fix(ui): patch npm advisories from renovate security PRs

feat(ui): let Lighthouse Bedrock settings use a Bedrock API key (#13245 )
2026-11-04 10:24:50 +00:00 · 2026-11-03 14:12:42 +01:00 · 2026-11-03 11:43:39 +01:00
14 changed files with 623 additions and 273 deletions
@@ -1,4 +1,4 @@
-FROM python:3.15.1-slim-trixie@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build
+FROM python:3.12.16-slim-trixie@sha256:8523d6abeb48ceae0b7240d30c5808fc26cb79c1a635bacdf19cf3baecfbec07 AS build

 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
@@ -1,4 +1,4 @@
-FROM python:3.15.1-slim-trixie@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build
+FROM python:3.12.16-slim-trixie@sha256:8523d6abeb48ceae0b7240d30c5808fc26cb79c1a635bacdf19cf3baecfbec07 AS build

 LABEL maintainer="https://github.com/prowler-cloud/api"

@@ -25,7 +25,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # =============================================================================
 # Final stage - Minimal runtime environment
 # =============================================================================
-FROM python:3.15.1-alpine3.23@sha256:cb295b554dbbea09b2c0e6e6d9ce55f051347c902fbb611e618c071addfb30a3
+FROM python:3.13.16-alpine3.23@sha256:07b20c774a247152e74f622034c1482495d299e070eec620ddff13e01264290b

 LABEL maintainer="https://github.com/prowler-cloud"

@@ -3,7 +3,7 @@
 import { zodResolver } from "@hookform/resolvers/zod";
 import { KeyRound, Loader2, PlugZap, Save, Trash2 } from "lucide-react";
 import { useState } from "react";
-import { useForm } from "react-hook-form";
+import { useForm, useWatch } from "react-hook-form";

 import {
  createLighthouseV2Configuration,
@@ -12,6 +12,7 @@ import {
  updateLighthouseV2Configuration,
 } from "@/app/(prowler)/lighthouse/_actions";
 import {
+  BEDROCK_AUTH_METHOD,
  buildCredentialPayload,
  buildLighthouseV2ConfigFormSchema,
  buildLighthouseV2ConfigurationInput,
@@ -74,6 +75,14 @@ export function LighthouseV2ConfigurationForm({
    mode: "onSubmit",
  });
  const status = getConnectionStatus(configuration);
+  const bedrockAuthMethod = useWatch({
+    control: form.control,
+    name: "bedrockAuthMethod",
+  });
+  // An API key has no instance-role fallback, so the hint only fits access keys.
+  const usesInstanceRoleHint =
+    provider.credentialsOptional &&
+    bedrockAuthMethod !== BEDROCK_AUTH_METHOD.API_KEY;

  const runConnectionTest = async (configurationId: string) => {
    setTesting(true);
@@ -143,7 +152,12 @@ export function LighthouseV2ConfigurationForm({
        return;
      }

-      form.reset(getFormDefaults(result.data));
+      // Keep the chosen Bedrock auth method only when its credentials were
+      // saved; a blank save keeps the stored ones, whatever method they use.
+      form.reset({
+        ...getFormDefaults(result.data),
+        ...(credentials ? { bedrockAuthMethod: values.bedrockAuthMethod } : {}),
+      });
      onConfigurationSaved(result.data);
      notifyLighthouseV2ConfigurationsChanged();
      if (shouldTestAfterSave) {
@@ -260,14 +274,17 @@ export function LighthouseV2ConfigurationForm({
                icon={<KeyRound className="size-4" />}
                title="Credentials"
                description={
-                  provider.credentialsOptional
-                    ? "Leave the keys blank to use this installation's own AWS role; only the region is needed."
+                  usesInstanceRoleHint
+                    ? configuration
+                      ? "Leave blank to keep existing credentials, or enter only the region to use this installation's own AWS role."
+                      : "Leave the keys blank to use this installation's own AWS role; only the region is needed."
                    : configuration
                      ? "Leave blank to keep existing credentials."
                      : "Credentials are required for new configurations."
                }
              >
                <CredentialFields
+                  control={form.control}
                  credentialsOptional={provider.credentialsOptional}
                  errors={form.formState.errors}
                  hasStoredCredentials={hasConfiguration}
@@ -1,24 +1,33 @@
-import { type useForm } from "react-hook-form";
+import { Controller, type useForm, useWatch } from "react-hook-form";

-import { type LighthouseV2ConfigFormValues } from "@/app/(prowler)/lighthouse/_lib/config";
+import {
+  BEDROCK_AUTH_METHOD,
+  type LighthouseV2ConfigFormValues,
+} from "@/app/(prowler)/lighthouse/_lib/config";
 import {
  LIGHTHOUSE_V2_PROVIDER_TYPE,
  type LighthouseV2ProviderType,
 } from "@/app/(prowler)/lighthouse/_types";
 import { Field, FieldError, FieldLabel } from "@/components/shadcn/field/field";
 import { Input } from "@/components/shadcn/input/input";
+import {
+  RadioGroup,
+  RadioGroupItem,
+} from "@/components/shadcn/radio-group/radio-group";

 // Stored secrets are never sent back by the API, so the fields would look
 // empty even when a key exists; the masked placeholder stands in for it.
 const STORED_SECRET_PLACEHOLDER = "•".repeat(36);

 export function CredentialFields({
+  control,
  credentialsOptional = false,
  errors,
  hasStoredCredentials = false,
  provider,
  register,
 }: {
+  control: ReturnType<typeof useForm<LighthouseV2ConfigFormValues>>["control"];
  // Keys may be left blank (Bedrock with the installation's own role).
  credentialsOptional?: boolean;
  errors: ReturnType<
@@ -30,17 +39,50 @@ export function CredentialFields({
    typeof useForm<LighthouseV2ConfigFormValues>
  >["register"];
 }) {
-  // With optional keys a saved configuration may have none, so the masked
-  // placeholder would suggest a key that is not there.
+  const isBedrock = provider === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK;
+  // The masked placeholder would suggest a key that may not be there: with
+  // optional keys a saved configuration may have none, and for Bedrock the
+  // API does not say whether access keys or an API key are stored.
  const secretPlaceholder =
-    hasStoredCredentials && !credentialsOptional
+    hasStoredCredentials && !credentialsOptional && !isBedrock
      ? STORED_SECRET_PLACEHOLDER
      : undefined;
  const keyLabelSuffix = credentialsOptional ? " (optional)" : "";
+  const bedrockAuthMethod = useWatch({ control, name: "bedrockAuthMethod" });
+  const usesBedrockApiKey =
+    isBedrock && bedrockAuthMethod === BEDROCK_AUTH_METHOD.API_KEY;
  return (
    <div className="grid gap-4">
+      {isBedrock && (
+        <Field>
+          <FieldLabel>Authentication method</FieldLabel>
+          <Controller
+            control={control}
+            name="bedrockAuthMethod"
+            render={({ field }) => (
+              <RadioGroup
+                value={field.value}
+                onValueChange={field.onChange}
+                orientation="horizontal"
+                aria-label="Authentication method"
+              >
+                <label className="flex items-center gap-2 text-sm">
+                  <RadioGroupItem value={BEDROCK_AUTH_METHOD.ACCESS_KEYS} />
+                  AWS access keys
+                </label>
+                <label className="flex items-center gap-2 text-sm">
+                  <RadioGroupItem value={BEDROCK_AUTH_METHOD.API_KEY} />
+                  Bedrock API key
+                </label>
+              </RadioGroup>
+            )}
+          />
+        </Field>
+      )}
+
      {(provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI ||
-        provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE) && (
+        provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE ||
+        usesBedrockApiKey) && (
        <Field>
          <FieldLabel htmlFor="lighthouse-v2-api-key">API key</FieldLabel>
          <Input
@@ -72,41 +114,45 @@ export function CredentialFields({
        </Field>
      )}

