Universal AI Coding-Agent Gateway, Autonomous Control Plane & Model Router Connect Claude Code, Cursor, Codex, OpenCode, Aider & 20+ Coding Agents to Google Antigravity, Anthropic, OpenAI, DeepSeek & Local Inference with Zero Friction.
Nexus is not an AI model. Nexus is the universal provider fabric, dynamic routing engine, and infrastructure layer between your coding agents and every model provider.
⚡ What's New in Nexus
v0.5.0:
- 🪐 First-Class Google Antigravity CLI (
agy) Native Provider: Direct subprocess integration with zero token scraping, inheriting local authentication, multi-turn tool support, and live dynamic discovery of 14+ models (gemini-3.8/3.7/3.6-flash,gemini-3.1-pro,claude-sonnet-4-6,gpt-oss-120b).- 🌿 Workflow DAG & Concurrent Parallel Execution: Branching Directed Acyclic Graph workflows with dependency resolution, parallel branch dispatch, condition evaluation, and execution history.
- ☁️ Expanded Cloud Provider Adapters: Native adapters with streaming for Azure OpenAI deployments, Cloudflare Workers AI, Perplexity AI, and Replicate.
- 🧠 Semantic Vector Cache & PgVector Storage: Embeddings-based similarity caching with in-memory cosine fallback and PostgreSQL
pgvectorgeneration for high hit-rate prompt reuse.- 🗄️ Local File & Multi-Backend Vector Stores: Built-in JSON/directory local vector store adapter and pluggable vector store contract.
- 📝 Immutable Semantic Versioned Prompt Templates: Centralized
PromptTemplateRegistrysupporting template variables{{var}}, default fallbacks, and semver tag tracking.- 📊 Accurate Tiktoken Token Accounting: cl100k/o200k/p50k BPE estimation, message framing overhead calculations, and pre-flight budget verification.
- 🔔 Production Alerting & Prometheus Monitoring: Ready-to-use Prometheus alerting rules and Alertmanager routing manifests for error rates, P99 latency, circuit breaker state, and quota exhaustion.
- 🩹 Tool Schema Auto-Healer & Default Infill: Self-heals malformed JSON arguments from upstream models and infills missing schema fields so agent harnesses never fail.
- 🔒 Stream Clamping & Tokenizer Leak Shield: Real-time filtering of tokenizer artifact tokens (
<unk>,<s>,<|im_end|>) with runaway loop termination.- 🗜️ Six-Engine Token Compression: Real-time prompt minification with measured savings up to 95%.
- 🔌 Native Model Context Protocol (MCP) Server: Full live gateway inspection via standard MCP tools.
Nexus now ships a set of live, measured dashboards that turn OmniRoute's static marketing claims into verifiable, per-request telemetry. Every number below is computed from the running gateway — no fabricated quotas, no synthetic fallbacks.
| Feature | Dashboard Route | What it proves (with real data) |
|---|---|---|
| Compression Lab | /compression |
Paste any prompt → see the real per-engine token savings (minify · dedupe · collapse-arrays · elide-middle) from the stacked compressPipeline. OmniRoute claims "15–95% savings" statically; Nexus shows your actual savings, live. |
| Routing Decision Replay | /routing-replay |
Click any past request → inspect the real fallback attempt chain + the live candidate ranking and why the winner won. |
| Cost & Budget Dashboard | /cost-budget |
Live token burn + per-provider throughput + a configurable budget guard with over/near-ceiling alerts (real /v1/metrics). |
| Strategy A/B Simulator | /strategy-sim |
Rank the same candidate pool under two routing strategies and compare outcomes side-by-side via the read-only POST /v1/routing/compare. |
| Agent Health & Resilience Board | /resilience |
Circuit-open / degraded providers, detached long-tasks, and orchestrated-agent failovers in one ops view. |
Screenshots above are captured from the live dashboard (
http://127.0.0.1:3000) against a running gateway. Introduced in commitsa4ed97f(Compression Lab) and2725c3a(the four dashboards).
Nexus is a universal AI coding-agent gateway, provider fabric, and autonomous control plane that dynamically discovers models across providers and exposes them through one OpenAI-compatible and Anthropic-compatible local endpoint (http://127.0.0.1:8787).
