deps(deps): bump the npm-minor-patch group across 1 directory with 31 updates by dependabot[bot] · Pull Request #505 · creatornader/atrib

dependabot · 2026-07-14T04:20:30Z

Bumps the npm-minor-patch group with 31 updates in the / directory:

Package	From	To
eslint	`10.5.0`	`10.7.0`
prettier	`3.8.4`	`3.9.5`
tsx	`4.22.4`	`4.23.1`
turbo	`2.9.18`	`2.10.5`
typescript-eslint	`8.61.0`	`8.64.0`
vite	`8.0.16`	`8.1.4`
vitest	`4.1.8`	`4.1.10`
@a2a-js/sdk	`0.3.13`	`0.3.14`
@browserbasehq/stagehand	`3.6.0`	`3.7.0`
@google/adk	`1.2.0`	`1.3.0`
@langchain/core	`1.1.49`	`1.2.3`
@langchain/langgraph	`1.4.2`	`1.4.8`
@mastra/core	`1.42.0`	`1.51.0`
@mastra/mcp	`1.10.0`	`1.14.0`
@openai/agents	`0.11.6`	`0.13.4`
@opentelemetry/context-async-hooks	`2.8.0`	`2.9.0`
@opentelemetry/exporter-trace-otlp-proto	`0.219.0`	`0.220.0`
@opentelemetry/sdk-trace-base	`2.8.0`	`2.9.0`
@opentelemetry/semantic-conventions	`1.41.1`	`1.43.0`
mem0ai	`3.0.8`	`3.1.0`
openai	`6.42.0`	`6.47.0`
playwright	`1.60.0`	`1.61.1`
fast-check	`4.8.0`	`4.9.0`
@anthropic-ai/sdk	`0.104.1`	`0.111.0`
@sd-jwt/core	`0.19.0`	`0.20.0`
@sd-jwt/sd-jwt-vc	`0.19.0`	`0.20.0`
agents	`0.16.0`	`0.17.4`
wrangler	`4.100.0`	`4.111.0`
@cloudflare/codemode	`0.4.1`	`0.4.3`
@cloudflare/vitest-pool-workers	`0.16.15`	`0.18.5`
@playwright/test	`1.60.0`	`1.61.1`

Updates eslint from 10.5.0 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)

f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)

0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)

96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)

0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)

75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)

b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)

e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)

a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)

d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)

8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)

a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)

8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

c30d808 docs: Update README (GitHub Actions Bot)

5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)

04174cb docs: Update README (GitHub Actions Bot)

026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)

9d42fef docs: Update README (GitHub Actions Bot)

b230159 docs: Update README (GitHub Actions Bot)

0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

9489379 chore: update dependency @eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])

81a4774 chore: updates for v9.39.5 release (Jenkins)

9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)

72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)

833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])

7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)

8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)

e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])

0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)

1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])

4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)

993539f chore: update dependency @eslint/json to ^2.0.1 (#21042) (renovate[bot])

53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)

5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)

a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)

7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits

fabd99b 10.7.0
37c5e75 Build: changelog update for 10.7.0
9489379 chore: update dependency @eslint/eslintrc to ^3.3.6 (#21076)
81a4774 chore: updates for v9.39.5 release
3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
c30d808 docs: Update README
f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

3.9.4

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @fisker)

🔗 Changelog

3.9.3

Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @seiyab)

TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @evoactivity)

🔗 Changelog

3.9.1

CLI: Fix ignored file has been cached incorrectly (#19483 by @kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

Fix Flow variance annotation print (#19022 by @marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text

999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text

999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

[link](https://github.com/prettier/prettier/blob/main/<> "title")

[link](https://github.com/prettier/prettier/blob/main/ "title")

</tr></table>

... (truncated)

Commits

b6c7d18 Release 3.9.5
cd54ccc Avoid corrupting empty Markdown link with title (#19487)
2bb67ce Preserving comments' placement property (#19567)
91bcac8 Add more tests for comment-only object type (#19587)
cbee737 Remove space in empty object type (#19583)
6394c73 Align empty module declaration with TS (#19568)
a4e6f7a Prevent the addition of space in type() with + (#19516)
3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
908503e Handle dangling comments in SwitchStatement (#19581)
943a475 Angular: Support expression for exhaustive typechecking (#19571)
Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

support tsImport after global preload (8d4ffc2)

watch: avoid clearing piped output (95d0672)

watch: treat script and dependency paths literally (79fddde)

Performance Improvements

index transform cache lazily (e818ad6)

load esbuild lazily in CLI (d067938)

map Node TypeScript formats directly (cdcc623)

use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

npm package (@latest dist-tag)

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

This release is also available on:

npm package (@latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

isolate hook state per async module.register() registration (a305f36)

This release is also available on:

npm package (@latest dist-tag)

Commits

79fddde fix(watch): treat script and dependency paths literally
e818ad6 perf: index transform cache lazily
cdcc623 perf: map Node TypeScript formats directly
d067938 perf: load esbuild lazily in CLI
95d0672 fix(watch): avoid clearing piped output
6fd4607 docs: add per-page metadata
f4176d8 docs: generate sitemap
8d4ffc2 fix: support tsImport after global preload
f0e89b2 docs: document Node's public type-stripping API vs internal loader path
f8992f1 perf: use sync module hooks on Node v22.22.3+
Additional commits viewable in compare view

Updates turbo from 2.9.18 to 2.10.5

Release notes

Sourced from turbo's releases.

Turborepo v2.10.5

What's Changed

Changelog

perf: Evaluate simple include globs without wax compilation by @anthonyshew in vercel/turborepo#13285

chore: Dogfood native Cargo support in this repository by @anthonyshew in vercel/turborepo#13283

release(turborepo): 2.10.4 by @github-actions[bot] in vercel/turborepo#13286

ci: Remove dead sccache configuration by @anthonyshew in vercel/turborepo#13289

feat: Serve the Remote Cache as an sccache backend for Cargo tasks by @anthonyshew in vercel/turborepo#13288

fix: Reject output path traversal by @anthonyshew in vercel/turborepo#13290

fix: Disable the sccache proxy when remote cache use is off by @anthonyshew in vercel/turborepo#13291

feat: Embed sccache so the Cargo compile cache needs no installation by @anthonyshew in vercel/turborepo#13293

release(turborepo): 2.10.5-canary.1 by @github-actions[bot] in vercel/turborepo#13294

fix: Pin a flag-aware turbo canary for the eve-agent deployment by @anthonyshew in vercel/turborepo#13295

fix: Make the sccache compile cache actually cache by @anthonyshew in vercel/turborepo#13296

release(turborepo): 2.10.5-canary.2 by @github-actions[bot] in vercel/turborepo#13297

fix: Stop ambient CARGO_INCREMENTAL from suppressing compile cache injection by @anthonyshew in vercel/turborepo#13298

fix: Never let compile cache storage failures fail the build by @anthonyshew in vercel/turborepo#13299

test: Add outputs path-traversal negative-case regression tests by @dnukumamras in vercel/turborepo#13300

release(turborepo): 2.10.5-canary.3 by @github-actions[bot] in vercel/turborepo#13302

ci: Authenticate to Remote Cache via OIDC token exchange by @anthonyshew in vercel/turborepo#13303

fix: Keep pnpm patches with version range keys during prune by @anthonyshew in vercel/turborepo#13307

test: Scrub ambient turbo configuration from integration test children by @anthonyshew in vercel/turborepo#13306

fix: Show toolchain tasks in the TUI and never run in silence by @anthonyshew in vercel/turborepo#13308

ci: Fix change detection on push events by @anthonyshew in vercel/turborepo#13304

refactor: Rename the Cargo toolchain id to rust by @anthonyshew in vercel/turborepo#13311

fix: Remove extraneous bun.lock entries during prune by @anthonyshew in vercel/turborepo#13317

feat: Require a user-declared name for the Cargo workspace package by @anthonyshew in vercel/turborepo#13312

feat: Parse and validate the task command field by @anthonyshew in vercel/turborepo#13313

chore: Harden turbo-vsc to invoke turbo without a shell by @dnukumamras in vercel/turborepo#13319

feat: Resolve and execute task command overrides by @anthonyshew in vercel/turborepo#13315

release(turborepo): 2.10.5-canary.4 by @github-actions[bot] in vercel/turborepo#13325

feat: Run the Rust workspace tests through nextest via command override by @anthonyshew in vercel/turborepo#13316

feat: Engage the Remote Cache and sccache compile cache for Rust CI by @anthonyshew in vercel/turborepo#13292

ci: Pin GitHub Actions to full commit SHAs by @XananasX7 in vercel/turborepo#13143

fix: Make npm prune rehoisting deterministic and complete by @anthonyshew in vercel/turborepo#13323

feat: Report incremental cache reuse in the run summary by @anthonyshew in vercel/turborepo#13327

chore: Remove planning docs by @anthonyshew in vercel/turborepo#13329

docs: Migrate docs site to @vercel/geistdocs package by @molebox in vercel/turborepo#13320

ci: Update Remote Cache action by @anthonyshew in vercel/turborepo#13330

release(turborepo): 2.10.5-canary.5 by @github-actions[bot] in vercel/turborepo#13331

ci: Remove path-based workflow scheduling by @anthonyshew in vercel/turborepo#13332

fix: Resolve EADDRINUSE in kitchen-sink api dev script by @ashusnapx in vercel/turborepo#13328

ci: Disable telemetry messages in workflows by @anthonyshew in vercel/turborepo#13334

fix: Prevent Cargo run tasks from being cached by @anthonyshew in vercel/turborepo#13335

fix: Isolate Cargo cache by host platform by @anthonyshew in vercel/turborepo#13337

fix: Continue TUI text selection beyond viewport by @anthonyshew in vercel/turborepo#13338

ci: Dogfood Cargo target restoration by @anthonyshew in vercel/turborepo#13336

fix: Require current Cargo lockfiles for caching by @anthonyshew in vercel/turborepo#13339

... (truncated)

Commits

78091b6 publish 2.10.5 to registry
82bcfb6 refactor: Add Toolchain output availability (#13360)
6ed2fb4 fix: Preserve Yarn package extension ranges when pruning (#13363)
38aa7d2 chore: Update agents app Eve dependency (#13364)
ed17249 fix: Synchronize Cargo prune Docker lockfile (#13350)
d533266 fix: Hash Cargo build environment inputs (#13348)
ef122d9 ci: Shard Rust tests across runners (#13356)
b3cd7a1 fix: Include patched Ghostty crate in Cargo workspace (#13357)
f82e2c7 release(turborepo): 2.10.5-canary.6 (#13355)
e76f0b4 fix: Isolate Command Overrides From Toolchain Cache I/O (#13354)
Additional commits viewable in compare view

Updates typescript-eslint from 8.61.0 to 8.64.0

Release notes

Sourced from typescript-eslint's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

support parsing import defer (#12513)

eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)

typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

Evyatar Daud @StyleShit

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)

eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)

eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)

scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

Evyatar Daud @StyleShit

Kristjan @KristjanTammekivi

Michael Naumov @mnaoumov

Serhii Leniv @Serhii-Leniv

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.64.0 (2026-07-13)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

remove redundant package.json "files" (#12444)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.1 (2026-06-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

414d9ab chore(release): publish 8.64.0
290cf6c chore(release): publish 8.63.0
3ea32f4 chore(release): publish 8.62.1
54e2857 chore(release): publish 8.62.0
81e4c26 feat: remove redundant package.json "files" (#12444)
aaad718 chore(release): publish 8.61.1
See full diff in compare view

Updates vite from 8.0.16 to 8.1.4

Release notes

Sourced from vite's releases.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.4 (2026-07-09)

Features

legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

build: add workaround for building on stackblitz (#22840) (575c32c)

build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)

deps: update all non-major dependencies (#22865) (d4295a9)

deps: update rolldown-related dependencies (#22866) (7cf07e4)

html: avoid backtracking in import-only check (#22848) (b5868c0)

optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)

ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)

strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

avoid warnings (#22851) (af21ab6)

Build System

remove the custom onLog function (#22878) (2c4a217)

replace deprecated onwarn with onLog (#22741) (c581b55)

8.1.3 (2026-07-02)

Bug Fixes

css: inject inlined CSS after the shebang line (#22717) (1534d36)

deps: bump es-module-lexer to 2.3.0 (#22838) (7103c3a)

preload css for nested dynamic imports (#22759) (2c53054)

ssr: correct stacktrace column position for first line (#22828) (c4acd69)

8.1.2 (2026-06-30)

Bug Fixes

deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)

restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)

... (truncated)

Commits

a477454 release: v8.1.4
ab5dafa feat(legacy): prefer oxc as minifier (fix #21973) (#22468)
173a1b6 fix(ssr): align named export function call stacktrace column with Node (#22829)
575c32c fix(build): add workaround for building on stackblitz (#22840)
72a5e21 fix(optimizer): avoid optimizer run for transform request before init (#22852)
a9539d6 chore(deps): update dependency postcss-modules to v9 (#22867)
70435b2 docs: fix incorrect @default for server.cors (#22859)
2c4a217 build: remove the custom onLog function (#22878)
c581b55 build: replace deprecated onwarn with onLog (#22741)
ea22fb3 refactor: eliminate ineffectiveDynamicImport warn (#22876)
Additional commits viewable in compare view

Updates vitest from 4.1.8 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

Commits

db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 ...
Description has been truncated

dependabot · 2026-07-14T04:20:31Z

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

… updates Bumps the npm-minor-patch group with 31 updates in the / directory: | Package | From | To | | --- | --- | --- | | [eslint](https://github.com/eslint/eslint) | `10.5.0` | `10.7.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` | | [turbo](https://github.com/vercel/turborepo) | `2.9.18` | `2.10.5` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.61.0` | `8.64.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.1.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.10` | | [@a2a-js/sdk](https://github.com/a2aproject/a2a-js) | `0.3.13` | `0.3.14` | | [@browserbasehq/stagehand](https://github.com/browserbase/stagehand/tree/HEAD/packages/core) | `3.6.0` | `3.7.0` | | [@google/adk](https://github.com/google/adk-js) | `1.2.0` | `1.3.0` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.1.49` | `1.2.3` | | [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.4.2` | `1.4.8` | | [@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core) | `1.42.0` | `1.51.0` | | [@mastra/mcp](https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp) | `1.10.0` | `1.14.0` | | [@openai/agents](https://github.com/openai/openai-agents-js) | `0.11.6` | `0.13.4` | | [@opentelemetry/context-async-hooks](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.9.0` | | [@opentelemetry/exporter-trace-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.220.0` | | [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.9.0` | | [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.41.1` | `1.43.0` | | [mem0ai](https://github.com/mem0ai/mem0/tree/HEAD/mem0-ts) | `3.0.8` | `3.1.0` | | [openai](https://github.com/openai/openai-node) | `6.42.0` | `6.47.0` | | [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.1` | | [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.8.0` | `4.9.0` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.104.1` | `0.111.0` | | [@sd-jwt/core](https://github.com/openwallet-foundation/sd-jwt-js) | `0.19.0` | `0.20.0` | | [@sd-jwt/sd-jwt-vc](https://github.com/openwallet-foundation/sd-jwt-js) | `0.19.0` | `0.20.0` | | [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.16.0` | `0.17.4` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.100.0` | `4.111.0` | | [@cloudflare/codemode](https://github.com/cloudflare/agents/tree/HEAD/packages/codemode) | `0.4.1` | `0.4.3` | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.16.15` | `0.18.5` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.1` | Updates `eslint` from 10.5.0 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.5.0...v10.7.0) Updates `prettier` from 3.8.4 to 3.9.5 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.4...3.9.5) Updates `tsx` from 4.22.4 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.4...v4.23.1) Updates `turbo` from 2.9.18 to 2.10.5 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.18...v2.10.5) Updates `typescript-eslint` from 8.61.0 to 8.64.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint) Updates `vite` from 8.0.16 to 8.1.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite) Updates `vitest` from 4.1.8 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `@a2a-js/sdk` from 0.3.13 to 0.3.14 - [Release notes](https://github.com/a2aproject/a2a-js/releases) - [Changelog](https://github.com/a2aproject/a2a-js/blob/main/CHANGELOG.md) - [Commits](a2aproject/a2a-js@v0.3.13...v0.3.14) Updates `@browserbasehq/stagehand` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/browserbase/stagehand/releases) - [Changelog](https://github.com/browserbase/stagehand/blob/main/packages/core/CHANGELOG.md) - [Commits](https://github.com/browserbase/stagehand/commits/@browserbasehq/stagehand@3.7.0/packages/core) Updates `@google/adk` from 1.2.0 to 1.3.0 - [Release notes](https://github.com/google/adk-js/releases) - [Commits](google/adk-js@adk-v1.2.0...adk-v1.3.0) Updates `@langchain/core` from 1.1.49 to 1.2.3 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/commits/@langchain/core@1.2.3) Updates `@langchain/langgraph` from 1.4.2 to 1.4.8 - [Release notes](https://github.com/langchain-ai/langgraphjs/releases) - [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md) - [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.8/libs/langgraph-core) Updates `@mastra/core` from 1.42.0 to 1.51.0 - [Release notes](https://github.com/mastra-ai/mastra/releases) - [Changelog](https://github.com/mastra-ai/mastra/blob/main/docs/CHANGELOG.md) - [Commits](https://github.com/mastra-ai/mastra/commits/@mastra/core@1.51.0/packages/core) Updates `@mastra/mcp` from 1.10.0 to 1.14.0 - [Release notes](https://github.com/mastra-ai/mastra/releases) - [Changelog](https://github.com/mastra-ai/mastra/blob/main/packages/mcp/CHANGELOG.md) - [Commits](https://github.com/mastra-ai/mastra/commits/@mastra/mcp@1.14.0/packages/mcp) Updates `@openai/agents` from 0.11.6 to 0.13.4 - [Release notes](https://github.com/openai/openai-agents-js/releases) - [Commits](openai/openai-agents-js@v0.11.6...v0.13.4) Updates `@opentelemetry/context-async-hooks` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.9.0) Updates `@opentelemetry/exporter-trace-otlp-proto` from 0.219.0 to 0.220.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.220.0) Updates `@opentelemetry/sdk-trace-base` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.9.0) Updates `@opentelemetry/semantic-conventions` from 1.41.1 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.41.1...semconv/v1.43.0) Updates `mem0ai` from 3.0.8 to 3.1.0 - [Release notes](https://github.com/mem0ai/mem0/releases) - [Commits](https://github.com/mem0ai/mem0/commits/ts-v3.1.0/mem0-ts) Updates `openai` from 6.42.0 to 6.47.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v6.42.0...v6.47.0) Updates `playwright` from 1.60.0 to 1.61.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.61.1) Updates `fast-check` from 4.8.0 to 4.9.0 - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.9.0/packages/fast-check) Updates `@anthropic-ai/sdk` from 0.104.1 to 0.111.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.104.1...sdk-v0.111.0) Updates `@sd-jwt/core` from 0.19.0 to 0.20.0 - [Release notes](https://github.com/openwallet-foundation/sd-jwt-js/releases) - [Changelog](https://github.com/openwallet-foundation/sd-jwt-js/blob/main/CHANGELOG.md) - [Commits](openwallet-foundation/sd-jwt-js@v0.19.0...v0.20.0) Updates `@sd-jwt/sd-jwt-vc` from 0.19.0 to 0.20.0 - [Release notes](https://github.com/openwallet-foundation/sd-jwt-js/releases) - [Changelog](https://github.com/openwallet-foundation/sd-jwt-js/blob/main/CHANGELOG.md) - [Commits](openwallet-foundation/sd-jwt-js@v0.19.0...v0.20.0) Updates `agents` from 0.16.0 to 0.17.4 - [Release notes](https://github.com/cloudflare/agents/releases) - [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md) - [Commits](https://github.com/cloudflare/agents/commits/agents@0.17.4/packages/agents) Updates `wrangler` from 4.100.0 to 4.111.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.111.0/packages/wrangler) Updates `@cloudflare/codemode` from 0.4.1 to 0.4.3 - [Release notes](https://github.com/cloudflare/agents/releases) - [Changelog](https://github.com/cloudflare/agents/blob/main/packages/codemode/CHANGELOG.md) - [Commits](https://github.com/cloudflare/agents/commits/@cloudflare/codemode@0.4.3/packages/codemode) Updates `@cloudflare/vitest-pool-workers` from 0.16.15 to 0.18.5 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.5/packages/vitest-pool-workers) Updates `@playwright/test` from 1.60.0 to 1.61.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.61.1) --- updated-dependencies: - dependency-name: "@a2a-js/sdk" dependency-version: 0.3.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.111.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@browserbasehq/stagehand" dependency-version: 3.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@cloudflare/codemode" dependency-version: 0.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@google/adk" dependency-version: 1.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@langchain/core" dependency-version: 1.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@langchain/langgraph" dependency-version: 1.4.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@mastra/core" dependency-version: 1.50.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@mastra/mcp" dependency-version: 1.13.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@openai/agents" dependency-version: 0.13.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/context-async-hooks" dependency-version: 2.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-proto" dependency-version: 0.220.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.43.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@playwright/test" dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@sd-jwt/core" dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@sd-jwt/sd-jwt-vc" dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: agents dependency-version: 0.17.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: fast-check dependency-version: 4.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: mem0ai dependency-version: 3.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: openai dependency-version: 6.46.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: playwright dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: turbo dependency-version: 2.10.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: typescript-eslint dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: vite dependency-version: 8.1.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: wrangler dependency-version: 4.110.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…499913

The @sd-jwt 0.20.0 pair in this group enforces SD-JWT digest uniqueness and rejects the pinned AP2 / VI reference artifacts, whose L2 payloads reference the same disclosure digest from both _sd and delegate_payload. Held at 0.19.0 with a dependabot ignore until the upstream duplicate-reference question is resolved and the reference artifacts regenerate cleanly (tracked follow-up). Forward-compatible pieces land now: the synthetic VI fixtures are single-reference (the immediate fixture is regenerated from deterministic seeds instead of its unrecoverable hand-signed keys), and the crypto-conformance duplicate-digest mutation handles both payload shapes. The @google/adk and @openai/agents minor bumps moved the version facts the runtime receipt proofs pin; pins updated to 1.3.0 and 0.13.4.