deps: periodic dependency & security updates

[qw-in]

periodic dependency & security updates

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
arcjet-docs	Ready	Preview	Oct 13, 2026 7:39pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.5 ⏵ 16.4.0		+75	+1
	@​arcjet/​sensitive-info-rampart@​1.14.0 ⏵ 1.14.1	+1			+1
	@​astrojs/​markdown-remark@​7.3.1 ⏵ 7.3.2				+2
	@​arcjet/​react-router@​1.14.0 ⏵ 1.14.1	+1			+1
	@​arcjet/​deno@​1.14.0 ⏵ 1.14.1	+1			+1
	@​arcjet/​remix@​1.14.0 ⏵ 1.14.1	+1			+1
	@​arcjet/​sveltekit@​1.14.0 ⏵ 1.14.1	+1			+1
	@​nosecone/​sveltekit@​1.14.0 ⏵ 1.14.1	+2			+1
	@​arcjet/​nuxt@​1.14.0 ⏵ 1.14.1	+1			+1
	@​arcjet/​fastify@​1.14.0 ⏵ 1.14.1	+2			+1
	@​arcjet/​bun@​1.14.0 ⏵ 1.14.1	+2		+1	+1
	@​arcjet/​astro@​1.14.0 ⏵ 1.14.1	+1			+1
	@​arcjet/​nest@​1.14.0 ⏵ 1.14.1	+2			+1
	@​types/​node@​24.13.5 ⏵ 24.19.1	+1		+1
	@​astrojs/​node@​11.1.5 ⏵ 11.1.7	+1		+1
	@​astrojs/​react@​6.0.5 ⏵ 6.0.6				+1
	posthog-js@​1.433.5 ⏵ 1.438.1			+1
	@​astrojs/​vercel@​11.0.10 ⏵ 11.0.12	+1		+1	+1
	@​arcjet/​decorate@​1.14.0 ⏵ 1.14.1	-4			+1
	@​astrojs/​starlight@​0.42.1 ⏵ 0.42.5	+1		+1	+1
	@​arcjet/​node@​1.14.0 ⏵ 1.14.1	+2			+1
	astro@​7.3.2 ⏵ 7.3.6	+1		+1	+1
	pino-pretty@​13.1.3 ⏵ 13.2.0	+1			+6
	nanostores@​1.5.3 ⏵ 1.5.5	+1		+1	+1
	type-fest@​5.9.0 ⏵ 5.10.0	+1		+1
	@​arcjet/​protocol@​1.14.0 ⏵ 1.14.1				+1
	pino@​10.3.1 ⏵ 10.4.0	+1
	@​arcjet/​redact@​1.14.0 ⏵ 1.14.1	-1			+1
	sharp@​0.35.4 ⏵ 0.35.5	+1	+16	+1
	@​arcjet/​inspect@​1.14.0 ⏵ 1.14.1	-1			+1
	@​clerk/​nextjs@​6.39.6 ⏵ 6.39.7
	@​hono/​node-server@​2.1.1 ⏵ 2.1.3	+1
See 12 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm @arcjet/sensitive-info-rampart License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (package/models/rampart/LICENSE) From: package-lock.json → npm/@arcjet/sensitive-info-rampart@1.14.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@arcjet/sensitive-info-rampart@1.14.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Approved

Rationale: Dependency-only PR with patch/minor bumps and new npm overrides targeting a batch of published advisories (undici GHSA-w293-vg96-wgc3, multer GHSA-3pph-fpjx-jg34, plus upstream fixes for proxy-addr, shell-quote, seroval, http-cache-semantics, MCP SDK, fast-copy, DOMPurify delivered via @arcjet, @astrojs, hono, nuxt/nanostores, etc.). All version movements are forward-only within a stable major, snippet package.json files are kept in lockstep with the root for @arcjet 1.14.1 and astro 7.3.6, and the new .npmrc comments document the two new overrides. One escalation trigger (dependency-changes) fires but the scope is well-understood and clearly security-motivated, so I'm comfortable approving.

Summary of Changes

Periodic dependency refresh: patch/minor bumps across @arcjet, @astrojs, @nestjs, @clerk, hono, next, pino, sass, sharp, type-fest, @types/node, etc.; adds npm overrides pinning undici to 7.29.1 under @ai-sdk/provider-utils and 8.10.2 under eve, and bumps the multer override from 2.3.0 → 2.4.0. Snippet package.jsons for astro, fastify, and nuxt are brought in line with the root versions.

Escalation Triggers

• Dependency Changes: package.json and three snippet package.json files updated; new overrides added for undici (two scopes) and multer bumped.

Notes

Lockfile is outside the path filter and not visible here — assume CI will catch any resolution drift. Worth confirming that the eve → undici 8.10.2 override is honoured given eve pins undici 8.9.0 exactly (npm overrides do replace exact pins, but it's the kind of thing to watch in CI output).

Path filtering: 1 file excluded by ignore paths. 5 of 6 files included in review.

_{Review: badebba5 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}