zrm625 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/.changeset/security-runtime-patches.md b/.changeset/security-runtime-patches.md
@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Update MCP, network, and desktop runtime dependencies to address security advisories while retaining the existing protocol and storage compatibility patches.
diff --git a/apps/cli/package.json b/apps/cli/package.json
@@ -36,7 +36,7 @@
     "quickjs-emscripten": "catalog:"
   },
   "devDependencies": {
-    "@cloudflare/worker-bundler": "0.2.1",
+    "@cloudflare/worker-bundler": "0.2.6",
     "@effect/vitest": "catalog:",
     "@types/node": "catalog:",
     "bun-types": "catalog:",

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -47,7 +47,7 @@
     "@types/node": "catalog:",
     "@zip.js/zip.js": "^2.8.26",
     "bun-types": "catalog:",
-    "electron": "41.10.3",
+    "electron": "42.11.3",
     "electron-builder": "26.16.1",
     "electron-vite": "^5",
     "quickjs-emscripten": "catalog:",

diff --git a/apps/host-selfhost/package.json b/apps/host-selfhost/package.json
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@better-auth/api-key": "^1.6.11",
-    "@cloudflare/worker-bundler": "0.2.1",
+    "@cloudflare/worker-bundler": "0.2.6",
     "@effect/atom-react": "catalog:",
     "@effect/platform-bun": "catalog:",
     "@executor-js/analytics": "workspace:*",

diff --git a/apps/marketing/package.json b/apps/marketing/package.json
@@ -14,11 +14,11 @@
     "typecheck:slow": "tsc --noEmit"
   },
   "dependencies": {
-    "@astrojs/cloudflare": "14.3.1",
-    "@astrojs/react": "6.0.5",
+    "@astrojs/cloudflare": "14.3.4",
+    "@astrojs/react": "6.0.6",
     "@executor-js/react": "workspace:*",
     "@tailwindcss/vite": "^4.2.2",
-    "astro": "7.3.2",
+    "astro": "7.3.8",
     "clsx": "^2.1.1",
     "motion": "^12.38.0",
     "posthog-js": "^1.372.5",

