#577 build(deps): upgrade vulnerable dependencies to clear ~1,680 Dependabot alerts

Summary

Clears most of the open Dependabot alerts in this repo by upgrading vulnerable dependencies across all 52 flagged lockfiles/manifests.

• Before: 1,710 open alerts (153 critical, 701 high)
• Expected to close: 1,683
• Left after merge: 27 (0 critical), all needing a major-version jump or blocked upstream (see below)

"Expected to close" was checked locally. For every open alert, I tested the version now in its lockfile against the advisory's vulnerable range. Dependabot recomputes on merge, so the real count may differ slightly.

How

• Python (uv.lock): uv lock -P "<pkg>>=<first_patched>,<cap>" per alerted package. The cap is the next major for transitive deps and the next minor for direct deps, so the bump stays as small as possible.
  • Pillow 13, filelock 4.2 and dnspython 2.9 dropped Python 3.10. requires-python moves from >=3.10 to >=3.11 in the 4 voice-agent demos, examples/cookbook/smolagents and apps/livekit-moss-vercel/.../livekit-moss-agent (READMEs updated).
  • mcp stays on 1.x (1.30.0). An unbounded upgrade pulled mcp 2.x, which breaks agora-moss imports.
  • apps/pipecat-moss/{ollama-local,hume-ollama-local}: pipecat-ai 1.5.0 → 1.14.0, the first release that allows the patched Pillow 13.
• JavaScript (npm/pnpm): direct deps bumped within their major. Next.js 16.2.6 → 16.4.1 and 15.x → 15.5.28; vite ^8.1.6; react-router-dom ^7.18.2. Transitive packages go through npm audit fix (non-force), pnpm up --depth Infinity, and overrides / pnpm.overrides / pnpm-workspace.yaml overrides where a parent pins an old version. The existing pinned postcss / fast-uri overrides move to the patched versions.
  • vitest 3 → 4 (dev-only) in packages/{mastra-moss,vercel-sdk,n8n-nodes-moss,vitepress-plugin-moss}. The critical tinypool advisories are only fixed in tinypool 2.x, which needs vitest 4. All four packages' tests still pass (see Verification). Drop that part of the second commit if you'd rather not take the major.
  • For packages/n8n-nodes-moss, npm audit fix downgraded n8n-workflow 2.x → 1.x, which broke the build. That lock was redone with targeted bumps plus a form-data override instead.

Verification

Python: uv sync --frozen on Python 3.12, plus pytest where tests exist, plus an import smoke check of each top-level module.

• Tests pass: agora-moss app (6) and package (12), smolagents (7), mongodb/sqlite/supabase/zeroentropy connectors, pipecat-moss (13), ten-moss (29).
• All voice-agent, daytona, cognee, sim, image-search and semantic-cache modules import (missing env vars aside).

JavaScript: npm ci / pnpm install --frozen-lockfile, then each project's build/test/lint/typecheck.

• Builds pass: apps/next-js (build, test, lint), apps/moss-llamaindex/frontend, apps/livekit-moss-vercel/agent-react, apps/moss-vscode (build, typecheck), examples/voice-agents/insurance-adjuster/ui, examples/javascript-web, vitepress demo-site, packages/moss-md-indexer.
• Build, typecheck and tests pass in packages/{mastra-moss,vercel-sdk,n8n-nodes-moss}; build and tests pass in packages/vitepress-plugin-moss.

Pre-existing failures, not caused by this PR (same result on main):

• moss-live-labs/examples/image-search/react-app: tsc fails on import.meta.env typing.
• apps/pipecat-moss/{ollama-local,hume-ollama-local}: imports fail because pipecat.processors.aggregators.openai_llm_context no longer exists in pipecat-ai ≥1.x, and moss is not a declared dependency.
• apps/elevenlabs-moss: pyaudio needs system portaudio to build.

Left open (27), and why

Alerts	Where	Why skipped
9	minimatch (<11.0.1) in next-js, moss-vscode, both promos, javascript examples, image-search react-app, agent-react, vitepress-plugin-moss	Only fixed in minimatch 11 (major). Parents (eslint, typescript-eslint, glob) pin 9.x/10.x.
6	opentelemetry-api (<=1.45.0) in the 6 LiveKit voice demos	Needs livekit-agents ≥1.8.7, which needs openai 3.x (major). One alert per lockfile, not worth the jump.
3	vite 5.4.21 in packages/vitepress-plugin-moss	Comes from vitepress 1.x. Only fixed in vite 6+ (major). Goes away with the vitepress 2 migration.
2	zod 3.x in examples/cookbook/{mastra,vercel-ai-sdk}	Only fixed in zod 4 (major).
1	@ai-sdk/provider-utils 2.2.8 in examples/cookbook/mastra	2.x has no patch. Pinned by mastra.
1	uuid 10 in packages/n8n-nodes-moss	Only fixed in uuid 11 (major). Pinned by n8n-workflow.
1	dnspython in packages/moss-data-connector/moss-connector-mongodb	2.9 needs Python ≥3.11. This shipped package still supports 3.10.

