refactor: Upgrading libs to fix vulnerabilities

.changeset/mighty-bottles-poke.md

@@ -0,0 +1,9 @@
+---
+"@outputai/cli": patch
+"@outputai/llm": patch
+"output-api": patch
+"@outputai/core": patch
+"@outputai/http": patch
+---
+
+Updating libraries to fix vulnerabilities

package.json

@@ -35,8 +35,7 @@
     "typedoc": "0.28.19",
     "typescript": "5.9.3",
     "typescript-eslint": "8.59.1",
-    "vite": "7.3.3",
-    "vite-tsconfig-paths": "6.1.1",
+    "vite": "8.0.16",
     "vitest": "4.1.5"
   },
   "license": "UNLICENSED",

pnpm-workspace.yaml

@@ -19,7 +19,7 @@ catalog:
   js-yaml: 4.1.1
   ky: 1.14.3
   semver: 7.7.4
-  undici: 8.1.0
+  undici: 8.5.0
   winston: 3.19.0
   zod: 4.3.6
 
@@ -32,29 +32,33 @@ minimumReleaseAgeExclude:
 
 overrides:
   '@anthropic-ai/sdk@>=0.79.0 <0.91.1': '>=0.91.1'
-  '@types/node@<24': '>=24.10.15'
+  '@grpc/grpc-js@>=1.14.0 <1.14.4': '>=1.14.4'
   '@hono/node-server@<1.19.13': '>=1.19.13'
-  axios@>=1.0.0 <1.15.2: '>=1.15.2'
+  '@types/node@<24': '>=24.10.15'
+  axios@>=1.0.0 <1.16.0: '>=1.16.1'
   body-parser@<1.20.3: '>=1.20.3'
   cookie@<0.7.0: '>=0.7.0'
+  esbuild@>=0.27.3 <0.28.1: '>=0.28.1'
   express@<4.20.0: '>=4.20.0'
   follow-redirects@<=1.15.11: '>=1.16.0'
-  hono@<4.12.14: '>=4.12.14'
+  form-data@>=4.0.0 <4.0.6: '>=4.0.6'
+  hono@<4.12.14: '>=4.12.25'
   js-yaml@>=4.0.0 <4.1.1: '>=4.1.1'
   liquidjs@<10.26.0: '>=10.26.0'
   lodash@<=4.17.23: '>=4.18.0'
+  markdown-it@<=14.1.1: '>=14.2.0'
   minimatch@<3.1.4: '>=3.1.4'
   path-to-regexp@<0.1.13: '>=0.1.13'
   path-to-regexp@>=8.0.0 <8.4.0: '>=8.4.0'
   postcss@<8.5.10: '>=8.5.10'
-  protobufjs@<=7.5.7: '>=7.5.8'
-  qs@<=6.14.1: '>=6.14.2'
+  protobufjs@<=7.6.2: '>=7.6.3'
+  protobufjs@>=8.0.0 <=8.5.0: '>=8.6.0'
   qs@>=6.11.1 <=6.15.1: '>=6.15.2'
   send@<0.19.0: '>=0.19.0'
   serve-static@<1.16.0: '>=1.16.0'
-  tar@<=7.5.10: '>=7.5.11'
+  tar@<=7.5.10: '>=7.5.16'
   uuid@<14.0.0: '>=14.0.0'
-  ws@>=8.0.0 <8.20.1: '>=8.20.1'
+  ws@>=8.0.0 <8.20.1: '>=8.21.0'
   zod@<=3.22.2: '>=3.22.3'
 
 strictDepBuilds: true

sdk/cli/src/commands/workflow/generate.spec.ts

@@ -5,8 +5,8 @@ import { generateWorkflow } from '#services/workflow_generator.js';
 import { parseWorkflowDir } from '#utils/workflow_dir_parser.js';
 import { InvalidNameError, WorkflowExistsError } from '#types/errors.js';
 