diff --git a/bun.lock b/bun.lock
diff --git a/package.json b/package.json
@@ -73,27 +73,55 @@
   "dependencies": {},
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",
-    "@changesets/cli": "^2.30.0",
+    "@changesets/cli": "^2.31.1",
     "@effect/language-service": "^0.85.1",
     "@effect/tsgo": "^0.5.2",
     "@effect/vitest": "catalog:",
     "@executor-js/plugin-provider-service-split": "workspace:*",
-    "@typescript/native-preview": "^7.0.0-dev.20260410.1",
-    "@vitest/expect": "catalog:",
-    "@vitest/mocker": "catalog:",
-    "@vitest/pretty-format": "catalog:",
-    "@vitest/runner": "catalog:",
-    "@vitest/snapshot": "catalog:",
-    "@vitest/spy": "catalog:",
-    "@vitest/utils": "catalog:",
-    "atmn": "^1.1.8",
+    "@typescript/native-preview": "^7.0.0-dev.20260707.2",
+    "@vitest/expect": "^4.1.12",
+    "@vitest/mocker": "^4.1.12",
+    "@vitest/pretty-format": "^4.1.12",
+    "@vitest/runner": "^4.1.11",
+    "@vitest/snapshot": "^4.1.12",
+    "@vitest/spy": "^4.1.12",
+    "@vitest/utils": "^4.1.12",
+    "atmn": "^1.1.25",
     "effect": "catalog:",
-    "knip": "^6.3.0",
+    "knip": "^6.42.1",
     "oxfmt": "^0.44.0",
-    "oxlint": "^1.56.0",
-    "turbo": "^2.5.6",
+    "oxlint": "~1.60.0",
+    "turbo": "^2.11.10",
     "typescript": "^5.9.3",
-    "vitest": "catalog:"
+    "vitest": "^4.1.12"
+  },
+  "overrides": {
+    "@effect/atom-react": "4.0.0-beta.59",
+    "@effect/opentelemetry": "4.0.0-beta.59",
+    "@effect/platform-bun": "4.0.0-beta.59",
+    "@effect/platform-node": "4.0.0-beta.59",
+    "@effect/platform-node-shared": "4.0.0-beta.59",
+    "@modelcontextprotocol/sdk": "1.32.1",
+    "@opentelemetry/core": "^2.12.0",
+    "@opentelemetry/exporter-prometheus": "^0.217.0",
+    "@opentelemetry/propagator-jaeger": "^2.9.0",
+    "@opentelemetry/sdk-node": "^0.217.0",
+    "diff": "^9.0.0",
+    "dompurify": "^3.4.17",
+    "effect": "4.0.0-beta.59",
+    "esbuild": "^0.28.2",
+    "form-data": "^4.0.6",
+    "global-agent": "^4.1.3",
+    "katex": "^0.18.11",
+    "kysely": "0.28.17",
+    "protobufjs": "^8.6.6",
+    "qs": "^6.16.0",
+    "sharp": "^0.35.5",
+    "shell-quote": "^1.11.0",
+    "tinypool": "^2.1.2",
+    "tough-cookie": "^4.1.4",
+    "undici": "^8.12.3",
+    "ws": "^8.22.0"
   },
   "packageManager": "bun@1.3.11",
   "catalog": {
@@ -102,34 +130,34 @@
     "@effect/platform-node": "4.0.0-beta.59",
     "@effect/atom-react": "4.0.0-beta.59",
     "@effect/vitest": "4.0.0-beta.59",
-    "@types/node": "^24.3.1",
-    "bun-types": "^1.2.22",
-    "drizzle-orm": "^0.45.0",
-    "drizzle-kit": "^0.31.10",
-    "@libsql/client": "^0.17.3",
+    "@types/node": "^24.19.2",
+    "bun-types": "^1.4.3",
+    "drizzle-orm": "^0.45.4",
+    "drizzle-kit": "^0.31.11",
+    "@libsql/client": "^0.17.4",
     "@libsql/kysely-libsql": "^0.4.1",
-    "@vitest/expect": "^4.1.5",
-    "@vitest/mocker": "^4.1.5",
-    "@vitest/pretty-format": "^4.1.5",
-    "@vitest/runner": "^4.1.5",
-    "@vitest/snapshot": "^4.1.5",
-    "@vitest/spy": "^4.1.5",
-    "@vitest/utils": "^4.1.5",
-    "vitest": "^4.1.5",
-    "vite": "^8.0.0",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@tailwindcss/vite": "^4.2.2",
-    "@tanstack/react-router": "^1.170.41",
-    "@tanstack/react-start": "^1.168.60",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
+    "@vitest/expect": "^4.1.12",
+    "@vitest/mocker": "^4.1.12",
+    "@vitest/pretty-format": "^4.1.12",
+    "@vitest/runner": "^4.1.11",
+    "@vitest/snapshot": "^4.1.12",
+    "@vitest/spy": "^4.1.12",
+    "@vitest/utils": "^4.1.12",
+    "vitest": "^4.1.12",
+    "vite": "^8.3.5",
+    "@vitejs/plugin-react": "^6.1.2",
+    "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/react-router": "^1.170.45",
+    "@tanstack/react-start": "^1.169.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "typescript": "^5.9.3",
-    "tailwindcss": "^4.2.2",
+    "tailwindcss": "^4.3.3",
     "quickjs-emscripten": "^0.31.0",
     "@jitl/quickjs-wasmfile-release-sync": "0.31.0",
-    "tsup": "^8.5.0",
+    "tsup": "^8.5.1",
     "@effect/opentelemetry": "4.0.0-beta.59"
   },
   "patchedDependencies": {
@@ -139,6 +167,6 @@
     "agents@0.17.3": "patches/agents@0.17.3.patch",
     "libsql@0.5.29": "patches/libsql@0.5.29.patch",
     "@electric-sql/pglite-socket@0.1.4": "patches/@electric-sql%2Fpglite-socket@0.1.4.patch",
-    "@modelcontextprotocol/client@2.0.0": "patches/@modelcontextprotocol%2Fclient@2.0.0.patch"
+    "@modelcontextprotocol/client@2.3.1": "patches/@modelcontextprotocol%2Fclient@2.3.1.patch"
   }
 }
diff --git a/packages/core/fumadb/package.json b/packages/core/fumadb/package.json
@@ -118,6 +118,6 @@
     "kysely": "^0.28.16",
     "kysely-typeorm": "^0.3.0",
     "semver": "^7.7.4",
-    "zod": "4.3.6"
+    "zod": "4.6.7"
   }
 }
diff --git a/packages/core/test-servers/package.json b/packages/core/test-servers/package.json
@@ -15,8 +15,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "effect": "catalog:",
-    "graphql-yoga": "^5.17.0",
-    "zod": "4.3.6"
+    "graphql-yoga": "^5.24.6",
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250620.0",

