AgentsKit-io · EmersonBraun · May 22, 2026 · May 22, 2026 · May 22, 2026 · May 22, 2026
@@ -0,0 +1,46 @@
+---
+"@agentskit/adapters": patch
+"@agentskit/angular": patch
+"@agentskit/cli": patch
+"@agentskit/core": patch
+"@agentskit/eval": patch
+"@agentskit/eval-braintrust": patch
+"@agentskit/ink": patch
+"@agentskit/memory": patch
+"@agentskit/observability": patch
+"@agentskit/observability-langfuse": patch
+"@agentskit/rag": patch
+"@agentskit/react": patch
+"@agentskit/react-native": patch
+"@agentskit/runtime": patch
+"@agentskit/sandbox": patch
+"@agentskit/skills": patch
+"@agentskit/solid": patch
+"@agentskit/svelte": patch
+"@agentskit/templates": patch
+"@agentskit/tools": patch
+"@agentskit/vue": patch
+---
+
+Resolve GitHub code-scanning alerts and refresh dependencies. No public
+API changes.
+
+Security:
+- `polynomial-redos`: removed the ambiguous `\s*` in the fenced-block
+  regex (`@agentskit/core` `parseUIMessage`).
+- `bad-tag-filter` / `double-escaping` / `incomplete-multi-character-
+  sanitization`: HTML stripping in `@agentskit/tools` (`fetchUrl`,
+  `webSearch`) now loops until stable, drops unterminated `<!--`
+  comments, and decodes `&amp;` last.
+- `incomplete-sanitization`: hardened Markdown table cells
+  (`@agentskit/eval`), Mermaid labels (`@agentskit/runtime` `flowToMermaid`),
+  and assorted regex escaping.
+- `incomplete-url-substring-sanitization`: `@agentskit/adapters` `openai()`
+  matches the canonical OpenAI host exactly via `URL` parsing.
+- `file-system-race`: `@agentskit/cli` `config init` creates files with
+  the atomic `wx` open flag.
+
+Dependencies: minor/patch sweep via `pnpm -r update` (`@types/node`,
+`vitest`, `@types/react`, `vite`, `fumadocs-*`, `motion`, `svelte`,
+`@angular/core`, `@cloudflare/workers-types`). `marked` (15 → 18) is a
+major bump and was intentionally skipped.
@@ -93,8 +93,10 @@ export async function POST(req: Request) {
       },
     })
   } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e)
-    return new Response(JSON.stringify({ error: msg }), {
+    // Log details server-side; never return raw error text (it can leak
+    // stack traces, internal paths, or upstream provider responses).
+    console.error('[ask-docs] request failed:', e)
+    return new Response(JSON.stringify({ error: 'Upstream request failed.' }), {
       status: 502,
       headers: { 'content-type': 'application/json' },
     })

@@ -1,7 +1,7 @@
 'use client'
 
 import { useMemo } from 'react'
-import { useChat, ChatContainer, Message, InputBar } from '@agentskit/react'
+import { useChat, ChatContainer, InputBar } from '@agentskit/react'
 import '@/styles/agentskit-theme.css'
 import { createMockAdapter, initialAssistant } from './_shared/mock-adapter'
 import { MdRenderer } from './_shared/md-renderer'

@@ -1,7 +1,7 @@
 'use client'
 
 import { useMemo } from 'react'
-import { useChat, ChatContainer, Message, InputBar } from '@agentskit/react'
+import { useChat, ChatContainer, InputBar } from '@agentskit/react'
 import '@/styles/agentskit-theme.css'
 import { createMockAdapter, initialAssistant } from './_shared/mock-adapter'
 import { MdRenderer } from './_shared/md-renderer'

