chore(deps): bump dependencies

[MichaelMilstead]

bumps jsonwebtoken dependency to bump transitive dependency on vulnerable version of jws
runs npm update mdast-util-to-hast to bump package-lock mdast-util-to-hast version to 13.2.1 to avoid vulnerable version

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
cloud	Ready	Preview, Comment	Dec 24, 2025 9:24pm
showcase	Ready	Preview, Comment	Dec 24, 2025 9:24pm
tambo-docs	Ready	Preview, Comment	Dec 24, 2025 9:24pm

[charliecreates]

The dependency bumps look consistent for addressing the jws transitive vulnerability via [email protected] and updating mdast-util-to-hast. The only notable concern is a potential version drift: package-lock.json increments apps/api to 0.127.1 without a shown matching change in apps/api/package.json, which can lead to inconsistent metadata and recurring lockfile churn.

Summary of changes

Dependency updates

• Bumped jsonwebtoken in apps/api/package.json from ^9.0.2 to ^9.0.3.
• Updated package-lock.json accordingly:
  • apps/api version bumped from 0.127.0 → 0.127.1.
  • jsonwebtoken lock entry updated to 9.0.3, which pulls in jws ^4.0.1.
  • Hoisted/updated related packages: added/updated top-level [email protected] and [email protected] (replacing nested jsonwebtoken/node_modules/jws + jwa).
  • Bumped mdast-util-to-hast from 13.2.0 → 13.2.1 in the lockfile.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@​4.20.5
	@​octokit/​rest@​20.1.2
	@​actions/​core@​1.11.1

View full report