diff --git a/packages/hosts/mcp-apps-shell/package.json b/packages/hosts/mcp-apps-shell/package.json
@@ -91,12 +91,12 @@
     "playwright-core": "^1.59.1",
     "react": "catalog:",
     "react-dom": "catalog:",
-    "recharts": "3.8.0",
+    "recharts": "3.8.1",
     "tailwindcss": "catalog:",
     "typescript": "catalog:",
     "vite": "catalog:",
     "vite-plugin-singlefile": "^2.3.2",
     "vitest": "catalog:",
-    "zod": "4.3.6"
+    "zod": "4.6.7"
   }
 }
diff --git a/packages/hosts/mcp-apps-shell/src/shell/smoke-harness-bundle.gen.ts b/packages/hosts/mcp-apps-shell/src/shell/smoke-harness-bundle.gen.ts
diff --git a/packages/hosts/mcp/package.json b/packages/hosts/mcp/package.json
@@ -50,7 +50,7 @@
     "@modelcontextprotocol/ext-apps": "^1.7.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "effect": "catalog:",
-    "zod": "4.3.6"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",

diff --git a/packages/plugins/graphql/package.json b/packages/plugins/graphql/package.json
@@ -65,7 +65,7 @@
     "@executor-js/config": "workspace:*",
     "@executor-js/sdk": "workspace:*",
     "graphql": "^16.12.0",
-    "graphql-yoga": "^5.17.0"
+    "graphql-yoga": "^5.24.6"
   },
   "devDependencies": {
     "@effect/atom-react": "catalog:",

diff --git a/packages/plugins/mcp/package.json b/packages/plugins/mcp/package.json
@@ -66,18 +66,18 @@
     "@effect/platform-node": "catalog:",
     "@executor-js/config": "workspace:*",
     "@executor-js/sdk": "workspace:*",
-    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/core": "2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "lucide-react": "^1.7.0",
-    "zod": "4.3.6"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@effect/atom-react": "catalog:",
     "@effect/vitest": "catalog:",
     "@executor-js/api": "workspace:*",
     "@executor-js/react": "workspace:*",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server": "2.3.1",
     "@types/node": "catalog:",
     "@types/react": "catalog:",
     "bun-types": "catalog:",

diff --git a/packages/plugins/mcp/src/sdk/call-tool-result-schema.gen.ts b/packages/plugins/mcp/src/sdk/call-tool-result-schema.gen.ts
@@ -94,7 +94,7 @@ export const callToolResultJsonSchema = {
                     type: "string",
                     format: "date-time",
                     pattern:
-                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
                   },
                 },
                 additionalProperties: false,
@@ -142,7 +142,7 @@ export const callToolResultJsonSchema = {
                     type: "string",
                     format: "date-time",
                     pattern:
-                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
                   },
                 },
                 additionalProperties: false,
@@ -190,7 +190,7 @@ export const callToolResultJsonSchema = {
                     type: "string",
                     format: "date-time",
                     pattern:
-                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
                   },
                 },
                 additionalProperties: false,
@@ -272,7 +272,7 @@ export const callToolResultJsonSchema = {
                     type: "string",
                     format: "date-time",
                     pattern:
-                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
                   },
                 },
                 additionalProperties: false,
@@ -366,7 +366,7 @@ export const callToolResultJsonSchema = {
                     type: "string",
                     format: "date-time",
                     pattern:
-                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+                      "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
                   },
                 },
                 additionalProperties: false,

