checks will show it).

🤖 Generated with Claude Code

---

Note

Overview
Adds automated dependency maintenance and runtime security checks without changing application code.

Dependabot (.github/dependabot.yml): daily npm updates at the Yarn workspace root and weekly GitHub Actions updates (workflows + composite actions), both with a 7-day cooldown. Major vitest bumps are ignored to avoid the Yarn 1 / vite issue noted in #52.

CI: a weekly Monday cron so advisories can fail CI even when main hasn’t changed. A new Dependency audit job runs make audit after a frozen yarn install; it uses continue-on-error on pull requests so new advisories don’t block every PR, while push and scheduled runs still fail the workflow.

Makefile: new audit target — yarn audit --groups dependencies --level high (runtime deps only, high/critical).

^{Reviewed by Cursor Bugbot for commit e25b9a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jeffdupont]

Merged main in (e25b9a5):

• yarn.lock is main's. The dependabot merges today superseded this branch's lockfile bumps.
• make audit now runs yarn audit --groups dependencies --level high.
• The audit job has continue-on-error on pull_request, so a newly published advisory doesn't turn every PR red. Push to main and a new weekly schedule (Mon 13:00 UTC) still fail. This matches python-ai-sdk#176.
• dependabot.yml now ignores vitest semver-major. vitest 5 drops vite as a dependency and Yarn 1 doesn't install peers, which is why chore(deps-dev): bump vitest from 4.1.9 to 5.0.2 #52 fails.

Locally, make audit exits 0, and build and typecheck pass. This needs a second approver, since it's jeffdupont's PR.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e25b9a5. Configure here.}

[cursor]

Audit level does not fail CI

Medium Severity

Yarn 1 yarn audit --level only filters printed advisories and does not change the exit code. make audit still fails on low or moderate runtime findings, so pushes to main and the weekly cron go red even with --level high. Those lower-severity advisories are also omitted from the job log, which hides why the gate failed.

 

^{Reviewed by Cursor Bugbot for commit e25b9a5. Configure here.}