chore(deps): bump the production-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: @fozikio/reflex, @modelcontextprotocol/sdk, better-sqlite3 and yaml.

Updates @fozikio/reflex from 0.2.0 to 0.2.1

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fozikio/reflex since your current version.

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in modelcontextprotocol/typescript-sdk#1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in modelcontextprotocol/typescript-sdk#1839
• Add end-to-end test suite by @​felixweinberger in modelcontextprotocol/typescript-sdk#2167
• v1 stdio buffer limit by @​KKonstantinov in modelcontextprotocol/typescript-sdk#2239
• fix: support Zod 3.25 method literals by @​mattzcarey in modelcontextprotocol/typescript-sdk#2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in modelcontextprotocol/typescript-sdk#2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in modelcontextprotocol/typescript-sdk#2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2547
• chore: bump version to 1.30.0 by @​felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

• @​mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503
• @​arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

• 2d889f2 chore: bump version to 1.30.0 (#2563)
• e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
• bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
• 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
• 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
• 369513d fix: support Zod 3.25 method literals (#2368)
• e7ee57c v1 stdio buffer limit (#2239)
• c36e1ef Add end-to-end test suite (#2167)
• bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
• 9edbab7 fix(server): prioritize zod issues and format them (#1503)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.

Updates better-sqlite3 from 11.10.0 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

• use Ubuntu 22.04-arm by @​neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

• add gypfile option to package.json by @​neoxpert in WiseLibs/better-sqlite3#1505
• Update SQLite to version 3.53.4 by @​JoshuaWise in WiseLibs/better-sqlite3#1506
• validate the parameters of table properly by @​theosotr in WiseLibs/better-sqlite3#1504
• fix: this dependabot configuration does not set a co... in... by @​anupamme in WiseLibs/better-sqlite3#1508
• fixed process aborting from terminating worker threads (WiseLibs/better-sqlite3#1507)

New Contributors

• @​theosotr made their first contribution in WiseLibs/better-sqlite3#1504
• @​anupamme made their first contribution in WiseLibs/better-sqlite3#1508

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

• Refactored codebase to use node-addon-api by @​JoshuaWise in WiseLibs/better-sqlite3#1498
• Added a new db.explain() method, for running EXPLAIN queries without needing to supply bound parameters.
• Added a new preparedStatement.toString() method, for getting the expanded SQL of a prepared statement.
• Fix SqliteError cross-realm and Error.isError compatibility by @​dennismutuku2005 in WiseLibs/better-sqlite3#1473

New Contributors

• @​dennismutuku2005 made their first contribution in WiseLibs/better-sqlite3#1473

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

• Update SQLite to version 3.53.3 by @​JoshuaWise in WiseLibs/better-sqlite3#1492
• Utilize node:20-trixie for Electron v43 and onwards by @​neoxpert in WiseLibs/better-sqlite3#1495

... (truncated)

Commits

• dbc2ea1 13.0.3
• b872585 use Ubuntu 22.04-arm (#1510)
• 569e85a 13.0.2
• df1324b fix: this dependabot configuration does not set a co... in... (#1508)
• b9fbe5f fixed segfault from making calls while worker thread is terminating
• 71707c4 validate the parameters of table properly (#1504)
• 6478c99 Update SQLite to version 3.53.4 (#1506)
• 6d24034 add gypfile option to package.json (#1505)
• ab6232e fixed typo in docs
• 57d751c updated readme
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for better-sqlite3 since your current version.

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

[idapixl]

Holding this one, with a reason rather than a rebase loop.

The Node 20 Compat failure is the gate working, not a flake. This bumps better-sqlite3 11 → 13, and 13 declares "engines": { "node": ">=22" } while cortex-engine declares >=20. Merging as-is would drop Node 20 support for every installer without a version bump saying so — the failing job is the only thing currently preventing that.

The other three updates in this group are fine. It's specifically the better-sqlite3 major that forces the choice.

That choice is real and probably due soon: Node 20 reached end-of-life on 2026-04-30, and the CI logs already warn that checkout@v4/setup-node@v4 are being forced onto Node 24. Dropping Node 20 is defensible — but it's a breaking change for consumers and belongs in a deliberate release with engines raised to >=22 in the same commit, not in a dependency-group merge.

Leaving open for that decision. Not a security hold: npm install @fozikio/cortex-engine currently reports 0 vulnerabilities.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.