Per-lockfile breakdown

Lockfile / manifest	Open before	Expected to close	Left
packages/agora-moss/uv.lock	25	25	0
packages/mastra-moss/package-lock.json	50	50	0
packages/moss-data-connector/moss-connector-mongodb/uv.lock	9	8	1
packages/moss-data-connector/moss-connector-sqlite/uv.lock	3	3	0
packages/moss-data-connector/moss-connector-supabase/uv.lock	28	28	0
packages/moss-data-connector/moss-connector-zeroentropy/uv.lock	1	1	0
packages/moss-md-indexer/example/pnpm-lock.yaml	33	33	0
packages/moss-md-indexer/package-lock.json	46	46	0
packages/moss-md-indexer/pnpm-lock.yaml	28	28	0
packages/n8n-nodes-moss/package-lock.json	14	13	1
packages/pipecat-moss/uv.lock	49	49	0
packages/ten-moss/uv.lock	1	1	0
packages/vercel-sdk/package-lock.json	13	13	0
packages/vitepress-plugin-moss/demo-site/documentation/package-lock.json	8	8	0
packages/vitepress-plugin-moss/demo-site/documentation/pnpm-lock.yaml	8	8	0
packages/vitepress-plugin-moss/demo-site/pnpm-lock.yaml	9	9	0
packages/vitepress-plugin-moss/package.json	1	1	0
packages/vitepress-plugin-moss/pnpm-lock.yaml	58	49	9
apps/agora-moss/uv.lock	25	25	0
apps/elevenlabs-moss/uv.lock	6	6	0
apps/livekit-moss-vercel/agent-react/package.json	20	20	0
apps/livekit-moss-vercel/agent-react/pnpm-lock.yaml	40	39	1
apps/livekit-moss-vercel/livekit-voice-agent/livekit-moss-agent/uv.lock	90	90	0
apps/moss-llamaindex/frontend/package-lock.json	28	28	0
apps/moss-vscode/package-lock.json	36	35	1
apps/moss-vscode/promo/package-lock.json	25	24	1
apps/next-js/package-lock.json	62	61	1
apps/pipecat-moss/hume-ollama-local/uv.lock	84	84	0
apps/pipecat-moss/ollama-local/uv.lock	84	84	0
apps/vapi-moss/uv.lock	7	7	0
examples/cookbook/daytona/uv.lock	22	22	0
examples/cookbook/mastra/package-lock.json	54	52	2
examples/cookbook/moss-cognee-daytona/uv.lock	31	31	0
examples/cookbook/sim/uv.lock	7	7	0
examples/cookbook/smolagents/uv.lock	56	56	0
examples/cookbook/vercel-ai-sdk/package.json	1	0	1
examples/javascript-web/package-lock.json	10	10	0
examples/javascript/package-lock.json	5	4	1
examples/moss-pikachu/promo/package-lock.json	27	26	1
examples/voice-agents/airline-pnr/uv.lock	93	92	1
examples/voice-agents/candidate-screening/uv.lock	96	95	1
examples/voice-agents/insurance-adjuster/ui/package-lock.json	31	31	0
examples/voice-agents/insurance-adjuster/uv.lock	84	83	1
examples/voice-agents/mortgage-lending/uv.lock	84	83	1
moss-live-labs/examples/advanced-voice-agent/uv.lock	91	90	1
moss-live-labs/examples/image-search/backend-py/uv.lock	3	3	0
moss-live-labs/examples/image-search/react-app/package-lock.json	20	19	1
moss-live-labs/examples/image-search/setup-py/uv.lock	3	3	0
moss-live-labs/examples/semantic-cache/uv.lock	4	4	0
moss-live-labs/examples/voice-agent/uv.lock	84	83	1
moss-live-labs/python/uv.lock	3	3	0
package-lock.json	10	10	0
Total	1710	1683	27

Summary by CodeRabbit

• Chores
  • Updated framework, tooling, and supporting package versions across the app and examples.
  • Python-based voice agent and cookbook examples now require Python 3.11 or newer; Python 3.10 is no longer supported.
• Documentation
  • Updated setup prerequisites to reflect the Python 3.11 minimum.