-      {provider === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK && (
+      {isBedrock && (
        <div className="grid gap-4 md:grid-cols-2">
-          <Field>
-            <FieldLabel htmlFor="lighthouse-v2-access-key">
-              AWS access key ID{keyLabelSuffix}
-            </FieldLabel>
-            <Input
-              id="lighthouse-v2-access-key"
-              type="password"
-              autoComplete="off"
-              placeholder={secretPlaceholder}
-              aria-invalid={Boolean(errors.awsAccessKeyId)}
-              {...register("awsAccessKeyId")}
-            />
-            {errors.awsAccessKeyId?.message && (
-              <FieldError>{errors.awsAccessKeyId.message}</FieldError>
-            )}
-          </Field>
+          {!usesBedrockApiKey && (
+            <>
+              <Field>
+                <FieldLabel htmlFor="lighthouse-v2-access-key">
+                  AWS access key ID{keyLabelSuffix}
+                </FieldLabel>
+                <Input
+                  id="lighthouse-v2-access-key"
+                  type="password"
+                  autoComplete="off"
+                  placeholder={secretPlaceholder}
+                  aria-invalid={Boolean(errors.awsAccessKeyId)}
+                  {...register("awsAccessKeyId")}
+                />
+                {errors.awsAccessKeyId?.message && (
+                  <FieldError>{errors.awsAccessKeyId.message}</FieldError>
+                )}
+              </Field>

-          <Field>
-            <FieldLabel htmlFor="lighthouse-v2-secret-key">
-              AWS secret access key{keyLabelSuffix}
-            </FieldLabel>
-            <Input
-              id="lighthouse-v2-secret-key"
-              type="password"
-              autoComplete="off"
-              placeholder={secretPlaceholder}
-              aria-invalid={Boolean(errors.awsSecretAccessKey)}
-              {...register("awsSecretAccessKey")}
-            />
-            {errors.awsSecretAccessKey?.message && (
-              <FieldError>{errors.awsSecretAccessKey.message}</FieldError>
-            )}
-          </Field>
+              <Field>
+                <FieldLabel htmlFor="lighthouse-v2-secret-key">
+                  AWS secret access key{keyLabelSuffix}
+                </FieldLabel>
+                <Input
+                  id="lighthouse-v2-secret-key"
+                  type="password"
+                  autoComplete="off"
+                  placeholder={secretPlaceholder}
+                  aria-invalid={Boolean(errors.awsSecretAccessKey)}
+                  {...register("awsSecretAccessKey")}
+                />
+                {errors.awsSecretAccessKey?.message && (
+                  <FieldError>{errors.awsSecretAccessKey.message}</FieldError>
+                )}
+              </Field>
+            </>
+          )}

          <Field className="md:col-span-2">
            <FieldLabel htmlFor="lighthouse-v2-region">AWS region</FieldLabel>
@@ -284,14 +284,14 @@ describe("LighthouseV2ConfigPage", () => {
      maskedKey,
    );

+    // But not for Bedrock: the API does not say whether access keys or an
+    // API key are stored, so masking either set could claim the wrong one
    await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
-    expect(screen.getByLabelText("AWS access key ID")).toHaveAttribute(
+    expect(screen.getByLabelText("AWS access key ID")).not.toHaveAttribute(
      "placeholder",
-      maskedKey,
    );
-    expect(screen.getByLabelText("AWS secret access key")).toHaveAttribute(
+    expect(screen.getByLabelText("AWS secret access key")).not.toHaveAttribute(
      "placeholder",
-      maskedKey,
    );
  });

@@ -330,6 +330,44 @@ describe("LighthouseV2ConfigPage", () => {
    expect(createConfigurationMock).not.toHaveBeenCalled();
  });

+  it("does not hint at a stored Bedrock API key it cannot know about", async () => {
+    // Given: Bedrock has a stored configuration of unknown credential type
+    const user = userEvent.setup();
+    renderPage();
+    await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
+
+    // When
+    await user.click(screen.getByRole("radio", { name: "Bedrock API key" }));
+
+    // Then
+    expect(screen.getByLabelText("API key")).not.toHaveAttribute("placeholder");
+  });
+
+  it("falls back to access keys after saving Bedrock without new credentials", async () => {
+    // Given
+    const user = userEvent.setup();
+    updateConfigurationMock.mockResolvedValue({ data: configurations[1] });
+    renderPage();
+    await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
+    await user.click(screen.getByRole("radio", { name: "Bedrock API key" }));
+
+    // When: saved with blank fields, so the stored credentials stay
+    await user.click(
+      within(
+        screen.getByRole("region", { name: "Lighthouse AI settings" }),
+      ).getByRole("button", { name: /^Save$/i }),
+    );
+
+    // Then: the form no longer claims an API key that was never saved
+    await waitFor(() => expect(updateConfigurationMock).toHaveBeenCalled());
+    expect(updateConfigurationMock.mock.calls[0]?.[1]).not.toHaveProperty(
+      "credentials",
+    );
+    expect(
+      await screen.findByRole("radio", { name: "AWS access keys" }),
+    ).toBeChecked();
+  });
+
  it("shows Bedrock access key, secret key, and region fields", async () => {
    // Given
    const user = userEvent.setup();
@@ -344,6 +382,42 @@ describe("LighthouseV2ConfigPage", () => {
    expect(screen.getByLabelText("AWS region")).toBeInTheDocument();
  });

+  it("saves Bedrock with an API key instead of access keys", async () => {
+    // Given
+    const user = userEvent.setup();
+    updateConfigurationMock.mockResolvedValue({ data: configurations[1] });
+    testConnectionMock.mockResolvedValue({ data: configurations[1] });
+    renderPage();
+    await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
+
+    // When: the API key method is chosen
+    await user.click(screen.getByRole("radio", { name: "Bedrock API key" }));
+
+    // Then: the access key fields give way to the API key field
+    expect(
+      screen.queryByLabelText("AWS access key ID"),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByLabelText("AWS secret access key"),
+    ).not.toBeInTheDocument();
+
+    // When
+    await user.type(screen.getByLabelText("API key"), "ABSKlongterm");
+    await user.type(screen.getByLabelText("AWS region"), "us-east-1");
+    await user.click(
+      within(
+        screen.getByRole("region", { name: "Lighthouse AI settings" }),
+      ).getByRole("button", { name: /^Save$/i }),
+    );
+
+    // Then
+    await waitFor(() => expect(updateConfigurationMock).toHaveBeenCalled());
+    expect(updateConfigurationMock.mock.calls[0]?.[1].credentials).toEqual({
+      api_key: "ABSKlongterm",
+      aws_region_name: "us-east-1",
+    });
+  });
+
  it("changes a Bedrock region without keys when the installation role is allowed", async () => {
    // Given: the API reports Bedrock needs no credentials (Private Cloud)
    const user = userEvent.setup();
@@ -358,6 +432,13 @@ describe("LighthouseV2ConfigPage", () => {
    });
    await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));

+    // Then: blank fields keep the stored credentials, so the hint says so
+    expect(
+      screen.getByText(
+        "Leave blank to keep existing credentials, or enter only the region to use this installation's own AWS role.",
+      ),
+    ).toBeInTheDocument();
+
    // When: only the region is entered
    expect(
      screen.getByLabelText("AWS access key ID (optional)"),
@@ -3,6 +3,7 @@ import { describe, expect, it } from "vitest";
 import { LIGHTHOUSE_V2_PROVIDER_TYPE } from "@/app/(prowler)/lighthouse/_types";

