@@ -71,3 +71,73 @@ updates:
       python-dependencies:
         patterns:
           - "*"
+
+  # The TypeScript SDK's integration fixtures that hold each framework's supported
+  # FLOOR. These four entries are for security updates alone —
+  # `open-pull-requests-limit: 0` turns version updates off — and exist to stop one
+  # move. Each floor carries an advisory whose only fix is a major its framework
+  # release cannot take (SECURITY.md, "Accepted, with no fix available"), and
+  # Dependabot's grouped security updates reach that fix by moving the framework off
+  # the line the fixture exists to test: #838, #931, and #935, which opened three
+  # minutes after #934 put the pins back. `ignore` applies to security updates too,
+  # so each range below keeps the framework on its line, and zod on 3 where the
+  # framework requires it; every fix that stays on the line still arrives. Ranges
+  # are `versions`, never `update-types`, which security updates do not read. A new
+  # floor fixture needs an entry here: __tests__/ci/ts-sdk-fixture-pins.test.ts
+  # fails without one.
+  - package-ecosystem: npm
+    directory: /sdk/typescript/integration/fixtures/ai-4
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: ai
+        versions: [">=5.0.0"]
+      # ai@4.3.19 peers on zod ^3.23.8.
+      - dependency-name: zod
+        versions: [">=4.0.0"]
+
+  - package-ecosystem: npm
+    directory: /sdk/typescript/integration/fixtures/langchain-0.3
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "@langchain/core"
+        versions: [">=0.4.0"]
+      # @langchain/langgraph@0.4.10 peers on @langchain/core <0.4.0.
+      - dependency-name: "@langchain/langgraph"
+        versions: [">=0.5.0"]
+      # Both depend on zod ^3.25.32. A zod 4 here would still install, nested
+      # under them, so nothing but this range keeps the fixture's own zod on 3.
+      - dependency-name: zod
+        versions: [">=4.0.0"]
+
+  - package-ecosystem: npm
+    directory: /sdk/typescript/integration/fixtures/llamaindex-0.11
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: llamaindex
+        versions: [">=0.12.0"]
+      # @llamaindex/core@0.6.8 and @llamaindex/workflow@1.1.5 need zod ^3.23.8.
+      - dependency-name: zod
+        versions: [">=4.0.0"]
+
+  - package-ecosystem: npm
+    directory: /sdk/typescript/integration/fixtures/mastra-0
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 0
+    ignore:
+      # @mastra/core, and the @mastra/memory and @mastra/mcp releases paired with it.
+      - dependency-name: "@mastra/*"
+        versions: [">=1.0.0"]
+      # @mastra/core@0.24.9 requires ai@^4. This fixture's own zod is already 4.
+      - dependency-name: ai
+        versions: [">=5.0.0"]
@@ -1,13 +1,14 @@
 # Changelog
 
-## 1.0.13-beta.0 — 2026-10-25
+## 1.0.13-beta.0 — 2026-10-27
 
 ### Features
 
 - **`fp-cloud-cli` cuts `0.0.2` stable.** The `0.0.2b0` line opened after `0.0.1` was never published; it is cut stable rather than published, so `pipx install fp-cloud-cli` resolves the `fp` that drives what FailproofAI Cloud now serves (entries in `fp-cloud-cli/CHANGELOG.md`). This is the PyPI package's own line and does not move the npm version, which stays at `1.0.13-beta.0` (#936)
 
