fix(deps): re-lock @modelcontextprotocol/sdk, follow-redirects, launch-editor and vite onto their fixed releases (#25047)

Fixes #25041

Clause-②: no

## What this does

`main`'s scheduled `Validate Dependencies` run 39536495453 is red at its
OSV step: the lockfile matches 12 advisory rows (9 distinct ids, 6 High)
in four locked packages, and every one names a fixed release. Every
declared range on every path already admits its fix, so this is a
**re-lock only**. `pnpm-lock.yaml` is the whole diff. It adds no
override, no `osv-scanner.toml` exemption, and no `package.json` range.

| Package | Locked → resolved | Advisories | Path (`pnpm why -r`) | How
|
|:--|:--|:--|:--|:--|
| `@modelcontextprotocol/sdk` | 1.31.0 → **1.32.1** (fix 1.32.0) |
GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw,
GHSA-rvq5-wwqv-78pq | direct `^1.30.1` in `@objectstack/mcp`,
`@objectstack/connector-mcp` and the private
`@objectstack/example-showcase` | re-lock |
| `follow-redirects` | 1.16.0 → **1.16.1** | GHSA-8r9p-f939-6h3c,
GHSA-q3jh-wrc6-jgq8 | `mongodb-memory-server-core@11.3.0` (`^1.16.0`) ←
`mongodb-memory-server` ← `@objectstack/driver-mongodb` devDependencies
| re-lock |
| `launch-editor` | 2.14.1 → **2.14.2** | GHSA-587h-7wmj-h5pm,
GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw | `@changesets/cli@3.0.3`
(`^2.14.1`) ← the root devDependencies | re-lock |
| `vite` | 8.0.16 → **8.3.4** (fixed lines 8.1.6 / 8.2.4 / 8.3.3) | the
same three as `launch-editor` (vite bundles it) | `vitest@4.1.11`
(dependency and peer `^6.0.0 \|\| ^7.0.0 \|\| ^8.0.0`),
`@vitest/mocker@4.1.11` (peer, same range), `fumadocs-mdx@15.2.3`
(optional peer `7.x.x \|\| 8.x.x`) | re-lock |

**Each target is the newest release inside the existing ranges.** That
is what a targeted `pnpm update` resolves, and what a fresh downstream
install gets. For `vite`, the three fixed lines come from the
advisories' own ranges in the OSV npm database: introduced 8.0.0 fixed
8.1.6, introduced 8.2.0 fixed 8.2.4, introduced 8.3.0 fixed 8.3.3. 8.3.4
sits outside all three. `vitest@4.1.11`'s peer range admits it, and so
does its own devDependency: both `vitest` 4.1.11 and `fumadocs-mdx`
15.2.3 develop against `vite ^8.2.0`, so 8.1.6 would sit below what
either consumer tests against. If 8.3.4 ever has to be backed off, 8.2.4
is the fix on that line.

## How the lockfile was moved, and the route rejected first

- **Rejected: a targeted `pnpm update`.** Measured twice, with
`--no-save`, so no `package.json` moved:
- The first spelling was `pnpm update -r --depth Infinity --no-save
follow-redirects launch-editor vite @modelcontextprotocol/sdk`. It moved
the SDK alone, leaving `follow-redirects`, `launch-editor` and `vite`
exactly where they were.
- The same run moved 12 unrelated packages, at +101/−68 lines:
`@inquirer/ansi` / `confirm` / `core` / `type`, `@napi-rs/wasm-runtime`
1.2.4 → 1.2.5, `node-abi` 3.96.0 → 3.99.0, and `seroval` /
`seroval-plugins` 1.6.8 → 1.6.11. It also added new copies of
`@babel/runtime`, `ip-address`, `nanoid`, `postcss` and
`set-cookie-parser`, and touched the `knex`, `tsup` and
`postcss-load-config` snapshots.
- `pnpm update -r --no-save @modelcontextprotocol/sdk` alone, at default
depth, produced the identical churn.
- Control: a plain non-frozen `pnpm install` on the base lockfile leaves
0 changed files, so the churn is `update`'s own.
- **Taken: the precedent's recipe (#21951).** I appended four temporary
exact overrides to `pnpm-workspace.yaml` and ran `pnpm install`. I then
restored the file to its HEAD blob and ran `pnpm install` again. The
second install keeps the four resolutions, because every declared range
admits them.
- The restore is proven, not assumed: `git hash-object
pnpm-workspace.yaml` equals the HEAD blob
`ecbd0f4bfdeb4c7c03bb43d910c5f2406fbadea7`, and `git diff HEAD` on it is
empty.
- The lockfile's own `overrides:` section is unchanged, and no importer
specifier moved.