You point one URL at Nexus. Nexus handles everything else:
- Universal Provider Fabric: Connect any OpenAI-compatible provider once — Nexus automatically discovers models, normalizes capabilities, encrypts keys, and creates instant routing bindings.
- Dynamic Model Discovery: Discovers every model from every provider you configure — automatically, with zero hardcoded catalogs.
- Intelligent Routing: Routes each request to the best available, healthy, cost-appropriate model using policies like
nexus/best-coding,nexus/free,nexus/fast, andnexus/reasoning. - Multi-Key Rotation & Cooldown: Rotates API keys, isolates 429 rate limits, and automatically fails over across models, keys, and providers.
- Protocol Translation: Transparently projects OpenAI
/v1/chat/completionsand Anthropic/v1/messagesrequests to any upstream provider with streaming SSE support. - Token Optimization: Prompt compression and tool-schema normalization run directly in the gateway with real-time measured token savings.
- AGY Application Builder: Autonomous software building lifecycle (plan, scaffold, build, test, verify, repair) orchestrated through the Nexus control plane.
Nexus is the control plane — not another coding agent.
flowchart TD
DEV["Developer / Coding Agent"]
DEV -->|"OpenAI /v1 or Anthropic /v1\nhttp://127.0.0.1:8787"| NEXUS
subgraph NEXUS["Nexus Gateway & Control Plane — http://127.0.0.1:8787"]
PROTO["Protocol Adapter\nOpenAI ↔ Anthropic translation"]
OPT["Token Optimizer\nprompt compressor & tool-schema normalizer"]
ROUTER["Routing Engine\nFREE · CHEAP · FAST · BEST · BEST-CODING\nvision · reasoning · long-context · tool-calling"]
KEYS["Key Registry\nrotation · cooldown · circuit breaker"]
CATALOG["Model Catalog\ndynamic discovery · ETag delta sync"]
VAULT["Credential Vault\nAES-256-GCM encrypted at rest"]
OBS["Observability\nmetrics · latency p50/p95/p99 · audit trail"]
APP_ENG["Autonomous Application Engine\nPlanner · Risk Engine · Workflow DAG"]
PROTO --> OPT --> ROUTER
ROUTER --> KEYS
KEYS --> CATALOG
CATALOG --> VAULT
ROUTER --> OBS
APP_ENG --> ROUTER
end
CATALOG -->|"live REST calls"| PROVIDERS
subgraph PROVIDERS["Provider APIs & Local Engines"]
AGY_CLI["Google Antigravity CLI (agy)"]
OAI["OpenAI"]
ANT["Anthropic"]
DSK["DeepSeek"]
ORT["OpenRouter"]
GGL["Google AI / Gemini"]
GRQ["Groq"]
MST["Mistral"]
XAI["xAI / Grok"]
TGT["Together AI"]
FRW["Fireworks AI"]
CBR["Cerebras"]
NVD["NVIDIA NIM"]
LOCAL["Ollama / vLLM / LM Studio"]
CUSTOM["Generic OpenAI-compatible"]
end
APP_ENG -->|"Subprocess Execution"| AGY["AGY Building Agent"]
AGY -->|"Routes code generation"| NEXUS
DEV --> DASHBOARD["Mission Control Dashboard\nhttp://127.0.0.1:3000\nproviders · models · routing · agents · metrics · audit"]
DASHBOARD --> NEXUS
| Problem | Nexus Solution |
|---|---|
| Rate limits hit on one provider | Fans load across every configured key and provider automatically |
| Paying for GPT-4 on routine tasks | nexus/free and nexus/cheap route to the best free/cheap model |
| API keys expire or get rate-limited | Key Registry rotates keys and cools them down on 429 / 401 |
| Agents support only one base URL | One local endpoint serves all agents simultaneously |
| New models released constantly | Dynamic discovery — no restarts, no config file edits |
| Tool-calling schemas differ by provider | Gateway normalizes schemas before routing |
| Context window wasted on boilerplate | Prompt compressor runs before routing; reports measured savings |
| Multi-step application construction | Autonomous Application Engine coordinates planning, AGY scaffolding, and testing |
irm https://raw.githubusercontent.com/rachidSabah/Nexus/main/scripts/install.ps1 | iexTo completely remove Nexus (stops services, deletes the install dir + vault, unlinks the anx CLI):
irm https://raw.githubusercontent.com/rachidSabah/Nexus/main/scripts/uninstall.ps1 | iexcurl -fsSL https://raw.githubusercontent.com/rachidSabah/Nexus/main/scripts/install.sh | bashTo completely remove Nexus (stops services, deletes the install dir + vault, unlinks the anx CLI):
curl -fsSL https://raw.githubusercontent.com/rachidSabah/Nexus/main/scripts/uninstall.sh | bashBoth installers verify Node.js >= 20, clone the repo, install pnpm if missing, build from source, initialize ~/.agent-nexus, generate an encrypted vault key, start the gateway, and print the dashboard URL.
