chore: update @arcjet/* to 1.8.0

[qw-in]

Dogfoods the arcjet-js build-tooling modernization (arcjet/arcjet-js#6093: rollup→tsdown, dist-only packaging with exports maps, TypeScript 6 declarations) across every example before it ships as stable. Now on 1.7.0-rc.1, which fixes both issues rc.0 dogfooding surfaced:

• the widened @nosecone/next CSP defaults type — the three Next.js examples that extend the defaults in proxy.ts build again, so @nosecone/next is now on the rc too (previously held at 1.6.1)
• the unreplaced __ARCJET_SDK_VERSION__ placeholder in the sdkVersion request field

The Deno example's source now imports through the deno.json import map (bare specifiers) instead of unversioned npm: specifiers, which had been resolving to latest and silently ignoring the pinned versions.

Validated locally per example on rc.1: npm install + build for the 13 buildable JS examples, tsc for firebase-functions, and deno check with a regenerated lockfile — all passing.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​arcjet/​react-router@​1.6.1 ⏵ 1.8.0			+1	+2
	npm/​@​arcjet/​fastify@​1.6.1 ⏵ 1.8.0			+1	+2
	npm/​@​arcjet/​sveltekit@​1.6.1 ⏵ 1.8.0			+1	+2
	npm/​@​arcjet/​nest@​1.6.1 ⏵ 1.8.0			+1	+2
	npm/​@​arcjet/​astro@​1.6.1 ⏵ 1.8.0			+1	+2
	npm/​@​arcjet/​node@​1.6.1 ⏵ 1.8.0				+2
	npm/​@​arcjet/​inspect@​1.6.1 ⏵ 1.8.0				+2
	npm/​@​arcjet/​next@​1.6.1 ⏵ 1.8.0				+2
	npm/​@​arcjet/​nuxt@​1.6.1 ⏵ 1.8.0	+28		+1	+6
	npm/​@​arcjet/​decorate@​1.6.1 ⏵ 1.8.0	+23			+5
	npm/​@​nosecone/​next@​1.6.1 ⏵ 1.8.0	+4			+5

View full report

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Reviewers Assigned

Rationale: This PR updates many @arcjet/* dependencies across examples from stable releases to the 1.7.0-rc.0 pre-release and adjusts Deno imports to use the import map. The changes are small and scoped to examples, but they affect security-related middleware/bot-protection packages and introduce pre-release packages, so automated review cannot fully validate compatibility or supply-chain risk. No specific escalation reviewers are configured.

Summary of Changes

Updates Arcjet dependencies in multiple example apps to 1.7.0-rc.0 and changes the Deno example source imports to use deno.json import aliases instead of direct npm: specifiers.

Escalation Triggers

• Dependency Changes: Multiple package.json files update @arcjet/* dependencies to the 1.7.0-rc.0 pre-release.

Review Focus Areas

• Is adopting @arcjet/* 1.7.0-rc.0 across examples intentional despite being a pre-release?
  Pre-release security-related packages may contain API or behavior changes that differ from stable releases.
• Confirm the Deno import map works with the updated source imports and run the Deno example.
  The source now imports @arcjet/deno and @arcjet/inspect via import aliases rather than direct npm: specifiers, so runtime resolution depends on deno.json being loaded.
• Verify this example is always run from a context where deno.json import mappings are honored.
  Direct execution in an environment that does not load the import map could fail to resolve @arcjet/deno and @arcjet/inspect.
• Check whether lockfiles are expected for these examples and whether they need updating.
  Dependency version changes without corresponding lockfile updates can lead to inconsistent installs if lockfiles are used elsewhere in the repository.
• Review the Arcjet 1.7.0-rc.0 changelog or release notes for breaking changes affecting the examples.
  Several examples use Arcjet protection logic; API or behavior changes could silently weaken or break bot detection, shield, rate limiting, or integration middleware.

Notes

No hardcoded secrets or direct injection issues were visible in the diff. Primary concern is dependency and compatibility risk from moving security-related packages to a release candidate.

Path filtering: 15 files excluded by ignore paths. 16 of 31 files included in review.

_{Review: c4ebeb0b | Model: openai/gpt-5.5 | Powered by Arcjet Review}

[qw-in]

This doesn't really need to merge - CI going green is really the only signal I need here!

[davidmytton]

Looks good. Up to you if you want to merge or close.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Environment variable access: npm @arcjet/astro Location: Package overview From: examples/astro/package-lock.json → npm/@arcjet/astro@1.8.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@arcjet/astro@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report