 import {
+  BEDROCK_AUTH_METHOD,
  buildCredentialPayload,
  buildLighthouseV2ConfigFormSchema,
  EMPTY_FORM_VALUES,
@@ -136,4 +137,101 @@ describe("Bedrock configuration form", () => {
      ).toBeUndefined();
    });
  });
+
+  describe("when authenticating with a Bedrock API key", () => {
+    const apiKeyValues = (overrides: Partial<LighthouseV2ConfigFormValues>) =>
+      values({ bedrockAuthMethod: BEDROCK_AUTH_METHOD.API_KEY, ...overrides });
+
+    it("should require the API key and the region for a new configuration", () => {
+      // Given / When / Then
+      expect(errorPaths(false, apiKeyValues({}))).toEqual([
+        "apiKey",
+        "awsRegionName",
+      ]);
+    });
+
+    it("should still require the API key where the installation role is allowed", () => {
+      // Given / When / Then
+      expect(
+        errorPaths(
+          false,
+          apiKeyValues({ awsRegionName: "us-east-1" }),
+          OPTIONAL,
+        ),
+      ).toEqual(["apiKey"]);
+    });
+
+    it("should require the region to rotate the key on an existing configuration", () => {
+      // Given / When / Then
+      expect(
+        errorPaths(true, apiKeyValues({ apiKey: "ABSKlongterm" })),
+      ).toEqual(["awsRegionName"]);
+    });
+
+    it.each(["ABSKlongterm", "bedrock-api-key-shortterm"])(
+      "should accept the %s key format",
+      (apiKey) => {
+        // Given / When / Then
+        expect(
+          errorPaths(
+            false,
+            apiKeyValues({ apiKey, awsRegionName: "us-east-1" }),
+          ),
+        ).toEqual([]);
+      },
+    );
+
+    it("should reject a key that is not a Bedrock API key", () => {
+      // Given / When / Then
+      expect(
+        errorPaths(
+          false,
+          apiKeyValues({ apiKey: "sk-proj-123", awsRegionName: "us-east-1" }),
+        ),
+      ).toEqual(["apiKey"]);
+    });
+
+    it("should send the key and region, without leftover access keys", () => {
+      // Given: access keys typed before switching to the API key method
+      const formValues = apiKeyValues({
+        apiKey: " ABSKlongterm ",
+        awsAccessKeyId: "AKIA",
+        awsSecretAccessKey: "secret",
+        awsRegionName: "us-east-1",
+      });
+
+      // When / Then
+      expect(buildCredentialPayload(BEDROCK, formValues, false)).toEqual({
+        api_key: "ABSKlongterm",
+        aws_region_name: "us-east-1",
+      });
+    });
+
+    it("should keep the stored configuration when nothing is entered", () => {
+      // Given / When / Then
+      expect(errorPaths(true, apiKeyValues({}))).toEqual([]);
+      expect(
+        buildCredentialPayload(BEDROCK, apiKeyValues({}), true),
+      ).toBeUndefined();
+    });
+  });
+
+  describe("when authenticating with access keys", () => {
+    it("should ignore an API key left over from the other method", () => {
+      // Given
+      const formValues = values({
+        apiKey: "ABSKlongterm",
+        awsAccessKeyId: "AKIA",
+        awsSecretAccessKey: "secret",
+        awsRegionName: "us-east-1",
+      });
+
+      // When / Then
+      expect(buildCredentialPayload(BEDROCK, formValues, false)).toEqual({
+        aws_access_key_id: "AKIA",
+        aws_secret_access_key: "secret",
+        aws_region_name: "us-east-1",
+      });
+    });
+  });
 });
@@ -37,8 +37,20 @@ export interface FeedbackState {
  variant: FeedbackVariant;
 }

+export const BEDROCK_AUTH_METHOD = {
+  ACCESS_KEYS: "access_keys",
+  API_KEY: "api_key",
+} as const;
+
+export type BedrockAuthMethod =
+  (typeof BEDROCK_AUTH_METHOD)[keyof typeof BEDROCK_AUTH_METHOD];
+
+// Long-term keys start with "ABSK", short-term ones with "bedrock-api-key-".
+const BEDROCK_API_KEY_PATTERN = /^(ABSK|bedrock-api-key-)\S+$/;
+
 const lighthouseV2ConfigFormSchemaBase = z.object({
  apiKey: z.string(),
+  bedrockAuthMethod: z.enum(BEDROCK_AUTH_METHOD),
  awsAccessKeyId: z.string(),
  awsSecretAccessKey: z.string(),
  awsRegionName: z.string(),
@@ -51,6 +63,7 @@ export type LighthouseV2ConfigFormValues = z.infer<

 export const EMPTY_FORM_VALUES: LighthouseV2ConfigFormValues = {
  apiKey: "",
+  bedrockAuthMethod: BEDROCK_AUTH_METHOD.ACCESS_KEYS,
  awsAccessKeyId: "",
  awsSecretAccessKey: "",
  awsRegionName: "",
@@ -117,6 +130,34 @@ export function buildLighthouseV2ConfigFormSchema(

    if (provider !== LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK) return;

+    if (data.bedrockAuthMethod === BEDROCK_AUTH_METHOD.API_KEY) {
+      const regionName = data.awsRegionName.trim();
+      if (hasConfiguration && !apiKey && !regionName) return;
+
+      if (!apiKey) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "Bedrock API key is required.",
+          path: ["apiKey"],
+        });
+      } else if (!BEDROCK_API_KEY_PATTERN.test(apiKey)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message:
+            "Bedrock API keys start with 'ABSK' (long-term) or 'bedrock-api-key-' (short-term).",
+          path: ["apiKey"],
+        });
+      }
+      if (!regionName) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "AWS region is required.",
+          path: ["awsRegionName"],
+        });
+      }
+      return;
+    }
+
    if (credentialsOptional) {
      // The installation's own role: a region alone is enough, and keys,
      // when given, still have to come as a pair.
@@ -190,6 +231,14 @@ export function buildCredentialPayload(
  { credentialsOptional = false }: LighthouseV2ProviderCapabilities = {},
 ): LighthouseV2Credentials | undefined {
  if (provider === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK) {
+    if (values.bedrockAuthMethod === BEDROCK_AUTH_METHOD.API_KEY) {
+      const apiKey = values.apiKey.trim();
+      const regionName = values.awsRegionName.trim();
+      if (hasConfiguration && !apiKey && !regionName) return undefined;
+
+      return { api_key: apiKey, aws_region_name: regionName };
+    }
+
    const hasBedrockCredentials =
      Boolean(values.awsAccessKeyId.trim()) ||
      Boolean(values.awsSecretAccessKey.trim()) ||
@@ -0,0 +1 @@
+`zod` to 4.6.6, `js-yaml` to 4.3.2 and `vitest` to 4.1.11, plus transitive `hono`, `vite`, `brace-expansion`, `fast-uri`, `ip-address`, `body-parser` and `baseline-browser-mapping` to patched versions, resolving 32 npm audit advisories (9 high, 20 moderate, 3 low)
@@ -11,7 +11,11 @@ function RadioGroup({
  return (
    <RadioGroupPrimitive.Root
      data-slot="radio-group"
-      className={cn("flex flex-col gap-4", className)}
+      // Radix sets aria-orientation only when `orientation` is passed.
+      className={cn(
+        "flex flex-col gap-4 aria-[orientation=horizontal]:flex-row aria-[orientation=horizontal]:flex-wrap",
+        className,
+      )}
      {...props}
    />
  );
@@ -434,10 +434,10 @@
  {
    "section": "dependencies",
    "name": "js-yaml",
-    "from": "4.3.0",
-    "to": "4.3.1",
+    "from": "4.3.1",
+    "to": "4.3.2",
    "strategy": "installed",
-    "generatedAt": "2026-09-08T07:45:48.316Z"
+    "generatedAt": "2026-11-03T13:08:27.774Z"
  },
  {
    "section": "dependencies",
@@ -642,10 +642,10 @@
  {
    "section": "dependencies",
    "name": "zod",
-    "from": "4.1.11",
-    "to": "4.4.3",
+    "from": "4.4.3",
+    "to": "4.6.6",
    "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-11-03T13:08:27.774Z"
  },
  {
    "section": "dependencies",
@@ -762,26 +762,26 @@
  {
    "section": "devDependencies",
    "name": "@vitest/browser",
-    "from": "4.1.8",
-    "to": "4.1.10",
+    "from": "4.1.10",
+    "to": "4.1.11",
    "strategy": "installed",
-    "generatedAt": "2026-07-24T08:32:45.227Z"
+    "generatedAt": "2026-11-03T13:08:27.774Z"
  },
  {
    "section": "devDependencies",
    "name": "@vitest/browser-playwright",
-    "from": "4.1.8",
-    "to": "4.1.10",
+    "from": "4.1.10",
+    "to": "4.1.11",
    "strategy": "installed",
-    "generatedAt": "2026-07-24T08:32:45.227Z"
+    "generatedAt": "2026-11-03T13:08:27.774Z"
  },
  {
    "section": "devDependencies",
    "name": "@vitest/coverage-v8",
-    "from": "4.1.8",
-    "to": "4.1.10",
+    "from": "4.1.10",
+    "to": "4.1.11",
    "strategy": "installed",
-    "generatedAt": "2026-07-24T08:32:45.227Z"
+    "generatedAt": "2026-11-03T13:08:27.774Z"
  },
  {
    "section": "devDependencies",
@@ -970,10 +970,10 @@
  {
    "section": "devDependencies",
    "name": "vitest",
-    "from": "4.1.8",
-    "to": "4.1.10",
+    "from": "4.1.10",
+    "to": "4.1.11",
    "strategy": "installed",
-    "generatedAt": "2026-07-24T08:32:45.227Z"
+    "generatedAt": "2026-11-03T13:08:27.774Z"
  },
  {
    "section": "devDependencies",
@@ -89,7 +89,7 @@
    "date-fns": "4.1.0",
    "framer-motion": "11.18.2",
    "import-in-the-middle": "3.3.1",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
    "jwt-decode": "4.0.0",
    "langchain": "1.4.0",
    "lucide-react": "0.543.0",
@@ -115,7 +115,7 @@
    "topojson-client": "3.1.0",
    "use-stick-to-bottom": "1.1.1",
    "world-atlas": "2.0.2",
-    "zod": "4.4.3",
+    "zod": "4.6.6",
    "zustand": "5.0.8"
  },
  "devDependencies": {
@@ -132,9 +132,9 @@
    "@types/topojson-client": "3.1.5",
    "@types/topojson-specification": "1.0.5",
    "@vitejs/plugin-react": "5.1.2",
-    "@vitest/browser": "4.1.10",
-    "@vitest/browser-playwright": "4.1.10",
-    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/browser": "4.1.11",
+    "@vitest/browser-playwright": "4.1.11",
+    "@vitest/coverage-v8": "4.1.11",
    "babel-plugin-react-compiler": "1.0.0",
    "dotenv": "16.6.1",
    "dotenv-expand": "12.0.3",
@@ -158,7 +158,7 @@
    "tailwindcss": "4.1.18",
    "typescript": "5.5.4",
    "typescript-eslint": "8.59.3",
-    "vitest": "4.1.10",
+    "vitest": "4.1.11",
    "vitest-browser-react": "2.0.4"
  },
  "packageManager": "pnpm@11.1.3+sha512.c85357fe17ca12dd23dd7071822666dfd7e3cb76fe214e3370b5ea2fb34f2a231185509b63e717f3cd0acb38dd3f8d82bcd5e8172400ae678b70ea4fbed0896d",
@@ -14,7 +14,7 @@ overrides:
  lodash: 4.18.1
  sharp: 0.35.5
  lodash-es: 4.18.1
-  hono: 4.12.34
+  hono: 4.13.11
  '@hono/node-server': 1.19.17
  '@isaacs/brace-expansion': 5.0.1
  fast-xml-parser: 5.8.0
@@ -22,13 +22,13 @@ overrides:
  postcss: 8.5.23
  esbuild: 0.28.1
  rollup@>=4: 4.59.0
-  vite@>=7 <8: 7.3.5
+  vite@>=7 <8: 7.3.7
  ws@>=8 <9: 8.21.0
  es-module-lexer: 2.3.0
  '@babel/core': 7.29.7
  browserslist: 4.28.7
  caniuse-lite: 1.0.30001792
-  baseline-browser-mapping: 2.10.29
+  baseline-browser-mapping: 2.11.0
  minimatch@<4: 3.1.4
  minimatch@>=9 <10: 9.0.7
  minimatch@>=10: 10.2.3
@@ -38,15 +38,15 @@ overrides:
  express-rate-limit: 8.5.1
  uuid: 11.1.1
  dompurify: 3.4.17
-  brace-expansion@<2: 1.1.18
-  brace-expansion@>=5: 5.0.9
-  fast-uri: 3.1.6
-  ip-address: 10.3.1
+  brace-expansion@<2: 1.1.21
+  brace-expansion@>=5: 5.0.12
+  fast-uri: 3.1.9
+  ip-address: 10.7.4
  mermaid: 11.16.1
-  body-parser: 2.3.0
+  body-parser: 2.4.0
  proxy-addr: 2.0.8
  '@humanfs/node': 0.16.8
-  js-yaml: 4.3.1
+  js-yaml: 4.3.2