 ### Dependencies
 
+- Put the `ai-4`, `langchain-0.3`, `llamaindex-0.11` and `mastra-0` SDK integration fixtures back on the releases they exist to test, and stop Dependabot moving them. Its grouped security update #935, opened three minutes after #934 restored the first three, moved them again: `ai@4.3.19` → `5.0.52`, `@langchain/core@0.3.80` → `1.3.0`, `llamaindex@0.11.4` → `0.12.1` (each with `zod@3.25.76` → `4.6.7`), and `@mastra/core@0.24.9` → `1.79.0`. `__tests__/ci/ts-sdk-fixture-pins.test.ts` and the `frameworks` and `runtimes` integration shards have failed on `main` since, and so on every open PR. All four are back on their #934 manifests and lockfiles, and `.github/dependabot.yml` gives each a security-updates-only entry whose `ignore` ranges hold its framework on its line, and zod on 3 where the framework requires it, so the move is no longer proposed; the pin test now fails if a floor fixture loses that entry (#950)
 - Restore the `ai-4`, `langchain-0.3` and `llamaindex-0.11` SDK integration fixtures to the releases they exist to test: `ai@4.3.19`, `@langchain/core@0.3.80` with `@langchain/langgraph@0.4.10`, and `llamaindex@0.11.4`, each with `zod@3.25.76`. Dependabot's grouped security update (#931) reached the zod fix by moving them to `ai@7.0.152`, `@langchain/core@1.3.0` and `llamaindex@0.12.1`, the pin move `SECURITY.md` rules out, so the matrix silently stopped testing three supported floors. `llamaindex-0.11` then stopped installing (`@llamaindex/workflow@1.1.5` peers on `zod@^3.23.8`, so `npm ci` failed `ERESOLVE`), and because global setup installs every fixture first, the `frameworks` and `runtimes` integration shards failed on `main`. #931 also moved the `runtimes` fixture to `zod@4.6.7` while its Deno program still imported `npm:zod@4.6.5`, which Deno could no longer find; it now imports the installed version. `__tests__/ci/ts-sdk-fixture-pins.test.ts` fails on either move before anything installs (#934)
 - Patch the fixable SDK integration fixture advisories with fixture-local `overrides`, moving no pin: `undici` 7.29.1 → 7.30.1 in `ai-5` (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472); `fast-uri` 3.1.8 → 3.1.9 in `llamaindex-0.11` (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp); and in `mastra-1`, `@modelcontextprotocol/server` 2.0.0 → 2.3.0 and `@modelcontextprotocol/client` 2.2.0 → 2.3.0 (GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453, GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw), both pinned exactly by `@mastra/mcp@2.0.0`, each now with its own `@modelcontextprotocol/core@2.3.0` nested under it (#934)
 - `SECURITY.md` accepts zod GHSA-mrhx-c7xc-m3w5 in the five fixtures held to zod 3: `ai-4`, `langchain-0.3` and `llamaindex-0.11`, and the nested copies in `langchain-dup-core` and `mastra-0`. It is fixed only in zod 4.6.6, no zod 3 release carries the fix, and every copy is required at `^3` by the framework release its fixture pins (#934)
 
@@ -56,8 +56,9 @@ The gate above scans the lockfiles it is *given* (the `--lockfile` list in the
 workflow). GitHub's dependency graph reads **every** lockfile in the repository, so
 Dependabot alerts cover trees the gate does not — in particular the TypeScript SDK's
 integration fixtures, `sdk/typescript/integration/fixtures/*/package-lock.json`.
-Those are not in the scanner's list and are not a Dependabot *update* ecosystem in
-[`.github/dependabot.yml`](.github/dependabot.yml) either, so an alert is the only
+Those are not in the scanner's list and get no Dependabot *version* updates either
+(the four floor fixtures have entries in [`.github/dependabot.yml`](.github/dependabot.yml),
+but only to restrain its security updates; see below), so an alert is the only
 thing that will ever mention them. Treat the alert list as authoritative for those
 paths, and see *Triaging a Dependabot alert in an integration fixture* below for how
 to resolve one.
@@ -118,6 +119,17 @@ That splits an alert in one of these lockfiles into two cases:
    the scanner does not read these lockfiles, so an `[[IgnoredVulns]]` entry for one
    would filter nothing and be reported as an unused ignore.
 
+Dependabot's own security updates know neither case. Given a case-2 advisory they
+reach the fix by moving the framework, which is how #838, #931 and #935 happened
+(#935 opened three minutes after #934 put the pins back). So each floor fixture —
+`ai-4`, `langchain-0.3`, `llamaindex-0.11`, `mastra-0` — has a security-updates-only
+entry in [`.github/dependabot.yml`](.github/dependabot.yml)
+(`open-pull-requests-limit: 0`) whose `ignore` ranges hold its framework on its
+line, and zod on 3 where that framework requires it; a fix that stays on the line
+still arrives. A new floor fixture needs its own entry, and
+`__tests__/ci/ts-sdk-fixture-pins.test.ts` fails without one. A Dependabot PR that
+moves a pin anyway fails that same test: close it rather than merge it.
+
 ### Accepted, with no fix available
 
 | Advisory | Package | Fixtures | Why it stays |
 
@@ -2,23 +2,30 @@ import { readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 
 import { describe, expect, it } from "vitest";
+import { parse } from "yaml";
 
