Weekly package maintenance — 2026-08-18

[ross0x01]

Summary

• update 28 compatible root dependencies/devDependencies selected from 46 direct ncu candidates, while keeping every resolved package release older than 24 hours
• remediate the two high-severity audit paths with nanoid@3.3.18 and deepmerge-ts@8.0.1
• align the existing @langchain/core security override to 1.2.8 for langchain@1.5.9 compatibility
• leave Desktop and Local package manifests unchanged because neither has a package-specific vulnerable path

Root candidates

Updated:

• Agent/runtime: @e2b/code-interpreter@2.7.1, e2b@2.39.0, all direct Trigger.dev packages to 4.5.11, @vercel/functions@3.9.3, convex@1.44.0, centrifuge@5.7.1, redis@6.2.1, and ws@8.21.3
• UI/browser: @legendapp/list@3.3.6, @workos-inc/widgets@1.16.1, next/eslint-config-next@16.3.1, posthog-js@1.417.3, react-shiki@0.11.1, and swr@2.5.1
• Server/product: @posthog/ai@8.8.0, posthog-node@5.49.1, @workos-inc/node@10.10.0, gpt-tokenizer@4.0.0, jose@6.2.9, langchain@1.5.9, and stripe@22.5.0
• Development: @posthog/cli@0.11.3, @testing-library/user-event@14.6.4, and concurrently@10.0.5

Skipped:

• Node-22-only/coupled migrations: @ai-sdk/openai@4, @ai-sdk/react@4, @openrouter/ai-sdk-provider@3, ai@7, @workos-inc/authkit-nextjs@4.3.1, chalk@6, openai@7, pdfjs-serverless@1.3.1, and @testing-library/jest-dom@7. CI remains Node 20; ai and AuthKit are locally patched, and PDFJS also retains the known typed-array incompatibility.
• Preview verification blocker: the eligible 3.1111.0 updates for @aws-sdk/client-lambda-microvms, @aws-sdk/client-s3, and @aws-sdk/s3-request-presigner were conservatively reverted after six Preview Cloud Agent attempts returned AWS InvalidSignatureException. Production on the 3.1107.0 baseline completed the same command successfully. The failure persisted on the post-revert Preview deployment, so these candidates remain skipped and the evidence now points to Preview's environment-provided AWS credentials/signing configuration rather than the generated client package.
• 24-hour gate: no eligible newer release existed for lucide-react, marked, or uuid. Eligible fallback versions were used below the too-new latest releases for Legend List, E2B, PostHog JS/CLI, and Testing Library user-event.
• Toolchain migrations: @types/node@26, eslint@10, typescript@7, and pnpm@11 are intentionally outside dependency maintenance scope.

ncu also reported the pnpm package-manager candidate in addition to the 46 direct dependency/devDependency candidates.

Package-to-feature mapping

• Legend List, Next, SWR, PostHog JS, Convex, and Centrifuge cover message/task rendering, client navigation, saved-task persistence, realtime state, and client analytics.
• React Shiki covers highlighted code blocks; WorkOS Widgets covers the Security settings surface.
• Trigger.dev, Vercel Functions, E2B, and AWS Lambda MicroVM packages cover Agent dispatch/realtime execution, server request lifetimes, cloud sandboxes, and paid MicroVM execution.
• AWS S3 packages, LangChain, and GPT Tokenizer cover uploads, signed URLs, CSV parsing, and file/token processing.
• WorkOS Node/Jose cover user/auth and local-sandbox JWT paths; Stripe/Redis/PostHog Node cover billing, coordination/rate-limit state, and server analytics.
• PostHog CLI, user-event, concurrently, and eslint-config-next are build/test/development-only.

Validation

• guarded install and frozen install with minimumReleaseAge=1440
• registry publish-time verification for all newly resolved lockfile versions: 0 younger than 24 hours, 0 missing timestamps; youngest was posthog-js@1.417.3 at about 27.3 hours
• root/workspace audit: 0 advisories (from 2 high)
• standalone Local audit: 0 advisories; Local frozen install and TypeScript build passed
• Prettier for package.json, git diff --check, lint (7 existing warnings), and TypeScript typecheck passed
• Jest: 400 suites / 3,992 tests passed
• Next.js 16.3.1 production build with webpack passed
• Trigger.dev CLI, PostHog sourcemap CLI, and GPT tokenizer encode/decode smokes passed
• Desktop Tauri build was not run because Cargo is unavailable; Desktop dependencies are unchanged

Preview verification

Browser-plugin Google Chrome verification passed for client navigation/reload, task creation and saved-task/sidebar persistence, streamed response rendering, Markdown table/code/Mermaid output, Legend List message rendering, attachment/access/cloud/model selectors, and Security settings. The exercised task and reload produced no application runtime exception or failed application request; the only reload error was the known Vercel feedback-toolbar root 405, and canceled prefetches were net::ERR_ABORTED.

Cloud Agent execution is blocked in Preview. On rollback deployment hackerai-hu3fc1n78-hackerai.vercel.app, Trigger run run_06g1d5av8bletirfatdqqf54e1 used worker 20260818.2 and failed both AWS Lambda MicroVM creation attempts with HTTP 403 InvalidSignatureException, credential_source=environment, before the harmless command ran. The task response and failure persisted after reload. This PR remains draft until Preview AWS credentials/signing are repaired and the real Cloud Agent command can be rerun successfully; CodeRabbit has therefore only recorded its expected draft skip, not a full review.

Summary by CodeRabbit

• Chores
  • Updated underlying platform, analytics, payments, workflow, and development tooling components.
  • Refreshed package version overrides to improve compatibility and maintain supported dependency versions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hackerai	Ready	Preview	Aug 18, 2026 8:30pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e619d8a3-efab-41a7-bf95-fd113131f50f

📥 Commits

Reviewing files that changed from the base of the PR and between f9d650c and da62dba.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Walkthrough

Walkthrough

The package manifest updates production and development dependency versions. It also updates pnpm overrides for nanoid, deepmerge-ts, and @langchain/core.

Changes

Dependency refresh

Layer / File(s)	Summary
Package versions and override constraints package.json	Production and development dependency versions were updated. The pnpm overrides now use newer versions for nanoid and @langchain/core, and pin deepmerge-ts below version 8.0.0 to 8.0.1.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to da62d

The PR is limited to dependency declarations and the lockfile, with security audits and validation checks passing; no actionable merge-blocking risk remains beyond normal review.

Possibly related PRs

• hackerai-tech/hackerai#1070: Updates overlapping dependencies and pnpm overrides in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency maintenance changes and includes the update date.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/weekly-package-maintenance-2026-08-18

---

_{Comment @coderabbitai help to get the list of available commands.}