[failproofai-legion-904] Clear the fixable Dependabot alerts: mcp in the SDK lock, sprintf-js in two fixtures

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.0.12-beta.0 — 2026-10-16
+
+### Dependencies
+
+- Patch `mcp` 1.28.1 → 1.30.0 (GHSA-84m7-p3x7-pcfv) in the Python SDK's test lockfile, the finding that turned `main`'s Supply Chain gate red. crewai pins `mcp~=1.28.1`, so the fix is a `[tool.uv] override-dependencies` entry in `sdk/python/pyproject.toml`; uv applies it only when resolving `uv.lock`, and the published package's metadata is unchanged (#904)
+- Remove `sprintf-js` (GHSA-hp3w-g68c-fv3c, no fixed release) from the `nextjs` and `mastra-1` SDK integration fixtures with an `argparse` 2.0.1 override. Both reached it through `@mastra/core` → `gray-matter` → `js-yaml@3` → `argparse@1`, and js-yaml 3 loads `argparse` only from its CLI, which nothing runs; every pin stays put (#904)
+
 ## 1.0.11 — 2026-10-15
 
 The first stable release with the new terminal experience and OpenTelemetry. Everything below in the `1.0.11-beta.*` sections ships here; the highlights:

sdk/python/pyproject.toml

@@ -74,6 +74,18 @@ llamaindex = ["llama-index-core>=0.14.23,<0.15"]
 pydantic-ai = ["pydantic-ai-slim>=2.0,<3"]      # 2.0 removed Agent(instrument=...)
 otel = ["opentelemetry-sdk>=1.39,<2"]          # optional SpanExporter / processor APIs
 
+# Read by uv only when it resolves uv.lock, the dev/test lockfile. It is not package
+# metadata, so it never reaches anyone installing `failproofai-sdk[crewai]`.
+#
+# crewai pins `mcp~=1.28.1`, and mcp 1.8.0 through 1.29.1 carry GHSA-84m7-p3x7-pcfv
+# (unbounded Streamable HTTP sessions). The fix, 1.30.0, is outside that pin, so no
+# in-range update reaches it; this is the uv equivalent of an npm `overrides` entry.
+# The ceiling keeps crewai on the 1.x API it is written against. Delete this once a
+# crewai release allows 1.30: an override replaces crewai's own requirement outright,
+# so while it is here uv does not check the mcp version crewai asks for.
+[tool.uv]
+override-dependencies = ["mcp>=1.30.0,<2"]
+
 [tool.setuptools.dynamic]
 version = { attr = "failproofai_sdk._version.__version__" }
 

sdk/typescript/CHANGELOG.md

@@ -12,7 +12,14 @@ section is missing or empty is refused before anything is built.
 
 ### Fixes
 
-- _Nothing yet._
+- **`nextjs` and `mastra-1` drop `sprintf-js`.** Every release through `1.1.3`
+  carries GHSA-hp3w-g68c-fv3c and none fixes it, so the fix is to take it out of
+  the tree. Both fixtures reached it only through `@mastra/core@1.68.0` →
+  `gray-matter@4.0.3` → `js-yaml@3.15.2` → `argparse@1.0.10`, and js-yaml 3 loads
+  `argparse` from its `js-yaml` CLI alone, never from the library `gray-matter`
+  calls. A fixture-local `overrides` entry moves `argparse` to `2.0.1`, which has no
+  dependencies. Each lockfile changes by those two packages and nothing else, and
+  `npm audit` on both now reports no findings. (#904)
 
 ## 0.0.1-beta.1 — 2026-10-15
 

sdk/typescript/integration/fixtures/mastra-1/package.json

@@ -13,6 +13,7 @@
     "@types/node": "22.20.4"
   },
   "overrides": {
-    "@modelcontextprotocol/client": "2.2.0"
+    "@modelcontextprotocol/client": "2.2.0",
+    "argparse": "2.0.1"
   }
 }

sdk/typescript/integration/fixtures/nextjs/package.json

@@ -24,5 +24,8 @@
     "@types/node": "22.20.4",
     "@types/react": "19.3.0",
     "typescript": "5.9.3"
+  },
+  "overrides": {
+    "argparse": "2.0.1"
   }
 }