 importers:

@@ -54,7 +54,7 @@ importers:
    dependencies:
      '@ai-sdk/react':
        specifier: 3.0.205
-        version: 3.0.205(react@19.2.7)(zod@4.4.3)
+        version: 3.0.205(react@19.2.7)(zod@4.6.6)
      '@aws-sdk/client-bedrock-runtime':
        specifier: 3.1045.0
        version: 3.1045.0
@@ -78,16 +78,16 @@ importers:
        version: 5.2.2(react-hook-form@7.62.0(react@19.2.7))
      '@langchain/aws':
        specifier: 1.3.7
-        version: 1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))
+        version: 1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))
      '@langchain/core':
        specifier: 1.1.45
-        version: 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+        version: 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
      '@langchain/mcp-adapters':
        specifier: 1.1.3
-        version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
+        version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))(zod@4.6.6))
      '@langchain/openai':
        specifier: 1.4.5
-        version: 1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(ws@8.21.0)
+        version: 1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(ws@8.21.0)
      '@lezer/highlight':
        specifier: 1.2.3
        version: 1.2.3
@@ -189,7 +189,7 @@ importers:
        version: 12.10.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
      ai:
        specifier: 6.0.203
-        version: 6.0.203(zod@4.4.3)
+        version: 6.0.203(zod@4.6.6)
      ajv:
        specifier: 8.18.0
        version: 8.18.0
@@ -215,14 +215,14 @@ importers:
        specifier: 3.3.1
        version: 3.3.1
      js-yaml:
-        specifier: 4.3.1
-        version: 4.3.1
+        specifier: 4.3.2
+        version: 4.3.2
      jwt-decode:
        specifier: 4.0.0
        version: 4.0.0
      langchain:
        specifier: 1.4.0
-        version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))
+        version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))
      lucide-react:
        specifier: 0.543.0
        version: 0.543.0(react@19.2.7)
@@ -293,8 +293,8 @@ importers:
        specifier: 2.0.2
        version: 2.0.2
      zod:
-        specifier: 4.4.3
-        version: 4.4.3
+        specifier: 4.6.6
+        version: 4.6.6
      zustand:
        specifier: 5.0.8
        version: 5.0.8(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))
@@ -337,16 +337,16 @@ importers:
        version: 1.0.5
      '@vitejs/plugin-react':
        specifier: 5.1.2
-        version: 5.1.2(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+        version: 5.1.2(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
      '@vitest/browser':
-        specifier: 4.1.10
-        version: 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)
+        specifier: 4.1.11
+        version: 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)
      '@vitest/browser-playwright':
-        specifier: 4.1.10
-        version: 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)
+        specifier: 4.1.11
+        version: 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)
      '@vitest/coverage-v8':
-        specifier: 4.1.10
-        version: 4.1.10(@vitest/browser@4.1.10)(vitest@4.1.10)
+        specifier: 4.1.11
+        version: 4.1.11(@vitest/browser@4.1.11)(vitest@4.1.11)
      babel-plugin-react-compiler:
        specifier: 1.0.0
        version: 1.0.0
@@ -417,11 +417,11 @@ importers:
        specifier: 8.59.3
        version: 8.59.3(eslint@9.39.2(jiti@2.7.0))(typescript@5.5.4)
      vitest:
-        specifier: 4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+        specifier: 4.1.11
+        version: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.11)(@vitest/coverage-v8@4.1.11)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
      vitest-browser-react:
        specifier: 2.0.4
-        version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.10)
+        version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.11)

 packages:

@@ -1051,7 +1051,7 @@ packages:
    resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==}
    engines: {node: '>=18.14.1'}
    peerDependencies:
-      hono: 4.12.34
+      hono: 4.13.11

  '@hookform/resolvers@5.2.2':
    resolution: {integrity: sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA==}
@@ -3604,56 +3604,56 @@ packages:
    resolution: {integrity: sha512-EcA07pHJouywpzsoTUqNh5NwGayl2PPVEJKUSinGGSxFGYn+shYbqMGBg6FXDqgXum9Ou/ecb+411ssw8HImJQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    peerDependencies:
-      vite: 7.3.5
+      vite: 7.3.7

-  '@vitest/browser-playwright@4.1.10':
-    resolution: {integrity: sha512-nMoXGEiRpT7m3W7NsbvrM2aKNwiNHZf+zEpUCvMteGjZFvfT96Q9fh7QyB98dvDWXiKvrLxA7bJ1mCOOv+JQPw==}
+  '@vitest/browser-playwright@4.1.11':
+    resolution: {integrity: sha512-riLBxPqwnJ0lWs2DN2WeUfYeKLoAjbP2Xx8cLQdSddzMi20sksIa6K2mPz79DyMZKKVKH2ksOC2yJvtNcZg8cg==}
    peerDependencies:
      playwright: '*'
-      vitest: 4.1.10
+      vitest: 4.1.11