-vi.mock( '../../services/workflow_generator.js' );
-vi.mock( '../../utils/workflow_dir_parser.js' );
+vi.mock( '#services/workflow_generator.js' );
+vi.mock( '#utils/workflow_dir_parser.js' );
 
 describe( 'Generate Command', () => {
   let mockGenerateWorkflow: any;

sdk/cli/src/services/coding_agents.spec.ts

@@ -10,13 +10,13 @@ import { access } from 'node:fs/promises';
 import fs from 'node:fs/promises';
 
 vi.mock( 'node:fs/promises' );
-vi.mock( '../utils/paths.js', () => ( {
+vi.mock( '#utils/paths.js', () => ( {
   getTemplateDir: vi.fn().mockReturnValue( '/templates' )
 } ) );
-vi.mock( '../utils/template.js', () => ( {
+vi.mock( '#utils/template.js', () => ( {
   processTemplate: vi.fn().mockImplementation( ( content: string ) => content )
 } ) );
-vi.mock( '../utils/claude.js', () => ( {
+vi.mock( '#utils/claude.js', () => ( {
   executeClaudeCommand: vi.fn().mockResolvedValue( undefined )
 } ) );
 vi.mock( '@oclif/core', () => ( {
@@ -199,7 +199,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should call registerPluginMarketplace and installOutputAIPlugin', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
 
       await ensureClaudePlugin( '/test/project' );
 
@@ -219,7 +219,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should show error and prompt user when plugin commands fail', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
       const { confirm } = await import( '#utils/prompt.js' );
 
       vi.mocked( executeClaudeCommand )
@@ -240,7 +240,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should allow user to proceed without plugin setup if they confirm', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
       const { confirm } = await import( '#utils/prompt.js' );
 
       vi.mocked( executeClaudeCommand )
@@ -304,7 +304,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should show error and prompt user when registerPluginMarketplace fails', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
       const { confirm } = await import( '#utils/prompt.js' );
 
       vi.mocked( executeClaudeCommand )
@@ -325,7 +325,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should show error and prompt user when installOutputAIPlugin fails', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
       const { confirm } = await import( '#utils/prompt.js' );
 
       vi.mocked( executeClaudeCommand )
@@ -347,7 +347,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should allow user to proceed without plugin setup if they confirm', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
       const { confirm } = await import( '#utils/prompt.js' );
 
       vi.mocked( executeClaudeCommand )
@@ -364,7 +364,7 @@ describe( 'coding_agents service', () => {
     } );
 
     it( 'should rethrow plugin error in non-interactive mode without prompting', async () => {
-      const { executeClaudeCommand } = await import( '../utils/claude.js' );
+      const { executeClaudeCommand } = await import( '#utils/claude.js' );
       const { confirm } = await import( '#utils/prompt.js' );
       const { isInteractive } = await import( '#utils/interactive.js' );
 

sdk/llm/package.json

@@ -16,22 +16,22 @@
     "undici": "catalog:"
   },
   "devDependencies": {
-    "ai": "6.0.168",
     "@ai-sdk/amazon-bedrock": "4.0.111",
     "@ai-sdk/anthropic": "3.0.81",
     "@ai-sdk/azure": "3.0.68",
     "@ai-sdk/google-vertex": "4.0.140",
     "@ai-sdk/openai": "3.0.67",
-    "@ai-sdk/perplexity": "3.0.33"
+    "@ai-sdk/perplexity": "3.0.33",
+    "ai": "6.0.168"
   },
   "peerDependencies": {
-    "ai": ">=6 <7",
     "@ai-sdk/amazon-bedrock": ">=4 <5",
     "@ai-sdk/anthropic": ">=3 <4",
     "@ai-sdk/azure": ">=3 <4",
     "@ai-sdk/google-vertex": ">=4 <5",
     "@ai-sdk/openai": ">=3 <4",
-    "@ai-sdk/perplexity": ">=3 <4"
+    "@ai-sdk/perplexity": ">=3 <4",
+    "ai": ">=6 <7"
   },
   "license": "Apache-2.0",
   "publishConfig": {

test_workflows/src/workflows/llm/generate_text/prompt@v1.prompt

@@ -1,6 +1,6 @@
 ---
 provider: anthropic
-model: claude-sonnet-4-20250514
+model: claude-haiku-4-5
 temperature: 0.7
 maxTokens: 4000
 messageOptions:

vitest.config.js

@@ -1,8 +1,9 @@
 import { defineConfig } from 'vitest/config';
-import tsconfigPaths from 'vite-tsconfig-paths';
 
 export default defineConfig( {
-  plugins: [ tsconfigPaths() ],
+  resolve: {
+    tsconfigPaths: true
+  },
   test: {
     silent: true,
     environment: 'node',