## Lockfile diff scope

`pnpm-lock.yaml` only, **+187/−237**. The `packages:` section goes from
1372 to 1367 keys, with 26 removed and 21 added. Every moved entry
belongs to the four packages or to `vite`'s own closure:

- the four rows in the table above;
- `rolldown` 1.0.3 → 1.2.14 (`vite` 8.3.4 declares `~1.2.12`), its 14
platform bindings 1.0.3 → 1.2.14, the new
`@rolldown/binding-android-arm-eabi` 1.2.14, and `@oxc-project/types`
0.133.0 → 0.154.0;
- **dropped**: `@rolldown/binding-wasm32-wasi` 1.0.3 and the chain only
it reached. That chain is `@napi-rs/wasm-runtime` 1.2.4, `@emnapi/core`
1.10.0, `@emnapi/runtime` 1.10.0, `@emnapi/wasi-threads` 1.2.1 and
`@tybys/wasm-util` 0.10.4.
- `npm view rolldown@1.2.14 optionalDependencies` declares no
wasm32-wasi binding, while 1.0.3 declares one.
- `@emnapi/runtime` 1.11.3 stays, because it is the copy
`@img/sharp-wasm32` already used on the base.

The `snapshots:` section goes from 1379 to 1374 keys, covering the same
names plus the peer-suffix rewrites on `vitest`, `@vitest/mocker` and
`fumadocs-mdx`. In the importers section, 3 lines move the SDK version
and 80 version strings carry the new `vite`/`rolldown` peer suffix (79
`vitest`, 1 `fumadocs-mdx`). Nothing else moved.

## Local proofs, at `7b0295c723`

| Proof | Exit | Reading |
|:--|:--|:--|
| `pnpm install --frozen-lockfile` | 0 | |
| `pnpm check:vendor-export-contract-resolve` | 0 | `VERDICT: PASS —
vendor export contract (registry resolution, installed with
npm@11.21.0), 3 edge(s) verified`. It governs only the better-auth
family, so it passes over the SDK without judging it. |
| `pnpm check:override-consistency` | 0 | `9 published-manifest
declaration(s) … all resolve to their override targets` |
| `pnpm turbo run build --filter=@objectstack/mcp
--filter=@objectstack/connector-mcp --concurrency=2` (shared verify
lock) | 0 | `VERDICT command-exit 0`, 33/33 tasks, 0 cached |
| `test` for both packages (shared verify lock) | 0 | `@objectstack/mcp`
40 files / 479 tests passed; `@objectstack/connector-mcp` 4 files / 36
tests passed |
| `typecheck` for both packages (`tsc --noEmit` +
`check:test-typecheck`) | 0 | both test layers compile at their existing
ledger counts (mcp 6 files / 53 errors / 8 pinned signatures;
connector-mcp 1 / 5 / 1) |

- **The vite consumer** is those two vitest runs. Resolved from each
package, `vitest` 4.1.11 loads `vite` 8.3.4, and the installed SDK is
1.32.1.
- **The docs build was not run**, because it would prove nothing about
this change. `apps/docs` builds through Next, and `fumadocs-mdx` touches
`vite` only in its `dist/vite` plugin entry and `rolldown` only in its
type declarations. CI's `Build Docs` runs the production command.

## OSV reading

I measured with OSV-Scanner **2.5.0**, the binary the workflow's pinned
action image ships. Its sha256 `edcfc41d…524e0c` matches the release's
`SHA256SUMS`. `api.osv.dev` answers 403 from this container, so the scan
ran offline (`--offline-vulnerabilities --download-offline-databases`)
against the npm database downloaded 2026-10-21 03:59 UTC. Each side ran
under its own `osv-scanner.toml`, with the identical invocation.

