chore(deps): refresh maintained integrations

[drewstone]

Summary

• publish 5.0.2 with the maintained Neo4j Agent Memory and Mem0 adapters
• align the official optimizer bridge with agent-eval@0.126.7
• update build tooling and force patched transitive server, WebSocket, Vite, and esbuild versions

Checks

• pnpm install --frozen-lockfile
• pnpm audit --audit-level=low (0 advisories)
• pnpm lint
• pnpm typecheck
• pnpm test (466 passed, 12 skipped)
• pnpm build
• pnpm verify:package
• pnpm verify:official-optimizers
• git diff --check
• git merge-tree --write-tree origin/main HEAD

[tangletools]

✅ Auto-approved drewstone PR — d5e7878c

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-25T00:30:00Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	87.1s (2 bridge agents)
Total	87.1s

💰 Value — sound

Routine 5.0.2 patch: bumps the two maintained memory-adapter devDeps, aligns agent-eval to a published 0.126.7 (required by the repo's own verify scripts), and extends the existing pnpm overrides + release-age carve-out to force patched transitive vite/esbuild/hono/ws for a clean audit graph — all i

• What it does: Version 5.0.1 → 5.0.2. Dependency-only delta in package.json: (a) @tangle-network/agent-eval 0.126.6 → 0.126.7; (b) devDeps @neo4j-labs/agent-memory 0.4.0 → 0.4.1 and mem0ai 3.1.0 → 3.1.1; (c) biome ^2.5.4 → ^2.5.5, typescript ^5.7.0 → ^5.9.3; (d) adds vite 8.1.5 as a direct devDep; (e) extends the existing pnpm.overrides block (which already pinned hono + ws) to also force @hono/node-server 2.0.1
• Goals it achieves: 1) Publish the maintained Neo4j Agent Memory and Mem0 adapters at their current patch versions — these are genuinely consumed (tests/memory/neo4j.test.ts:1, tests/memory/mem0.test.ts:1, tests/memory-adapter.test.ts:1 type-import them). 2) Re-align the official optimizer bridge to agent-eval@0.126.7 — required, because scripts/verify-package.mjs:41 and scripts/verify-official-optimizers.mjs:18 enfo
• Assessment: Good change, built in the grain of the repo. It introduces no new mechanism: pnpm.overrides (hono/ws) and minimumReleaseAgeExclude (@tangle-network/*) both already existed and this only extends them. Promoting vite to a direct devDep while also overriding it is the idiomatic pnpm way to pin a patched transitive (vite/esbuild are pulled by vitest — confirmed in lockfile lines 54/57, vitest@4.1.10(.
• Better / existing approach: none — this is the right approach. Verified by: (1) grepping src/tests for direct vite/esbuild/hono imports — none in source, so they are correctly treated as transitive pins, not first-class deps; (2) confirming the overrides + exclude mechanisms pre-existed (prior hono/ws overrides, prior @tangle-network exclude) so the change extends rather than reinvents; (3) confirming agent-eval exact-pin +
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content

🎯 Usefulness — sound

A routine, coherent dependency refresh: every bumped package is actively wired into shipped code or is a transitive security pin, with no dead surface.

• Integration: Fully reachable. The two adapter packages refreshed (@neo4j-labs/agent-memory, mem0ai) back createNeo4jAgentMemoryAdapter (src/memory/neo4j.ts:27) and the Mem0 adapter (src/memory/mem0.ts), both re-exported through src/memory/index.ts:17-18 and the ./memory subpath export (package.json:32). agent-eval@0.126.7 is the highest-fan-in dependency, imported across research-loop, optimization, retrieval-
• Fit with existing patterns: Matches the repo's established maintenance pattern exactly. Prior commits 1d07c89 and PR #80 (3687ca3) are the same shape of version-alignment refresh; the pnpm overrides + minimumReleaseAge mechanism was already in use and this just extends it with two more fast-moving pins. No competing pattern.
• Real-world viability: Conservative bumps within compatible ranges plus forced patched transitives yielding 0 npm advisories. The release-age exclusions for esbuild/vite are correctly added so the freshness gate does not block the security pins. Tests (466 passed) cover both adapter surfaces. Nothing here narrows to a happy path — it is mechanical version movement.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260725T003611Z}

[tangletools]

✅ No Blockers — d5e7878c

Review health 100/100 · Reviewer score 83/100 · Confidence 75/100 · 4 findings (4 low)

glm: Correctness 83 · Security 83 · Testing 83 · Architecture 83

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

🟡 LOW Security-advisory resolution grouped under 'Changed' rather than 'Security' or 'Fixed' — CHANGELOG.md

The bullet 'Forced patched Hono, Node server, WebSocket, Vite, and esbuild releases so the installed graph has no known npm advisories' describes a security-relevant supply-chain fix (no known npm advisories) but is filed under the generic '### Changed' subsection. Keep a Changelog convention would normally surface this under '### Fixed' or a dedicated '### Security' section so consumers scanning the changelog for vulnerability resolutions can find it. Stylistic only; no behavioral impact.

🟡 LOW vite/esbuild bypass the release-age freshness gate — package.json

Adding esbuild and vite to minimumReleaseAgeExclude lets freshly-published versions of these install before the 3-day (4320 min) gate. Both are pinned to exact versions via overrides (esbuild 0.28.1, vite 8.1.5) and are dev-only, so real supply-chain risk is minimal, but the exclude weakens the gate for any future transitive vite/esbuild release too. Intentional and acceptable for a pinned refresh; flagging only for verifier visibility.

🟡 LOW esbuild major bump (0.27.7 -> 0.28.1) via override affects tsup/bundle-require build path — pnpm-lock.yaml

esbuild is overridden 0.27.7 -> 0.28.1; bundle-require (used by tsup) now resolves esbuild@0.28.1. esbuild 0.28.0 shipped breaking changes to its API surface. This only affects the build toolchain, not the published package runtime, and is excluded from minimumReleaseAge intentionally. Verify pnpm build (tsup) and pnpm test succeed on this lockfile; no integrity or correctness issue in the lockfile itself.

🟡 LOW vite major-version override (7->8) on vitest's transitive vite — pnpm-lock.yaml

vite is overridden 7.3.2 -> 8.1.5 and is the vite that vitest 4.1.10 resolves against. The override IS within vitest 4.1.10's declared peer range (^6.0.0 || ^7.0.0 || ^8.0.0), so pnpm accepts it. Vite 8 is a major release; if any test config relied on vite-7-only behavior this would surface as a test failure. Low risk because it is a devDependency and explicitly pinned in package.json. Confirm the test suite runs green post-install before merge; no lockfile-level action required.

---

_{tangletools · 2026-07-25T00:38:21Z · trace}

[tangletools]

✅ Approved — 4 non-blocking findings — d5e7878c

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-07-25T00:38:21Z · immutable trace}