-  '@vitest/browser@4.1.10':
-    resolution: {integrity: sha512-UDwuWGwXj646CBx/bQHOaJSX7np0I8JL/UKQYa1e4QrVHH8VdWtx8eaOuf8sy0ShwDgR6NjJAsp5eF6vjF6qng==}
+  '@vitest/browser@4.1.11':
+    resolution: {integrity: sha512-bwMovvAeuTFOK5kIFevw4VEf+1gVEICv4SYK4k3knJOxl6b1zEWud8mYKD73e1B0odAn174h1MofURy2TPWf3w==}
    peerDependencies:
-      vitest: 4.1.10
+      vitest: 4.1.11

-  '@vitest/coverage-v8@4.1.10':
-    resolution: {integrity: sha512-IM49HmthevbgAO4anp1hwtoT9wYe59w0LR00gr+eagHE+ZJ5lK4sLPeO0ubgoJcwLk6dehU3R24N+FbEEKDc8g==}
+  '@vitest/coverage-v8@4.1.11':
+    resolution: {integrity: sha512-8MVGEFnJIcdGjcbfKmeq8z0pZHH0JlVtoVZH9Q/qwUp6wyFnEJUBMrw9DCaj+ra3vShGmhavjalMIhPNxZAUcw==}
    peerDependencies:
-      '@vitest/browser': 4.1.10
-      vitest: 4.1.10
+      '@vitest/browser': 4.1.11
+      vitest: 4.1.11
    peerDependenciesMeta:
      '@vitest/browser':
        optional: true

-  '@vitest/expect@4.1.10':
-    resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==}
+  '@vitest/expect@4.1.11':
+    resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}

-  '@vitest/mocker@4.1.10':
-    resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==}
+  '@vitest/mocker@4.1.11':
+    resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
    peerDependencies:
      msw: ^2.4.9
-      vite: 7.3.5
+      vite: 7.3.7
    peerDependenciesMeta:
      msw:
        optional: true
      vite:
        optional: true

-  '@vitest/pretty-format@4.1.10':
-    resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==}
+  '@vitest/pretty-format@4.1.11':
+    resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}

-  '@vitest/runner@4.1.10':
-    resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==}
+  '@vitest/runner@4.1.11':
+    resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}

-  '@vitest/snapshot@4.1.10':
-    resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==}
+  '@vitest/snapshot@4.1.11':
+    resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==}

-  '@vitest/spy@4.1.10':
-    resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==}
+  '@vitest/spy@4.1.11':
+    resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==}

-  '@vitest/utils@4.1.10':
-    resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==}
+  '@vitest/utils@4.1.11':
+    resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==}

  '@webassemblyjs/ast@1.14.1':
    resolution: {integrity: sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==}
@@ -3877,26 +3877,26 @@ packages:
  base64-js@1.5.1:
    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}

-  baseline-browser-mapping@2.10.29:
-    resolution: {integrity: sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==}
+  baseline-browser-mapping@2.11.0:
+    resolution: {integrity: sha512-oCu2wfipvX3AePSgmOuKkIywOu+8n9psz7hXYmk56ghpu3+7KzNIBopaOs4c9BrtdnTtW30unG9GTfHo7EwERQ==}
    engines: {node: '>=6.0.0'}
    hasBin: true

  bidi-js@1.0.3:
    resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}

-  body-parser@2.3.0:
-    resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
+  body-parser@2.4.0:
+    resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==}
    engines: {node: '>=18'}

  bowser@2.14.1:
    resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==}

-  brace-expansion@1.1.18:
-    resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
+  brace-expansion@1.1.21:
+    resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==}

-  brace-expansion@5.0.9:
-    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
+  brace-expansion@5.0.12:
+    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
    engines: {node: 20 || >=22}

  braces@3.0.3:
@@ -4609,6 +4609,10 @@ packages:
    resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
    engines: {node: '>=0.8.x'}

+  eventsource-parser@3.0.6:
+    resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==}
+    engines: {node: '>=18.0.0'}
+
  eventsource-parser@3.1.0:
    resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
    engines: {node: '>=18.0.0'}
@@ -4664,8 +4668,8 @@ packages:
  fast-string-width@3.0.2:
    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}

-  fast-uri@3.1.6:
-    resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==}
+  fast-uri@3.1.9:
+    resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==}

  fast-wrap-ansi@0.2.0:
    resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==}
@@ -4927,8 +4931,8 @@ packages:
  hermes-parser@0.25.1:
    resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}

-  hono@4.12.34:
-    resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==}
+  hono@4.13.11:
+    resolution: {integrity: sha512-/SMX/RQNJn7oNmFwH6DtwDqcrzZU2otm1FD6OJe2cWF6cfy/F8hq0XVBv7xW3FTJshRQwuBnXHDq2kNsdZnshg==}
    engines: {node: '>=16.9.0'}

  html-encoding-sniffer@6.0.0:
@@ -4971,6 +4975,10 @@ packages:
    resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
    engines: {node: '>=0.10.0'}

+  iconv-lite@0.7.3:
+    resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==}
+    engines: {node: '>=0.10.0'}
+
  ignore@5.3.2:
    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
    engines: {node: '>= 4'}
@@ -5012,8 +5020,8 @@ packages:
    resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==}
    engines: {node: '>=12'}

-  ip-address@10.3.1:
-    resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==}
+  ip-address@10.7.4:
+    resolution: {integrity: sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==}
    engines: {node: '>= 12'}

  ipaddr.js@1.9.1:
@@ -5205,8 +5213,8 @@ packages:
  js-tokens@4.0.0:
    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}

-  js-yaml@4.3.1:
-    resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
+  js-yaml@4.3.2:
+    resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
    hasBin: true

  jsdom@27.4.0:
@@ -6974,8 +6982,8 @@ packages:
  victory-vendor@36.9.2:
    resolution: {integrity: sha512-PnpQQMuxlwYdocC8fIJqVXvkeViHYzotI+NJrCuav0ZYFoq912ZHBk3mCeuj+5/VpodOjPe1z0Fk2ihgzlXqjQ==}

-  vite@7.3.5:
-    resolution: {integrity: sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==}
+  vite@7.3.7:
+    resolution: {integrity: sha512-AHEzTORMbi7/7aXp7w7KZ5+DCUdSeLsJz0grY8xHpc9DHdYb0vQu6DqJfm2tOw3gDExNgPgnJTXxM6syYFHaCA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    hasBin: true
    peerDependencies:
@@ -7028,23 +7036,23 @@ packages:
      '@types/react-dom':
        optional: true

-  vitest@4.1.10:
-    resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==}
+  vitest@4.1.11:
+    resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==}
    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
    hasBin: true
    peerDependencies:
      '@edge-runtime/vm': '*'
      '@opentelemetry/api': ^1.9.0
      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.10
-      '@vitest/browser-preview': 4.1.10
-      '@vitest/browser-webdriverio': 4.1.10
-      '@vitest/coverage-istanbul': 4.1.10
-      '@vitest/coverage-v8': 4.1.10
-      '@vitest/ui': 4.1.10
+      '@vitest/browser-playwright': 4.1.11
+      '@vitest/browser-preview': 4.1.11
+      '@vitest/browser-webdriverio': 4.1.11
+      '@vitest/coverage-istanbul': 4.1.11
+      '@vitest/coverage-v8': 4.1.11
+      '@vitest/ui': 4.1.11
      happy-dom: '*'
      jsdom: '*'
-      vite: 7.3.5
+      vite: 7.3.7
    peerDependenciesMeta:
      '@edge-runtime/vm':
        optional: true
@@ -7227,6 +7235,9 @@ packages:
  zod@4.4.3:
    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}

+  zod@4.6.6:
+    resolution: {integrity: sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==}
+
  zustand@4.5.7:
    resolution: {integrity: sha512-CHOUy7mu3lbD6o6LJLfllpjkzhHXSBlX8B9+qPddUsIfeF5S/UZ5q0kmCsnRqT1UHFQZchNFDDzMbQsuesHWlw==}
    engines: {node: '>=12.7.0'}
@@ -7269,28 +7280,28 @@ snapshots:

