chore: bump July dependency batch (usemoss/moss#357–#377) by samanyugoyal2010 · Pull Request #407 · usemoss/moss

samanyugoyal2010 · 2026-07-17T18:25:54Z

Summary

Bump the July dependency batch across manifests and lockfiles, with compatibility constraints applied where majors break consumers:

pydantic-settings → 2.14.2
protobufjs → 8.7.1 (where present in the dependency tree)
js-yaml → 4.3.0 where safe; gray-matter stays on js-yaml 3.14.2 (safeLoad removed in 4+)
nltk → 3.10.0
esbuild → 0.28.1
cryptography → 49.0.0
vite → 6.4.x for VitePress peers; 8.1.5 only where already a direct Vite 8 consumer
starlette → 1.3.1
undici → 7.28.0 (latest compatible with jsdom/cheerio; undici 8 breaks jsdom)
python-multipart → 0.0.32
PyJWT → 2.13.0
aiohttp → 3.14.1

Also removes inert overrides that did not affect install graphs, syncs pnpm-workspace.yaml overrides for pnpm 11, and relocates .pnpm-store/ next to node_modules/ in .gitignore.

Issues

Closes #357
Closes #358
Closes #359
Closes #360
Closes #361
Closes #362
Closes #363
Closes #364
Closes #366
Closes #374
Closes #375
Closes #377

Pull Request Checklist

Please ensure that your PR meets the following requirements:

I have read the CONTRIBUTING guide.
I have updated the documentation (if applicable).
My code follows the style guidelines of this project.
I have performed a self-review of my own code.
I have added tests that prove my fix is effective or that my feature works.
New and existing unit tests pass locally with my changes.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Dependency maintenance / chore

Update pydantic-settings, protobufjs, js-yaml, nltk, esbuild, cryptography, vite, starlette, undici, python-multipart, PyJWT, and aiohttp to latest across manifests and lockfiles. Refs: usemoss#357 usemoss#358 usemoss#359 usemoss#360 usemoss#361 usemoss#362 usemoss#363 usemoss#364 usemoss#366 usemoss#374 usemoss#375 usemoss#377 Co-authored-by: Cursor <cursoragent@cursor.com>

Pin undici to ^7.28.0 (latest compatible with jsdom) and add @vue/language-core so vitepress-plugin and next-js tests pass. Co-authored-by: Cursor <cursoragent@cursor.com>

Copilot

Pull request overview

This PR updates a July batch of dependencies across the repository’s JavaScript/TypeScript (npm/pnpm) and Python (uv) environments, aligning transitive dependency versions via overrides and refreshing lockfiles used by SDKs, packages, apps, and examples.

Changes:

Added/expanded JS dependency overrides (and pnpm workspace overrides) to standardize versions like vite, esbuild, js-yaml, protobufjs, and undici across multiple workspaces.
Refreshed multiple package-lock.json and uv.lock files to reflect updated resolved versions (e.g., aiohttp, PyJWT, cryptography, starlette).
Minor housekeeping updates (e.g., .gitignore for .pnpm-store/, minimum versions in a Python requirements.txt).