 /**
  * A TypeScript SDK integration fixture named for a release line — `ai-4`,
  * `langchain-0.3`, `mastra-0` — exists to hold its framework on that line: the
  * pinned release is the subject of the test (SECURITY.md, "Triaging a Dependabot
  * alert in an integration fixture"). A move off it still installs and still
  * passes, against a different major, so the matrix loses a supported floor with
- * every check green. Dependabot security updates have made that move twice
- * (#838, #931), both times to reach a fix the fixture could not take. This fails
- * on the manifest, before anything installs.
+ * every check green. Dependabot security updates have made that move three times
+ * (#838, #931, #935), each to reach a fix the fixture could not take; #935 opened
+ * three minutes after #934 put the pins back. This fails on the manifest, before
+ * anything installs, and on a `.github/dependabot.yml` that no longer stops the
+ * move from being proposed for a supported floor.
  *
  * #931 also moved the `runtimes` fixture's zod without the `npm:zod@…` specifier
  * its Deno program imports, which Deno resolves against the fixture's
  * `node_modules` and so could no longer find. That half is checked here too.
  */
 
-const fixturesDir = join(__dirname, "..", "..", "sdk", "typescript", "integration", "fixtures");
+const root = join(__dirname, "..", "..");
+const fixturesDir = join(root, "sdk", "typescript", "integration", "fixtures");
+
+/** Every framework's supported floor: where the SDK's peer range starts. */
+const FLOORS = ["ai-4", "langchain-0.3", "llamaindex-0.11", "mastra-0"];
 
 /** The package each fixture-name prefix pins. */
 const FRAMEWORK: Record<string, string> = {
@@ -58,11 +65,60 @@ const specifiers = fixtures.flatMap((fixture) =>
     }),
 );
 
+type DependabotUpdate = {
+  "package-ecosystem": string;
+  directory?: string;
+  directories?: string[];
+  "open-pull-requests-limit"?: number;
+  ignore?: { "dependency-name": string; versions?: string[] }[];
+};
+
+/** Each fixture directory `.github/dependabot.yml` names, with the entry naming it. */
+const FIXTURE_DIR = "/sdk/typescript/integration/fixtures/";
+const dependabot = parse(readFileSync(join(root, ".github", "dependabot.yml"), "utf8")) as {
+  updates: DependabotUpdate[];
+};
+const fixtureEntries = dependabot.updates
+  .filter((update) => update["package-ecosystem"] === "npm")
+  .flatMap((update) =>
+    [update.directory, ...(update.directories ?? [])]
+      .filter((dir): dir is string => dir?.startsWith(FIXTURE_DIR) === true)
+      .map((dir) => ({ fixture: dir.slice(FIXTURE_DIR.length), update })),
+  );
+
+type Version = [number, number, number];
+const versionOf = (text: string): Version => {
+  const [major = 0, minor = 0, patch = 0] = text.split(".").map(Number);
+  return [major, minor, patch];
+};
+const compare = (a: Version, b: Version) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+
+/** The first release past a line: `4` → 5.0.0, `0.3` → 0.4.0. */
+const nextLine = (line: string): Version => {
+  const [major, minor] = line.split(".").map(Number);
+  return minor === undefined ? [major! + 1, 0, 0] : [major!, minor + 1, 0];
+};
+
+/** Whether a `dependency-name`, which may use `*`, matches `name`. */
+const namesMatch = (pattern: string, name: string) =>
+  new RegExp(`^${pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`).test(name);
+
+/**
+ * Whether `update` ignores `name` from the next line on, while still letting a
+ * fix on the line replace `pinned`. Only `>=` ranges in `versions` count: security
+ * updates read `versions`, and do not read `update-types`.
+ */
+const holdsOnLine = (update: DependabotUpdate, name: string, pinned: string, line: string) =>
+  (update.ignore ?? [])
+    .filter((rule) => namesMatch(rule["dependency-name"], name))
+    .flatMap((rule) => rule.versions ?? [])
+    .map((range) => /^>=\s*(\d+(?:\.\d+){0,2})$/.exec(range.trim())?.[1])
+    .filter((bound): bound is string => bound !== undefined)
+    .some((bound) => compare(versionOf(bound), nextLine(line)) <= 0 && compare(versionOf(bound), versionOf(pinned)) > 0);
+
 describe("TS SDK integration fixtures named for a release line", () => {
   it("finds them, every framework's supported floor among them", () => {
-    expect(named.map((f) => f.fixture)).toEqual(
-      expect.arrayContaining(["ai-4", "langchain-0.3", "llamaindex-0.11", "mastra-0"]),
-    );
+    expect(named.map((f) => f.fixture)).toEqual(expect.arrayContaining(FLOORS));
   });
 
   it("know which framework each name pins", () => {
@@ -78,6 +134,34 @@ describe("TS SDK integration fixtures named for a release line", () => {
   });
 });
 
