gsxdsm 8bc3d7b0a5 FN-6042: raise dependency security floors ...

Harden dependency floors and update the Vitest toolchain to patched releases.

- upgrade workspace vitest and @vitest/coverage-v8 dependencies to the 4.1 line across packages and plugins
- pin transitive protobufjs via pnpm overrides and lockfile updates to patched versions
- adapt Vitest configs, engine test helpers, and security-floor coverage for the new dependency baselines
- add the published CLI changeset and related workspace/package metadata updates included in the task branch

Files changed:
 .changeset/fn-6042-security-dependencies.md        |   5 +
 AGENTS.md                                          |   4 +
 Dockerfile                                         |   3 +
 docs/PLUGIN_AUTHORING.md                           |   2 -
 package.json                                       |   3 +-
 packages/cli/package.json                          |   4 +-
 packages/cli/vitest.config.ts                      |   2 +-
 packages/core/package.json                         |   4 +-
 packages/core/vitest.config.ts                     |   2 +-
 packages/dashboard/app/test/mockApi.ts             |   4 +-
 packages/dashboard/package.json                    |   4 +-
 packages/dashboard/vitest.config.ts                |   2 +-
 packages/desktop/package.json                      |   4 +-
 packages/desktop/vitest.config.ts                  |   2 +-
 packages/droid-cli/package.json                    |   2 +-
 packages/droid-cli/vitest.config.ts                |   2 +-
 packages/engine/package.json                       |   4 +-
 .../engine/src/__tests__/executor-test-helpers.ts  |  29 +-
 .../engine/src/__tests__/gridlock-detector.test.ts |   5 +-
 .../src/__tests__/heartbeat-scheduler.test.ts      |   3 +-
 packages/engine/src/__tests__/scheduler.test.ts    |  24 +-
 packages/engine/src/__tests__/self-healing.test.ts |   5 +
 packages/engine/tsconfig.json                      |   3 +-
 packages/engine/vitest.config.ts                   |  10 +-
 packages/i18n/package.json                         |   2 +-
 packages/i18n/vitest.config.ts                     |   7 +
 packages/mobile/package.json                       |   2 +-
 packages/mobile/vitest.config.ts                   |   2 +-
 packages/pi-claude-cli/package.json                |   2 +-
 packages/pi-claude-cli/vitest.config.ts            |   2 +-
 packages/pi-llama-cpp/package.json                 |   2 +-
 packages/pi-llama-cpp/vitest.config.ts             |   2 +-
 packages/plugin-sdk/package.json                   |   2 +-
 packages/plugin-sdk/vitest.config.ts               |   2 +-
 .../examples/fusion-plugin-auto-label/package.json |   2 +-
 .../fusion-plugin-auto-label/vitest.config.ts      |   2 +-
 .../examples/fusion-plugin-ci-status/package.json  |   2 +-
 .../fusion-plugin-ci-status/vitest.config.ts       |   2 +-
 .../fusion-plugin-notification/package.json        |   2 +-
 .../fusion-plugin-notification/vitest.config.ts    |   2 +-
 .../fusion-plugin-settings-demo/package.json       |   2 +-
 .../fusion-plugin-settings-demo/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-acp-runtime/package.json     |   2 +-
 plugins/fusion-plugin-acp-runtime/vitest.config.ts |   2 +-
 plugins/fusion-plugin-agent-browser/package.json   |   2 +-
 .../fusion-plugin-agent-browser/vitest.config.ts   |   2 +-
 .../fusion-plugin-cli-printing-press/package.json  |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../package.json                                   |   2 +-
 .../src/__tests__/orchestrator-live-output.test.ts |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-cursor-runtime/package.json  |   4 +-
 .../fusion-plugin-dependency-graph/package.json    |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-droid-runtime/package.json   |   2 +-
 .../fusion-plugin-droid-runtime/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-even-cards/package.json      |   2 +-
 plugins/fusion-plugin-even-cards/vitest.config.ts  |   2 +-
 .../package.json                                   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-hermes-runtime/package.json  |   2 +-
 .../fusion-plugin-hermes-runtime/vitest.config.ts  |   2 +-
 .../fusion-plugin-openclaw-runtime/package.json    |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../fusion-plugin-paperclip-runtime/package.json   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-reports/package.json         |   2 +-
 .../src/__tests__/review-panel.test.ts             |   6 +-
 plugins/fusion-plugin-reports/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-roadmap/package.json         |   2 +-
 plugins/fusion-plugin-roadmap/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-whatsapp-chat/package.json   |   2 +-
 .../fusion-plugin-whatsapp-chat/vitest.config.ts   |   2 +-
 pnpm-lock.yaml                                     | 626 ++++++++-------------
 .../__tests__/dependency-security-floor.test.mjs   |  95 ++++
 75 files changed, 475 insertions(+), 491 deletions(-)

Fusion-Task-Id: FN-6042

Fusion-Task-Lineage: fff6a1cb-8937-435c-9a91-b7c7a59cc80e

2026-06-08 15:19:27 -07:00

..

acp-client-runtime.md

feat(acp): bundle into CLI, on-demand install, S1 safety + evidence (U8)

2026-06-03 09:25:56 -07:00

auto-git-init-project-registration.md

fix(FN-1455): initialize git during project registration

2026-06-06 00:38:28 -07:00

cli-agent-codex-droid-pi-adapters.md

feat(engine): add Codex, Droid, and Pi cli-agent adapters (U5)

2026-06-05 00:00:05 -07:00

cli-agent-executor-seam.md

feat(engine): wire cli-agent executor seam and task session lifecycle (U7)

2026-06-05 00:01:12 -07:00

cli-agent-generic-adapter.md

feat(engine): add generic heuristic-tier cli-agent adapter (U6)

2026-06-04 23:34:33 -07:00

cli-agent-hook-ingestion.md

feat(dashboard): add cli-agent hook ingestion route and session hook scripts (U17)

2026-06-04 23:39:07 -07:00

cli-agent-hybrid-chat.md

feat(dashboard): wire cli-agent chat surface and runner glue; fix stale engine mocks (U12 completion)

2026-06-05 03:02:27 -07:00

cli-agent-mobile-terminal-input.md

feat(dashboard): mobile terminal input bar with sticky Ctrl accessory keys (U13)

2026-06-05 02:27:46 -07:00

cli-agent-one-shot-sessions.md

feat(engine): cli-agent one-shot sessions for validator, planning, and CE (U9)

2026-06-05 00:15:57 -07:00

cli-agent-resume-coordinator.md

feat(engine): cli-agent resume coordinator and self-healing integration (U8)

2026-06-05 00:16:14 -07:00

cli-agent-review-fixes.md

fix(review): schema-version gate, output-filter escape-bypass, generic double-wrap, follow-up resolution

2026-06-05 03:41:54 -07:00

cli-agent-runtime-bootstrap.md

feat: bootstrap cli-agent runtime and wire executor, transport, chat, and recovery seams

2026-06-05 03:24:41 -07:00

cli-agent-session-transport.md

feat(dashboard): cli-agent session transport — WS attach, tickets, SSE state, output hardening (U10)

2026-06-04 23:44:39 -07:00

cli-agent-settings-autonomy-gate.md

feat: cli-agent adapter settings, autonomy approval gate, and node editor config (U15)

2026-06-05 00:30:27 -07:00

cli-agent-terminal-ui.md

feat(dashboard): cli-agent terminal UI, task-card states, and notification banner support (U11)

2026-06-05 01:16:13 -07:00

cli-agent-tui-attach.md

feat(cli): TUI full-screen attach to cli-agent sessions (U14)

2026-06-04 23:56:10 -07:00

compound-engineering-plugin-scaffold.md

feat(compound-engineering): live agent output, steering, and a real Q&A surface

2026-06-03 14:17:40 -07:00

config.json

feat(tui+release): persist vitest memory guard, aggregate root CHANGELOG, lockstep all packages

2026-04-25 09:09:31 -07:00

directory-picker-create-folder.md

Address PR review feedback (#1466)

2026-06-06 06:31:44 -07:00

fair-lizards-jump.md

FN-5908: recover planning sessions after load failures

2026-06-02 18:58:48 -07:00

fix-base-commit-sha-local-main.md

fix(engine): capture baseCommitSha against local main, not origin/main

2026-06-03 15:24:03 -07:00

fix-branch-group-name-collision-triage.md

fix(core): reuse same-name branch group instead of colliding on triage

2026-06-03 08:40:01 -07:00

fix-compound-engineering-css-build.md

fix(FN-0000): include compound engineering dashboard css

2026-06-08 12:55:52 -07:00

fix-frozen-dashboard-animations.md

fix(dashboard): unfreeze animations broken by transition tokens used as durations

2026-06-03 19:48:40 -07:00

fix-opencode-go-api-key-env.md

Address PR review comments

2026-06-05 11:12:40 +10:00

fix-stranded-done-feature-recovery.md

fix(engine): recover missions wedged by stranded done features

2026-06-03 07:06:30 -07:00

fn-1467-pr-feedback-fixes.md

fix: address PR review feedback (#1467)

2026-06-07 23:03:38 -07:00

fn-5796-plugin-state-noop.md

FN-5796: make plugin same-state transitions idempotent

2026-05-31 20:50:09 -07:00

fn-5797-show-hidden-fix.md

FN-5797: fix usage indicator show hidden button behavior

2026-05-31 21:08:41 -07:00

fn-5803-streaming-cross-message-space.md

FN-5803: normalize streamed sentence spacing across message boundaries

2026-05-31 23:24:53 -07:00

fn-5805-onboard-command.md

FN-5805: add fn onboard command with sequential runOnboard flow

2026-06-01 01:42:19 -07:00

fn-5806-onboard-step-skip.md

FN-5806: make onboarding steps individually skippable

2026-06-01 13:20:55 -07:00

fn-5807-onboarding-autolaunch.md

FN-5807: add onboarding auto-launch hook before interactive commands

2026-06-01 13:03:20 -07:00

fn-5808-onboard-backcompat-guard.md

FN-5808: skip onboarding auto-launch for non-interactive and existing setups

2026-06-01 13:33:56 -07:00

fn-5809-skip-onboarding-bypass.md

FN-5809: add onboarding skip-flag and env bypass handling

2026-06-01 14:07:46 -07:00

fn-5812-onboard-backcompat-guard.md

FN-5812: add onboard autolaunch backcompat guard coverage

2026-06-01 16:55:56 -07:00

fn-5813-onboard-docs.md

FN-5813: update fn onboard help and CLI docs

2026-06-01 17:15:11 -07:00

fn-5815-onboard-command.md

FN-5815: add changeset for fn onboard minor release

2026-06-01 17:52:12 -07:00

fn-5817-auto-merge-toggle-mobile.md

FN-5817: prevent blank dashboard after auto-merge toggle

2026-06-01 01:30:34 -07:00

fn-5818-shared-branch-working-branch.md

FN-5818: fix shared-branch-group execution to use per-task working branches

2026-06-01 01:37:25 -07:00

fn-5822-branch-group-dashboard.md

FN-5822: wire shared branch-group visibility and merge controls

2026-06-01 04:47:19 -07:00

fn-5825-group-task-modal.md

FN-5825: add dedicated grouped-task modal popup

2026-06-01 05:15:14 -07:00

fn-5829-shared-feature-branch-option.md

FN-5829: add shared feature branch option for new tasks

2026-06-01 03:23:10 -07:00

fn-5830-branch-group-promotion.md

FN-5830: re-land shared branch promotion gate and API

2026-06-01 05:39:01 -07:00

fn-5832-unsupported-message-role.md

FN-5832: surface unsupported message-role provider errors

2026-06-01 07:53:56 -07:00

fn-5834-developer-role-compat.md

FN-5834: enforce explicit developer-role compatibility for custom providers

2026-06-01 09:05:18 -07:00

fn-5835-source-issue-tracking.md

FN-5835: reuse imported GitHub source issue tracking

2026-06-01 08:13:36 -07:00

fn-5844-external-plugin-authoring.md

FN-5844: add plugin dev loop and external authoring docs

2026-06-01 19:40:28 -07:00

fn-5845-branch-group-collapse.md

FN-5845: fix mobile agent log scroll and add collapsible branch group card

2026-06-01 16:24:21 -07:00

fn-5846-shared-group-merge-routing.md

fix(FN-5846): commit-ownership-anchor already-merged attribution (U3)

2026-06-03 09:40:30 -07:00

fn-5847-onboard-autolaunch-marker.md

FN-5847: honor onboarding completion marker in auto-launch

2026-06-01 18:52:28 -07:00

fn-5851-goal-store-resolution.md

FN-5851: fix goal tool store resolution

2026-06-01 23:39:20 -07:00

fn-5852-queued-message-stale-flush.md

fix(FN-5852): confirm server generation state before flushing queued chat messages

2026-06-03 19:54:02 -07:00

fn-5853-skills-persistence.md

FN-5853: persist skills toggle state in dashboard

2026-06-01 23:01:26 -07:00

fn-5856-quick-chat-resize.md

FN-5856: preserve closed quick chat panel size

2026-06-01 23:37:03 -07:00

fn-5858-chat-multipart-fix.md

FN-5858: fix multipart chat attachment sends

2026-06-02 00:07:07 -07:00

fn-5862-pi-coding-agent-0.78.md

FN-5862: bump pi coding agent dependencies to 0.78

2026-06-01 23:55:20 -07:00

fn-5872-registry-cleanup.md

FN-5872: clear active-session registry on PR cleanup

2026-06-02 07:46:38 -07:00

fn-5880-mission-interview-complete-draft.md

FN-5880: recover plan-ready mission interview drafts

2026-06-02 09:02:48 -07:00

fn-5883-planning-restore.md

FN-5883: restore planning-mode single-task history

2026-06-02 10:07:08 -07:00

fn-5890-task-created-title.md

FN-5890: include task description in ntfy task-created notifications

2026-06-02 10:29:34 -07:00

fn-5892-planning-history-fix.md

FN-5892: dedupe planning sessions and persist history deletion

2026-06-02 12:42:04 -07:00

fn-5896-mission-goal-linkage.md

FN-5896: persist mission-goal linkage in schema

2026-06-02 14:41:41 -07:00

fn-5897-linked-goals-read-paths.md

FN-5897: surface linked goals in mission read paths

2026-06-02 17:58:41 -07:00

fn-5898-mission-goal-unlinked-indicator.md

FN-5898: add unlinked mission goal indicator

2026-06-02 18:15:14 -07:00

fn-5901-validator-run-reaper.md

FN-5901: reap stale mission validator runs

2026-06-02 15:33:31 -07:00

fn-5902-mission-validation-ai-run.md

FN-5902: make mission validation AI-run all criteria

2026-06-02 18:11:26 -07:00

fn-5907-planning-create-fetch.md

FN-5907: harden planning task creation side effects

2026-06-03 13:20:17 -07:00

fn-5909-merge-install-script.md

FN-5909: run configured merge bootstrap before verification

2026-06-02 18:43:29 -07:00

fn-5911-agent-log-jsonl.md

FN-5911: move agent logs to per-task JSONL storage

2026-06-03 01:10:18 -07:00

fn-5916-cli-bin-launcher.md

FN-5916: fix CLI bin targets for pnpm install

2026-06-02 21:54:14 -07:00

fn-5917-codex-oauth-login.md

FN-5917: fix Codex OAuth option selection

2026-06-02 18:56:36 -07:00

fn-5924-oauth-alert-throttle.md

FN-5924: throttle OAuth expiry alerts across restarts

2026-06-02 23:13:16 -07:00

fn-5936-auto-merge-mobile-fix.md

FN-5936: fix auto-merge board stabilization on mobile

2026-06-03 13:20:17 -07:00

fn-5937-clear-auto-pause-retry.md

FN-5937: clear deadlock auto-pause on retry

2026-06-03 15:32:29 -07:00

fn-5941-mission-incompatible-agent-guard.md

FN-5941: stop missions stalling on incompatible/custom-role agents

2026-06-03 17:14:42 -07:00

fn-5949-pr-conflict-resolution.md

FN-5949: add AI PR conflict resolution to Create PR flow

2026-06-03 15:32:29 -07:00

fn-5950-pr-push-branch.md

FN-5950: add Create PR branch-push remediation

2026-06-03 22:31:23 -07:00

fn-5968-changes-tab-mobile.md

FN-5968: streamline Changes-tab mobile controls

2026-06-07 18:51:46 -07:00

fn-5972-mobile-auto-merge.md

FN-5972: fix mobile auto-merge blank dashboard

2026-06-07 18:51:46 -07:00

fn-6007-fix-duplicate-github-issues.md

FN-6007: prevent duplicate GitHub issue imports and tracking issues

2026-06-07 18:54:24 -07:00

fn-6018-agent-error-stop-delete.md

FN-6018: allow stopping and deleting failed agents

2026-06-08 10:33:17 -07:00

fn-6025-auto-merge-toggle-flags.md

FN-6025: fix builtin coding auto-merge review flags

2026-06-08 13:32:58 -07:00

fn-6030-workflow-terminal-notifications.md

FN-6030: fix workflow terminal notifications

2026-06-08 13:54:17 -07:00

fn-6042-security-dependencies.md

FN-6042: raise dependency security floors

2026-06-08 15:19:27 -07:00

FN-5770-workflow-interpreter-authoritative.md

FN-5770: promote workflow interpreter to guarded lifecycle driver

2026-06-07 18:51:46 -07:00

FN-5833-custom-provider-responses-fix.md

FN-5833: fix custom Responses API model lookup

2026-06-01 08:23:02 -07:00

FN-5899-mission-goal-tooling.md

FN-5899: add mission-goal linking commands and tools

2026-06-02 14:47:51 -07:00

FN-5958-mission-goal-links.md

FN-5958: add mission goal linking to create and update flows

2026-06-03 22:31:23 -07:00

FN-5977-goal-retrieval-engine-tools.md

FN-5977: expose goal retrieval tools across engine agents

2026-06-07 18:51:46 -07:00

FN-5985-mission-goal-not-found-contract.md

FN-5985: align mission goal link errors

2026-06-07 20:23:07 -07:00

FN-6024-built-in-workflow-edges.md

FN-6024: fix built-in workflow graph edges

2026-06-08 13:32:58 -07:00

FN-6035-builtin-coding-workflow-parity.md

FN-6035: align builtin coding workflow registry with canonical IR

2026-06-08 13:32:58 -07:00

fn-branch-group-single-pr.md

feat(FN-branch-group): surface group PR controls in dashboard + CLI (U7)

2026-06-03 10:31:18 -07:00

fn-db-corruption-resilience.md

Harden fusion.db against recurring corruption

2026-06-01 21:55:10 -07:00

fn-pr-commands.md

Address PR review feedback (#1461)

2026-06-06 00:09:53 -07:00

four-oranges-film.md

FN-5904: feat(FN-5904): add browse-and-install flow for skills.sh catalog in Skills view

2026-06-02 18:29:53 -07:00

friendly-ravens-hammer.md

FN-5885: fix terminal copy/paste shortcuts

2026-06-02 09:20:31 -07:00

graph-custom-workflows.md

docs(changeset): cover editor upgrade and consolidation scope

2026-06-05 00:49:04 -07:00

i18n-localization-foundation.md

feat(i18n): add @fusion/i18n package, catalogs, and i18next-cli tooling (U2)

2026-06-03 08:00:31 -07:00

minimax-usage-missing-rows.md

fix(dashboard): show missing Minimax usage rows and weekly windows

2026-06-03 07:51:38 -07:00

per-task-automerge-override.md

fix(engine): honor per-task auto-merge override when global auto-merge is off

2026-06-03 10:18:24 -07:00

quiet-built-in-workflows.md

feat: allow disabling built-in workflows

2026-06-08 07:53:42 -07:00

review-column-auto-merge.md

fix(FN-0000): address auto-merge review feedback

2026-06-08 07:57:11 -07:00

sharp-graphs-stretch.md

FN-6019: make dependency graph fill full dashboard width

2026-06-08 13:32:58 -07:00

step-inversion-workflow-modelable-steps.md

feat(sdk,dashboard,docs): U9 — save-time code validation route, SDK type exports, skill doc, step-inversion docs + changeset

2026-06-04 13:15:50 -07:00

vitest-autokill-guard.md

fix(tui): stop vitest auto-kill firing on garbage memory metric and killing non-vitest processes

2026-06-03 13:33:38 -07:00

workflow-board-list-layout.md

fix: stabilize workflow board and loop recovery

2026-06-07 23:30:16 -07:00

workflow-column-agent-assignment.md

test(engine): column-agent surface matrix, parity invisibility proof, docs

2026-06-05 00:32:52 -07:00

workflow-custom-columns-traits.md

fix(core): widen Task.column to ColumnId across packages; v1-preserving IR persistence for rollback safety (#1403 #1405)

2026-06-04 08:00:33 -07:00

workflow-extension-plugins.md

fix(engine): address workflow extension PR feedback

2026-06-07 21:19:10 -07:00

workflow-graph-editor-and-bundled-plugins.md

Fix Settings plugin installs registering unloadable directory paths

2026-06-04 21:57:46 -07:00

workflow-loop-nodes.md

feat(FN-0000): add workflow loop nodes

2026-06-07 23:56:25 -07:00

workflow-model-lanes-settings.md

Address PR review feedback (#1502)

2026-06-07 22:56:35 -07:00

workflow-settings-mechanism.md

test(core): end-to-end workflow-settings journey + surface enumeration; docs and changeset

2026-06-05 01:16:27 -07:00