Reviewed changes

Copilot reviewed 21 out of 74 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`sdks/javascript/sdk/package.json`	Adds npm `overrides` to enforce updated transitive dependency versions for the JS SDK.
`sdks/javascript/bindings/package.json`	Adds npm `overrides` for the N-API bindings package dependency tree.
`sdks/javascript/bindings/package-lock.json`	Updates resolved versions (notably `js-yaml` → `5.2.1` and bin path change to `.mjs`).
`packages/vitepress-plugin-moss/pnpm-workspace.yaml`	Introduces pnpm workspace overrides for the plugin workspace.
`packages/vitepress-plugin-moss/package.json`	Updates Vite-related dependencies/peer range and adds overrides used during local installs.
`packages/vitepress-plugin-moss/demo-site/pnpm-workspace.yaml`	Adds pnpm workspace overrides for the demo site.
`packages/vitepress-plugin-moss/demo-site/package.json`	Moves/expands dependency overrides used during local demo-site installs.
`packages/vitepress-plugin-moss/demo-site/documentation/pnpm-workspace.yaml`	Adds pnpm workspace overrides for documentation sub-workspace.
`packages/vitepress-plugin-moss/demo-site/documentation/package.json`	Adds dependency overrides for documentation site tooling.
`packages/vitepress-plugin-moss/demo-site/documentation/package-lock.json`	Updates resolved tooling deps (e.g., `vite` and `rolldown` patch bumps).
`packages/vercel-sdk/package.json`	Adds npm `overrides` to align transitive versions in this package.
`packages/moss-md-indexer/pnpm-workspace.yaml`	Adds pnpm workspace overrides for the md-indexer package.
`packages/moss-md-indexer/package.json`	Updates/expands overrides (including `undici`, `vite`, `js-yaml`, `protobufjs`).
`packages/moss-md-indexer/example/pnpm-workspace.yaml`	Adds pnpm workspace overrides for the example workspace.
`packages/moss-md-indexer/example/package.json`	Adds overrides to keep example tooling versions aligned.
`packages/moss-data-connector/moss-connector-supabase/uv.lock`	Updates Python lockfile entries (e.g., `cryptography`/`pyjwt`, metadata constraints).
`packages/moss-data-connector/moss-connector-sqlite/uv.lock`	Updates Python lockfile metadata constraints (e.g., `exceptiongroup` markers).
`packages/moss-data-connector/moss-connector-mongodb/uv.lock`	Updates Python lockfile metadata constraints (e.g., `exceptiongroup` markers).
`packages/mastra-moss/package.json`	Adds npm `overrides` to align transitive deps.
`package.json`	Updates root overrides to newer versions for tooling dependencies.
`moss-live-labs/python/uv.lock`	Updates lock metadata (e.g., minimum `moss` version spec).
`moss-live-labs/examples/voice-agent/uv.lock`	Updates `aiohttp` and `pyjwt` resolved versions.
`moss-live-labs/examples/semantic-cache/uv.lock`	Updates lockfile dependency markers for `exceptiongroup`.
`moss-live-labs/examples/image-search/setup-py/uv.lock`	Updates lock metadata (e.g., minimum `moss` spec and markers).
`moss-live-labs/examples/image-search/setup-js/package.json`	Updates overrides (notably `protobufjs`) and adds several new override pins.
`moss-live-labs/examples/image-search/setup-js/package-lock.json`	Updates resolved versions (including `@moss-dev/moss`/`moss-core`, tooling deps).
`moss-live-labs/examples/image-search/react-app/package.json`	Bumps `vite` patch and adds overrides to align transitive deps.
`moss-live-labs/examples/image-search/react-app/package-lock.json`	Updates resolved tooling deps (e.g., `vite`, `rolldown`, `js-yaml`).
`moss-live-labs/examples/image-search/backend-py/uv.lock`	Updates `starlette` and lockfile markers.
`examples/voice-agents/insurance-adjuster/uv.lock`	Updates lockfile markers and dependency marker changes for `onnxruntime` deps.
`examples/voice-agents/insurance-adjuster/ui/package.json`	Adds overrides to align tooling dependencies.
`examples/voice-agents/insurance-adjuster/ui/package-lock.json`	Updates resolved `js-yaml` and related metadata.
`examples/moss-pikachu/promo/package.json`	Adds overrides block for aligned tooling deps.
`examples/moss-pikachu/promo/package-lock.json`	Updates resolved `js-yaml` and related metadata.
`examples/javascript/package.json`	Expands overrides beyond `minimatch` to additional tooling deps.
`examples/javascript/package-lock.json`	Updates resolved `js-yaml` and bin path metadata.
`examples/javascript-web/package.json`	Bumps `vite` and adds overrides for aligned tooling deps.
`examples/javascript-web/package-lock.json`	Updates a broad set of resolved tooling deps after the version bumps.
`examples/cookbook/smolagents/uv.lock`	Updates lockfile markers for `exceptiongroup`.
`examples/cookbook/sim/uv.lock`	Updates `starlette` and lockfile markers.
`examples/cookbook/mastra/package.json`	Adds overrides for aligned tooling deps.
`examples/cookbook/mastra/package-lock.json`	Updates lockfile root dependency spec (`@moss-dev/moss`) and resolved transitive deps.
`apps/vapi-moss/uv.lock`	Updates `starlette` and lockfile markers.
`apps/next-js/package.json`	Expands overrides to align tooling deps used in this app.
`apps/moss-vscode/promo/package.json`	Adds overrides for aligned tooling deps.
`apps/moss-vscode/promo/package-lock.json`	Updates resolved `js-yaml` and metadata.
`apps/moss-vscode/package.json`	Adds overrides for aligned tooling deps in the VS Code extension.
`apps/moss-vscode/package-lock.json`	Updates resolved dependency tree; `undici` appears with Node engine metadata.
`apps/moss-llamaindex/backend/requirements.txt`	Adds minimum versions for `python-multipart` and `nltk`.
`apps/elevenlabs-moss/uv.lock`	Updates lockfile markers and minimum `moss` spec in metadata.
`.gitignore`	Ignores local pnpm store directory `.pnpm-store/`.

