chore: bump July dependency batch (usemoss/moss#357–#377) by samanyugoyal2010 · Pull Request #407 · usemoss/moss

samanyugoyal2010 · 2026-07-17T18:25:54Z

Summary

Bump the July dependency batch across manifests and lockfiles, with compatibility constraints applied where majors break consumers:

pydantic-settings → 2.14.2
protobufjs → 8.7.1 (where present in the dependency tree)
js-yaml → 4.3.0 where safe; gray-matter stays on js-yaml 3.14.2 (safeLoad removed in 4+)
nltk → 3.10.0
esbuild → 0.28.1
cryptography → 49.0.0
vite → 6.4.x for VitePress peers; 8.1.5 only where already a direct Vite 8 consumer
starlette → 1.3.1
undici → 7.28.0 (latest compatible with jsdom/cheerio; undici 8 breaks jsdom)
python-multipart → 0.0.32
PyJWT → 2.13.0
aiohttp → 3.14.1

Also removes inert overrides that did not affect install graphs, syncs pnpm-workspace.yaml overrides for pnpm 11, and relocates .pnpm-store/ next to node_modules/ in .gitignore.

Issues

Closes #357
Closes #358
Closes #359
Closes #360
Closes #361
Closes #362
Closes #363
Closes #364
Closes #366
Closes #374
Closes #375
Closes #377

Pull Request Checklist

Please ensure that your PR meets the following requirements:

I have read the CONTRIBUTING guide.
I have updated the documentation (if applicable).
My code follows the style guidelines of this project.
I have performed a self-review of my own code.
I have added tests that prove my fix is effective or that my feature works.
New and existing unit tests pass locally with my changes.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Dependency maintenance / chore

Update pydantic-settings, protobufjs, js-yaml, nltk, esbuild, cryptography, vite, starlette, undici, python-multipart, PyJWT, and aiohttp to latest across manifests and lockfiles. Refs: usemoss#357 usemoss#358 usemoss#359 usemoss#360 usemoss#361 usemoss#362 usemoss#363 usemoss#364 usemoss#366 usemoss#374 usemoss#375 usemoss#377 Co-authored-by: Cursor <cursoragent@cursor.com>

Pin undici to ^7.28.0 (latest compatible with jsdom) and add @vue/language-core so vitepress-plugin and next-js tests pass. Co-authored-by: Cursor <cursoragent@cursor.com>

Copilot

Pull request overview

This PR updates a July batch of dependencies across the repository’s JavaScript/TypeScript (npm/pnpm) and Python (uv) environments, aligning transitive dependency versions via overrides and refreshing lockfiles used by SDKs, packages, apps, and examples.

Changes:

Added/expanded JS dependency overrides (and pnpm workspace overrides) to standardize versions like vite, esbuild, js-yaml, protobufjs, and undici across multiple workspaces.
Refreshed multiple package-lock.json and uv.lock files to reflect updated resolved versions (e.g., aiohttp, PyJWT, cryptography, starlette).
Minor housekeeping updates (e.g., .gitignore for .pnpm-store/, minimum versions in a Python requirements.txt).

Reviewed changes

Copilot reviewed 21 out of 74 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`sdks/javascript/sdk/package.json`	Adds npm `overrides` to enforce updated transitive dependency versions for the JS SDK.
`sdks/javascript/bindings/package.json`	Adds npm `overrides` for the N-API bindings package dependency tree.
`sdks/javascript/bindings/package-lock.json`	Updates resolved versions (notably `js-yaml` → `5.2.1` and bin path change to `.mjs`).
`packages/vitepress-plugin-moss/pnpm-workspace.yaml`	Introduces pnpm workspace overrides for the plugin workspace.
`packages/vitepress-plugin-moss/package.json`	Updates Vite-related dependencies/peer range and adds overrides used during local installs.
`packages/vitepress-plugin-moss/demo-site/pnpm-workspace.yaml`	Adds pnpm workspace overrides for the demo site.
`packages/vitepress-plugin-moss/demo-site/package.json`	Moves/expands dependency overrides used during local demo-site installs.
`packages/vitepress-plugin-moss/demo-site/documentation/pnpm-workspace.yaml`	Adds pnpm workspace overrides for documentation sub-workspace.
`packages/vitepress-plugin-moss/demo-site/documentation/package.json`	Adds dependency overrides for documentation site tooling.
`packages/vitepress-plugin-moss/demo-site/documentation/package-lock.json`	Updates resolved tooling deps (e.g., `vite` and `rolldown` patch bumps).
`packages/vercel-sdk/package.json`	Adds npm `overrides` to align transitive versions in this package.
`packages/moss-md-indexer/pnpm-workspace.yaml`	Adds pnpm workspace overrides for the md-indexer package.
`packages/moss-md-indexer/package.json`	Updates/expands overrides (including `undici`, `vite`, `js-yaml`, `protobufjs`).
`packages/moss-md-indexer/example/pnpm-workspace.yaml`	Adds pnpm workspace overrides for the example workspace.
`packages/moss-md-indexer/example/package.json`	Adds overrides to keep example tooling versions aligned.
`packages/moss-data-connector/moss-connector-supabase/uv.lock`	Updates Python lockfile entries (e.g., `cryptography`/`pyjwt`, metadata constraints).
`packages/moss-data-connector/moss-connector-sqlite/uv.lock`	Updates Python lockfile metadata constraints (e.g., `exceptiongroup` markers).
`packages/moss-data-connector/moss-connector-mongodb/uv.lock`	Updates Python lockfile metadata constraints (e.g., `exceptiongroup` markers).
`packages/mastra-moss/package.json`	Adds npm `overrides` to align transitive deps.
`package.json`	Updates root overrides to newer versions for tooling dependencies.
`moss-live-labs/python/uv.lock`	Updates lock metadata (e.g., minimum `moss` version spec).
`moss-live-labs/examples/voice-agent/uv.lock`	Updates `aiohttp` and `pyjwt` resolved versions.
`moss-live-labs/examples/semantic-cache/uv.lock`	Updates lockfile dependency markers for `exceptiongroup`.
`moss-live-labs/examples/image-search/setup-py/uv.lock`	Updates lock metadata (e.g., minimum `moss` spec and markers).
`moss-live-labs/examples/image-search/setup-js/package.json`	Updates overrides (notably `protobufjs`) and adds several new override pins.
`moss-live-labs/examples/image-search/setup-js/package-lock.json`	Updates resolved versions (including `@moss-dev/moss`/`moss-core`, tooling deps).
`moss-live-labs/examples/image-search/react-app/package.json`	Bumps `vite` patch and adds overrides to align transitive deps.
`moss-live-labs/examples/image-search/react-app/package-lock.json`	Updates resolved tooling deps (e.g., `vite`, `rolldown`, `js-yaml`).
`moss-live-labs/examples/image-search/backend-py/uv.lock`	Updates `starlette` and lockfile markers.
`examples/voice-agents/insurance-adjuster/uv.lock`	Updates lockfile markers and dependency marker changes for `onnxruntime` deps.
`examples/voice-agents/insurance-adjuster/ui/package.json`	Adds overrides to align tooling dependencies.
`examples/voice-agents/insurance-adjuster/ui/package-lock.json`	Updates resolved `js-yaml` and related metadata.
`examples/moss-pikachu/promo/package.json`	Adds overrides block for aligned tooling deps.
`examples/moss-pikachu/promo/package-lock.json`	Updates resolved `js-yaml` and related metadata.
`examples/javascript/package.json`	Expands overrides beyond `minimatch` to additional tooling deps.
`examples/javascript/package-lock.json`	Updates resolved `js-yaml` and bin path metadata.
`examples/javascript-web/package.json`	Bumps `vite` and adds overrides for aligned tooling deps.
`examples/javascript-web/package-lock.json`	Updates a broad set of resolved tooling deps after the version bumps.
`examples/cookbook/smolagents/uv.lock`	Updates lockfile markers for `exceptiongroup`.
`examples/cookbook/sim/uv.lock`	Updates `starlette` and lockfile markers.
`examples/cookbook/mastra/package.json`	Adds overrides for aligned tooling deps.
`examples/cookbook/mastra/package-lock.json`	Updates lockfile root dependency spec (`@moss-dev/moss`) and resolved transitive deps.
`apps/vapi-moss/uv.lock`	Updates `starlette` and lockfile markers.
`apps/next-js/package.json`	Expands overrides to align tooling deps used in this app.
`apps/moss-vscode/promo/package.json`	Adds overrides for aligned tooling deps.
`apps/moss-vscode/promo/package-lock.json`	Updates resolved `js-yaml` and metadata.
`apps/moss-vscode/package.json`	Adds overrides for aligned tooling deps in the VS Code extension.
`apps/moss-vscode/package-lock.json`	Updates resolved dependency tree; `undici` appears with Node engine metadata.
`apps/moss-llamaindex/backend/requirements.txt`	Adds minimum versions for `python-multipart` and `nltk`.
`apps/elevenlabs-moss/uv.lock`	Updates lockfile markers and minimum `moss` spec in metadata.
`.gitignore`	Ignores local pnpm store directory `.pnpm-store/`.

