deps: weekly drift report

[bmdhodl]

Repo notes:

• SDK version drift: sdk/pyproject.toml still says 1.2.9, while memory/state.md says the latest shipped SDK release is 1.2.10.
• Python extras drift: crewai>=0.28 no longer resolves on PyPI. Latest published crewai is 1.14.4, so the current floor is stale and should be replaced deliberately instead of left as-is.

PATCH

• opentelemetry-api 1.41.0 -> 1.41.1
• opentelemetry-sdk 1.41.0 -> 1.41.1

MINOR

• @modelcontextprotocol/sdk 1.26.0 -> 1.29.0
• @types/node 25.2.2 -> 25.6.0

MAJOR

• langchain-core 0.3.84 -> 1.3.2
• langgraph 0.6.11 -> 1.1.10
• crewai spec >=0.28 -> suggestion: pin to an existing 1.x line after compatibility review; latest published is 1.14.4
• typescript 5.9.3 -> 6.0.3
• zod 3.25.76 -> 4.4.2

SECURITY

• langgraph 0.6.11 -> 1.1.10 (CVE-2026-28277)
• langgraph-checkpoint 3.0.1 -> 4.0.0 (CVE-2026-27794)

[bmdhodl]

Week of 2026-05-02. Initial automated drift snapshot.

PATCH

• sdk:crewai 0.28 -> 1.14.4
• sdk:opentelemetry-api 1.41.0 -> 1.41.1
• sdk:opentelemetry-sdk 1.41.0 -> 1.41.1

MINOR

• mcp-server:@modelcontextprotocol/sdk 1.26.0 -> 1.29.0
• mcp-server:@types/node 25.2.2 -> 25.6.0

MAJOR

• mcp-server:typescript 5.9.3 -> 6.0.3
• mcp-server:zod 3.25.76 -> 4.4.2
• sdk:langchain-core 0.3.84 -> 1.3.2
• sdk:langgraph 0.6.11 -> 1.1.10

SECURITY

• sdk:langgraph 0.6.11 -> 1.0.10 (CVE-2026-28277)

Note: sdk: Python entries use lower-bound versions from sdk/pyproject.toml because the repo does not commit a Python lockfile.

[bmdhodl]

Week of 2026-05-03. Automated drift snapshot.

PATCH

• sdk:opentelemetry-api 1.41.0 -> 1.41.1
• sdk:opentelemetry-sdk 1.41.0 -> 1.41.1

MINOR

• mcp-server:@modelcontextprotocol/sdk 1.26.0 -> 1.29.0
• mcp-server:@types/node 25.2.2 -> 25.6.0

MAJOR

• mcp-server:typescript 5.9.3 -> 6.0.3
• mcp-server:zod 3.25.76 -> 4.4.2
• sdk:crewai >=0.28 -> 1.14.4 (repo floor; exact current unresolved)
• sdk:langchain-core 0.3.84 -> 1.3.2
• sdk:langgraph 0.6.11 -> 1.1.10

SECURITY

• sdk:langgraph 0.6.11 -> 1.0.10 (CVE-2026-28277)

Note: sdk: Python entries use lower-bound versions from sdk/pyproject.toml because the repo does not commit a Python lockfile. sdk:crewai is reported as a manifest floor because the exact current version is not pinned in-repo.

[bmdhodl]

Weekly drift update (2026-05-03).

Weekly dependency drift scan for agent47.

Note: sdk entries use lower bounds from sdk/pyproject.toml because no committed Python lockfile is present

SECURITY

• sdk:langgraph: 0.6.11 -> 1.1.10 (CVE-2026-28277)

MAJOR

• mcp-server:typescript: 5.9.3 -> 6.0.3
• mcp-server:zod: 3.25.76 -> 4.4.2
• sdk:crewai: 0.28 -> 1.14.4
• sdk:langchain-core: 0.3.84 -> 1.3.2

MINOR

• mcp-server:@modelcontextprotocol/sdk: 1.26.0 -> 1.29.0
• mcp-server:@types/node: 25.2.2 -> 25.6.0

PATCH

• sdk:opentelemetry-api: 1.41.0 -> 1.41.1
• sdk:opentelemetry-sdk: 1.41.0 -> 1.41.1

[bmdhodl]

Weekly drift scan for 2026-05-04.

Repo/package drift note:

• sdk/pyproject.toml is still agentguard47 1.2.9 while GitHub Releases and PyPI are already 1.2.10.
• mcp-server/package.json is 0.2.2 in repo while npm still serves @agentguard47/mcp-server 0.2.1.
• Python targets below are suggestions only because sdk/pyproject.toml declares lower bounds, not a locked environment.

