feat: bump @expressots/studio-agent from 4.0.0-preview.3.4 to 4.0.0

[dependabot]

Bumps @expressots/studio-agent from 4.0.0-preview.3.4 to 4.0.0.

Release notes

Sourced from @​expressots/studio-agent's releases.

ExpressoTS Studio 4.0.0 — first stable release.

Publishes @expressots/studio (local UI + CLI) and @expressots/studio-agent (in-process instrumentation). @expressots/mcp-server stays private in the monorepo for a later release.

Highlights

• Status dashboard, architecture map, request timeline with traces and replay, live logs, error inspector
• Security view: npm audit + OSV advisories with reachability scoring, OWASP API Top 10 runtime posture
• Zero production cost: the adapter loads the agent only in development when installed
• Everything runs locally; nothing is sent off the box

Requires @expressots/core ^4.0.0, @expressots/adapter-express ^4.0.0, Node.js >= 20.19.0.

Full details in CHANGELOG.md.

Changelog

Sourced from @​expressots/studio-agent's changelog.

4.0.0 (2026-07-16)

First public release of ExpressoTS Studio. Part of the ExpressoTS v4.0.0 release bundle. See the v4.0.0 release notes and the Studio section of the docs.

Studio is developed as three packages in this monorepo. Two of them are published to npm:

Package	Published	Purpose
@expressots/studio	Yes	CLI + bundled web UI you run on your laptop. Boots the UI, probes the agent, opens the browser.
@expressots/studio-agent	Yes	Loaded into the app process: instrumentation middleware, SQLite recorder, log capture, DI snapshot, security engine, Socket.IO server. Optional peer dependency of @expressots/adapter-express.
@expressots/mcp-server	No	Stdio MCP server for Claude Desktop, Cursor, and other AI editors. Private and not published in 4.0; it lives in the monorepo and will ship in a later release.

Features

• Status dashboard: app health, runtime info, DI scope counts, top routes, aggregate security grade.
• Architecture map: read-only graph of controllers / use-cases / providers / middleware with DI scope badges and active-path highlighting; auto-generated from AppContainer.introspect().
• Request timeline + trace detail: live recording of every HTTP request with OpenTelemetry spans, headers / body diff, and one-click Replay.
• Live logs: in-memory buffer of every framework + app log line, filterable by level, route, and context.
• Error inspector: aggregated runtime errors with stack frames and deep-links to source.
• Security view: npm audit + OSV.dev advisories with transitive root-cause chains, reachability scoring (confirmed / likely / unreachable / unknown), and one-click fixes. OWASP API Top 10 runtime posture findings derived from recorded traffic.
• MCP server (in-repo, unpublished): code-generation tools for CRUD / DTO / middleware / tests, grounded in ExpressoTS idioms.
• Dynamic loading: adapter-express only imports @expressots/studio-agent when NODE_ENV=development and the package is installed. Production deployments pay zero runtime cost.

Architecture

• Studio UI to Studio agent over Socket.IO on the local machine (default port 3334).
• Studio agent persists recordings in a local SQLite database (.studio/).
• MCP server is a separate stdio process; it does not require the agent or the UI to be running.
• Everything runs on the developer's machine. Nothing is sent off the box.

Compatibility

• Requires @expressots/core ^4.0.0 and @expressots/adapter-express ^4.0.0.
• Node.js >= 20.19.0.

Included since preview.3.4 (GA hardening)

• Security hardening (c7ceead): root overrides pin js-yaml, hono, ws, esbuild, protobufjs, @opentelemetry/core, and vite to patched versions; in-memory rate limiter in the Studio server; stricter path normalization and error handling in the route scanner, OpenAPI path utils, and security engine.
• Coverage detection and reporting features.
• type: module set for ES module support; tightened type definitions across packages.
• Removed unused dependencies: serve-static (studio), socket.io-client and three unused direct OpenTelemetry packages (studio-agent).
• Tests added for mcp-server (0 to 15) and the Studio server (23 to 32); root MIT LICENSE added.
• engines.node >= 20.19.0 across all workspaces.

Preview line (4.0.0-preview.3.x)

Commits

• 2fdfd69 chore(release): bump to 4.0.0
• cb9c744 chore(studio): production hardening for 4.0 GA
• c7ceead chore(dependencies): update package versions and add overrides
• 5d105c6 feat(coverage): implement coverage detection and reporting features
• 88c6b5b feat(types): enhance type definitions for improved type safety and clarity
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)