Files not reviewed (15)

apps/moss-vscode/package-lock.json: Generated file
apps/moss-vscode/promo/package-lock.json: Generated file
examples/cookbook/mastra/package-lock.json: Generated file
examples/javascript-web/package-lock.json: Generated file
examples/javascript/package-lock.json: Generated file
examples/moss-pikachu/promo/package-lock.json: Generated file
examples/voice-agents/insurance-adjuster/ui/package-lock.json: Generated file
moss-live-labs/examples/image-search/react-app/package-lock.json: Generated file
moss-live-labs/examples/image-search/setup-js/package-lock.json: Generated file
packages/mastra-moss/package-lock.json: Generated file
packages/moss-md-indexer/example/pnpm-lock.yaml: Generated file
packages/moss-md-indexer/pnpm-lock.yaml: Generated file
packages/vercel-sdk/package-lock.json: Generated file
packages/vitepress-plugin-moss/demo-site/documentation/package-lock.json: Generated file
packages/vitepress-plugin-moss/demo-site/documentation/pnpm-lock.yaml: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cubic-dev-ai · 2026-07-17T19:19:40Z

@cubic.dev

@samanyugoyal2010 I have started the AI code review. It will take a few minutes to complete.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

samanyugoyal2010 · 2026-07-17T19:25:25Z

@cubic-dev-ai review this pull request

cubic-dev-ai · 2026-07-17T19:25:30Z

@cubic-dev-ai review this pull request

@samanyugoyal2010 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 74 files

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

Restore Vite 6 for VitePress peers, remove inert overrides, pin js-yaml 3.x under gray-matter, keep undici on 7.28.0 for jsdom, and move .pnpm-store next to node_modules in .gitignore. Co-authored-by: Cursor <cursoragent@cursor.com>

cubic-dev-ai

All reported issues were addressed across 46 files (changes from recent commits).

_{Tip: instead of fixing issues one by one fix them all with cubic
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

@gr2m

Replace gray-matter with @gr2m fork (js-yaml 4), regenerate locks, align Vite/esbuild ranges, trim dead overrides, bound minimatch pins, and set allowBuilds.esbuild to a real boolean. Co-authored-by: Cursor <cursoragent@cursor.com>

cubic-dev-ai

1 issue found across 24 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/moss-md-indexer/package.json">

<violation number="1">
P3: The gray-matter override in this package.json's `overrides` section is redundant. The dependency is already declared as `"npm:@gr2m/gray-matter@4.0.3-with-pr-137"` in `dependencies`, so pnpm already resolves `import ... from 'gray-matter'` to the fork. And the `pnpm-workspace.yaml` already has the same override for all workspace packages, covering any transitive gray-matter resolutions. The duplicate in `overrides` adds no behavioral effect and creates a maintainability hazard — if the fork version is updated later, the override in this file could drift out of sync with the dependency declaration. Consider removing it.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

The direct dependency already aliases @gr2m/gray-matter, and pnpm-workspace.yaml still overrides transitive gray-matter. Co-authored-by: Cursor <cursoragent@cursor.com>

HarshaNalluru · 2026-07-22T07:33:28Z

please resolve merge conflicts

HarshaNalluru

@samanyugoyal2010 merge conflicts

Resolve uv.lock conflicts by regenerating locks from merged pyproject manifests while keeping intentional July dependency pins. Co-authored-by: Cursor <cursoragent@cursor.com>

samanyugoyal2010 · 2026-07-23T06:33:50Z

@HarshaNalluru the issue should be fixed now

HarshaNalluru · 2026-07-23T08:17:08Z

@samanyugoyal2010 please resolve all the conversations.

HarshaNalluru · 2026-07-28T21:55:20Z

@samanyugoyal2010 checks failing and merge conflicts

Resolve conflicts across dependency manifests and lockfiles. Manifests: - Keep main's pnpm-workspace.yaml structure (onlyBuiltDependencies / allowBuilds / ignoredBuiltDependencies) and take the higher pin from each side; carry over the branch's undici, protobufjs and gray-matter overrides. - vitepress-plugin-moss stays a direct Vite 8 consumer per main (usemoss#398); VitePress-peer projects stay on vite ^6.4.3. - Merge the duplicate "overrides" blocks the branch introduced in 10 package.json files. The duplicate JSON key silently dropped main's block, which would have reverted its postcss / fast-uri pins. - Drop the vite ^6.4.x overrides from mastra-moss, vercel-sdk and sdks/javascript/sdk: vite is only a vitest transitive dep there, and the override downgraded main's vite 7.3.6 / 8.1.3. Lockfiles regenerated from the resolved manifests rather than merged by hand; daytona uv.lock keeps main's langsmith 0.10.10 while taking the branch's langchain and python-multipart bumps. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

github-actions · 2026-07-31T06:44:54Z

Codex review

No issues found.