  '@adobe/css-tools@4.4.4': {}

-  '@ai-sdk/gateway@3.0.129(zod@4.4.3)':
+  '@ai-sdk/gateway@3.0.129(zod@4.6.6)':
    dependencies:
      '@ai-sdk/provider': 3.0.10
-      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.6.6)
      '@vercel/oidc': 3.2.0
-      zod: 4.4.3
+      zod: 4.6.6

-  '@ai-sdk/provider-utils@4.0.29(zod@4.4.3)':
+  '@ai-sdk/provider-utils@4.0.29(zod@4.6.6)':
    dependencies:
      '@ai-sdk/provider': 3.0.10
      '@standard-schema/spec': 1.1.0
-      eventsource-parser: 3.1.0
-      zod: 4.4.3
+      eventsource-parser: 3.0.6
+      zod: 4.6.6

  '@ai-sdk/provider@3.0.10':
    dependencies:
      json-schema: 0.4.0

-  '@ai-sdk/react@3.0.205(react@19.2.7)(zod@4.4.3)':
+  '@ai-sdk/react@3.0.205(react@19.2.7)(zod@4.6.6)':
    dependencies:
-      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
-      ai: 6.0.203(zod@4.4.3)
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.6.6)
+      ai: 6.0.203(zod@4.6.6)
      react: 19.2.7
      swr: 2.3.8(react@19.2.7)
      throttleit: 2.1.0
@@ -8190,7 +8201,7 @@ snapshots:
      globals: 14.0.0
      ignore: 5.3.2
      import-fresh: 3.3.1
-      js-yaml: 4.3.1
+      js-yaml: 4.3.2
      minimatch: 3.1.4
      strip-json-comments: 3.1.1
    transitivePeerDependencies:
@@ -8233,9 +8244,9 @@ snapshots:

  '@floating-ui/utils@0.2.10': {}

-  '@hono/node-server@1.19.17(hono@4.12.34)':
+  '@hono/node-server@1.19.17(hono@4.13.11)':
    dependencies:
-      hono: 4.12.34
+      hono: 4.13.11

  '@hookform/resolvers@5.2.2(react-hook-form@7.62.0(react@19.2.7))':
    dependencies:
@@ -8423,17 +8434,17 @@ snapshots:
      '@jridgewell/resolve-uri': 3.1.2
      '@jridgewell/sourcemap-codec': 1.5.5

-  '@langchain/aws@1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))':
+  '@langchain/aws@1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))':
    dependencies:
      '@aws-sdk/client-bedrock-agent-runtime': 3.1045.0
      '@aws-sdk/client-bedrock-runtime': 3.1045.0
      '@aws-sdk/client-kendra': 3.1045.0
      '@aws-sdk/credential-provider-node': 3.972.39
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
    transitivePeerDependencies:
      - aws-crt

-  '@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)':
+  '@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)':
    dependencies:
      '@cfworker/json-schema': 4.1.1
      '@standard-schema/spec': 1.1.0
@@ -8441,7 +8452,7 @@ snapshots:
      camelcase: 6.3.0
      decamelize: 1.2.0
      js-tiktoken: 1.0.21
-      langsmith: 0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+      langsmith: 0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
      mustache: 4.2.0
      p-queue: 6.6.2
      zod: 4.4.3
@@ -8452,14 +8463,14 @@ snapshots:
      - openai
      - ws

-  '@langchain/langgraph-checkpoint@1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))':
+  '@langchain/langgraph-checkpoint@1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))':
    dependencies:
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
      uuid: 11.1.1

-  '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)':
+  '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)':
    dependencies:
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
      '@langchain/protocol': 0.0.15
      '@types/json-schema': 7.0.15
      p-queue: 9.2.0
@@ -8475,17 +8486,17 @@ snapshots:
      - openai
      - ws

-  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
+  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))(zod@4.4.3)':
    dependencies:
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
-      '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))
-      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
+      '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))
+      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)
      '@langchain/protocol': 0.0.15
      '@standard-schema/spec': 1.1.0
      uuid: 11.1.1
      zod: 4.4.3
    optionalDependencies:
-      zod-to-json-schema: 3.25.1(zod@4.4.3)
+      zod-to-json-schema: 3.25.1(zod@4.6.6)
    transitivePeerDependencies:
      - '@opentelemetry/api'
      - '@opentelemetry/exporter-trace-otlp-proto'
@@ -8497,10 +8508,32 @@ snapshots:
      - vue
      - ws

-  '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
+  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))(zod@4.6.6)':
    dependencies:
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
-      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
+      '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))
+      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)
+      '@langchain/protocol': 0.0.15
+      '@standard-schema/spec': 1.1.0
+      uuid: 11.1.1
+      zod: 4.6.6
+    optionalDependencies:
+      zod-to-json-schema: 3.25.1(zod@4.6.6)
+    transitivePeerDependencies:
+      - '@opentelemetry/api'
+      - '@opentelemetry/exporter-trace-otlp-proto'
+      - '@opentelemetry/sdk-trace-base'
+      - openai
+      - react
+      - react-dom
+      - svelte
+      - vue
+      - ws
+
+  '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))(zod@4.6.6))':
+    dependencies:
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
+      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))(zod@4.6.6)
      '@modelcontextprotocol/sdk': 1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)
      debug: 4.4.3
      zod: 4.4.3
@@ -8510,9 +8543,9 @@ snapshots:
      - '@cfworker/json-schema'
      - supports-color

-  '@langchain/openai@1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(ws@8.21.0)':
+  '@langchain/openai@1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(ws@8.21.0)':
    dependencies:
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
      js-tiktoken: 1.0.21
      openai: 6.37.0(ws@8.21.0)(zod@4.4.3)
      zod: 4.4.3
@@ -8541,7 +8574,7 @@ snapshots:

  '@modelcontextprotocol/sdk@1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)':
    dependencies:
-      '@hono/node-server': 1.19.17(hono@4.12.34)
+      '@hono/node-server': 1.19.17(hono@4.13.11)
      ajv: 8.18.0
      ajv-formats: 3.0.1(ajv@8.18.0)
      content-type: 1.0.5
@@ -8551,7 +8584,7 @@ snapshots:
      eventsource-parser: 3.1.0
      express: 5.2.1
      express-rate-limit: 8.5.1(express@5.2.1)
-      hono: 4.12.34
+      hono: 4.13.11
      jose: 6.1.3
      json-schema-typed: 8.0.2
      pkce-challenge: 5.0.1
@@ -10687,7 +10720,7 @@ snapshots:

  '@vercel/oidc@3.2.0': {}

-  '@vitejs/plugin-react@5.1.2(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))':
+  '@vitejs/plugin-react@5.1.2(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))':
    dependencies:
      '@babel/core': 7.29.7
      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.7)
@@ -10695,33 +10728,33 @@ snapshots:
      '@rolldown/pluginutils': 1.0.0-beta.53
      '@types/babel__core': 7.20.5
      react-refresh: 0.18.0
-      vite: 7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)
+      vite: 7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)
    transitivePeerDependencies:
      - supports-color

-  '@vitest/browser-playwright@4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)':
+  '@vitest/browser-playwright@4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)':
    dependencies:
-      '@vitest/browser': 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)
-      '@vitest/mocker': 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      '@vitest/browser': 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)
+      '@vitest/mocker': 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
      playwright: 1.56.1
      tinyrainbow: 3.1.0
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      vitest: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.11)(@vitest/coverage-v8@4.1.11)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
    transitivePeerDependencies:
      - bufferutil
      - msw
      - utf-8-validate
      - vite

-  '@vitest/browser@4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)':
+  '@vitest/browser@4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)':
    dependencies:
      '@blazediff/core': 1.9.1
-      '@vitest/mocker': 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
-      '@vitest/utils': 4.1.10
+      '@vitest/mocker': 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      '@vitest/utils': 4.1.11
      magic-string: 0.30.21
      pngjs: 7.0.0
      sirv: 3.0.2
      tinyrainbow: 3.1.0
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      vitest: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.11)(@vitest/coverage-v8@4.1.11)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
      ws: 8.21.0
    transitivePeerDependencies:
      - bufferutil
@@ -10729,10 +10762,10 @@ snapshots:
      - utf-8-validate
      - vite

