[failproofai-legion-902] Patch the nextjs and mastra-0 fixture advisories without moving a pin

CHANGELOG.md

@@ -17,6 +17,10 @@ The first stable release with the new terminal experience and OpenTelemetry. Eve
 - **Reconnecting with a different key replaces every saved credential,** and events the old key was refused are resent with the new one.
 - **The daemon no longer stops collecting** when a settings change or backfill arrives while it is busy.
 
+### Dependencies
+
+- Patch the TypeScript SDK's integration fixtures: `next` 16.3.6 → 16.4.1 (six advisories), `sharp` 0.35.5 and `source-map-js` 1.2.2 in `nextjs`, and `@modelcontextprotocol/sdk` 1.30.1 → 1.32.1 (GHSA-6qxp-vccf-f47h) in `mastra-0`, inside `@mastra/mcp@0.14.5`'s `^1.17.5` range. Dependabot's version of this PR also moved `ai` 4 → 5 in `ai-4` and `@mastra/core`/`@mastra/memory` 0.x → 1.x in `mastra-0`, the pin moves `SECURITY.md` rules out (and an unresolvable tree next to `@mastra/mcp@0.14.5`, which failed every integration shard), plus `ai` 7.0.111 → 7.0.141 in `nextjs`, whose pins must match its `ai-7` twin; none of those are applied (#902)
+
 ## 1.0.11-beta.5 — 2026-10-15
 
 ### Fixes

sdk/typescript/CHANGELOG.md

@@ -108,6 +108,18 @@ section is missing or empty is refused before anything is built.
   against the override. This package's own dev lockfile also moves
   `source-map-js` to `1.2.2` (GHSA-68fv-2mgg-jv7q). (#901)
 
+- **`nextjs` and `mastra-0` clear their fixable advisories, again without moving
+  a pin.** `nextjs` moves `next` to `16.4.1` (six advisories, fixed in `16.3.8`),
+  `sharp` to `0.35.5` (GHSA-wq5f-xc86-pv6w) and `source-map-js` to `1.2.2`
+  (GHSA-68fv-2mgg-jv7q). `mastra-0` moves `@modelcontextprotocol/sdk` from
+  `1.30.1` to `1.32.1` (GHSA-6qxp-vccf-f47h), inside the `^1.17.5` range
+  `@mastra/mcp@0.14.5` declares, so only the lockfile changes. Dependabot's
+  version of this PR also moved `ai-4` to `ai@5.0.52` and `mastra-0` to
+  `@mastra/core@1.77.0`, which cannot install beside `@mastra/mcp@0.14.5` and
+  failed every integration shard, and `nextjs`'s `ai` to `7.0.141`, off the
+  `ai-7` twin its routes' traces are compared against. None of those are
+  applied. (#902)
+
 ## 0.0.1-beta.0 — 2026-09-23
 
 ### Added