+describe("Dependabot security updates on the supported floors", () => {
+  const floors = named.filter((f) => FLOORS.includes(f.fixture));
+  const zod3 = floors.filter((f) => readJson(f.fixture, "package.json").dependencies?.zod?.startsWith("3."));
+
+  it("finds every floor, and the ones held to zod 3", () => {
+    expect(floors.map((f) => f.fixture).sort()).toEqual([...FLOORS].sort());
+    expect(zod3.map((f) => f.fixture)).toEqual(expect.arrayContaining(["ai-4", "langchain-0.3", "llamaindex-0.11"]));
+  });
+
+  it.each(floors)("$fixture has one security-only entry holding $framework on $line", ({ fixture, framework, line }) => {
+    const entries = fixtureEntries.filter((e) => e.fixture === fixture).map((e) => e.update);
+    expect(entries, `${fixture}: npm entries in .github/dependabot.yml`).toHaveLength(1);
+    expect(entries[0]!["open-pull-requests-limit"], `${fixture}: version updates`).toBe(0);
+    const pinned = readJson(fixture, "package.json").dependencies![framework!]!;
+    expect(holdsOnLine(entries[0]!, framework!, pinned, line), `${fixture}: ignore for ${framework}`).toBe(true);
+  });
+
+  it.each(zod3)("$fixture holds zod on 3, which its framework requires", ({ fixture }) => {
+    const entry = fixtureEntries.find((e) => e.fixture === fixture)!.update;
+    const pinned = readJson(fixture, "package.json").dependencies!.zod!;
+    expect(holdsOnLine(entry, "zod", pinned, "3"), `${fixture}: ignore for zod`).toBe(true);
+  });
+
+  it("names only fixtures that exist", () => {
+    expect(fixtureEntries.map((e) => e.fixture).filter((f) => !fixtures.includes(f))).toEqual([]);
+  });
+});
+
 describe("TS SDK integration fixtures' npm: specifiers", () => {
   it("finds the Deno program's", () => {
     expect(specifiers.map((s) => s.name)).toEqual(expect.arrayContaining(["ai", "zod"]));
 
@@ -39,6 +39,21 @@ section is missing or empty is refused before anything is built.
   for a release line pinning its framework off that line, or an `npm:` specifier
   naming a version the fixture does not install. (#934)
 
+- **The four framework floors stay put.** Dependabot's grouped security update
+  #935, opened three minutes after #934 merged, moved `ai-4`, `langchain-0.3` and
+  `llamaindex-0.11` off their releases again (`ai@4.3.19` → `5.0.52`,
+  `@langchain/core@0.3.80` → `1.3.0` with `@langchain/langgraph@0.4.10` →
+  `1.5.2`, `llamaindex@0.11.4` → `0.12.1`, each with `zod@3.25.76` → `4.6.7`), and
+  `mastra-0` too (`@mastra/core@0.24.9` → `1.79.0`, `@mastra/memory@0.15.13` →
+  `1.39.0`). All four are back on their #934 manifests and lockfiles. So that the
+  move stops being proposed rather than being undone a fourth time,
+  `.github/dependabot.yml` gives each floor a security-updates-only entry
+  (`open-pull-requests-limit: 0`) whose `ignore` ranges hold its framework on its
+  line, and zod on 3 where that framework requires it; a fix that stays on the
+  line still arrives. `__tests__/ci/ts-sdk-fixture-pins.test.ts` now also fails
+  when a floor has no such entry, or one that would let the framework leave its
+  line. (#950)
+
 - **The remaining fixable fixture advisories clear, each with an override.** `ai-5`
   moves `undici` 7.29.1 → 7.30.1 (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685,
   GHSA-f72v-6w45-q472) and `llamaindex-0.11` moves `fast-uri` 3.1.8 → 3.1.9