Files not reviewed (15)

apps/moss-vscode/package-lock.json: Generated file
apps/moss-vscode/promo/package-lock.json: Generated file
examples/cookbook/mastra/package-lock.json: Generated file
examples/javascript-web/package-lock.json: Generated file
examples/javascript/package-lock.json: Generated file
examples/moss-pikachu/promo/package-lock.json: Generated file
examples/voice-agents/insurance-adjuster/ui/package-lock.json: Generated file
moss-live-labs/examples/image-search/react-app/package-lock.json: Generated file
moss-live-labs/examples/image-search/setup-js/package-lock.json: Generated file
packages/mastra-moss/package-lock.json: Generated file
packages/moss-md-indexer/example/pnpm-lock.yaml: Generated file
packages/moss-md-indexer/pnpm-lock.yaml: Generated file
packages/vercel-sdk/package-lock.json: Generated file
packages/vitepress-plugin-moss/demo-site/documentation/package-lock.json: Generated file
packages/vitepress-plugin-moss/demo-site/documentation/pnpm-lock.yaml: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cubic-dev-ai · 2026-07-17T19:19:40Z

@cubic.dev

@samanyugoyal2010 I have started the AI code review. It will take a few minutes to complete.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

samanyugoyal2010 · 2026-07-17T19:25:25Z

@cubic-dev-ai review this pull request

cubic-dev-ai · 2026-07-17T19:25:30Z

@cubic-dev-ai review this pull request

@samanyugoyal2010 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

6 issues found across 74 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="examples/moss-pikachu/promo/package.json">

<violation number="1" location="examples/moss-pikachu/promo/package.json:39">
P2: The Undici override misses this batch's requested 8.7.0 upgrade and will keep any matching transitive dependency on the 7.x line. Aligning the override with 8.7.0 keeps the manifest consistent with the stated dependency update.</violation>
</file>

<file name="packages/moss-md-indexer/example/pnpm-workspace.yaml">

<violation number="1" location="packages/moss-md-indexer/example/pnpm-workspace.yaml:7">
P2: The example workspace still installs undici 7.28.0, so this part of the advertised 8.7.0 dependency update is not applied. Align this override with the batch target and regenerate the lockfile.</violation>
</file>

<file name="examples/cookbook/mastra/package.json">

<violation number="1" location="examples/cookbook/mastra/package.json:26">
P2: The Undici update remains on major 7 even though this batch declares 8.7.0 as its target. Using `^8.7.0` keeps this manifest aligned with the stated dependency update.</violation>
</file>

<file name="packages/moss-md-indexer/pnpm-workspace.yaml">

<violation number="1" location="packages/moss-md-indexer/pnpm-workspace.yaml:7">
P2: The Undici bump described by this PR is not applied here; this override keeps the workspace on the 7.x line and the lockfile resolves 7.28.0. Align this value with the intended 8.7.0 target, after reconciling its Node engine requirement.</violation>
</file>

<file name="packages/mastra-moss/package.json">

<violation number="1" location="packages/mastra-moss/package.json:47">
P2: Published `@moss-tools/mastra` consumers will not receive these dependency remediations because npm ignores `overrides` from installed packages; the local lockfile also has no Undici or protobufjs to override. Runtime constraints should be applied through actual dependencies/upstream packages, while irrelevant local overrides should be omitted.</violation>
</file>

<file name="packages/moss-md-indexer/example/package.json">

<violation number="1" location="packages/moss-md-indexer/example/package.json:22">
P1: Node 18 users of the documented example now receive an unsupported undici through Cheerio because this override requires Node 20.18.1+. Consider retaining a Node-18-compatible undici major or explicitly raising the package requirement, and keep the workspace override in sync.</violation>
</file>

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

Restore Vite 6 for VitePress peers, remove inert overrides, pin js-yaml 3.x under gray-matter, keep undici on 7.28.0 for jsdom, and move .pnpm-store next to node_modules in .gitignore. Co-authored-by: Cursor <cursoragent@cursor.com>

cubic-dev-ai

All reported issues were addressed across 46 files (changes from recent commits).

