security: open Dependabot alerts #1442

Tracking issue for open Dependabot security alerts, maintained by the weekly security-dependency job.

Last updated: 2026-10-26

Left open

• feat: comprehensive telemetry instrumentation #39–fix: address remaining code review issues from PR #39 #43 @modelcontextprotocol/sdk 1.29.0 → 1.32.x (runtime, 3 high + 2 medium; filed 2026-10-12 to 2026-10-22). This is a minor bump within 1.x, but the repo pins a local patch, patches/@modelcontextprotocol%2Fsdk@1.29.0.patch (registered in root package.json patchedDependencies). It adds callTool overloads and a session-expired re-initialize hook in dist/{cjs,esm}/client. The patch has to be re-created against 1.32.x (bun patch), and the patchedDependencies key renamed, before the version can be bumped. Dependabot PR chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.32.0 in /packages/opencode #1571 changes only the version pin, so it would leave the patch pointing at a version that is no longer installed. The 2026-10-26 run of this job was going to add this to PR fix(deps): patch 9 Dependabot security alerts #1443, but it could not clone or push to the repo (the Devin git proxy returned 403), so the change was not made.
• docs: rewrite README for open-source launch #33 @hey-api/openapi-ts 0.90.10 → 0.97.3 (dev-only SDK codegen). The vulnerable code is the buildClientParams template copied into packages/sdk/js/src/v2/gen/core/params.gen.ts, so closing it means regenerating the SDK. Under 0.97.3 the post-codegen patch in packages/sdk/js/script/build.ts fails (the ServerSentEventsResult<TData, TError> needle no longer exists — upstream fixed that typing), the @hey-api/sdk instance option is deprecated in favour of operations: { strategy: "single", containerName: "OpencodeClient", methods: "instance" }, and the regenerated src/v2/gen differs by ~18k lines (part of that is spec drift between the committed SDK and the current server). This needs its own PR: update build.ts for the new plugin options and patch sites, regenerate, and review the SDK surface.

Notes

• PR fix(deps): patch 9 Dependabot security alerts #1443 is 41 commits behind main (GitHub still reports it mergeable) and has the needs:issue label even though its body says Part of #1442.

Superseded Dependabot PRs

• chore(deps): bump minimatch from 10.0.3 to 10.2.3 #1185 (minimatch 10.2.3), chore(deps-dev): bump turbo from 2.8.13 to 2.10.9 #1104 (turbo 2.10.9), chore(deps): bump @ai-sdk/provider-utils from 4.0.23 to 4.0.33 in /packages/core #1277 (@ai-sdk/provider-utils 4.0.33) — superseded by PR fix(deps): patch 9 Dependabot security alerts #1443.
• chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.32.0 in /packages/opencode #1571 (@modelcontextprotocol/sdk 1.32.0) — not superseded yet (see above).