deps: close all 175 dependabot alerts — range-exact overrides, vitest 3, otel 2

- pnpm overrides pin every vulnerable transitive to its advisory's exact
  first-patched version, scoped to the advisory's own vulnerable range so
  no dependency is dragged across a major it didn't need (criticals:
  form-data 4.0.6, handlebars 4.7.9, protobufjs 7.5.5).
- vitest < 3.2.6 is a critical (CVE fix floor) with no 0.x/1.x backport —
  forced major to ^3.2.6 in every package. Test scripts unify on
  `vitest run` (aci/ai ran bare watch mode). tools' vscode mock alias
  becomes absolute (vitest 3 dropped relative alias resolution).
- packages/ai otel family 1.x → 2.x (core <2.8.0 advisory covers all 1.x):
  resourceFromAttributes, ATTR_* semconv, constructor spanProcessors. The
  previously-uncollectable telemetry suite now runs: ai 31 tests (was 16).
- direct bumps: vite ^6.4.3 (site), esbuild ^0.25.8 (mcp), uuid ^11.1.1
  (tools). packages/ai/package-lock.json deleted — stray npm lockfile in a
  pnpm workspace, carried 24 of the alerts.
- ci: test step filtered @hanzo/tools but the package is @hanzo/cli-tools —
  the suite never ran in CI. Fixed; 87 tests now gate (behind the existing
  continue-on-error). pnpm 9 reads onlyBuiltDependencies from package.json,
  not pnpm-workspace.yaml — mirrored so native build scripts stay allowlisted.

Verified: browser 243/243 + e2e 30/30 + build; aci 29/29; ai 31/31;
cli-tools 87/87; site builds on vite 6; mcp builds on esbuild 0.25.

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
       run: pnpm --filter @hanzo/ai test
 
     - name: Test tools package
-      run: pnpm --filter @hanzo/tools test
+      run: pnpm --filter @hanzo/cli-tools test
       continue-on-error: true
 
     - name: Test VS Code extension

apps/site/package.json

@@ -18,6 +18,6 @@
   "devDependencies": {
     "@playwright/test": "^1.54.1",
     "terser": "^5.43.1",
-    "vite": "^5.4.19"
+    "vite": "^6.4.3"
   }
 }