_{Tip: instead of fixing issues one by one fix them all with cubic
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

@gr2m

Replace gray-matter with @gr2m fork (js-yaml 4), regenerate locks, align Vite/esbuild ranges, trim dead overrides, bound minimatch pins, and set allowBuilds.esbuild to a real boolean. Co-authored-by: Cursor <cursoragent@cursor.com>

cubic-dev-ai

1 issue found across 24 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/moss-md-indexer/package.json">

<violation number="1">
P3: The gray-matter override in this package.json's `overrides` section is redundant. The dependency is already declared as `"npm:@gr2m/gray-matter@4.0.3-with-pr-137"` in `dependencies`, so pnpm already resolves `import ... from 'gray-matter'` to the fork. And the `pnpm-workspace.yaml` already has the same override for all workspace packages, covering any transitive gray-matter resolutions. The duplicate in `overrides` adds no behavioral effect and creates a maintainability hazard — if the fork version is updated later, the override in this file could drift out of sync with the dependency declaration. Consider removing it.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

The direct dependency already aliases @gr2m/gray-matter, and pnpm-workspace.yaml still overrides transitive gray-matter. Co-authored-by: Cursor <cursoragent@cursor.com>

HarshaNalluru · 2026-07-22T07:33:28Z

please resolve merge conflicts

HarshaNalluru

@samanyugoyal2010 merge conflicts

Resolve uv.lock conflicts by regenerating locks from merged pyproject manifests while keeping intentional July dependency pins. Co-authored-by: Cursor <cursoragent@cursor.com>

samanyugoyal2010 · 2026-07-23T06:33:50Z

@HarshaNalluru the issue should be fixed now

samanyugoyal2010 requested review from HarshaNalluru and r4ghu as code owners July 17, 2026 18:25

fix: restore CI after undici/jsdom and vitepress build breaks

ea636e4

Pin undici to ^7.28.0 (latest compatible with jsdom) and add @vue/language-core so vitepress-plugin and next-js tests pass. Co-authored-by: Cursor <cursoragent@cursor.com>

HarshaNalluru requested a review from Copilot July 17, 2026 19:14

Copilot started reviewing on behalf of HarshaNalluru July 17, 2026 19:15 View session

HarshaNalluru previously approved these changes Jul 17, 2026

View reviewed changes

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Comment thread package.json Outdated

Comment thread packages/vitepress-plugin-moss/package.json Outdated

Comment thread examples/cookbook/mastra/package-lock.json

Potential fix for pull request finding

bd45da5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

samanyugoyal2010 dismissed HarshaNalluru’s stale review via bd45da5 July 17, 2026 19:20

cubic-dev-ai Bot reviewed Jul 17, 2026

View reviewed changes

fix: drop redundant gray-matter override in md-indexer

d1b0d21

The direct dependency already aliases @gr2m/gray-matter, and pnpm-workspace.yaml still overrides transitive gray-matter. Co-authored-by: Cursor <cursoragent@cursor.com>

HarshaNalluru approved these changes Jul 17, 2026

View reviewed changes

HarshaNalluru requested changes Jul 23, 2026

View reviewed changes

Merge origin/main into issues-july-bulk

80422e5

Resolve uv.lock conflicts by regenerating locks from merged pyproject manifests while keeping intentional July dependency pins. Co-authored-by: Cursor <cursoragent@cursor.com>

samanyugoyal2010 requested a review from HarshaNalluru July 23, 2026 06:33

Uh oh!

Conversation

samanyugoyal2010 commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Issues

Pull Request Checklist

Type of Change

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot commented Jul 17, 2026

Uh oh!

samanyugoyal2010 commented Jul 17, 2026

Uh oh!

cubic-dev-ai Bot commented Jul 17, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

HarshaNalluru commented Jul 22, 2026

Uh oh!

HarshaNalluru left a comment

Choose a reason for hiding this comment

Uh oh!

samanyugoyal2010 commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

samanyugoyal2010 commented Jul 17, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading