[jeffdupont]

What

• Dependency audit in CI: new make audit target that runs yarn audit --groups dependencies --level high (runtime deps only) and a Dependency audit CI job that runs it.
  • Yarn 1 exits with a bitmask of every severity it found, and --level only filters the printed list, so the target fails only when the high (8) or critical (16) bit is set. Exit 1 is also Yarn's own error exit, so it fails closed on that.
  • The job runs on push, on pull requests, and weekly (Monday 13:00 UTC), so an advisory published against an unchanged lockfile still shows up.
  • On pull requests the job is continue-on-error: a newly published advisory shows the check red, but the check is not required and does not fail the workflow run. Push and the weekly run still fail.
• Dependabot: .github/dependabot.yml with npm daily at the workspace root (one yarn.lock covers every packages/* workspace) and github-actions weekly for the workflows and the composite actions under .github/actions/*, both with a 7-day cooldown. vitest majors are ignored: vitest 5 drops vite as a dependency, and Yarn 1 then never installs it (see chore(deps-dev): bump vitest from 4.1.9 to 5.0.2 #52, chore(deps): pin vitest 4 and stop the sdk-usage shutdown timeout #164). Same shape as go-ai-sdk (go-ai-sdk#3) and python-ai-sdk (python-ai-sdk#176).

No package.json or yarn.lock changes. The packages the new job flagged are patched on main, and this branch picks them up by merging it: zod 4.6.6 (#163), body-parser 2.4.0 (#167), undici 6.29.1 / 7.30.1 (#169), fast-uri 3.1.9 (#168) and qs 6.17.1 (#198).

Verified locally

On the branch merged with main:

• make audit → 0 vulnerabilities found, exit 0. Against this branch's previous lockfile, the same audit reports 14 high with today's advisory data and exits 14, so the job does fail when it should.
• yarn build, yarn test (all workspaces), yarn typecheck, yarn code:check, yarn api:check, yarn lint:pkg all exit 0.

🤖 Generated with Claude Code

---

Note

Overview
Adds automated dependency hygiene: a new make audit target audits runtime npm deps only and fails on high/critical findings (with Yarn 1–specific exit-code handling), wired into a Dependency audit CI job.

CI now also runs on a weekly schedule (Mondays 13:00 UTC) so advisories against an unchanged lockfile still surface. On pull requests, the audit job is continue-on-error (visible but non-blocking); push and scheduled runs still fail the workflow when audit fails.

Introduces Dependabot for daily npm updates at the Yarn workspace root and weekly GitHub Actions updates (workflows + composite actions), both with a 7-day cooldown, and ignores vitest semver-major updates due to a known Yarn 1 / vite issue.

^{Reviewed by Cursor Bugbot for commit a4985b4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jeffdupont]

Merged main in (e25b9a5):

• yarn.lock is main's. The dependabot merges today superseded this branch's lockfile bumps.
• make audit now runs yarn audit --groups dependencies --level high.
• The audit job has continue-on-error on pull_request, so a newly published advisory doesn't turn every PR red. Push to main and a new weekly schedule (Mon 13:00 UTC) still fail. This matches python-ai-sdk#176.
• dependabot.yml now ignores vitest semver-major. vitest 5 drops vite as a dependency and Yarn 1 doesn't install peers, which is why chore(deps-dev): bump vitest from 4.1.9 to 5.0.2 #52 fails.

Locally, make audit exits 0, and build and typecheck pass. This needs a second approver, since it's jeffdupont's PR.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e25b9a5. Configure here.}