# Prerequisites: Node.js >= 20, pnpm >= 9
git clone https://github.com/rachidSabah/Nexus.git
cd Nexus
pnpm install
pnpm build
# Start the gateway (port 8787)
node apps/gateway/dist/bin.js
# Start the dashboard (port 3000) — separate terminal
pnpm --filter @anx/dashboard devdocker compose upGateway: http://127.0.0.1:8787 · Dashboard: http://127.0.0.1:3000
- Open the Dashboard: Navigate to
http://127.0.0.1:3000. - Add a Provider: Enter your API key (stored encrypted in
~/.agent-nexus/vault.json). - Model Discovery: Nexus immediately contacts the provider, discovers all accessible models, classifies their capabilities, and registers them in the dynamic catalog.
- Point Your Coding Agent: Configure your favorite coding agent to use
http://127.0.0.1:8787/v1as its base URL. - Start Coding: Use high-level aliases such as
nexus/best-codingor direct model IDs.
Nexus seamlessly integrates the Google Antigravity CLI (agy) as a native, zero-config local engine:
- Zero Scraping / Safe Subprocess Architecture: Directly operates through local CLI process execution (
agy -p ... --output-format json / stream-json), inheriting your authenticated session without requiring or exposing API keys. - Dynamic 14-Model Discovery: Automatically probes and surfaces the full suite of cutting-edge models (
gemini-3.8-flash-high/medium/low,gemini-3.7-flash,gemini-3.6-flash,gemini-3.1-pro,claude-sonnet-4-6,claude-opus-4-6-thinking,gpt-oss-120b). - High-Speed Subprocess Streaming: Native NDJSON line streaming translated on-the-fly into OpenAI and Anthropic SSE chunks.
- Process Tree Cleanup: Guaranteed process tree termination (
taskkillon Windows /SIGTERMprocess group on Unix) to prevent zombie processes upon client abort.
Non-Anthropic upstream models (DeepSeek, GLM, Qwen, Mistral) occasionally omit required schema fields or return malformed argument JSON. Nexus automatically inspects and repairs tool calls before sending them to coding agent harnesses:
- Intelligent Infilling: Detects missing schema fields (
pattern: '*',path: '.',command: '',description: '') and automatically infills safe defaults. - Upstream Schema Sanitization: Strips metadata-only fields (
toolAction,toolSummary,wait_ms,timeout) fromrequired[]before proxying to strict upstream validators.
Protects your coding agents from corrupted model completions and infinite repetition loops:
- Special Token Filtering: Strips out-of-vocabulary tokenizer leaks (
<unk>,<s>,</s>,<|im_end|>,[UNK],[PAD]). - SSE Stream Clamping: Detects runaway loops and repetitive token bursts (3+ occurrences) and safely terminates the stream with
finish_reason: 'length'.
When an upstream provider experiences transient lag, queue buildup, or stalled first-token delivery, Nexus speculatively starts a concurrent stream to the next best alternative provider after an adaptive threshold (hedgedDelayMs, default 800ms). The first provider to emit tokens wins the race; the slower upstream socket is instantly aborted via AbortController, preventing double billing and eliminating waiting time.
LLM reasoning models occasionally truncate closing braces or emit markdown fences around JSON outputs. Nexus transparently repairs responses before returning them to your coding agents:
- Strips markdown fences (
```json) and preamble commentary. - Converts single-quoted keys and unquoted identifiers into strict RFC-8259 JSON.
- Auto-closes unclosed quotes, brackets (
]), and braces (}). - Eliminates illegal trailing commas in objects and arrays.
