diff --git a/ui/components/resources/table/resource-detail-content.test.ts b/ui/components/resources/table/resource-detail-content.test.ts index 7d63cdec10..1543ddf1c7 100644 --- a/ui/components/resources/table/resource-detail-content.test.ts +++ b/ui/components/resources/table/resource-detail-content.test.ts @@ -30,7 +30,7 @@ describe("resource detail content", () => { it("renders the external resource link below the resource title row", () => { expect(source).toContain(` { diff --git a/ui/package.json b/ui/package.json index 57c3d5345e..f56ae2c690 100644 --- a/ui/package.json +++ b/ui/package.json @@ -168,10 +168,13 @@ "@hono/node-server": "1.19.14", "@internationalized/date": "3.10.0", "@isaacs/brace-expansion": "5.0.1", + "@langchain/langgraph-checkpoint>uuid": "11.1.1", + "@langchain/langgraph>uuid": "11.1.1", "@react-aria/interactions>react": "19.2.6", "@react-aria/ssr>react": "19.2.6", "@react-aria/ssr>react-dom": "19.2.6", "@react-aria/visually-hidden>react": "19.2.6", + "@sentry/webpack-plugin>uuid": "11.1.1", "fast-xml-parser": "5.8.0", "hono": "4.12.18", "lodash": "4.18.1", diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml index a673d6e428..34b5c6cc10 100644 --- a/ui/pnpm-lock.yaml +++ b/ui/pnpm-lock.yaml @@ -20,6 +20,9 @@ overrides: minimatch@>=10: 10.2.3 minimatch@<4: 3.1.4 qs: 6.14.2 + '@langchain/langgraph-checkpoint>uuid': 11.1.1 + '@langchain/langgraph>uuid': 11.1.1 + '@sentry/webpack-plugin>uuid': 11.1.1 rollup@>=4: 4.59.0 serialize-javascript: 7.0.5 @@ -4188,6 +4191,7 @@ packages: '@smithy/core@3.24.1': resolution: {integrity: sha512-3mT7o4qQyUWttYnVK3A0Z/u3Xha3E81tXn32Tz6vjZiUXhBrkEivpw1hBYfh84iFF9CSzkBU9Y1DJ3Q6RQ231g==} engines: {node: '>=18.0.0'} + deprecated: Deprecated due to bug in browser bundling instructions https://github.com/smithy-lang/smithy-typescript/issues/2025 '@smithy/credential-provider-imds@4.3.1': resolution: {integrity: sha512-0S/acwHnqX4WrjXzhdiDRxsG2s9SC0cpPIK9nZ1R6UOHd+j7uL28+4bHu22urbLk2TVw3fkp6na/+fkUt/pLNQ==} @@ -4788,6 +4792,7 @@ packages: '@ungap/structured-clone@1.3.0': resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==} + deprecated: Potential CWE-502 - Update to 1.3.1 or higher '@upsetjs/venn.js@2.0.0': resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==} @@ -6053,6 +6058,7 @@ packages: glob@10.5.0: resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true globals@14.0.0: @@ -8273,19 +8279,14 @@ packages: util-deprecate@1.0.2: resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==} - uuid@10.0.0: - resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} hasBin: true uuid@13.0.2: resolution: {integrity: sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==} hasBin: true - uuid@9.0.1: - resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==} - hasBin: true - vary@1.1.2: resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==} engines: {node: '>= 0.8'} @@ -10958,7 +10959,7 @@ snapshots: '@langchain/langgraph-checkpoint@1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))': dependencies: '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1) - uuid: 10.0.0 + uuid: 11.1.1 '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)': dependencies: @@ -10985,7 +10986,7 @@ snapshots: '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1) '@langchain/protocol': 0.0.15 '@standard-schema/spec': 1.1.0 - uuid: 10.0.0 + uuid: 11.1.1 zod: 4.4.3 optionalDependencies: zod-to-json-schema: 3.25.1(zod@4.4.3) @@ -13516,7 +13517,7 @@ snapshots: dependencies: '@sentry/bundler-plugin-core': 4.7.0 unplugin: 1.0.1 - uuid: 9.0.1 + uuid: 11.1.1 webpack: 5.104.1(lightningcss@1.30.2)(postcss@8.5.14) transitivePeerDependencies: - encoding @@ -16704,7 +16705,7 @@ snapshots: roughjs: 4.6.6 stylis: 4.3.6 ts-dedent: 2.2.0 - uuid: 13.0.2 + uuid: 11.1.1 micromark-core-commonmark@2.0.3: dependencies: @@ -18454,12 +18455,10 @@ snapshots: util-deprecate@1.0.2: {} - uuid@10.0.0: {} + uuid@11.1.1: {} uuid@13.0.2: {} - uuid@9.0.1: {} - vary@1.1.2: {} vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6): diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml index 26ebd51565..5e6df9449c 100644 --- a/ui/pnpm-workspace.yaml +++ b/ui/pnpm-workspace.yaml @@ -33,7 +33,14 @@ allowBuilds: # --- Level 3: Trust Policy + Exotic Subdeps --- # Fail when a package's trust evidence is downgraded (e.g., new publisher). trustPolicy: no-downgrade -trustPolicyExclude: [] +trustPolicyExclude: + # next-auth: real beta releases currently do not publish provenance, while an + # earlier one-off manual test release did. Keep this scoped to the exact + # reviewed version so a bump fails until re-reviewed. + - "next-auth@5.0.0-beta.30" + # semver: legacy 6.x releases predate modern npm provenance. Keep this scoped + # to the exact transitive version so a bump fails until re-reviewed. + - "semver@6.3.1" # Block transitive dependencies from using exotic specifiers (git URLs, tarballs). blockExoticSubdeps: true