@@ -2,7 +2,7 @@
 
 import { useMemo } from 'react'
 import type { Retriever, RetrievedDocument } from '@agentskit/core'
-import { useChat, ChatContainer, Message, InputBar } from '@agentskit/react'
+import { useChat, ChatContainer, InputBar } from '@agentskit/react'
 import '@/styles/agentskit-theme.css'
 import { createMockAdapter, initialAssistant } from './_shared/mock-adapter'
 import { MdRenderer } from './_shared/md-renderer'

@@ -35,11 +35,11 @@
     "@tailwindcss/postcss": "^4.3.0",
     "@vercel/analytics": "^2.0.1",
     "@vercel/speed-insights": "^2.0.0",
-    "fumadocs-core": "^16.8.12",
+    "fumadocs-core": "^16.9.0",
     "fumadocs-mdx": "^15.0.7",
-    "fumadocs-ui": "^16.8.12",
+    "fumadocs-ui": "^16.9.0",
     "mermaid": "^11.15.0",
-    "motion": "^12.39.0",
+    "motion": "^12.40.0",
     "next": "^16.2.6",
     "postcss": "^8.5.15",
     "react": "^19.2.6",
@@ -51,8 +51,8 @@
   },
   "devDependencies": {
     "@types/mdx": "^2.0.13",
-    "@types/node": "^25.9.0",
-    "@types/react": "^19.2.14",
+    "@types/node": "^25.9.1",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "typedoc": "^0.28.19",
     "typedoc-plugin-markdown": "^4.11.0",

@@ -98,6 +98,9 @@ function headingsIn(src) {
   return ids
 }
 
+// CodeQL js/file-access-to-http: not fixed by design. `url` is read from
+// docs MDX files and fetched precisely to verify the link resolves — that
+// is what this dev-only broken-link checker exists to do.
 async function reachable(url) {
   try {
     const res = await fetch(url, { method: 'HEAD', redirect: 'follow' })

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Scaffold a new docs page and register it in the nearest meta.json.
 // Usage: node scripts/docs-new.mjs <kind> <slug> [--title "Title"] [--description "..."] [--dir custom/path]
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
 import { dirname, join, resolve, relative } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -52,18 +52,30 @@ const description = opts.description ?? `${title} — short description of what
 
 const targetDir = resolve(DOCS, opts.dir)
 const targetFile = join(targetDir, `${slug}.mdx`)
-if (existsSync(targetFile)) {
-  console.error(`✗ ${relative(ROOT, targetFile)} already exists`)
-  process.exit(1)
-}
 mkdirSync(targetDir, { recursive: true })
-writeFileSync(targetFile, kindDef.template({ title, description, slug }))
+// `wx` flag: atomic create that fails if the file already exists,
+// instead of a racy exists-then-write check.
+try {
+  writeFileSync(targetFile, kindDef.template({ title, description, slug }), { flag: 'wx' })
+} catch (err) {
+  if (err.code === 'EEXIST') {
+    console.error(`✗ ${relative(ROOT, targetFile)} already exists`)
+    process.exit(1)
+  }
+  throw err
+}
 console.log(`✓ created ${relative(ROOT, targetFile)}`)
 
-// Register in meta.json if one sits alongside
+// Register in meta.json if one sits alongside.
 const metaPath = join(targetDir, 'meta.json')
-if (existsSync(metaPath)) {
-  const meta = JSON.parse(readFileSync(metaPath, 'utf8'))
+let metaRaw
+try {
+  metaRaw = readFileSync(metaPath, 'utf8')
+} catch (err) {
+  if (err.code !== 'ENOENT') throw err
+}
+if (metaRaw !== undefined) {
+  const meta = JSON.parse(metaRaw)
   meta.pages = Array.isArray(meta.pages) ? meta.pages : []
   if (!meta.pages.includes(slug)) {
     meta.pages.push(slug)

@@ -15,9 +15,9 @@
     "@agentskit/runtime": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   }
 }
@@ -14,7 +14,7 @@
     "@agentskit/eval-braintrust": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3"
   }