diff --git a/packages/react/package.json b/packages/react/package.json
@@ -56,7 +56,7 @@
     "react-day-picker": "^9.14.0",
     "react-hook-form": "^7.72.0",
     "react-resizable-panels": "^4",
-    "recharts": "3.8.0",
+    "recharts": "3.8.1",
     "shiki": "^4.0.2",
     "sonner": "^2.0.7",
     "streamdown": "^2.5.0",

diff --git a/patches/@modelcontextprotocol%2Fclient@2.0.0.patch b/patches/@modelcontextprotocol%2Fclient@2.0.0.patch
diff --git a/patches/@modelcontextprotocol%2Fclient@2.3.1.patch b/patches/@modelcontextprotocol%2Fclient@2.3.1.patch
@@ -0,0 +1,32 @@
+diff --git a/dist/shimsWorkerd.cjs b/dist/shimsWorkerd.cjs
+index 0c278fb8135fdf1a8e9088fcfe28a3cf1d1730ed..5fe2a8a1afc99c4daa5f643167cadaf9d0f1939d 100644
+--- a/dist/shimsWorkerd.cjs
++++ b/dist/shimsWorkerd.cjs
+@@ -1,2 +1,1 @@
+-const require_src = require('./src-DpAS0jfg.cjs');
+ const require_cfWorkerProvider = require('./cfWorkerProvider-B3dvjU3F.cjs');
+@@ -7,7 +6,7 @@ const require_cfWorkerProvider = require('./cfWorkerProvider-B3dvjU3F.cjs');
+ *
+ * This file is selected via package.json export conditions when running in workerd.
+ */
+-require_src.preloadSchemas();
++/* executor-patch: no-preload-schemas - build schemas lazily on first use. */
+ /**
+ * Whether `fetch()` may throw `TypeError` due to CORS. CORS is a browser-only concept —
+ * in Cloudflare Workers, a `TypeError` from `fetch` is always a real network/configuration
+diff --git a/dist/shimsWorkerd.mjs b/dist/shimsWorkerd.mjs
+index ca6eda547bce1286c329c82b1dc415f28352b6ed..3b7ff8d3700184df2dd50d58399abe3fc85b357a 100644
+--- a/dist/shimsWorkerd.mjs
++++ b/dist/shimsWorkerd.mjs
+@@ -1,2 +1,1 @@
+-import { n as preloadSchemas } from "./src-WCy6ifGf.mjs";
+ import { t as CfWorkerJsonSchemaValidator } from "./cfWorkerProvider-BylNJ1R5.mjs";
+@@ -7,7 +6,7 @@ import { t as CfWorkerJsonSchemaValidator } from "./cfWorkerProvider-BylNJ1R5.mj
+ *
+ * This file is selected via package.json export conditions when running in workerd.
+ */
+-preloadSchemas();
++/* executor-patch: no-preload-schemas - build schemas lazily on first use. */
+ /**
+ * Whether `fetch()` may throw `TypeError` due to CORS. CORS is a browser-only concept —
+ * in Cloudflare Workers, a `TypeError` from `fetch` is always a real network/configuration
diff --git a/scripts/check-patched-deps.ts b/scripts/check-patched-deps.ts
@@ -82,7 +82,7 @@ const runtimeChecks: readonly RuntimeCheck[] = [
     sentinels: ["markStreamUndelivered", "replayUndeliveredResponses"],
   },
   {
-    package: "@modelcontextprotocol/client@2.0.0 (dist/shimsWorkerd.mjs)",
+    package: "@modelcontextprotocol/client@2.3.1 (dist/shimsWorkerd.mjs)",
     purpose:
       "drops the workerd shim's module-eval preloadSchemas() (~15MB heap per isolate; " +
       "collapsed isolate reuse in the 2026-08-25 latency incident) — schemas build lazily",