- **Base `dfe60e3a0c`: exit 1.** The 12 rows are byte-for-byte the
scheduled run's, with the sprintf-js exemption filtered.
- **This PR `7b0295c723`: exit 0, `No issues found`.** The sprintf-js
exemption is filtered here too. That is the control that shows the
database loaded and matched.
- **`scripts/osv-base-relative.mjs`** over both JSON results exits 0: `0
introduced, 0 inherited, 9 resolved`.
- **One void reading, declared:** a first head scan without
`--download-offline-databases` printed `No issues found` at exit 0 with
no `Loaded npm local db` line, reading the exemption as unused. It had
loaded no database, and it is not counted.

What closes the card is the next scheduled (or a `workflow_dispatch`)
`Validate Dependencies` run on `main`. This PR's own run takes the
base-relative path.

## Changeset: `skip-changeset`, measured

Nothing publishes. No `package.json` changed, so every published
package's declared ranges are byte-identical and a downstream install
resolves exactly as before.

- **The two published consumers do not bundle the SDK.**
`@objectstack/mcp` and `@objectstack/connector-mcp` (`files: ["dist",
…]`) keep it as an external import: 4 and 3
`@modelcontextprotocol/sdk/…` import specifiers remain in their built
`dist`. The SDK's own `LATEST_PROTOCOL_VERSION = "…"` definition appears
in 0 of their `dist` files. The positive control is 6 hits in the SDK's
own `dist`.
- **No built `dist` names the other moved packages.** None of the 33
built `dist` trees names `rolldown`, `launch-editor` or
`follow-redirects`, while `vite`'s own `dist` does, which is the
control.
- **The other three are dev-only paths.** They arrive only through
devDependencies (`driver-mongodb`, the root, `vitest`) and the private
docs app.

## Gates

- **Derivation.** I ran `node scripts/pm/dispatch-gates.mjs --commands
--repo objectstack-ai/objectstack` at `7b0295c723`, which derived 19
commands from 1 path. I ran all 19, each exit captured before any pipe.
- **`--ran` reconciliation:** `19 derived, 18 run, 1 NOT-MEASURED, 0
UNRUN`.
- **18 exited 0:** `check-changeset-fixed`,
`check-closing-keyword-parity` (+ `--self-test`),
`check-comment-mask-corpus`, `check-dts-emitted --self-test`,
`check-osv-exemptions` (+ `--self-test`), `osv-base-relative
--self-test`, and the `pnpm` gates `check:driver-memory-census`,
`check:dts-closure`, `check:gitlink-declared`,
`check:lean-entry-closure`, `check:nul-bytes`,
`check:override-consistency`, `check:refd-timer-probe`,
`check:sourcemap-no-sources-content`,
`check:vendor-export-contract-resolve` and `check:watch-hint-literal`.
- **Partial sweeps:** `check:dts-closure` and
`check:sourcemap-no-sources-content` swept the 33 built packages only.
- **NOT MEASURED:** `pnpm check:dual-build-cjs-loads` exits 3
(`PREREQUISITE NOT MET`, needs a full `pnpm build`). CI's `Build Core`
and `Lint & Repo Gates` measure it on the built tree.
- **`git merge-tree --write-tree origin/main HEAD`** (`origin/main` =
`eddffc3390`): exit 0, clean. `pnpm-lock.yaml` is not routed to the
`os-regen` driver, so this local reading answers GitHub's question. The
2 commits `main` gained since the base touch none of `pnpm-lock.yaml`,
`pnpm-workspace.yaml`, the root `package.json` or `osv-scanner.toml`.

## Acceptance notes

- `vite` moves three minors, 8.0.16 → 8.3.4, and `rolldown` 1.0.3 →
1.2.14 with it. Every vitest suite in the repo runs on this pair, so
CI's `Test Core` is the wide reading. Locally, only the two MCP
packages' 515 tests ran.
- In this workspace, `pnpm update` (even depth 0, one direct dependency)
re-resolves a fixed set of unrelated packages, and with `--depth
Infinity` it does not move the transitive targets at all. The
temporary-override re-lock is the route that keeps a lockfile refresh
narrow here. Class: none (tooling behaviour, not a defect of this repo);
carrier: none.
- A local offline OSV scan without `--download-offline-databases` can
read green having loaded no database. Read the `Loaded npm local db`
line, or an exemption reading as filtered, before trusting a local "No
issues found".
- `pnpm install` prints `ioredis-mock 8.13.1: unmet peer ioredis@^5:
found 6.0.0`. That warning is already on `main`, and this diff does not
cause it.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01FM29ZqLTrnPNXxijioZwMp)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]