@@ -14,7 +14,7 @@
     "@agentskit/core": "workspace:*"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20260519.1",
+    "@cloudflare/workers-types": "^4.20260521.1",
     "typescript": "^6.0.3"
   }
 }
@@ -15,7 +15,7 @@
     "@agentskit/runtime": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3"
   }

@@ -14,7 +14,7 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3"
   }

@@ -16,8 +16,8 @@
     "react": "^19.2.6"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
-    "@types/react": "^19.2.14",
+    "@types/node": "^25.9.1",
+    "@types/react": "^19.2.15",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3"
   }

@@ -15,10 +15,10 @@
     "react-dom": "^19.2.6"
   },
   "devDependencies": {
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
     "typescript": "^6.0.3",
-    "vite": "^8.0.13"
+    "vite": "^8.0.14"
   }
 }
@@ -16,10 +16,10 @@
     "react-dom": "^19.2.6"
   },
   "devDependencies": {
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
     "typescript": "^6.0.3",
-    "vite": "^8.0.13"
+    "vite": "^8.0.14"
   }
 }
@@ -17,7 +17,7 @@
     "@agentskit/skills": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3"
   }

@@ -15,9 +15,9 @@
     "@agentskit/runtime": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   }
 }
@@ -15,9 +15,9 @@
     "@agentskit/runtime": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   }
 }
@@ -18,10 +18,10 @@
     "react-dom": "^19.2.6"
   },
   "devDependencies": {
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
     "typescript": "^6.0.3",
-    "vite": "^8.0.13"
+    "vite": "^8.0.14"
   }
 }
@@ -15,8 +15,8 @@
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.0",
-    "@types/node": "^25.9.0",
-    "@types/react": "^19.2.14",
+    "@types/node": "^25.9.1",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3"

@@ -20,10 +20,10 @@
   },
   "devDependencies": {
     "@playwright/test": "^1.60.0",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
     "typescript": "^6.0.3",
-    "vite": "^8.0.13"
+    "vite": "^8.0.14"
   }
 }
@@ -44,10 +44,10 @@
     "@changesets/cli": "2.31.0",
     "@playwright/test": "^1.60.0",
     "@size-limit/file": "^12.1.0",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@vitest/coverage-v8": "^4.1.7",
     "size-limit": "^12.1.0",
     "turbo": "2.9.14",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   }
 }
@@ -55,11 +55,11 @@
     "@agentskit/core": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.0",
+    "@types/node": "^25.9.1",
     "msw": "^2.14.6",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   },
   "peerDependencies": {
     "@aws-sdk/client-bedrock-runtime": "^3.0.0"

@@ -20,7 +20,16 @@ export function openai(config: OpenAIConfig): AdapterFactory {
   const { apiKey, model, baseUrl = 'https://api.openai.com', retry } = config
   // Auto: on for canonical OpenAI, off for every other compatible endpoint
   // where the param is a known source of 4xx surprises.
-  const includeUsage = config.includeUsage ?? baseUrl.startsWith('https://api.openai.com')
+  // Match the canonical OpenAI host exactly — a substring/prefix check
+  // would also accept `https://api.openai.com.evil.test`.
+  const isCanonicalOpenAI = (() => {
+    try {
+      return new URL(baseUrl).host === 'api.openai.com'
+    } catch {
+      return false
+    }
+  })()
+  const includeUsage = config.includeUsage ?? isCanonicalOpenAI
 
   return {
     capabilities: {

@@ -43,12 +43,12 @@
     "rxjs": "^7.0.0"
   },
   "devDependencies": {
-    "@angular/core": "^21.2.13",
-    "@types/node": "^25.9.0",
+    "@angular/core": "^21.2.14",
+    "@types/node": "^25.9.1",
     "rxjs": "^7.8.2",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6",
+    "vitest": "^4.1.7",
     "zone.js": "^0.16.2"
   },
   "publishConfig": {

@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import 'zone.js'
 import type { AdapterFactory, AdapterRequest, StreamChunk } from '@agentskit/core'
 import { AgentskitChat } from '../src'