PATCH

• opentelemetry-api 1.41.0 -> 1.41.1 (suggestion)
• opentelemetry-sdk 1.41.0 -> 1.41.1 (suggestion)
• @types/node 25.2.2 -> 25.6.0

MINOR

• @modelcontextprotocol/sdk 1.26.0 -> 1.29.0
• crewai 0.28 -> 1.14.4 (suggestion)

MAJOR

• langchain-core 0.3.84 -> 1.3.2 (suggestion)
• langgraph 0.6.11 -> 1.1.10 (suggestion)
• typescript 5.9.3 -> 6.0.3
• zod 3.25.76 -> 4.4.3

SECURITY

• langgraph declared lower bound 0.6.11 -> minimum patched target 1.0.10 (CVE-2026-28277)

[bmdhodl]

Weekly dependency drift sweep for 2026-05-04.

PATCH

• sdk: opentelemetry-api >=1.41.0 -> 1.41.1
• sdk: opentelemetry-sdk >=1.41.0 -> 1.41.1

MINOR

• mcp-server: @modelcontextprotocol/sdk 1.26.0 -> 1.29.0
• mcp-server: @types/node 25.2.2 -> 25.6.0

MAJOR

• mcp-server: typescript 5.9.3 -> 6.0.3
• mcp-server: zod 3.25.76 -> 4.4.3
• sdk: crewai >=0.28 -> exact current unresolved from manifest only; verify chosen target before upgrade
• sdk: langchain-core >=0.3.84 -> 1.3.2
• sdk: langgraph >=0.6.11 -> 1.1.10

SECURITY

• langgraph >=0.6.11 -> 1.0.10 (CVE-2026-28277)

SDK version drift note: sdk/pyproject.toml still says 1.2.9 while memory/state.md says latest shipped 1.2.10 and ops/03-ROADMAP_NOW_NEXT_LATER.md still mentions v1.2.9.

[bmdhodl]

2026-05-08 sweep

SDK publish drift is clear now: sdk/pyproject.toml, PyPI, and the latest GitHub release all say 1.2.10. mcp-server/package.json and npm both say 0.2.2.

PATCH

• sdk: opentelemetry-api >=1.41.0 -> 1.41.1 (suggestion; repo only declares a lower bound)
• sdk: opentelemetry-sdk >=1.41.0 -> 1.41.1 (suggestion; repo only declares a lower bound)
• mcp-server: @types/node 25.2.2 -> 25.6.2

MINOR

• mcp-server: @modelcontextprotocol/sdk 1.26.0 -> 1.29.0
• sdk: langgraph >=0.6.11 -> 1.1.10 (suggestion; repo only declares a lower bound)
• sdk: crewai >=0.28 -> 1.14.4 (suggestion; repo only declares a lower bound)

MAJOR

• mcp-server: typescript 5.9.3 -> 6.0.3
• mcp-server: zod 3.25.76 -> 4.4.3
• sdk: langchain-core >=0.3.84 -> 1.3.3 (suggestion; repo only declares a lower bound)

SECURITY

• sdk: langgraph 0.6.11 -> 1.0.10 (CVE-2026-28277)
• mcp-server: hono 4.12.0 -> 4.12.18
• mcp-server: ip-address 10.0.1 -> 10.2.0
• mcp-server: express-rate-limit 8.2.1 -> 8.5.1

[bmdhodl]

Weekly dependency drift snapshot for agent47 on 2026-05-08.

Python SDK rows are grounded from sdk/pyproject.toml minimum declared versions because this repo still has no committed Python lockfile.

PATCH

• sdk/opentelemetry-api: 1.41.0 -> 1.41.1
• sdk/opentelemetry-sdk: 1.41.0 -> 1.41.1

MINOR

• mcp-server/@modelcontextprotocol/sdk: 1.26.0 -> 1.29.0
• mcp-server/@types/node: 25.2.2 -> 25.6.2

MAJOR

• sdk/langchain-core: 0.3.84 -> 1.3.3
• sdk/langgraph: 0.6.11 -> 1.1.10
• sdk/crewai: 0.28 -> 1.14.4
• mcp-server/typescript: 5.9.3 -> 6.0.3
• mcp-server/zod: 3.25.76 -> 4.4.3

SECURITY

• sdk/langgraph: 0.6.11 -> 1.0.10 (CVE-2026-28277)