The batch dropped the "minimatch": "^9.0.7" override as an inert cleanup, but it was load-bearing: without it @typescript-eslint/typescript-estree resolved minimatch 9.0.3, below the >=9.0.7 floor main enforces, and four other subtrees fell back to 3.1.5. Restore the override alongside the new esbuild/js-yaml ones and regenerate the lockfile. All six minimatch subtrees now resolve 9.0.9, matching main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Address three blocking review findings: - sdks/javascript/sdk: drop the global "esbuild": "^0.28.1" override. esbuild is pre-1.0, so ^0.28.1 pushed esbuild-plugin-obfuscator (declares ^0.25.5) and tsx (declares ~0.25.0) outside their supported ranges. The direct devDependency still pins top-level esbuild at 0.28.1; nested tools resolve 0.25.12 within their own ranges. - image-search/setup-js: onnxruntime-web declares protobufjs ^7.2.4, so overriding it to ^8.7.1 forced a major it does not support. Scope the override to ^7.6.5, the latest patched 7.x inside that range. - livekit-moss-agent/uv.lock: regenerate from main with targeted upgrades only. The batch had rolled mcp 1.28.1 -> 1.23.0, pillow 12.3.0 -> 12.2.0 and pyasn1 0.6.4 -> 0.6.3 with no manifest change to justify them. Lock now carries only cryptography 49.0.0, pydantic-settings 2.14.2 and python-multipart 0.0.32. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

samanyugoyal2010 · 2026-07-31T07:03:31Z

@HarshaNalluru you can review and merge

samanyugoyal2010 requested review from HarshaNalluru and r4ghu as code owners July 17, 2026 18:25

fix: restore CI after undici/jsdom and vitepress build breaks

ea636e4

Pin undici to ^7.28.0 (latest compatible with jsdom) and add @vue/language-core so vitepress-plugin and next-js tests pass. Co-authored-by: Cursor <cursoragent@cursor.com>

HarshaNalluru requested a review from Copilot July 17, 2026 19:14

Copilot started reviewing on behalf of HarshaNalluru July 17, 2026 19:15 View session

HarshaNalluru previously approved these changes Jul 17, 2026

View reviewed changes

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Comment thread package.json Outdated

Comment thread packages/vitepress-plugin-moss/package.json Outdated

Comment thread examples/cookbook/mastra/package-lock.json

Potential fix for pull request finding

bd45da5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

samanyugoyal2010 dismissed HarshaNalluru’s stale review via bd45da5 July 17, 2026 19:20

cubic-dev-ai Bot reviewed Jul 17, 2026

View reviewed changes

fix: drop redundant gray-matter override in md-indexer

d1b0d21

The direct dependency already aliases @gr2m/gray-matter, and pnpm-workspace.yaml still overrides transitive gray-matter. Co-authored-by: Cursor <cursoragent@cursor.com>

HarshaNalluru approved these changes Jul 17, 2026

View reviewed changes

HarshaNalluru requested changes Jul 23, 2026

View reviewed changes

Merge origin/main into issues-july-bulk

80422e5

Resolve uv.lock conflicts by regenerating locks from merged pyproject manifests while keeping intentional July dependency pins. Co-authored-by: Cursor <cursoragent@cursor.com>

samanyugoyal2010 requested a review from HarshaNalluru July 23, 2026 06:33

HarshaNalluru previously approved these changes Jul 23, 2026

View reviewed changes

Merge branch 'main' into issues-july-bulk

9cad4e4

samanyugoyal2010 dismissed HarshaNalluru’s stale review via 9cad4e4 July 23, 2026 18:13

HarshaNalluru closed this Jul 25, 2026

HarshaNalluru reopened this Jul 25, 2026

samanyugoyal2010 requested a review from ashvathsureshkumar as a code owner July 31, 2026 06:40

samanyugoyal2010 and others added 2 commits July 30, 2026 23:48

Uh oh!

Conversation

samanyugoyal2010 commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Issues

Pull Request Checklist

Type of Change

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot commented Jul 17, 2026

Uh oh!

samanyugoyal2010 commented Jul 17, 2026

Uh oh!

cubic-dev-ai Bot commented Jul 17, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

HarshaNalluru commented Jul 22, 2026

Uh oh!

HarshaNalluru left a comment

Choose a reason for hiding this comment

Uh oh!

samanyugoyal2010 commented Jul 23, 2026

Uh oh!

HarshaNalluru commented Jul 23, 2026

Uh oh!

HarshaNalluru commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex review

Uh oh!

samanyugoyal2010 commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

samanyugoyal2010 commented Jul 17, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading