Skip to content

chore(deps): bump the npm_and_yarn group across 14 directories with 15 updates#7279

Merged
lalalune merged 1 commit into
developfrom
dependabot/npm_and_yarn/cloud/npm_and_yarn-8de24eb644
May 3, 2026
Merged

chore(deps): bump the npm_and_yarn group across 14 directories with 15 updates#7279
lalalune merged 1 commit into
developfrom
dependabot/npm_and_yarn/cloud/npm_and_yarn-8de24eb644

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 3, 2026

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps the npm_and_yarn group with 5 updates in the /cloud directory:

Package From To
ai 4.3.19 6.0.174
nodemailer 7.0.13 8.0.7
vite 5.4.21 8.0.10
hono 4.10.8 4.12.14
@hono/node-server 1.19.7 1.19.13

Bumps the npm_and_yarn group with 1 update in the /cloud/apps/api directory: hono.
Bumps the npm_and_yarn group with 1 update in the /cloud/apps/frontend directory: vite.
Bumps the npm_and_yarn group with 1 update in the /cloud/examples/clone-ur-crush directory: ai.
Bumps the npm_and_yarn group with 1 update in the /cloud/services/_smoke-mcp directory: hono.
Bumps the npm_and_yarn group with 2 updates in the /cloud/services/gateway-discord directory: hono and @hono/node-server.
Bumps the npm_and_yarn group with 1 update in the /cloud/services/gateway-webhook directory: hono.
Bumps the npm_and_yarn group with 7 updates in the /cloud/services/operator directory:

Package From To
minimatch 3.1.3 3.1.5
minimatch 10.2.2 10.2.5
brace-expansion 1.1.12 1.1.14
flatted 3.3.3 3.4.2
lodash 4.17.23 4.18.1
picomatch 4.0.3 4.0.4
path-to-regexp 8.3.0 8.4.2
yaml 2.8.2 2.8.4

Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-action-bench directory: uuid.
Bumps the npm_and_yarn group with 2 updates in the /plugins/plugin-action-bench/src/frontend directory: uuid and vite.
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-google-meet-cute directory: uuid.
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-matrix directory: matrix-js-sdk.
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-ollama directory: ai.
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-whatsapp directory: axios.

Updates ai from 4.3.19 to 6.0.174

Release notes

Sourced from ai's releases.

ai@6.0.174

Patch Changes

  • Updated dependencies [49f6d44]
    • @​ai-sdk/gateway@​3.0.109

ai@6.0.173

Patch Changes

  • 7beadf0: feat(mcp): propagate the server name through dynamic tool parts
  • Updated dependencies [7beadf0]
    • @​ai-sdk/provider-utils@​4.0.26
    • @​ai-sdk/gateway@​3.0.108

ai@5.0.183

Patch Changes

  • Updated dependencies [8dd759d]
    • @​ai-sdk/gateway@​2.0.86
Changelog

Sourced from ai's changelog.

6.0.174

Patch Changes

  • Updated dependencies [49f6d44]
    • @​ai-sdk/gateway@​3.0.109

6.0.173

Patch Changes

  • 7beadf0: feat(mcp): propagate the server name through dynamic tool parts
  • Updated dependencies [7beadf0]
    • @​ai-sdk/provider-utils@​4.0.26
    • @​ai-sdk/gateway@​3.0.108

6.0.172

Patch Changes

  • Updated dependencies [982af78]
    • @​ai-sdk/gateway@​3.0.107

6.0.171

Patch Changes

  • 48f842a: fix(ai): enforce callOptionsSchema at runtime in ToolLoopAgent

    ToolLoopAgentSettings.callOptionsSchema was declared and documented as a runtime schema for options, but tool-loop-agent.ts never invoked it. Any invariant a developer encoded in the schema was silently bypassed at runtime, and unchecked options flowed straight into prepareCall and any instructions template that interpolated them.

    ToolLoopAgent.prepareCall now validates caller-supplied options against callOptionsSchema (when set) via safeValidateTypes, throwing InvalidArgumentError on failure before forwarding to prepareCall / generateText / streamText.

  • a727da4: chore: ensure consistent import handling and avoid import duplicates or cycles

  • 5fee301: fix(mcp): prevent prototype pollution by using secureJsonParse

  • Updated dependencies [a727da4]

    • @​ai-sdk/provider-utils@​4.0.25
    • @​ai-sdk/provider@​3.0.10
    • @​ai-sdk/gateway@​3.0.106

6.0.170

Patch Changes

  • 19d587a: fix(ai): add allowSystemInMessages option and warn by default when system messages are found in prompt or messages

6.0.169

Patch Changes

... (truncated)

Commits
  • 0129eb6 Version Packages (#14912)
  • 8a46a3c Version Packages (#14875)
  • 7beadf0 Backport: feat(mcp): propagate the server name through dynamic tool parts (#1...
  • 29c80ec Version Packages (#14868)
  • 8e650ab Version Packages (#14824)
  • 48f842a backport v6: fix(ai): enforce callOptionsSchema at runtime in ToolLoopAgent (...
  • a727da4 backport of chore: ensure consistent import handling and avoid import duplica...
  • 5fee301 backport v6: fix(mcp): prevent prototype pollution by using secureJsonParse (...
  • 7ab1e18 Version Packages (#14815)
  • 19d587a v6: fix(ai): warn about system messages in messages or prompt (#14810)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ai since your current version.


Updates nodemailer from 7.0.13 to 8.0.7

Release notes

Sourced from nodemailer's releases.

v8.0.7

8.0.7 (2026-04-27)

Bug Fixes

  • keep domain as UTF-8 when local part is non-ASCII (#1814) (66d4ecb)

v8.0.6

8.0.6 (2026-04-24)

Bug Fixes

  • restore base64 wrap() trim behavior to prevent trailing CRLF (#1810) (#1811) (b1ae6c1)

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

  • decode SMTP server responses as UTF-8 at line boundary (95876b1)
  • sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.7 (2026-04-27)

Bug Fixes

  • keep domain as UTF-8 when local part is non-ASCII (#1814) (66d4ecb)

8.0.6 (2026-04-24)

Bug Fixes

  • restore base64 wrap() trim behavior to prevent trailing CRLF (#1810) (#1811) (b1ae6c1)

8.0.5 (2026-04-07)

Bug Fixes

  • decode SMTP server responses as UTF-8 at line boundary (95876b1)
  • sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

... (truncated)

Commits
  • 1997040 chore(master): release 8.0.7 (#1815)
  • 9b9c545 chore: drop nodemailer-ntlm-auth devDependency (#1816)
  • 22bf90c Bumped dev deps
  • 66d4ecb fix: keep domain as UTF-8 when local part is non-ASCII (#1814)
  • 6a4a01e Fix/base64 wrap trailing crlf (#1813)
  • a22efbc chore(master): release 8.0.6 (#1812)
  • b1ae6c1 fix: restore base64 wrap() trim behavior to prevent trailing CRLF (#1810) (#1...
  • 202cfb3 chore(master): release 8.0.5 (#1809)
  • b634abf docs: add CLAUDE.md with project conventions and release process
  • 95876b1 fix: decode SMTP server responses as UTF-8 at line boundary
  • Additional commits viewable in compare view

Updates vite from 5.4.21 to 8.0.10

Release notes

Sourced from vite's releases.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

create-vite@8.0.3

Please refer to CHANGELOG.md for details.

v8.0.3

Please refer to CHANGELOG.md for details.

create-vite@8.0.2

Please refer to CHANGELOG.md for details.

v8.0.2

Please refer to CHANGELOG.md for details.

create-vite@8.0.1

Please refer to CHANGELOG.md for details.

v8.0.1

Please refer to CHANGELOG.md for details.

plugin-legacy@8.0.1

Please refer to CHANGELOG.md for details.

create-vite@8.0.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.0.0

Please refer to CHANGELOG.md for details.

v8.0.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.10 (2026-04-23)

Features

Bug Fixes

  • hmrClient.logger.debug and hmrClient.logger.error looked different from other HMR logs (#22147) (a4d828f)
  • css: show filename in CSS minification warnings for .css?inline (#22292) (83f0a78)
  • optimizer: allow user transform.target to override default in optimizeDeps (#22273) (5c7cec6)
  • remove format sniffing module resolution from JS resolver (#22297) (b8a21cc)

Code Refactoring

8.0.9 (2026-04-20)

Features

Bug Fixes

  • allow binding when strictPort is set but wildcard port is in use (#22150) (dfc8aa5)
  • build: emptyOutDir should happen for watch rebuilds (#22207) (ee52267)
  • bundled-dev: reject requests to HMR patch files in non potentially trustworthy origins (#22269) (868f141)
  • css: use unique key for cssEntriesMap to prevent same-basename collision (#22039) (374bb5d)
  • deps: update all non-major dependencies (#22219) (4cd0d67)
  • deps: update all non-major dependencies (#22268) (c28e9c1)
  • detect Deno workspace root (fix #22237) (#22238) (1b793c0)
  • dev: handle errors in watchChange hook (#22188) (fc08bda)
  • optimizer: handle more chars that will be sanitized (#22208) (3f24533)
  • skip fallback sourcemap generation for ?raw imports (#22148) (3ec9cda)

Documentation

Miscellaneous Chores

  • deps: update dependency dotenv-expand to v13 (#22271) (0a3887d)

8.0.8 (2026-04-09)

Features

... (truncated)

Commits
  • 32c2978 release: v8.0.10
  • a4d06d9 feat: update rolldown to 1.0.0-rc.17 (#22299)
  • a4d828f fix: hmrClient.logger.debug and hmrClient.logger.error looked different f...
  • 83f0a78 fix(css): show filename in CSS minification warnings for .css?inline (#22292)
  • b8a21cc fix: remove format sniffing module resolution from JS resolver (#22297)
  • 40a0847 refactor: typecheck client directory (#22284)
  • 5c7cec6 fix(optimizer): allow user transform.target to override default in optimizeDe...
  • 9437518 refactor: enable some typecheck rules (#22278)
  • ce729f5 release: v8.0.9
  • 605bb97 docs: update build CLI defaults (#22261)
  • Additional commits viewable in compare view

Updates hono from 4.10.8 to 4.12.14

Release notes

Sourced from hono's releases.

v4.12.14

Security fixes

This release includes fixes for the following security issues:

Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

Other changes

  • fix(aws-lambda): handle invalid header names in request processing (#4883) fa2c74fe

v4.12.13

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.12...v4.12.13

v4.12.12

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4


... (truncated)

Commits

Updates @hono/node-server from 1.19.7 to 1.19.13

Release notes

Sourced from @​hono/node-server's releases.

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

New Contributors

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

Commits

Updates hono from 4.12.5 to 4.12.14

Release notes

Sourced from hono's releases.

v4.12.14

Security fixes

This release includes fixes for the following security issues:

Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

Other changes

  • fix(aws-lambda): handle invalid header names in request processing (#4883) fa2c74fe

v4.12.13

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.12...v4.12.13

v4.12.12

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4


... (truncated)

Commits

Updates vite from 5.4.21 to 8.0.10

Release notes

Sourced from vite's releases.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

create-vite@8.0.3

Please refer to CHANGELOG.md for details.

v8.0.3

Please refer to CHANGELOG.md for details.

create-vite@8.0.2

Please refer to CHANGELOG.md for details.

v8.0.2

Please refer to CHANGELOG.md for details.

create-vite@8.0.1

Please refer to CHANGELOG.md for details.

v8.0.1

Please refer to CHANGELOG.md for details.

plugin-legacy@8.0.1

Please refer to CHANGELOG.md for details.

create-vite@8.0.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.0.0

Please refer to CHANGELOG.md for details.

v8.0.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.10 (2026-04-23)

Features

Bug Fixes

  • hmrClient.logger.debug and hmrClient.logger.error looked different from other HMR logs (#22147) (a4d828f)
  • css: show filename in CSS minification warnings for .css?inline (#22292) (83f0a78)
  • optimizer: allow user transform.target to override default in optimizeDeps (#22273) (5c7cec6)
  • remove format sniffing module resolution from JS resolver (#22297) (b8a21cc)

Code Refactoring

8.0.9 (2026-04-20)

Features

Bug Fixes

  • allow binding when strictPort is set but wildcard port is in use (#22150) (dfc8aa5)
  • build: emptyOutDir should happen for watch rebuilds (#22207) (ee52267)
  • bundled-dev: reject requests to HMR patch files in non potentially trustworthy origins (#22269) (868f141)
  • css: use unique key for cssEntriesMap to prevent same-basename collision (#22039) (374bb5d)
  • deps: update all non-major dependencies (#22219) (4cd0d67)
  • deps: update all non-major dependencies (#22268) (c28e9c1)
  • detect Deno workspace root (fix #22237) (#22238) (1b793c0)
  • dev: handle errors in watchChange hook (#22188) (fc08bda)
  • optimizer: handle more chars that will be sanitized (#22208) (3f24533)
  • skip fallback sourcemap generation for ?raw imports (#22148) (3ec9cda)

Documentation

Miscellaneous Chores

  • deps: update dependency dotenv-expand to v13 (#22271) (0a3887d)

8.0.8 (2026-04-09)

Features

... (truncated)

Commits
  • 32c2978 release: v8.0.10
  • a4d06d9 feat: update rolldown to 1.0.0-rc.17 (#22299)
  • a4d828f fix: hmrClient.logger.debug and hmrClient.logger.error looked different f...
  • 83f0a78 fix(css): show filename in CSS minification warnings for .css?inline (#22292)
  • b8a21cc fix: remove format sniffing module resolution from JS resolver (#22297)
  • 40a0847 refactor: typecheck client directory (#22284)
  • 5c7cec6 fix(optimizer): allow user transform.target to override default in optimizeDe...
  • 9437518 refactor: enable some typecheck rules (#22278)
  • ce729f5 release: v8.0.9
  • 605bb97 docs: update build CLI defaults (#22261)
  • Additional commits viewable in compare view

Updates ai from 4.3.19 to 6.0.174

Release notes

Sourced from ai's releases.

ai@6.0.174

Patch Changes

  • Updated dependencies [49f6d44]
    • @​ai-sdk/gateway@​3.0.109

ai@6.0.173

Patch Changes

  • 7beadf0: feat(mcp): propagate the server name through dynamic tool parts
  • Updated dependencies [7beadf0]
    • @​ai-sdk/provider-utils@​4.0.26
    • @​ai-sdk/gateway@​3.0.108

ai@5.0.183

Patch Changes

  • Updated dependencies [8dd759d]
    • @​ai-sdk/gateway@​2.0.86
Changelog

Sourced from ai's changelog.

6.0.174

Patch Changes

  • Updated dependencies [49f6d44]
    • @​ai-sdk/gateway@​3.0.109

6.0.173

Patch Changes

  • 7beadf0: feat(mcp): propagate the server name through dynamic tool parts
  • Updated dependencies [7beadf0]
    • @​ai-sdk/provider-utils@​4.0.26
    • @​ai-sdk/gateway@​3.0.108

6.0.172

Patch Changes

  • Updated dependencies [982af78]
    • @​ai-sdk/gateway@​3.0.107

6.0.171

Patch Changes

  • 48f842a: fix(ai): enforce callOptionsSchema at runtime in ToolLoopAgent

    ToolLoopAgentSettings.callOptionsSchema was declared and documented as a runtime schema for options, but tool-loop-agent.ts never invoked it. Any invariant a developer encoded in the schema was silently bypassed at runtime, and unchecked options flowed straight into prepareCall and any instructions template that interpolated them.

    ToolLoopAgent.prepareCall now validates caller-supplied options against callOptionsSchema (when set) via safeValidateTypes, throwing InvalidArgumentError on failure before forwarding to prepareCall / generateText / streamText.

  • a727da4: chore: ensure consistent import handling and avoid import duplicates or cycles

  • 5fee301: fix(mcp): prevent prototype pollution by using secureJsonParse

  • Updated dependencies [a727da4]

    • @​ai-sdk/provider-utils@​4.0.25
    • @​ai-sdk/provider@​3.0.10
    • @​ai-sdk/gateway@​3.0.106

6.0.170

Patch Changes

  • 19d587a: fix(ai): add allowSystemInMessages option and warn by default when system messages are found in prompt or messages

6.0.169

Patch Changes

... (truncated)

Commits

…5 updates

Bumps the npm_and_yarn group with 5 updates in the /cloud directory:

| Package | From | To |
| --- | --- | --- |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `4.3.19` | `6.0.174` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `7.0.13` | `8.0.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `8.0.10` |
| [hono](https://github.com/honojs/hono) | `4.10.8` | `4.12.14` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.7` | `1.19.13` |

Bumps the npm_and_yarn group with 1 update in the /cloud/apps/api directory: [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 1 update in the /cloud/apps/frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /cloud/examples/clone-ur-crush directory: [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai).
Bumps the npm_and_yarn group with 1 update in the /cloud/services/_smoke-mcp directory: [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 2 updates in the /cloud/services/gateway-discord directory: [hono](https://github.com/honojs/hono) and [@hono/node-server](https://github.com/honojs/node-server).
Bumps the npm_and_yarn group with 1 update in the /cloud/services/gateway-webhook directory: [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 7 updates in the /cloud/services/operator directory:

| Package | From | To |
| --- | --- | --- |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.3` | `3.1.5` |
| [minimatch](https://github.com/isaacs/minimatch) | `10.2.2` | `10.2.5` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.3.0` | `8.4.2` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.4` |

Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-action-bench directory: [uuid](https://github.com/uuidjs/uuid).
Bumps the npm_and_yarn group with 2 updates in the /plugins/plugin-action-bench/src/frontend directory: [uuid](https://github.com/uuidjs/uuid) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-google-meet-cute directory: [uuid](https://github.com/uuidjs/uuid).
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-matrix directory: [matrix-js-sdk](https://github.com/matrix-org/matrix-js-sdk).
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-ollama directory: [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai).
Bumps the npm_and_yarn group with 1 update in the /plugins/plugin-whatsapp directory: [axios](https://github.com/axios/axios).


Updates `ai` from 4.3.19 to 6.0.174
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.174/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.174/packages/ai)

Updates `nodemailer` from 7.0.13 to 8.0.7
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.13...v8.0.7)

Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite)

Updates `hono` from 4.10.8 to 4.12.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.8...v4.12.14)

Updates `@hono/node-server` from 1.19.7 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.7...v1.19.13)

Updates `hono` from 4.12.5 to 4.12.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.8...v4.12.14)

Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite)

Updates `ai` from 4.3.19 to 6.0.174
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.174/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.174/packages/ai)

Updates `hono` from 4.12.5 to 4.12.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.8...v4.12.14)

Updates `hono` from 4.10.8 to 4.12.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.8...v4.12.14)

Updates `@hono/node-server` from 1.19.7 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.7...v1.19.13)

Updates `hono` from 4.10.8 to 4.12.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.8...v4.12.14)

Updates `minimatch` from 3.1.3 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.3...v3.1.5)

Updates `minimatch` from 10.2.2 to 10.2.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.3...v3.1.5)

Updates `brace-expansion` from 1.1.12 to 1.1.14
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `path-to-regexp` from 8.3.0 to 8.4.2
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.2)

Updates `yaml` from 2.8.2 to 2.8.4
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.4)

Updates `uuid` from 9.0.1 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v9.0.1...v14.0.0)

Updates `uuid` from 11.1.1 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v9.0.1...v14.0.0)

Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite)

Updates `uuid` from 11.1.1 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v9.0.1...v14.0.0)

Updates `matrix-js-sdk` from 31.6.1 to 41.4.0
- [Release notes](https://github.com/matrix-org/matrix-js-sdk/releases)
- [Changelog](https://github.com/matrix-org/matrix-js-sdk/blob/develop/CHANGELOG.md)
- [Commits](matrix-org/matrix-js-sdk@v31.6.1...v41.4.0)

Updates `ai` from 4.3.19 to 6.0.174
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.174/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.174/packages/ai)

Updates `axios` from 1.7.8 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.7.8...v1.15.0)

---
updated-dependencies:
- dependency-name: ai
  dependency-version: 6.0.174
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 8.0.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ai
  dependency-version: 6.0.174
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 10.2.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 8.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.8.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: matrix-js-sdk
  dependency-version: 41.4.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ai
  dependency-version: 6.0.174
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies javascript Pull requests that update Javascript code labels May 3, 2026
@@ -36,7 +36,7 @@
"sideEffects": false,
"dependencies": {
"@ai-sdk/ui-utils": "^1.2.8",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Potential peer-dependency conflict with @ai-sdk/ui-utils

ai is jumping two major versions (4 → 6), and @ai-sdk/ui-utils: ^1.2.8 is pinned to the v1.x line, which was released alongside ai v4/v5. ai v6 pairs with @ai-sdk/ui-utils v2.x; leaving the old constraint in place can cause npm to install mismatched versions, leading to runtime errors if the exported interfaces changed. The plugin-ollama source code also needs to be audited for any v4-era API calls (e.g., CoreTool, StreamingTextResponse, or prompt-format helpers) that were renamed or removed in v6.

},
"dependencies": {
"matrix-js-sdk": "^31.0.0",
"matrix-js-sdk": "^41.4.0",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 10-major-version leap in matrix-js-sdk

Bumping matrix-js-sdk from ^31 to ^41 spans ten major versions. The Matrix SDK has had sweeping API changes over this range (e.g., crypto module migration from legacy Olm to Rust-backed matrix-sdk-crypto, MatrixClient constructor and factory changes, event-type naming refactors). Without corresponding source-code updates in plugin-matrix, this upgrade is very likely to cause import errors or silent runtime failures. At minimum, the migration guides for each skipped major should be reviewed before landing.

"remark-mdx-frontmatter": "^5.0.0",
"typescript": "^6.0.0",
"vite": "^5.4.10"
"vite": "^8.0.10"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Vite 5 → 8: three major versions, rolldown migration

Vite 8 replaces the Rollup bundler with rolldown, which can break existing vite.config files that rely on Rollup-specific plugin APIs, output options, or build.rollupOptions shapes. No config file changes are included in this PR. If any of the affected apps (cloud/apps/frontend, cloud/package.json, cloud/packages/ui, plugins/plugin-action-bench/src/frontend) use Rollup-specific hooks, builds will fail silently or throw. The vite 6/7/8 migration guides should be applied before landing.

"@elizaos/core": "workspace:*",
"socket.io-client": "^4.8.1",
"uuid": "^9.0.0"
"uuid": "^14.0.0"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 uuid jump from v9/v11 to v14 may have breaking exports

Three packages (plugin-action-bench, plugin-action-bench/src/frontend, and plugin-google-meet-cute) jump to uuid ^14.0.0. The uuid package has iteratively changed its CJS/ESM export surface and dropped the default-export pattern in favour of named exports in recent major releases. Any existing code that calls uuid() or uses a default import will break if that pattern was removed in v12–v14. Each plugin's usage site should be verified before merging.

},
"devDependencies": {
"@types/bun": "latest",
"@types/bun": "*",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 @types/bun version spec changed from "latest" to "*"

In package.json under devDependencies, the version range was "latest" (a dist-tag that always resolves to the newest release). The lockfile now reflects "*" (any version). While npm generally treats both as "latest", "*" can resolve to a pre-release in some package managers, and the semantic intent is different. This looks unintentional — dependabot normally preserves the declared range. Worth confirming the root package.json for the operator service still says latest or if it was silently changed.

@lalalune lalalune merged commit 0cb8493 into develop May 3, 2026
33 of 50 checks passed
@lalalune lalalune deleted the dependabot/npm_and_yarn/cloud/npm_and_yarn-8de24eb644 branch May 3, 2026 05:54
lalalune added a commit that referenced this pull request May 3, 2026
…pm_and_yarn-8de24eb644

chore(deps): bump the npm_and_yarn group across 14 directories with 15 updates
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

connector dependencies javascript Pull requests that update Javascript code plugins

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant