Skip to content

chore(deps)(deps): bump the production-dependencies group across 1 directory with 69 updates#71

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-601bcc025f
Open

chore(deps)(deps): bump the production-dependencies group across 1 directory with 69 updates#71
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-601bcc025f

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 18, 2026

Bumps the production-dependencies group with 42 updates in the / directory:

Package From To
ajv 8.18.0 8.20.0
cosmiconfig 9.0.0 9.0.1
handlebars 4.7.8 4.7.9
@anthropic-ai/claude-code 2.1.50 2.1.143
@anthropic-ai/sdk 0.60.0 0.65.0
@babel/runtime 7.28.6 7.29.2
@borewit/text-codec 0.2.1 0.2.2
@google/genai 1.42.0 1.52.0
@modelcontextprotocol/sdk 1.26.0 1.29.0
@supabase/supabase-js 2.97.0 2.106.0
fastmcp 3.33.0 3.35.0
b4a 1.8.0 1.8.1
bare-events 2.8.2 2.8.3
bare-fs 4.5.4 4.7.1
bare-os 3.6.2 3.9.1
bare-stream 2.8.0 2.13.1
bare-url 2.3.2 2.4.3
stdin-discarder 0.1.0 0.2.2
eventsource-parser 3.0.6 3.0.8
figlet 1.10.0 1.11.0
mime-db 1.52.0 1.54.0
fs-extra 11.3.3 11.3.5
fuse.js 7.1.0 7.3.0
gaxios 7.1.3 7.1.4
get-east-asian-width 1.5.0 1.6.0
google-auth-library 10.5.0 10.6.2
hasown 2.0.2 2.0.3
is-arrayish 0.2.1 0.3.4
jsonfile 6.2.0 6.2.1
mcp-proxy 6.4.0 6.5.0
nan 2.25.0 2.27.0
node-abi 3.87.0 3.92.0
pipenet 1.4.0 1.4.2
pump 3.0.3 3.0.4
qs 6.15.0 6.15.2
side-channel-list 1.0.0 1.0.1
sql.js 1.14.0 1.14.1
strtok3 10.3.4 10.3.5
type-is 2.0.1 2.1.0
validator 13.15.26 13.15.35
ws 8.19.0 8.20.1
zod-to-json-schema 3.25.1 3.25.2

Updates ajv from 8.18.0 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

Commits

Updates cosmiconfig from 9.0.0 to 9.0.1

Changelog

Sourced from cosmiconfig's changelog.

9.0.1

  • Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
  • Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.
Commits
  • 9a5cda3 9.0.1
  • 2174017 update changelog
  • 536d4a0 Prevent race conditions when running multiple instances of cosmiconfig and ...
  • 4b48611 remove debug log
  • 53d1745 remove more EOL node versions
  • 7c1a1e3 replace resolve with realpath
  • fcc9084 add additional path.resolve for windows short paths
  • 7e995c8 debug
  • 52b6b1c drop node 14 build as it seems to fail for unreachable reasons
  • db45e38 fix tests on windows (3)
  • Additional commits viewable in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-code from 2.1.50 to 2.1.143

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.143

What's changed

  • Added plugin dependency enforcement: claude plugin disable now refuses when another enabled plugin depends on the target (with a copy-pasteable disable-chain hint), and claude plugin enable force-enables transitive dependencies
  • Added projected context cost (per-turn and per-invocation token estimates) to the /plugin marketplace browse pane
  • Added worktree.bgIsolation: "none" setting to let background sessions edit the working copy directly without EnterWorktree, for repos where worktrees are impractical
  • PowerShell tool now passes -ExecutionPolicy Bypass. Opt out with CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY=1
  • Background sessions now preserve the model and effort level you set after waking from idle
  • Shift+Tab in attached agent sessions now includes auto mode in the cycle
  • Fixed a corrupt .credentials.json with a non-array scopes value hanging the CLI on startup or silently aborting OAuth token refresh
  • Fixed right-click paste in claude agents on Windows Terminal and WSL
  • Fixed stop hooks that block repeatedly looping forever — the turn now ends with a warning after 8 consecutive blocks (override via CLAUDE_CODE_STOP_HOOK_BLOCK_CAP)
  • Fixed Esc/Ctrl+C not cancelling a pending /loop wakeup while Claude is idle between iterations
  • Fixed /goal evaluator firing while background shells or delegated subagents are still running
  • Fixed NO_COLOR/FORCE_COLOR in settings.json env stripping Claude Code's own UI colors — they now apply to subprocesses only
  • Fixed agent view spawning repeated PowerShell processes on Windows when listing sessions
  • Fixed /bg without a prompt sending "continue" to the forked session — the fork now waits for input
  • Fixed --agent <name> not finding plugin-contributed agents without the plugin: prefix
  • Fixed deleting a session from agent view not removing its transcript file
  • Fixed stale-fragment rendering when scrolling in attached background sessions on Windows Terminal
  • Fixed background agents false-positive worker-stall detection storm after host sleep or macOS App Nap
  • Fixed 5xx error messages pointing at status.claude.com instead of naming the configured gateway or cloud provider
  • The PowerShell tool is now enabled by default on Windows for Bedrock, Vertex, and Foundry users. Opt out with CLAUDE_CODE_USE_POWERSHELL_TOOL=0.
  • claude agents now accepts --add-dir, --settings, --mcp-config, and --plugin-dir and applies them to the dashboard and to background sessions dispatched from it
  • claude agents accepts --permission-mode, --model, --effort, and --dangerously-skip-permissions to set defaults for sessions dispatched from the view
  • claude --bg --dangerously-skip-permissions now persists across retire→wake
  • Fixed background sessions silently capturing IDE file references into the warm spare's input, which caused the reference to be prepended to the next prompt dispatched from claude agents
  • Worktree cleanup no longer falls back to rm -rf when git worktree remove fails, preventing loss of gitignored or in-progress files
  • Fixed background-job sessions on macOS getting "Operation not permitted" errors when reading files under ~/Documents, ~/Desktop, or ~/Downloads, even with Full Disk Access granted.
  • /bg now preserves --mcp-config, --settings, --add-dir, --plugin-dir, and --strict-mcp-config, so backgrounded sessions keep their MCP servers and settings across respawn.
  • Background sessions launched from claude agents now honor permissions.defaultMode from settings.json (was previously overridden to auto mode)
  • Fixed: on Windows, pressing ← in claude agents while a response was streaming could leave the agents list unresponsive to all input
  • /bg and ←-detach now preserve --fallback-model, so backgrounded workers degrade to the fallback model on overload instead of hard-failing.
  • /bg and ←-detach now preserve --allow-dangerously-skip-permissions, so the forked worker keeps bypass-permissions available in its Shift+Tab cycle.
  • Fixed: background daemon spawn now falls back to the running binary when the ~/.local/bin/claude launcher is missing or non-executable
  • Fixed claude agents --allow-dangerously-skip-permissions defaulting dispatched sessions to bypass mode instead of making it available in the permission cycle

v2.1.142

What's changed

  • Added new claude agents flags: --add-dir, --settings, --mcp-config, --plugin-dir, --permission-mode, --model, --effort, and --dangerously-skip-permissions to configure dispatched background sessions
  • Fast mode now uses Opus 4.7 by default (previously Opus 4.6). Set CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE=1 to pin fast mode to Opus 4.6
  • Plugins with a root-level SKILL.md and no skills/ subdirectory are now surfaced as a skill
  • The /plugin details pane and claude plugin details now show LSP servers a plugin provides
  • /web-setup warns before replacing an existing GitHub App connection
  • Fixed MCP_TOOL_TIMEOUT not raising the per-request fetch timeout for remote HTTP and SSE MCP servers, which capped tool calls at 60 seconds regardless of the configured value
  • Fixed background sessions not recognizing pre-existing git worktrees, blocking Edit while EnterWorktree refused to create a duplicate
  • Fixed background sessions disappearing and daemon reconnect failing after macOS sleep/wake — the daemon now detects clock jumps instead of treating them as elapsed idle time
  • Fixed daemon not exiting cleanly after the binary is upgraded (e.g. brew upgrade), causing dispatched agents to crash-loop on the deleted path
  • Fixed background agents crash-looping when the Claude-in-Chrome extension is connected without a shared tab

