[John-David Dalton (jdalton)]

Summary

• Reconcile the action workspace catalog with the approved dependency updates.
• Pin the lockfile to the selected versions and their dependency closure.

Validation

• Frozen install passed.
• Canonical validation passed on the combined stack: integration, type, format, lint, and build.

---

Note

Medium Risk
Fleet-wide TypeScript and Socket lib/sdk bumps affect every hook and build; behavior changes are possible despite validation passing on install and canonical checks.

Overview
Updates the fleet pnpm catalog and pnpm-lock.yaml so workspace packages resolve to a single approved dependency set—no application or hook source edits.

The largest toolchain shift is TypeScript moving from the dated dev build 7.1.0-dev.20260929.1 to stable 7.0.2, with matching -stable Socket packages and pnpm overrides bumped (@socketsecurity/lib 7.1.0, sdk 4.2.0, packageurl-js 1.6.0). Other catalog bumps include @types/node 26.6.4, MCP (@modelcontextprotocol/client 2.3.0, mcp-tada 0.5.0), markdown/mdast utilities, fallow, portless, shell-quote, taze, and @mdn/browser-compat-data.

The lockfile diff propagates those versions through the root workspace and the many .claude/hooks/fleet/* packages that depend on the catalog.

^{Reviewed by Cursor Bugbot for commit fe52a4a. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mcp-tada@​0.4.0 ⏵ 0.5.0			+1	+1
	@​types/​node@​26.6.3 ⏵ 26.6.4			+1
	@​modelcontextprotocol/​client@​2.2.0 ⏵ 2.3.0	+1		+1	+1
	mdast-util-from-markdown@​2.0.3 ⏵ 2.1.0	+1		+1	+2
	mdast-util-to-markdown@​2.1.3 ⏵ 2.2.0	+1		+1	+3
	shell-quote@​1.11.0 ⏵ 1.12.0	+1
	@​socketsecurity/​lib@​7.0.3 ⏵ 7.1.0	+2		+1
	@​socketregistry/​packageurl-js@​1.5.3 ⏵ 1.6.0
	portless@​0.15.6 ⏵ 0.15.7	+2		+1	-1
	@​socketsecurity/​sdk@​4.1.5 ⏵ 4.2.0	+2		+1
	fallow@​3.30.0 ⏵ 3.31.0	+1
	taze@​21.2.0 ⏵ 21.3.0				+1
	@​mdn/​browser-compat-data@​8.1.3 ⏵ 8.1.4				+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mcp-tada@​0.4.0 ⏵ 0.5.0			+1	-1
	@​types/​node@​26.6.3 ⏵ 26.6.4			+1	+1
	@​modelcontextprotocol/​client@​2.2.0 ⏵ 2.3.0	+1		+1
	mdast-util-from-markdown@​2.0.3 ⏵ 2.1.0	+1		+1	+5
	mdast-util-to-markdown@​2.1.3 ⏵ 2.2.0	+1		+1	+3
	shell-quote@​1.11.0 ⏵ 1.12.0	+1
	@​socketsecurity/​sdk@​4.1.5 ⏵ 4.2.0	+2		+1	-3
	@​socketsecurity/​lib@​7.0.3 ⏵ 7.1.0	+2		+1
	portless@​0.15.6 ⏵ 0.15.7	+2		+1	-1
	@​socketregistry/​packageurl-js@​1.5.3 ⏵ 1.6.0
	taze@​21.2.0 ⏵ 21.3.0				-1
	fallow@​3.30.0 ⏵ 3.31.0	+1
	@​mdn/​browser-compat-data@​8.1.3 ⏵ 8.1.4

View full report