package.json

@@ -29,5 +29,107 @@
     "build:jetbrains": "cd packages/jetbrains && ./gradlew build",
     "package:vscode": "pnpm --filter @hanzo/extension run package",
     "package:dxt": "pnpm --filter @hanzo/dxt run package"
+  },
+  "pnpm": {
+    "overrides": {
+      "@babel/core@<=7.29.0": "7.29.6",
+      "@grpc/grpc-js@<1.9.16": "1.9.16",
+      "@isaacs/brace-expansion@<=5.0.0": "5.0.1",
+      "@modelcontextprotocol/sdk@<1.24.0": "1.24.0",
+      "@modelcontextprotocol/sdk@<1.25.2": "1.25.2",
+      "@modelcontextprotocol/sdk@>=1.10.0 <=1.25.3": "1.26.0",
+      "@opentelemetry/core@<2.8.0": "2.8.0",
+      "@protobufjs/utf8@<=1.1.0": "1.1.1",
+      "ajv@<6.14.0": "6.14.0",
+      "ajv@>=7.0.0-alpha.0 <8.18.0": "8.18.0",
+      "axios@>=1.0.0 <=1.13.4": "1.13.5",
+      "axios@>=1.0.0 <1.12.0": "1.12.0",
+      "axios@>=1.0.0 <1.15.0": "1.15.0",
+      "axios@>=1.0.0 <1.15.1": "1.15.1",
+      "axios@>=1.0.0 <1.15.2": "1.15.2",
+      "axios@>=1.0.0 <1.16.0": "1.16.0",
+      "axios@>=1.7.0 <1.16.0": "1.16.0",
+      "body-parser@>=2.2.0 <2.2.1": "2.2.1",
+      "brace-expansion@<1.1.13": "1.1.13",
+      "brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
+      "diff@>=6.0.0 <8.0.3": "8.0.3",
+      "esbuild@<=0.24.2": "0.25.0",
+      "fast-uri@<=3.1.0": "3.1.1",
+      "fast-uri@<=3.1.1": "3.1.2",
+      "file-type@>=13.0.0 <21.3.1": "21.3.1",
+      "flatted@<=3.4.1": "3.4.2",
+      "flatted@<3.4.0": "3.4.0",
+      "follow-redirects@<=1.15.11": "1.16.0",
+      "form-data@>=4.0.0 <4.0.4": "4.0.4",
+      "form-data@>=4.0.0 <4.0.6": "4.0.6",
+      "glob@>=10.2.0 <10.5.0": "10.5.0",
+      "handlebars@>=4.0.0 <=4.7.8": "4.7.9",
+      "handlebars@>=4.0.0 <4.7.9": "4.7.9",
+      "handlebars@>=4.6.0 <=4.7.8": "4.7.9",
+      "ip-address@<=10.1.0": "10.1.1",
+      "js-yaml@<3.15.0": "3.15.0",
+      "js-yaml@>=4.0.0 <=4.1.1": "4.2.0",
+      "js-yaml@>=4.0.0 <4.1.1": "4.1.1",
+      "jws@<3.2.3": "3.2.3",
+      "linkify-it@<=5.0.0": "5.0.1",
+      "lodash@<=4.17.23": "4.18.0",
+      "lodash@>=4.0.0 <=4.17.22": "4.17.23",
+      "lodash@>=4.0.0 <=4.17.23": "4.18.0",
+      "markdown-it@<=14.1.1": "14.2.0",
+      "min-document@<=2.19.0": "2.19.1",
+      "minimatch@<3.1.3": "3.1.3",
+      "minimatch@<3.1.4": "3.1.4",
+      "minimatch@>=10.0.0 <10.2.1": "10.2.1",
+      "minimatch@>=10.0.0 <10.2.3": "10.2.3",
+      "minimatch@>=5.0.0 <5.1.7": "5.1.7",
+      "minimatch@>=5.0.0 <5.1.8": "5.1.8",
+      "minimatch@>=9.0.0 <9.0.6": "9.0.6",
+      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
+      "path-to-regexp@>=8.0.0 <8.4.0": "8.4.0",
+      "picomatch@<2.3.2": "2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": "4.0.4",
+      "playwright@<1.55.1": "1.55.1",
+      "postcss@<8.5.10": "8.5.10",
+      "protobufjs@<=7.5.5": "7.5.6",
+      "protobufjs@<=7.5.7": "7.5.8",
+      "protobufjs@<=7.6.0": "7.6.1",
+      "protobufjs@<=7.6.2": "7.6.3",
+      "protobufjs@<7.5.5": "7.5.5",
+      "qs@<6.14.1": "6.14.1",
+      "qs@>=6.11.1 <=6.15.1": "6.15.2",
+      "qs@>=6.7.0 <=6.14.1": "6.14.2",
+      "rollup@>=4.0.0 <4.59.0": "4.59.0",
+      "serialize-javascript@<=7.0.2": "7.0.3",
+      "serialize-javascript@>=5.0.0 <7.0.5": "7.0.5",
+      "tar-fs@>=2.0.0 <2.1.4": "2.1.4",
+      "tar-fs@>=3.0.0 <3.1.1": "3.1.1",
+      "tar@<=7.5.10": "7.5.11",
+      "tar@<=7.5.15": "7.5.16",
+      "tar@<=7.5.2": "7.5.3",
+      "tar@<=7.5.3": "7.5.4",
+      "tar@<=7.5.9": "7.5.10",
+      "tar@<7.5.7": "7.5.7",
+      "tar@<7.5.8": "7.5.8",
+      "tmp@<=0.2.3": "0.2.4",
+      "tmp@<0.2.6": "0.2.6",
+      "underscore@<=1.13.7": "1.13.8",
+      "undici@>=7.0.0 <7.18.2": "7.18.2",
+      "undici@>=7.0.0 <7.24.0": "7.24.0",
+      "undici@>=7.0.0 <7.28.0": "7.28.0",
+      "uuid@<11.1.1": "11.1.1",
+      "validator@<13.15.20": "13.15.20",
+      "validator@<13.15.22": "13.15.22",
+      "vite@<=5.4.19": "5.4.20",
+      "vite@<=6.4.1": "6.4.2",
+      "vite@<=6.4.2": "6.4.3",
+      "vite@>=5.2.6 <=5.4.20": "5.4.21",
+      "vitest@<3.2.6": "3.2.6",
+      "ws@>=8.0.0 <8.20.1": "8.20.1",
+      "ws@>=8.0.0 <8.21.0": "8.21.0",
+      "yaml@>=2.0.0 <2.8.3": "2.8.3"
+    },
+    "onlyBuiltDependencies": [
+      "better-sqlite3"
+    ]
   }
 }

