fix(coding-agent): patch vulnerable dependencies

evals/terminal-bench/pyproject.toml

@@ -16,6 +16,9 @@ packages = ["src/diffex_terminal_bench"]
 [tool.uv]
 default-groups = []
 prerelease = "if-necessary"
+# LiteLLM 1.106.4 caps filelock below 4, but its FileLock calls remain compatible.
+# 4.2.1 fixes GHSA-v4x8-3wr5-3wq8, GHSA-9vhv-jxww-xfm5, and GHSA-567q-5qvw-pf92.
+override-dependencies = ["filelock==4.2.1"]
 
 [[tool.uv.index]]
 name = "pypi"

evals/terminal-bench/tests/test_filelock_security.py

@@ -0,0 +1,60 @@
+"""Security and compatibility checks for the benchmark's filelock override."""
+
+from contextlib import closing
+from pathlib import Path
+import os
+import sqlite3
+import struct
+import tempfile
+import unittest
+
+from filelock import FileLock, ReadWriteLock, SoftFileLock, Timeout
+from huggingface_hub.utils import WeakFileLock
+
+
+class FilelockSecurityTests(unittest.TestCase):
+    @unittest.skipIf(os.name == "nt", "POSIX shared-directory permissions")
+    def test_planted_sqlite_journal_cannot_delete_an_unrelated_file(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            root.chmod(0o777)
+            database = root / "lock.db"
+            target = root / "fixture.txt"
+            target.write_text("must survive lock acquisition\n")
+            with closing(sqlite3.connect(database)) as connection:
+                connection.execute("CREATE TABLE fixture (value INTEGER)")
+                connection.commit()
+
+            # SQLite treats this tail as a super-journal filename and unlinks it
+            # during recovery if it opens the planted journal beside the database.
+            name = str(target).encode()
+            journal = Path(str(database) + "-journal")
+            journal.write_bytes(name + struct.pack(">II", len(name), sum(name))
+                                + bytes.fromhex("d9d505f920a163d7"))
+            lock = ReadWriteLock(str(database))
+            try:
+                with lock.read_lock(timeout=1):
+                    self.assertEqual(target.read_text(), "must survive lock acquisition\n")
+                with lock.write_lock(timeout=1):
+                    self.assertEqual(target.read_text(), "must survive lock acquisition\n")
+            finally:
+                lock.close()
+
+    def test_consumers_keep_exclusion_timeouts_and_release(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            for lock_type in (FileLock, SoftFileLock):
+                with self.subTest(lock_type=lock_type.__name__):
+                    path = str(Path(temporary) / f"{lock_type.__name__}.lock")
+                    holder = lock_type(path, timeout=1, mode=0o600)
+                    contender = lock_type(path, timeout=0)
+                    with holder:
+                        with self.assertRaises(Timeout):
+                            contender.acquire()
+                    with contender:
+                        self.assertTrue(contender.is_locked)
+            with WeakFileLock(Path(temporary) / "huggingface.lock", timeout=1):
+                pass
+
+
+if __name__ == "__main__":
+    unittest.main()

package.json

@@ -51,7 +51,7 @@
 		"check:identities": "node scripts/check-runtime-identities.mjs"
 	},
 	"devDependencies": {
-		"@anthropic-ai/sandbox-runtime": "0.0.26",
+		"@anthropic-ai/sandbox-runtime": "0.0.78",
 		"@biomejs/biome": "2.6.3",
 		"@opentelemetry/api": "1.10.0",
 		"@types/node": "26.6.5",
@@ -68,6 +68,7 @@
 	},
 	"version": "0.0.3",
 	"overrides": {
+		"zod": "4.6.6",
 		"nanoid": "3.3.18",
 		"protobufjs": "7.6.5",
 		"rimraf": "6.1.3",

packages/coding-agent/examples/extensions/sandbox/package.json

@@ -14,6 +14,9 @@
 		]
 	},
 	"dependencies": {
-		"@anthropic-ai/sandbox-runtime": "0.0.26"
+		"@anthropic-ai/sandbox-runtime": "0.0.78"
+	},
+	"overrides": {
+		"zod": "4.6.6"
 	}
 }

packages/coding-agent/install-lock/package.json

@@ -7,6 +7,7 @@
 		"@diffexai/diffex": "0.3.2"
 	},
 	"overrides": {
+		"zod": "4.6.6",
 		"protobufjs": "7.6.5",
 		"rimraf": "6.1.3",
 		"gaxios": {

packages/coding-agent/package.json

@@ -75,6 +75,7 @@
 		"yaml": "2.9.1"
 	},
 	"overrides": {
+		"zod": "4.6.6",
 		"protobufjs": "7.6.5",
 		"rimraf": "6.1.3",
 		"gaxios": {