deps: periodic dependency & security updates

[qw-in]

periodic dependency & security updates

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Approved

Rationale: This PR is a routine dependency maintenance change scoped to example projects. It bumps @arcjet/bun, @arcjet/inspect, @types/bun, @mastra/core, and zod to newer pinned versions, and adds a pnpm override for basic-ftp 6.2.1 under get-uri in the firebase-functions example to resolve GHSA-c475-qrg2-pj4r. The override is accompanied by a well-written entry in OVERRIDES.md documenting the reason and removal condition. All versions are pinned exactly (no ranges), no source code or runtime behaviour is changed, and nothing touches auth, infra, or production code. The dependency-changes trigger fires but the changes are well understood and low risk.

Summary of Changes

Periodic dependency bumps in three example projects (bun, firebase-functions, mastra-agent) plus a pnpm override pinning get-uri's basic-ftp transitive to 6.2.1 to address GHSA-c475-qrg2-pj4r, with a matching entry in OVERRIDES.md.

Escalation Triggers

• Dependency Changes: Three example package.json files updated and a new pnpm override added for basic-ftp.

Notes

Path filtering: 2 files excluded by ignore paths. 4 of 6 files included in review.

_{Review: cc06676e | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​bun@​1.3.14 ⏵ 1.4.0				+2
	npm/​@​mastra/​core@​1.59.0 ⏵ 1.63.2			+1		-19
	npm/​@​arcjet/​bun@​1.12.0 ⏵ 1.13.0
	npm/​zod@​4.4.3 ⏵ 4.5.4

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• npm/zod@4.5.4
• npm/@mastra/core@1.63.2

View full report

[qw-in]

@SocketSecurity ignore npm/@mastra/core@1.63.2 npm/zod@4.5.4

@mastra/core@1.63.2: The flagged shell, filesystem, and browser tools require an explicit Workspace; this example configures none and exposes only its authored order and warehouse tools. The EE license and telemetry files are unchanged from 1.59.0, and this example does not use the EE auth paths that emit those events.

zod@4.5.4: The Function constructor builds validators from static, code-defined schemas; keys are escaped and request values stay runtime data. This path already existed in 4.4.3, and this example does not call the opt-in z.compile API.