build(deps): bump dependencies to latest, clear pnpm audit, and trim overrides

[venables]

Changes

• All workspace dependencies bumped to their latest safe versions
• TypeScript 7, oxlint-tsgolint 7, @solana/kit 8, ai 7, @changesets/cli 3, @types/node 26
• pnpm audit goes from 35 advisories to 0
• Override block in pnpm-workspace.yaml cut from 18 entries to 5, each scoped and commented
• minimumReleaseAgeExclude removed; no longer needed
• Seven as casts removed that oxlint 1.80 flags as unnecessary
• Identity demo reads result.responseMessages (ai 7 change)
• pnpm 11.24.0 pinned in packageManager
• Patch changeset for @agentcommercekit/keys and @agentcommercekit/ack-id

Problem

The dependency tree had drifted: 35 audit advisories (1 critical, 19 high), most of them under mintlify, and an override block that had grown by accretion. Several of those overrides pinned versions the tree no longer pulls in, and two (vite, esbuild) were global instead of scoped to the vulnerable line.

Solution

Bump everything the full check accepts, then rebuild the override set from zero: remove every override, reinstall, audit, and add back only what still fails. Five remain:

Override	Why
esbuild@<0.24.3	drizzle-kit's deprecated @esbuild-kit pins esbuild 0.18
vite@7	vite 7.3.5 pins esbuild ^0.27 (low advisory); 7.3.6 allows ^0.28
qs@6	express 4 (via mintlify) pins qs 6.14
sharp@<0.35.0	mintlify pins sharp 0.33 (libvips CVEs)
puppeteer@24	extract-zip has no patched release; puppeteer 25 drops it

Two majors were left alone on purpose:

• @a2a-js/sdk 1.0 is an A2A protocol major (new Message shape, gRPC/protobuf peers) and would change ack-id's published ^0.3.0 peer range.
• did-resolver 5 conflicts with did-jwt and did-jwt-vc, which still depend on ^4.1.0 and produce incompatible Resolvable types.

Two things worth knowing about the majors that did land:

• ai 7 scopes result.response to the final step. The identity demo used result.response.messages to collect the full multi-step history, which would silently drop earlier tool-call messages. It now uses result.responseMessages, which keeps the ai 6 semantics.
• typescript 7 is the native compiler and exposes no JS API. Every repo command (tsdown build, oxlint type checking, knip, changesets, mintlify dev) works, but @mintlify/mdx/server would throw on import if the docs ever add twoslash blocks.

Testing

• pnpm run check (build + lint + format + test): 29/29 tasks pass, 0 lint warnings
• pnpm audit: no known vulnerabilities
• pnpm install --frozen-lockfile with both pnpm 11.8.0 and 11.24.0: lockfile stable
• pnpm exec changeset status: clean
• Payments demo imports were checked against the @solana/kit 7 and 8 release notes; none of the removed APIs are used
• Panel review loop (codex gpt-5.6, claude-fable-5, grok-4.6, glm-5.3): two rounds, all findings addressed or documented above

Pre-existing, not addressed here: mintlify validate warns on the @mintlify/components import in docs/ack-pay/payment-service.mdx, and .changeset/config.json carries an inert "tag": false key.

AI usage: Claude Code (Claude Fable 5) performed the dependency bumps, override analysis, source edits, and verification, and drove a multi-agent panel review (codex, claude, opencode). The author directed the work and reviewed the result.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Updated identity demo compatibility with the latest AI SDK response format.
  • Improved handling of identity document data and DID values in demos.

• Maintenance

  • Refreshed development tools and package versions across the project.
  • Updated Solana, cryptography, identifier, and documentation tooling packages.
  • Strengthened security vulnerability overrides for key build and runtime tools.
  • Updated release configuration and package manager requirements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4328423c-e627-427d-b363-cd03951e1d19

📥 Commits

Reviewing files that changed from the base of the PR and between 2233047 and ed0ad32.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (14)

• .changeset/config.json
• .changeset/deps-bump-keys-ack-id.md
• demos/identity/package.json
• demos/identity/src/client-agent.ts
• demos/identity/src/haiku-agent.ts
• demos/identity/src/index.ts
• demos/payments/package.json
• demos/skyfire-kya/src/skyfire-kya-ack-id.ts
• docs/package.json
• package.json
• packages/caip/src/caips/caip-2.test.ts
• packages/keys/package.json
• pnpm-workspace.yaml
• tools/cli-tools/package.json

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The pull request refreshes workspace and package dependencies, updates vulnerability and build policies, aligns demos with newer SDK and type behavior, and adds Changesets metadata for dependency-only package releases.

Changes

Dependency refresh and compatibility

Layer / File(s)	Summary
Workspace dependency policy .changeset/config.json, package.json, docs/package.json, pnpm-workspace.yaml	Workspace catalogs, dependency overrides, build permissions, package-manager versions, and development tools were updated.
Package and demo dependency updates demos/identity/package.json, demos/payments/package.json, packages/keys/package.json, tools/cli-tools/package.json	Runtime and tool dependencies were upgraded in the identity, payments, keys, and CLI packages.
SDK and type compatibility demos/identity/src/*, demos/skyfire-kya/src/skyfire-kya-ack-id.ts, packages/caip/src/caips/caip-2.test.ts	Identity agents now read responseMessages; DID document logging and DID URI literals no longer use explicit casts; a CAIP-2 test removes an input assertion.
Release metadata .changeset/deps-bump-keys-ack-id.md	Patch releases were declared for @agentcommercekit/keys and @agentcommercekit/ack-id with documented runtime dependency updates.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to ed0ad

This PR updates dependencies, narrows package overrides, and adjusts the identity demo for the new AI response API; the reported checks and audits pass, so no actionable merge-blocking risk remains beyond normal review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: dependency upgrades, removal of audit advisories, and reduction of pnpm overrides.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files. (9 skipped: 9 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files. (9 skipped: 9 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}