chore(deps,middleware): consolidated Dependabot batch 2026-08-11

[Weegy]

Consolidates the Dependabot PRs raised against main after #638 and #615 merged, so they can be reviewed and merged once instead of four times.

All five bot PRs in this run target /middleware only; web-ui is untouched.

What's in

Package	main	This PR	Dependabot proposed	Kind
openai	^6.46.0	^7.4.0	7.4.0	major
@types/node (dev)	^26.1.1	^26.2.0	26.1.2	minor
@aws-sdk/client-s3	^3.1075.0	^3.1107.0	3.1105.0	patch
undici	^8.5.0	^8.10.0	8.10.0	minor

@types/node is additionally raised from ^25.9.3 to ^26.2.0 in
packages/canvas-core, packages/conductor-core and packages/dev-runner-shim,
and @aws-sdk/client-s3 is mirrored in packages/harness-diagrams, so the
workspace manifests stop skewing from the root.

@types/node and @aws-sdk/client-s3 take the current resolution rather than the
bot's, which had already gone stale.

The one major: openai 7

openai 7.0.0 has exactly one breaking change: it requires Node.js 22. There
are no API changes in the 6 → 7 step.

That requirement is already satisfied everywhere: engines is
">=22.13.0 <23", .nvmrc is 22.22.3, every CI job pins node-version: '22',
and all Dockerfiles are on node:22.23.2.

Blast radius is small and deliberately contained — openai is imported in three
source locations plus two tests:

• packages/llm-adapter-openai/src/openaiClient.ts — the only value import of the
  default export (the file exists specifically so no consumer imports openai)
• packages/llm-adapter-openai/src/openaiProvider.ts — type import plus
  APIConnectionError / APIConnectionTimeoutError
• test/llmProviderOpenAiAdapter.test.ts, test/llmProviderMinimaxQuirks.test.ts

Build, typecheck and the full suite all pass against 7.4.0.

Lockfile delta

95 changed lines, and a version-level diff of the lockfile confirms only the
intended packages moved: the @aws-sdk/* family (all patch bumps inside 3.x),
@types/node, openai, undici. Nothing added, nothing removed, no transitive
major slipped in.

The workspace @types/node bumps produced no new lockfile entries — those
packages were already resolving to the hoisted root copy, so that part of the
change is purely declarative alignment.

Verification

Run locally on Node 22.22.3, mirroring the CI job order (npm ci → build → lint
→ typecheck → test):

Check	Result
npm ci	pass
build	pass
lint	0 errors
typecheck	pass
test	6094 pass / 0 fail / 4 skipped (1269 suites)
npm audit --audit-level=high	0 high, 0 critical (10 pre-existing moderates)

The remaining moderates are pre-existing and unrelated to this batch (uuid via
exceljs and botframework-streaming).

Superseded — safe to close

#651, #653, #654, #655

Excluded

• chore(deps,middleware)(deps): bump cookie from 0.7.2 to 2.0.1 in /middleware #652 cookie 0.7.2 → 2.0.1 — not a version bump. v2.0.0 removed the
  deprecated parse export (renamed to parseCookie) and moved the package to
  ESM-only. We import exactly that removed symbol in
  src/auth/operatorAuthAccessor.ts, so the bump does not compile as-is.

  It also sits in the session-verification path that gates every operator-only
  admin surface, so it deserves a focused review rather than riding along in a
  routine batch. Handled separately — see the follow-up PR.

Recommended follow-up

@types/node majors are ignored in the /web-ui dependabot block on the grounds
that types should track the Node 22 runtime, but /middleware has no such ignore
and its root is already on ^26. The two workspaces now follow different
policies for the same package. Worth deciding deliberately: either mirror the
ignore into /middleware and walk the root back to 22.x types, or drop it from
/web-ui. This PR keeps the existing middleware direction rather than changing
policy unilaterally.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}