All connected coding agents (Claude Code, Cursor, Aider, OpenCode, Codex) can share context, architectural decisions, and bug investigations in real time via the Nexus Context Bus and native Model Context Protocol (MCP) server:
broadcast_context: Publish architectural discoveries, test results, or refactoring constraints across all active agent sessions.query_shared_context: Query shared knowledge by topic or tag to prevent duplicate work.antigravity_health&antigravity_list_models: Query live Antigravity CLI daemon status, health diagnostics, and model discovery states over MCP.- REST Endpoints:
/v1/context/broadcast,/v1/context/query,/v1/context/shared.
When cloud providers experience 5xx outages, rate limit saturation, or network disconnects, Nexus seamlessly shifts traffic to local inference backends (ollama, vllm, lmstudio) without breaking active coding sessions.
Nexus exposes a sandbox.execute agent tool that runs untrusted code in a connected isolated backend (Docker/MCP sandbox) instead of the host — keeping your machine and gateway credentials out of agent-executed code. When an agent is debugging the gateway itself, use the isolated debug workflow (scripts/debug-isolated.sh): it copies your vault + key into a throwaway sandbox and runs a separate gateway instance there, so probing a dead route or a 402 provider never touches your live config or credentials.
Provider keys live encrypted in ~/.agent-nexus/vault.json. Nexus can export the entire vault as a single portable, passphrase-protected bundle so you can move it between machines or rotate a compromised host:
GET /v1/vault/export/file→ downloads.anx-vault.enc(AES-256-GCM, PBKDF2-derived key; default passphrasenexus-default-vault-backup, override via?passphrase=).POST /v1/vault/import→ uploads a bundle and re-registers every key (skips duplicates). Keys are never written to logs or API responses.
The bundle is portable: restore it on any Nexus instance to reconstruct identical provider bindings. (ee88217)
Nexus ships a runtime lifecycle for extensions, plugins, MCP servers, and workflows — all manageable at runtime with no gateway restart:
- Marketplace:
GET /v1/marketplace/search,/v1/marketplace/installed,/v1/marketplace/stats; install/update/toggle extensions viaPOST /v1/marketplace/extensions/:id/{install,update,toggle}andDELETE /v1/marketplace/extensions/:id. Compatibility is checked against the gateway version before install. - Plugins:
GET /v1/plugins;POST /v1/plugins/load,POST /v1/plugins/:id/unload(hot load/unload). - MCP: JSON-RPC over
POST /v1/mcp; server registry at/v1/mcp/servers, tool/resource/prompt discovery at/v1/mcp/{tools,resources,prompts}. - Workflows:
GET /v1/workflows,POST /v1/workflows/:id/execute(with execution history).
- Hot-swap:
POST /v1/runtime-agents/hot-swapre-targets a runtime agent or alias to a new model withAPPLIED_ZERO_DOWNTIME— no restart, in-flight requests keep their original target. - Supervisor: the gateway process supervisor reports live process health and system uptime (
supervisorStatus: 'HEALTHY'). - A2A coordinator:
POST /v1/a2a/handoffdispatches a task from one agent to a peer;POST /v1/a2a/messagesends peer messages through the A2A coordinator. Vault rotation is wired through the same lifecycle so re-keying never interrupts routing. (31b7d0d,9d02a75)
Nexus provides drop-in compatibility for 20+ coding agents and IDEs with 1-Click Install, Auto-Update, Buckle to Nexus, and Complete Uninstall:
| Agent / IDE | Config File / Settings | Protocol | 1-Click Dashboard Support |
|---|---|---|---|
Google Antigravity (agy) |
CLI Subprocess Native | Local CLI / Native Subprocess | Auto-detected · 14 Models · Zero Config |
| Claude Code | ~/.claude/settings.json (apiBaseUrl) |
Anthropic /v1/messages |
Install · Update · Buckle · Unbuckle · Uninstall |
| Cursor / Windsurf | Settings → Models (Base URL) | OpenAI /v1/chat/completions |
Install · Update · Buckle · Unbuckle · Uninstall |
| Aider | --openai-api-base http://127.0.0.1:8787/v1 |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| OpenCode / OpenCode Zen / OpenCode Go | ~/.opencode.json (url) |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| Codex CLI | ~/.codex/config.json (baseUrl) |
OpenAI /v1/chat/completions |
Install · Update · Buckle · Unbuckle · Uninstall |
| Hermes CLI | ~/.hermes/config.json |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| Qwen Code / Kimi Code | OPENAI_BASE_URL=http://127.0.0.1:8787/v1 |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| Cline / Roo Code | VS Code Extension Settings | OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| VS Code / Continue | ~/.continue/config.json |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| Neovim (Avante/CodeCompanion) | ~/.config/nvim/lua/... |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| Emacs (gptel/ellama) | ~/.emacs.d/init.el |
OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| JetBrains (AI Assistant/Continue) | IDE Plugin Settings | OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| OpenHands / Devin-CLI | Agent config / env | OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
| DeepSeek Harness | CLI config / env | OpenAI-compatible | Install · Update · Buckle · Unbuckle · Uninstall |
CLI Helper: You can also auto-configure all detected agents in one command:
anx integrations install --allor via Dashboard athttp://127.0.0.1:3000/integrations.
Instead of hardcoding a specific provider model, point your agent at Nexus policy aliases:
| Policy Alias | Selection Strategy |
|---|---|
nexus/best-coding |
Highest-ranked coding-optimized model available |
nexus/free |
Best healthy free-tier model across all connected providers |
nexus/cheap |
Lowest-cost healthy model meeting token & capability requirements |
nexus/fast |
Lowest-latency healthy model |
nexus/best |
Highest general quality model |
nexus/reasoning |
Best reasoning / chain-of-thought model |
nexus/vision |
Best vision-capable model |
nexus/long-context |
Best model for large context windows (>128k tokens) |
Nexus v0.5.0 features a local-first Durable Persistence & Recovery Engine:
- ACID Durability: Schema-versioned SQLite database with atomic JSON write boundaries.
- Interrupted Mission Recovery: Auto-reconciles in-flight DAG tasks upon process reboot or crash.
- Orphan Subprocess Reconciliation: Detects dead agent PIDs and cleans up abandoned execution leases.
- Idempotency Protection: SHA-256 request hashing prevents duplicate executions during network retries.
- Cryptographic Backups: Portable backup bundles validated by SHA-256 integrity checksums.
| Method | Path | Description |
|---|---|---|
POST |
/v1/chat/completions |
OpenAI-compatible chat completions with speculative hedged streaming |
POST |
/v1/messages |
Anthropic-compatible Messages API with transparent protocol translation |
GET |
/v1/models |
All dynamically discovered models across all healthy providers |
GET |
/v1/providers |
Configured provider health, models, and latency metrics |
GET |
/v1/rate-limits |
Per-key rate-limit state (tokens remaining / reset / Retry-After) — truthful, derived from live upstream headers (P1) |
GET |
/v1/routing/metrics |
Per-provider key health (active/cooldown/invalid, 429 rate) + free-model availability — derived, no fabricated quota (P4) |
POST |
/v1/compression/pipeline-preview |
Run the stacked compressPipeline on a prompt and return real per-engine token savings (minify · dedupe · collapse-arrays · elide-middle) + total |
POST |
/v1/routing/compare |
Read-only: rank the same candidate pool under two ranking strategies (A/B) and return both top-N lists — reuses the real scoring engine |
GET |
/v1/traces · /v1/traces/:id |
Historical routing decisions (winner, fallback attempts, intent) for replay |
GET |
/v1/tasks · /v1/tasks/:id |
Detached long-running tasks — fire-and-resume even if the browser disconnects |
GET |
/v1/agents/executions |
Orchestrated multi-agent executions with per-step failover status |
GET |
/v1/vault/export/file |
Export all provider keys as an AES-256-GCM encrypted bundle (.anx-vault.enc) |
POST |
/v1/vault/import |
Import + restore an encrypted vault bundle (AES-256-GCM, passphrase-protected) |
GET |
/v1/plugins |
Loaded gateway plugins and their status |
POST |
/v1/plugins/load · /v1/plugins/:id/unload |
Load / unload a runtime plugin without restart |
GET |
/v1/marketplace/search · /v1/marketplace/installed |
Browse and list installed marketplace extensions |
POST |
/v1/marketplace/extensions/:id/install · /:id/update · /:id/toggle |
Install / update / enable-disable an extension |
GET |
/v1/workflows · POST /v1/workflows/:id/execute |
List workflows and execute one by id |
POST |
/v1/runtime-agents/hot-swap |
