Summary

Update the CLI's dependency pins so a fresh installation no longer resolves the affected versions listed in the public advisories below. This is a dependency-maintenance proposal. Vulnerable code-path reachability and exploitation through AI CLI have not been established.

Problem to solve

The latest published package and the current default-branch package manifest pin sharp to 0.35.4 and undici to 7.30.0. Both versions fall within published advisory ranges with released patches. Keeping exact pins at those versions leaves consumers unable to receive the dependency fixes through an ordinary installation of the current CLI release.

Proposed behavior

Publish a CLI dependency set outside these affected ranges, preserving the existing commands and media behavior. Maintainers can choose the supported patched versions and validation approach.

Acceptance criteria

The CLI package manifest and lockfile resolve versions outside all nine listed affected ranges.
A fresh installation of the resulting published CLI release resolves the corrected dependency set.
Relevant existing CLI checks continue to pass, including media preview and download coverage.

Affected area

packages/ai-cli/package.json, the repository lockfile, and the dependency metadata shipped with the CLI package.

Non-goals

This proposal does not report a newly discovered vulnerability in AI CLI, claim that an advisory's attack prerequisites are reachable through the CLI, or request a public exploit demonstration. No application behavior failure or successful exploitation was reproduced.

Alternatives considered

Leave the exact pins unchanged, or move them to patched releases after compatibility validation. The latter removes the known version matches without requiring consumers to override the dependency graph. A major-version dependency migration is not required by this proposal.

Supporting context

Published baseline: npm ai-cli@0.8.0, also the latest stable GitHub release, source revision bd9d87a8ead2ff247b669fc6d4bcac90e8d96353.
Default-branch baseline: main at 20592fdd6deb68e09856f675a54e685b05b02226, with an unreleased package version of 0.8.1.
Verification was package and source inspection, not a CLI execution, source build, or exploit test. Runtime and platform are not needed to reproduce the manifest version matches.
The published npm metadata lists the pins. The corresponding tarball was fetched and its SHA-512 matched dist.integrity; its package manifest has the same pins.
The current source manifest has the same pins. The table links the public advisory sources that establish the affected and patched versions.

Dependency	Advisory	Published advisory summary	First patched version in the pinned major line
`undici`	GHSA-2m5v-pch6-74hx	Agent drops function-valued TLS options	7.30.1
`undici`	GHSA-4qv8-2p9j-2685	EventSource parser can grow memory without a bound	7.30.1
`undici`	GHSA-4w7w-5xrc-9h26	Redirect handling can poison caches and disclose cross-user data	7.30.1
`undici`	GHSA-55wc-3pg8-jfw6	Decompression interceptor can throw an uncaught exception	7.30.1
`undici`	GHSA-9fm3-97px-rjf6	Automatic WebSocket PONG responses can accumulate without a bound	7.30.1
`undici`	GHSA-f72v-6w45-q472	Integrity checks accept algorithm tokens incorrectly	7.30.1
`undici`	GHSA-qrxm-fqhp-jwvm	TLS renegotiation can cause denial of service	7.30.1
`sharp`	GHSA-wq5f-xc86-pv6w	librsvg memory safety under specified runtime conditions	0.35.5
`undici`	GHSA-xjj6-f33q-929c	Too many content encodings can trigger an uncaught error	7.30.1

The sharp advisory describes conditions on glibc-based Linux and distinguishes prebuilt binaries from a global librsvg installation. The undici TLS advisory applies to function-valued tls options such as a custom checkServerIdentity. These conditions were not established in AI CLI. The other listed advisory paths were also not exercised through the CLI. Advisory severities describe the dependencies' reported conditions, not demonstrated impact on AI CLI users.

Motivation

Make the released dependency set consume already-public upstream fixes while preserving compatibility. The observable result is a dependency tree without these version-range matches.

Implementation notes

The listed patched versions identify the earliest fixes in the currently pinned major lines; they are not a request to skip compatibility review or a claim that the resulting full dependency tree has no other advisories.

Testing notes

Inspect the resulting manifest, lockfile, and published package metadata, and rerun the repository's relevant existing checks. No compatibility tests were run for a replacement dependency set in this report.

Risks or tradeoffs

Dependency changes can affect native image binaries or HTTP behavior. Maintainers should validate the chosen versions before release. This proposal provides version evidence only.

Co-contributor credit

No, do not credit me.

Checklist

I have searched existing issues for duplicates.
I understand pull requests are limited to collaborators and maintainers will handle implementation.
I have removed API keys, tokens, credentials, and private data from this report.

Triage assessment

Impact level: not-applicable
Assessment status: not-applicable
Impact basis: This is a dependency-maintenance proposal based on public advisory version matches. No AI CLI behavioral failure, attack path, or security impact was established.
Workaround status: not-applicable
Workaround basis: No demonstrated application defect is classified by this proposal; consumer dependency overrides were not tested.

Activity

No activity yet.