-  '@vitest/coverage-v8@4.1.10(@vitest/browser@4.1.10)(vitest@4.1.10)':
+  '@vitest/coverage-v8@4.1.11(@vitest/browser@4.1.11)(vitest@4.1.11)':
    dependencies:
      '@bcoe/v8-coverage': 1.0.2
-      '@vitest/utils': 4.1.10
+      '@vitest/utils': 4.1.11
      ast-v8-to-istanbul: 1.0.3
      istanbul-lib-coverage: 3.2.2
      istanbul-lib-report: 3.0.1
@@ -10741,49 +10774,49 @@ snapshots:
      obug: 2.1.1
      std-env: 4.1.0
      tinyrainbow: 3.1.0
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      vitest: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.11)(@vitest/coverage-v8@4.1.11)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
    optionalDependencies:
-      '@vitest/browser': 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)
+      '@vitest/browser': 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)

-  '@vitest/expect@4.1.10':
+  '@vitest/expect@4.1.11':
    dependencies:
      '@standard-schema/spec': 1.1.0
      '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.10
-      '@vitest/utils': 4.1.10
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
      chai: 6.2.2
      tinyrainbow: 3.1.0

-  '@vitest/mocker@4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))':
    dependencies:
-      '@vitest/spy': 4.1.10
+      '@vitest/spy': 4.1.11
      estree-walker: 3.0.3
      magic-string: 0.30.21
    optionalDependencies:
      msw: 2.13.4(@types/node@24.10.8)(typescript@5.5.4)
-      vite: 7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)
+      vite: 7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)

-  '@vitest/pretty-format@4.1.10':
+  '@vitest/pretty-format@4.1.11':
    dependencies:
      tinyrainbow: 3.1.0

-  '@vitest/runner@4.1.10':
+  '@vitest/runner@4.1.11':
    dependencies:
-      '@vitest/utils': 4.1.10
+      '@vitest/utils': 4.1.11
      pathe: 2.0.3

-  '@vitest/snapshot@4.1.10':
+  '@vitest/snapshot@4.1.11':
    dependencies:
-      '@vitest/pretty-format': 4.1.10
-      '@vitest/utils': 4.1.10
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/utils': 4.1.11
      magic-string: 0.30.21
      pathe: 2.0.3

-  '@vitest/spy@4.1.10': {}
+  '@vitest/spy@4.1.11': {}

-  '@vitest/utils@4.1.10':
+  '@vitest/utils@4.1.11':
    dependencies:
-      '@vitest/pretty-format': 4.1.10
+      '@vitest/pretty-format': 4.1.11
      convert-source-map: 2.0.0
      tinyrainbow: 3.1.0

@@ -10915,13 +10948,13 @@ snapshots:

  agent-base@7.1.4: {}

-  ai@6.0.203(zod@4.4.3):
+  ai@6.0.203(zod@4.6.6):
    dependencies:
-      '@ai-sdk/gateway': 3.0.129(zod@4.4.3)
+      '@ai-sdk/gateway': 3.0.129(zod@4.6.6)
      '@ai-sdk/provider': 3.0.10
-      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.6.6)
      '@opentelemetry/api': 1.9.1
-      zod: 4.4.3
+      zod: 4.6.6

  ajv-formats@2.1.1(ajv@8.18.0):
    optionalDependencies:
@@ -10946,7 +10979,7 @@ snapshots:
  ajv@8.18.0:
    dependencies:
      fast-deep-equal: 3.1.3
-      fast-uri: 3.1.6
+      fast-uri: 3.1.9
      json-schema-traverse: 1.0.0
      require-from-string: 2.0.2

@@ -11059,19 +11092,19 @@ snapshots:

  base64-js@1.5.1: {}

-  baseline-browser-mapping@2.10.29: {}
+  baseline-browser-mapping@2.11.0: {}

  bidi-js@1.0.3:
    dependencies:
      require-from-string: 2.0.2

-  body-parser@2.3.0:
+  body-parser@2.4.0:
    dependencies:
      bytes: 3.1.2
      content-type: 2.1.0
      debug: 4.4.3
      http-errors: 2.0.1
-      iconv-lite: 0.7.2
+      iconv-lite: 0.7.3
      on-finished: 2.4.1
      qs: 6.16.0
      raw-body: 3.0.2
@@ -11081,12 +11114,12 @@ snapshots:

  bowser@2.14.1: {}

-  brace-expansion@1.1.18:
+  brace-expansion@1.1.21:
    dependencies:
      balanced-match: 1.0.2
      concat-map: 0.0.1

-  brace-expansion@5.0.9:
+  brace-expansion@5.0.12:
    dependencies:
      balanced-match: 4.0.4

@@ -11096,7 +11129,7 @@ snapshots:

  browserslist@4.28.7:
    dependencies:
-      baseline-browser-mapping: 2.10.29
+      baseline-browser-mapping: 2.11.0
      caniuse-lite: 1.0.30001792
      electron-to-chromium: 1.5.418
      node-releases: 2.0.54
@@ -11926,6 +11959,8 @@ snapshots:

  events@3.3.0: {}

+  eventsource-parser@3.0.6: {}
+
  eventsource-parser@3.1.0: {}

  eventsource@3.0.7:
@@ -11937,12 +11972,12 @@ snapshots:
  express-rate-limit@8.5.1(express@5.2.1):
    dependencies:
      express: 5.2.1
-      ip-address: 10.3.1
+      ip-address: 10.7.4

  express@5.2.1:
    dependencies:
      accepts: 2.0.0
-      body-parser: 2.3.0
+      body-parser: 2.4.0
      content-disposition: 1.0.1
      content-type: 1.0.5
      cookie: 0.7.2
@@ -12007,7 +12042,7 @@ snapshots:
    dependencies:
      fast-string-truncated-width: 3.0.3

-  fast-uri@3.1.6: {}
+  fast-uri@3.1.9: {}

  fast-wrap-ansi@0.2.0:
    dependencies:
@@ -12343,7 +12378,7 @@ snapshots:
    dependencies:
      hermes-estree: 0.25.1

-  hono@4.12.34: {}
+  hono@4.13.11: {}

  html-encoding-sniffer@6.0.0:
    dependencies:
@@ -12396,6 +12431,10 @@ snapshots:
    dependencies:
      safer-buffer: 2.1.2

+  iconv-lite@0.7.3:
+    dependencies:
+      safer-buffer: 2.1.2
+
  ignore@5.3.2: {}

  ignore@7.0.5: {}
@@ -12429,7 +12468,7 @@ snapshots:

  internmap@2.0.3: {}

-  ip-address@10.3.1: {}
+  ip-address@10.7.4: {}

  ipaddr.js@1.9.1: {}

@@ -12618,7 +12657,7 @@ snapshots:

  js-tokens@4.0.0: {}

-  js-yaml@4.3.1:
+  js-yaml@4.3.2:
    dependencies:
      argparse: 2.0.1

@@ -12712,12 +12751,12 @@ snapshots:
      - '@emnapi/core'
      - '@emnapi/runtime'

-  langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3)):
+  langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6)):
    dependencies:
-      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
-      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
-      '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))
-      langsmith: 0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+      '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
+      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.6.6))(zod@4.4.3)
+      '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0))
+      langsmith: 0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0)
      zod: 4.4.3
    transitivePeerDependencies:
      - '@opentelemetry/api'
@@ -12731,13 +12770,13 @@ snapshots:
      - ws
      - zod-to-json-schema

-  langsmith@0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0):
+  langsmith@0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.6.6))(ws@8.21.0):
    dependencies:
      p-queue: 6.6.2
    optionalDependencies:
      '@opentelemetry/api': 1.9.1
      '@opentelemetry/sdk-trace-base': 2.9.0(@opentelemetry/api@1.9.1)
-      openai: 6.37.0(ws@8.21.0)(zod@4.4.3)
+      openai: 6.37.0(ws@8.21.0)(zod@4.6.6)
      ws: 8.21.0

  language-subtag-registry@0.3.23: {}
@@ -13317,15 +13356,15 @@ snapshots:

  minimatch@10.2.3:
    dependencies:
-      brace-expansion: 5.0.9
+      brace-expansion: 5.0.12

  minimatch@3.1.4:
    dependencies:
-      brace-expansion: 1.1.18
+      brace-expansion: 1.1.21

  minimatch@9.0.7:
    dependencies:
-      brace-expansion: 5.0.9
+      brace-expansion: 5.0.12

  minimist@1.2.8: {}

@@ -13409,7 +13448,7 @@ snapshots:
    dependencies:
      '@next/env': 16.4.1
      '@swc/helpers': 0.5.23
-      baseline-browser-mapping: 2.10.29
+      baseline-browser-mapping: 2.11.0
      caniuse-lite: 1.0.30001792
      postcss: 8.5.23
      react: 19.2.7
@@ -13500,6 +13539,12 @@ snapshots:
      ws: 8.21.0
      zod: 4.4.3