Zero-downtime re-target a runtime agent/alias to a new model |
POST |
/v1/a2a/handoff · /v1/a2a/message |
Agent-to-agent task handoff and peer messaging (A2A coordinator) |
POST |
/v1/context/broadcast |
Broadcast shared architecture context to all connected agents |
POST |
/v1/context/query |
Query cross-agent shared context bus |
POST |
/v1/agents/:id/install |
Install agent CLI package in background |
POST |
/v1/agents/:id/update |
Update agent CLI package to latest upstream release |
POST |
/v1/agents/:id/rebind |
Configure agent to route through Nexus Gateway |
POST |
/v1/agents/:id/unbuckle |
Restore agent configuration to upstream standalone defaults |
POST |
/v1/agents/:id/uninstall |
Terminate process and completely uninstall agent package |
POST |
/v1/missions |
Dispatch autonomous multi-agent engineering missions (Idempotent) |
GET |
/v1/system/health |
Truthful 14-subsystem health matrix |
GET |
/v1/system/diagnostics |
Deep system diagnostics with automated root-cause analysis |
Full API reference: docs/API.md
The complete, in-depth documentation is available in docs/wiki/ and GitHub Wiki:
| Capability | Nexus v0.5.0 | LiteLLM | OmniRoute | OpenRouter |
|---|---|---|---|---|
Google Antigravity CLI (agy) Native Provider |
✅ Native Zero-Config | ❌ | ❌ | ❌ |
| Agent Buckling (Claude Code, Cursor, Codex, OpenCode) | ✅ 1-Click Install/Buckle | ❌ | ❌ | ❌ |
| Tool Schema Auto-Healing & Param Infill | ✅ Live Dynamic Infill | ❌ | ❌ | ❌ |
| Live Multi-Engine Token Compression | ✅ 6 Engines (Up to 95%) | ❌ | ❌ | |
| Model Context Protocol (MCP) Server | ✅ Full Native Server | ❌ | ❌ | |
| Speculative Hedged Streaming (<800ms TTFT) | ✅ Adaptive Abort Race | ❌ | ❌ | ❌ |
| Tokenizer Artifact Leak Shield | ✅ <unk>, <s>, <|im_end|> Clamp |
❌ | ❌ | ❌ |
| Cross-Agent Shared Context Bus | ✅ Broadcast & Query | ❌ | ❌ | ❌ |
| Encrypted Portable Vault Export/Restore | ✅ AES-256-GCM Backup | ❌ | ❌ | ❌ |
| Self-Hosted Local-First Execution | ✅ 100% On-Prem / Local | ✅ Python | ❌ Cloud Only |
ai-gateway · coding-agent · autonomous-agent · claude-code · codex · cursor · windsurf · aider · google-antigravity · antigravity-cli · gemini-3 · deepseek-v3 · deepseek-r1 · mcp · model-context-protocol · llm-router · prompt-compression · multi-agent-orchestration · token-optimization · local-inference · vllm · ollama · openrouter
- Provider API keys are encrypted at rest in
~/.agent-nexus/vault.jsonusing AES-256-GCM. - Keys are never logged, never forwarded across providers, and never returned in API responses.
- Continuous CI secret scanning via Gitleaks on every push.
- Dependencies are pinned with pnpm overrides as security floors (see
SECURITY.md):fastify >= 5.12.7(GHSA-667r-xxjv-c9mm, GHSA-p68q-wchp-6fh7, GHSA-9q9j-q6p8-xq58, GHSA-hwr6-493r-vm6h, GHSA-4mh8-r7rc-xpvc) ·undici >= 6.29.0(GHSA-rfgv-xxqx-mfg5, GHSA-3wwx-pv8p-q78v) ·ip-address >= 10.7.4(GHSA-j6r3-76f7-8jcv) ·fast-uri@3 >= 3.1.8,fast-uri@4 >= 4.2.2(GHSA-hrr3-gc8f-f4qj, GHSA-jvvf-x445-j334) ·hono >= 4.13.13(GHSA-hxh3-vqpv-xpqv) ·next >= 15.5.27(CVE-2026-94543, CVE-2026-94484) ·sharp >= 0.35.4(libheif GHSA-g89c-p67h-r497 / GHSA-2jg2-4ch7-h545) ·vitest >= 4.1.11(GHSA-82fw-gwwq-j7x9) ·js-yaml@3 >= 3.15.2,js-yaml@4 >= 4.3.2(CVE-2026-84375). Triage dev-only alerts withis:open scope:developmenton the Dependabot page.
Apache-2.0 © Nexus Contributors