packages/aci/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "vitest",
+    "test": "vitest run",
     "lint": "eslint src --ext .ts",
     "prepublishOnly": "npm run build"
   },
@@ -32,7 +32,7 @@
   "devDependencies": {
     "@types/node": "^20.10.5",
     "typescript": "^5.3.3",
-    "vitest": "^1.6.0",
+    "vitest": "^3.2.6",
     "eslint": "^8.56.0",
     "@typescript-eslint/eslint-plugin": "^6.19.0",
     "@typescript-eslint/parser": "^6.19.0"
@@ -48,4 +48,4 @@
   "bugs": {
     "url": "https://github.com/hanzoai/aci/issues"
   }
-}
+}

packages/ai/package.json

@@ -33,7 +33,7 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "test": "vitest",
+    "test": "vitest run",
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
@@ -41,13 +41,13 @@
     "zod": "^3.22.0",
     "eventsource-parser": "^1.0.0",
     "nanoid": "^5.0.0",
-    "@opentelemetry/api": "^1.7.0",
+    "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/resources": "^1.19.0",
+    "@opentelemetry/resources": "^2.9.0",
-    "@opentelemetry/semantic-conventions": "^1.19.0",
+    "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@opentelemetry/instrumentation": "^0.46.0",
+    "@opentelemetry/instrumentation": "^0.220.0",
-    "@opentelemetry/sdk-trace-node": "^1.19.0",
+    "@opentelemetry/sdk-trace-node": "^2.9.0",
-    "@opentelemetry/sdk-trace-base": "^1.19.0",
+    "@opentelemetry/sdk-trace-base": "^2.9.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.46.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
     "winston": "^3.11.0"
   },
   "peerDependencies": {
@@ -64,7 +64,7 @@
     "@types/react": "^18.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5.3.0",
-    "vitest": "^1.0.0"
+    "vitest": "^3.2.6"
   },
   "keywords": [
     "ai",
@@ -80,4 +80,4 @@
     "type": "git",
     "url": "https://github.com/hanzoai/ai.git"
   }
-}
+}

packages/ai/src/telemetry/hanzo-cloud.ts

@@ -6,8 +6,8 @@
 import { Telemetry, TelemetryConfig } from './index';
 import * as opentelemetry from '@opentelemetry/api';
 import { DiagConsoleLogger, DiagLogLevel, diag } from '@opentelemetry/api';
-import { Resource } from '@opentelemetry/resources';
+import { resourceFromAttributes } from '@opentelemetry/resources';
-import { SemanticResourceAttributes } from '@opentelemetry/semantic-conventions';
+import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic-conventions';
 import { registerInstrumentations } from '@opentelemetry/instrumentation';
 import { NodeTracerProvider } from '@opentelemetry/sdk-trace-node';
 import { BatchSpanProcessor } from '@opentelemetry/sdk-trace-base';
@@ -92,14 +92,15 @@ export class HanzoCloudTelemetry extends Telemetry {
     }
     
     // Create resource
-    const resource = new Resource({
+    const resource = resourceFromAttributes({
-      [SemanticResourceAttributes.SERVICE_NAME]: config.serviceName || 'hanzo-ai',
+      [ATTR_SERVICE_NAME]: config.serviceName || 'hanzo-ai',
-      [SemanticResourceAttributes.SERVICE_VERSION]: config.serviceVersion || '1.0.0',
+      [ATTR_SERVICE_VERSION]: config.serviceVersion || '1.0.0',
-      [SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT]: config.environment || 'development',
+      // stable semconv dropped deployment.environment; keep the raw key
+      'deployment.environment': config.environment || 'development',
       'hanzo.project.id': config.projectId,
       'hanzo.cloud.region': process.env.HANZO_CLOUD_REGION || 'us-east-1'
     });
-    
+
     // Create OTLP exporter
     this.exporter = new OTLPTraceExporter({
       url: `${config.cloudUrl}/v1/traces`,
@@ -108,22 +109,21 @@ export class HanzoCloudTelemetry extends Telemetry {
         'x-project-id': config.projectId
       }
     });
-    
+
-    // Create provider
+    // Create provider with batch processor (SDK 2.x: processors are
+    // constructor-only; addSpanProcessor was removed)
     this.provider = new NodeTracerProvider({
-      resource
+      resource,
+      spanProcessors: [
+        new BatchSpanProcessor(this.exporter, {
+          maxQueueSize: 1000,
+          maxExportBatchSize: 512,
+          scheduledDelayMillis: 5000,
+          exportTimeoutMillis: 30000
+        })
+      ]
     });
     
-    // Add batch processor
-    this.provider.addSpanProcessor(
-      new BatchSpanProcessor(this.exporter, {
-        maxQueueSize: 1000,
-        maxExportBatchSize: 512,
-        scheduledDelayMillis: 5000,
-        exportTimeoutMillis: 30000
-      })
-    );
-    
     // Register as global provider
     this.provider.register();
     

packages/browser/package.json

@@ -30,7 +30,7 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.8.3",
-    "vitest": "^0.34.6",
+    "vitest": "^3.2.6",
     "ws": "^8.18.3"
   },
   "engines": {

packages/mcp/package.json

@@ -58,7 +58,7 @@
     "@types/minimatch": "^5.1.2",
     "@types/node": "^20.10.5",
     "@types/ws": "^8.18.1",
-    "esbuild": "^0.19.11",
+    "esbuild": "^0.25.8",
     "jest": "^29.7.0",
     "ts-jest": "^29.4.1",
     "typescript": "^5.3.3"

packages/tools/package.json

@@ -16,7 +16,7 @@
     "js-yaml": "^4.1.0",
     "node-fetch": "^3.3.2",
     "@modelcontextprotocol/sdk": "^1.15.0",
-    "uuid": "^10.0.0",
+    "uuid": "^11.1.1",
     "ws": "^8.18.0"
   },
   "devDependencies": {
@@ -28,7 +28,7 @@
     "@types/vscode": "^1.101.0",
     "eslint": "^8.57.1",
     "typescript": "^5.8.3",
-    "vitest": "^0.34.6"
+    "vitest": "^3.2.6"
   },
   "engines": {
     "node": ">=18.0.0"

packages/tools/vitest.config.ts

@@ -1,4 +1,5 @@
 import { defineConfig } from 'vitest/config';
+import path from 'path';
 
 export default defineConfig({
   test: {
@@ -10,7 +11,8 @@ export default defineConfig({
   },
   resolve: {
     alias: {
-      'vscode': './test/mocks/vscode.ts'
+      // must be absolute — vitest 3 no longer resolves relative aliases
+      'vscode': path.resolve(__dirname, 'test/mocks/vscode.ts')
     }
   }
 });

packages/vscode/package.json

@@ -364,7 +364,7 @@
     "node-fetch": "^3.3.2",
     "sinon": "^21.0.0",
     "typescript": "^5.2.2",
-    "vitest": "^0.34.6"
+    "vitest": "^3.2.6"
   },
   "dependencies": {
     "@lancedb/lancedb": "^0.21.0",