+  openai@6.37.0(ws@8.21.0)(zod@4.6.6):
+    optionalDependencies:
+      ws: 8.21.0
+      zod: 4.6.6
+    optional: true
+
  optionator@0.9.4:
    dependencies:
      deep-is: 0.1.4
@@ -14783,7 +14828,7 @@ snapshots:
      d3-time: 3.1.0
      d3-timer: 3.0.1

-  vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0):
+  vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0):
    dependencies:
      esbuild: 0.28.1
      fdir: 6.5.0(picomatch@4.0.7)
@@ -14799,42 +14844,42 @@ snapshots:
      terser: 5.51.2
      yaml: 2.9.0

-  vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.10):
+  vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.11):
    dependencies:
      react: 19.2.7
      react-dom: 19.2.7(react@19.2.7)
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      vitest: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.11)(@vitest/coverage-v8@4.1.11)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
    optionalDependencies:
      '@types/react': 19.2.17
      '@types/react-dom': 19.2.3(@types/react@19.2.17)

-  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)):
+  vitest@4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.11)(@vitest/coverage-v8@4.1.11)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)):
    dependencies:
-      '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.10
-      '@vitest/runner': 4.1.10
-      '@vitest/snapshot': 4.1.10
-      '@vitest/spy': 4.1.10
-      '@vitest/utils': 4.1.10
+      '@vitest/expect': 4.1.11
+      '@vitest/mocker': 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/runner': 4.1.11
+      '@vitest/snapshot': 4.1.11
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
      es-module-lexer: 2.3.0
      expect-type: 1.3.0
      magic-string: 0.30.21
      obug: 2.1.1
      pathe: 2.0.3
-      picomatch: 4.0.5
+      picomatch: 4.0.7
      std-env: 4.1.0
      tinybench: 2.9.0
      tinyexec: 1.1.2
      tinyglobby: 0.2.17
      tinyrainbow: 3.1.0
-      vite: 7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)
+      vite: 7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0)
      why-is-node-running: 2.3.0
    optionalDependencies:
      '@opentelemetry/api': 1.9.1
      '@types/node': 24.10.8
-      '@vitest/browser-playwright': 4.1.10(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.5(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.10)
-      '@vitest/coverage-v8': 4.1.10(@vitest/browser@4.1.10)(vitest@4.1.10)
+      '@vitest/browser-playwright': 4.1.11(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.7(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.51.2)(yaml@2.9.0))(vitest@4.1.11)
+      '@vitest/coverage-v8': 4.1.11(@vitest/browser@4.1.11)(vitest@4.1.11)
      jsdom: 27.4.0
    transitivePeerDependencies:
      - msw
@@ -15010,12 +15055,19 @@ snapshots:
    dependencies:
      zod: 4.4.3

+  zod-to-json-schema@3.25.1(zod@4.6.6):
+    dependencies:
+      zod: 4.6.6
+    optional: true
+
  zod-validation-error@4.0.2(zod@4.4.3):
    dependencies:
      zod: 4.4.3

  zod@4.4.3: {}

+  zod@4.6.6: {}
+
  zustand@4.5.7(@types/react@19.2.17)(react@19.2.7):
    dependencies:
      use-sync-external-store: 1.6.0(react@19.2.7)
@@ -30,7 +30,7 @@ overrides:
  # Language middleware algorithmic DoS, Proxy Helper keeping `Connection` headers.
  # Node adapter 1.19.17 fixes serve-static path traversal via `%5C` on Windows
  # (1.19.15 was published without provenance and trips `trustPolicy: no-downgrade`).
-  "hono": "4.12.34"
+  "hono": "4.13.11"
  "@hono/node-server": "1.19.17"
  "@isaacs/brace-expansion": "5.0.1"
  "fast-xml-parser": "5.8.0"
@@ -44,7 +44,7 @@ overrides:
  # GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure). Dev-only tooling
  # (vitest/@vitejs/plugin-react); consumers allow ^7 but never resolve past 7.3.2
  # without a nudge.
-  "vite@>=7 <8": "7.3.5"
+  "vite@>=7 <8": "7.3.7"
  # GHSA-96hv-2xvq-fx4p (memory exhaustion DoS from tiny fragments, high) +
  # GHSA-58qx-3vcg-4xpx (uninitialized memory disclosure), both fixed in 8.21.0.
  # Not 8.21.1: it is still inside StepSecurity's 7-day npm cooldown gate.
@@ -63,7 +63,7 @@ overrides:
  # does not float past StepSecurity's 7-day npm cooldown gate.
  "browserslist": "4.28.7"
  "caniuse-lite": "1.0.30001792"
-  "baseline-browser-mapping": "2.10.29"
+  "baseline-browser-mapping": "2.11.0"
  "minimatch@<4": "3.1.4"
  "minimatch@>=9 <10": "9.0.7"
  "minimatch@>=10": "10.2.3"
@@ -95,21 +95,23 @@ overrides:
  # brace-expansion: three DoS advisories (exponential `{}` expansion, unbounded
  # expansion length OOM, unbounded intermediate arrays bypassing the
  # CVE-2026-14257 mitigation). 1.x via eslint > minimatch, 5.x via @sentry > glob.
-  "brace-expansion@<2": "1.1.18"
-  "brace-expansion@>=5": "5.0.9"
+  # 1.1.21 / 5.0.12 close the 2026-09-29 follow-ups (GHSA-6j4f-fj2g-mc7p,
+  # GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr); 1.x stays on its own major for minimatch@3.
+  "brace-expansion@<2": "1.1.21"
+  "brace-expansion@>=5": "5.0.12"
  # fast-uri (via ajv): host confusion through backslash authority delimiters,
  # failed IDN canonicalization and percent-encoded scheme normalization, plus SSRF
  # via malformed IPv6 normalization and repeated hostname percent-decoding.
-  "fast-uri": "3.1.6"
+  "fast-uri": "3.1.9"
  # ip-address (via express-rate-limit): SSRF / trust-boundary bypasses from
  # leading-zero octets, CIDR suffixes and IPv4-mapped / NAT64 misclassification.
-  "ip-address": "10.3.1"
+  "ip-address": "10.7.4"
  # mermaid (via streamdown): prototype pollution in config APIs and Architecture
  # diagrams, CSS injection into sibling elements, XY Chart infinite loop and
  # radar diagram DoS.
  "mermaid": "11.16.1"
  # body-parser (via express): invalid `limit` silently disabled size enforcement.
-  "body-parser": "2.3.0"
+  "body-parser": "2.4.0"
  # proxy-addr (via @modelcontextprotocol/sdk > express): GHSA-jqcg-44mw-7w3h
  # (critical), a short IPv4-mapped IPv6 trust subnet trusts every client, so
  # `req.ip` returns a spoofed X-Forwarded-For. 2.0.8 (2026-09-15) clears the
@@ -118,8 +120,8 @@ overrides:
  # @humanfs/node (via eslint): recursive copy followed symlinks outside the tree.
  "@humanfs/node": "0.16.8"
  # js-yaml: quadratic CPU in `!!omap` resolution (CVE-2026-59870 not backported
-  # to 4.3.0). Direct dep is already 4.3.1; the override lifts eslint's copy too.
-  "js-yaml": "4.3.1"
+  # to 4.3.0). Direct dep is already 4.3.2; the override lifts eslint's copy too.
+  "js-yaml": "4.3.2"

 # --- Level 1: Minimum Release Age ---
 # Packages must be published for at least 1 day before they can be installed.
Author	SHA1	Message	Date
pedrooot	5ce1a5a034	fix(ui): patch npm advisories from renovate security PRs	2026-11-03 14:12:42 +01:00
Alejandro Bailo	9bcbbf5404	feat(ui): let Lighthouse Bedrock settings use a Bedrock API key (#13245 )	2026-11-03 11:43:39 +01:00
				`@@ -0,0 +1 @@`
				`zod` to 4.6.6, `js-yaml` to 4.3.2 and `vitest` to 4.1.11, plus transitive `hono`, `vite`, `brace-expansion`, `fast-uri`, `ip-address`, `body-parser` and `baseline-browser-mapping` to patched versions, resolving 32 npm audit advisories (9 high, 20 moderate, 3 low)