Security remediation: patch bump all packages (easy-day-js incident) (#18056)

Co-authored-by: Mastra Code (anthropic/claude-opus-4-8) <noreply@mastra.ai>

Author: abhiaiyer91

.changeset/easy-day-js-security-remediation.md

@@ -0,0 +1,135 @@
+---
+'@mastra/acp': patch
+'@mastra/agent-browser': patch
+'@mastra/agent-builder': patch
+'@mastra/agentcore': patch
+'@mastra/agentfs': patch
+'@mastra/ai-sdk': patch
+'@mastra/arize': patch
+'@mastra/arthur': patch
+'@mastra/astra': patch
+'@mastra/auth': patch
+'@mastra/auth-auth0': patch
+'@mastra/auth-better-auth': patch
+'@mastra/auth-clerk': patch
+'@mastra/auth-cloud': patch
+'@mastra/auth-firebase': patch
+'@mastra/auth-neon': patch
+'@mastra/auth-okta': patch
+'@mastra/auth-studio': patch
+'@mastra/auth-supabase': patch
+'@mastra/auth-workos': patch
+'@mastra/azure': patch
+'@mastra/blaxel': patch
+'@mastra/braintrust': patch
+'@mastra/brightdata': patch
+'@mastra/browser-firecrawl': patch
+'@mastra/browser-viewer': patch
+'@mastra/chroma': patch
+'@mastra/claude': patch
+'@mastra/clickhouse': patch
+'@mastra/client-js': patch
+'@mastra/cloudflare': patch
+'@mastra/cloudflare-d1': patch
+'@mastra/codemod': patch
+'@mastra/convex': patch
+'@mastra/core': patch
+'@mastra/couchbase': patch
+'@mastra/cursor': patch
+'@mastra/datadog': patch
+'@mastra/daytona': patch
+'@mastra/deployer': patch
+'@mastra/deployer-cloud': patch
+'@mastra/deployer-cloudflare': patch
+'@mastra/deployer-netlify': patch
+'@mastra/deployer-vercel': patch
+'@mastra/docker': patch
+'@mastra/dsql': patch
+'@mastra/duckdb': patch
+'@mastra/dynamodb': patch
+'@mastra/e2b': patch
+'@mastra/editor': patch
+'@mastra/elasticsearch': patch
+'@mastra/evals': patch
+'@mastra/express': patch
+'@mastra/fastembed': patch
+'@mastra/fastify': patch
+'@mastra/files-sdk': patch
+'@mastra/gcs': patch
+'@mastra/github-signals': patch
+'@mastra/google-cloud-pubsub': patch
+'@mastra/google-drive': patch
+'@mastra/hono': patch
+'@mastra/inngest': patch
+'@mastra/koa': patch
+'@mastra/laminar': patch
+'@mastra/lance': patch
+'@mastra/langfuse': patch
+'@mastra/langsmith': patch
+'@mastra/libsql': patch
+'@mastra/loggers': patch
+'@mastra/longmemeval': patch
+'@mastra/mcp': patch
+'@mastra/mcp-docs-server': patch
+'@mastra/mcp-registry-registry': patch
+'@mastra/memory': patch
+'@mastra/modal': patch
+'@mastra/mongodb': patch
+'@mastra/mssql': patch
+'@mastra/mysql': patch
+'@mastra/nestjs': patch
+'@mastra/observability': patch
+'@mastra/openai': patch
+'@mastra/opencode': patch
+'@mastra/opensearch': patch
+'@mastra/otel-bridge': patch
+'@mastra/otel-exporter': patch
+'@mastra/perplexity': patch
+'@mastra/pg': patch
+'@mastra/pinecone': patch
+'@mastra/playground-ui': patch
+'@mastra/posthog': patch
+'@mastra/qdrant': patch
+'@mastra/rag': patch
+'@mastra/railway': patch
+'@mastra/react': patch
+'@mastra/redis': patch
+'@mastra/redis-streams': patch
+'@mastra/s3': patch
+'@mastra/s3vectors': patch
+'@mastra/schema-compat': patch
+'@mastra/sentry': patch
+'@mastra/server': patch
+'@mastra/slack': patch
+'@mastra/spanner': patch
+'@mastra/stagehand': patch
+'@mastra/tavily': patch
+'@mastra/temporal': patch
+'@mastra/turbopuffer': patch
+'@mastra/upstash': patch
+'@mastra/vectorize': patch
+'@mastra/vercel': patch
+'@mastra/voice-aws-nova-sonic': patch
+'@mastra/voice-azure': patch
+'@mastra/voice-cloudflare': patch
+'@mastra/voice-deepgram': patch
+'@mastra/voice-elevenlabs': patch
+'@mastra/voice-gladia': patch
+'@mastra/voice-google': patch
+'@mastra/voice-google-gemini-live': patch
+'@mastra/voice-inworld': patch
+'@mastra/voice-modelslab': patch
+'@mastra/voice-murf': patch
+'@mastra/voice-openai': patch
+'@mastra/voice-openai-realtime': patch
+'@mastra/voice-playai': patch
+'@mastra/voice-sarvam': patch
+'@mastra/voice-speechify': patch
+'@mastra/voice-xai-realtime': patch
+'@mastra/voyageai': patch
+'create-mastra': patch
+'mastra': patch
+'mastracode': patch
+---
+
+Security remediation for the 2026-06-17 "easy-day-js" supply-chain incident. Patch bump to publish clean versions and move the `latest` dist-tag forward, superseding the compromised versions that declared the malicious `easy-day-js` dependency.