Summary

Fixed:

• apps/js-sdk: removed stale uuid audit allowlist after current 14.0.0 audit result clears GHSA-w5hq-g745-h8pq
• apps/js-sdk/firecrawl: removed stale uuid audit allowlist after current 14.0.0 audit result clears GHSA-w5hq-g745-h8pq

Deferred:

• GHSA-v2v4-37r5-5v8g / ip-address in apps/api: blocked
  • Reason: Compatible upstream dependency still resolves to affected ip-address; no safe patch/minor path is available.
  • Next action: waiting on upstream
  • Tracking: create internal ticket
• GHSA-866g-f22w-33x8 / @ai-sdk/provider-utils in apps/api: needs-major
  • Reason: Compatible higher-level package lines still resolve to affected provider-utils; non-affected line requires coordinated major-family upgrades.
  • Next action: needs approval
  • Tracking: create internal ticket

Verification:

• CI-equivalent audit: passed with approved deferment

  

Summary by cubic

Fixes 2026-06-09 pnpm audit/audit-ci failures by removing stale uuid allowlists and syncing dependency overrides across apps/api, apps/js-sdk, and apps/js-sdk/firecrawl.

• Dependencies
  • apps/api: pin shell-quote@1.8.4.
  • apps/js-sdk: enforce diff>=4.0.4 and follow-redirects>=1.16.0 <2.0.0.
  • apps/js-sdk/firecrawl: add overrides for minimatch, picomatch, brace-expansion/@isaacs/brace-expansion, axios@1.16.1, rollup>=4.59.0, handlebars>=4.7.9, and follow-redirects>=1.16.0 <2.0.0.

^{Written for commit 8198d93. Summary will update on new commits.}