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.143

  • Added plugin dependency enforcement: claude plugin disable now refuses when another enabled plugin depends on the target (with a copy-pasteable disable-chain hint), and claude plugin enable force-enables transitive dependencies
  • Added projected context cost (per-turn and per-invocation token estimates) to the /plugin marketplace browse pane
  • Added worktree.bgIsolation: "none" setting to let background sessions edit the working copy directly without EnterWorktree, for repos where worktrees are impractical
  • PowerShell tool now passes -ExecutionPolicy Bypass. Opt out with CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY=1
  • Background sessions now preserve the model and effort level you set after waking from idle
  • Shift+Tab in attached agent sessions now includes auto mode in the cycle
  • Fixed a corrupt .credentials.json with a non-array scopes value hanging the CLI on startup or silently aborting OAuth token refresh
  • Fixed right-click paste in claude agents on Windows Terminal and WSL
  • Fixed stop hooks that block repeatedly looping forever — the turn now ends with a warning after 8 consecutive blocks (override via CLAUDE_CODE_STOP_HOOK_BLOCK_CAP)
  • Fixed Esc/Ctrl+C not cancelling a pending /loop wakeup while Claude is idle between iterations
  • Fixed /goal evaluator firing while background shells or delegated subagents are still running
  • Fixed NO_COLOR/FORCE_COLOR in settings.json env stripping Claude Code's own UI colors — they now apply to subprocesses only
  • Fixed agent view spawning repeated PowerShell processes on Windows when listing sessions
  • Fixed /bg without a prompt sending "continue" to the forked session — the fork now waits for input
  • Fixed --agent <name> not finding plugin-contributed agents without the plugin: prefix
  • Fixed deleting a session from agent view not removing its transcript file
  • Fixed stale-fragment rendering when scrolling in attached background sessions on Windows Terminal
  • Fixed background agents false-positive worker-stall detection storm after host sleep or macOS App Nap
  • Fixed 5xx error messages pointing at status.claude.com instead of naming the configured gateway or cloud provider
  • The PowerShell tool is now enabled by default on Windows for Bedrock, Vertex, and Foundry users. Opt out with CLAUDE_CODE_USE_POWERSHELL_TOOL=0.
  • claude agents now accepts --add-dir, --settings, --mcp-config, and --plugin-dir and applies them to the dashboard and to background sessions dispatched from it
  • claude agents accepts --permission-mode, --model, --effort, and --dangerously-skip-permissions to set defaults for sessions dispatched from the view
  • claude --bg --dangerously-skip-permissions now persists across retire→wake
  • Fixed background sessions silently capturing IDE file references into the warm spare's input, which caused the reference to be prepended to the next prompt dispatched from claude agents
  • Worktree cleanup no longer falls back to rm -rf when git worktree remove fails, preventing loss of gitignored or in-progress files
  • Fixed background-job sessions on macOS getting "Operation not permitted" errors when reading files under ~/Documents, ~/Desktop, or ~/Downloads, even with Full Disk Access granted.
  • /bg now preserves --mcp-config, --settings, --add-dir, --plugin-dir, and --strict-mcp-config, so backgrounded sessions keep their MCP servers and settings across respawn.
  • Background sessions launched from claude agents now honor permissions.defaultMode from settings.json (was previously overridden to auto mode)
  • Fixed: on Windows, pressing ← in claude agents while a response was streaming could leave the agents list unresponsive to all input
  • /bg and ←-detach now preserve --fallback-model, so backgrounded workers degrade to the fallback model on overload instead of hard-failing.
  • /bg and ←-detach now preserve --allow-dangerously-skip-permissions, so the forked worker keeps bypass-permissions available in its Shift+Tab cycle.
  • Fixed: background daemon spawn now falls back to the running binary when the ~/.local/bin/claude launcher is missing or non-executable
  • Fixed claude agents --allow-dangerously-skip-permissions defaulting dispatched sessions to bypass mode instead of making it available in the permission cycle

2.1.142

  • Added new claude agents flags: --add-dir, --settings, --mcp-config, --plugin-dir, --permission-mode, --model, --effort, and --dangerously-skip-permissions to configure dispatched background sessions
  • Fast mode now uses Opus 4.7 by default (previously Opus 4.6). Set CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE=1 to pin fast mode to Opus 4.6
  • Plugins with a root-level SKILL.md and no skills/ subdirectory are now surfaced as a skill
  • The /plugin details pane and claude plugin details now show LSP servers a plugin provides
  • /web-setup warns before replacing an existing GitHub App connection
  • Fixed MCP_TOOL_TIMEOUT not raising the per-request fetch timeout for remote HTTP and SSE MCP servers, which capped tool calls at 60 seconds regardless of the configured value
  • Fixed background sessions not recognizing pre-existing git worktrees, blocking Edit while EnterWorktree refused to create a duplicate
  • Fixed background sessions disappearing and daemon reconnect failing after macOS sleep/wake — the daemon now detects clock jumps instead of treating them as elapsed idle time
  • Fixed daemon not exiting cleanly after the binary is upgraded (e.g. brew upgrade), causing dispatched agents to crash-loop on the deleted path
  • Fixed background agents crash-looping when the Claude-in-Chrome extension is connected without a shared tab
  • Fixed clicking links in an attached claude agents session — the background worker's headless browser shim no longer applies while attached
  • Fixed claude agents "v to open in editor" using the daemon's default editor instead of your shell's $EDITOR/$VISUAL

... (truncated)

Commits
Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.


Updates @anthropic-ai/sdk from 0.60.0 to 0.65.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.65.0

0.65.0 (2025-09-29)

Full Changelog: sdk-v0.64.0...sdk-v0.65.0

Features

  • api: adds support for Claude Sonnet 4.5 and context management features (3f0b0fb)

Chores

  • internal: codegen related update (724a2b1)
  • internal: ignore .eslintcache (56a5f30)

sdk: v0.64.0

0.64.0 (2025-09-26)

Full Changelog: sdk-v0.63.1...sdk-v0.64.0

Features

  • toolRunner: support custom headers (ac6a7a3)

Performance Improvements

Chores

  • internal: fix incremental formatting in some cases (2bdf8ee)
  • internal: remove deprecated compilerOptions.baseUrl from tsconfig.json (2817c45)

sdk: v0.63.1

0.63.1 (2025-09-23)

Full Changelog: sdk-v0.63.0...sdk-v0.63.1

Bug Fixes

  • helpers/zod: fix compat with zod 3 (a2952e1)

Chores

  • do not install brew dependencies in ./scripts/bootstrap by default (115d81a)
  • internal: update CI (dfa991a)
  • package: lower zod peer dependency constraints (b40cfec)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.65.0 (2025-09-29)

Full Changelog: sdk-v0.64.0...sdk-v0.65.0

Features

  • api: adds support for Claude Sonnet 4.5 and context management features (3f0b0fb)

Chores

  • internal: codegen related update (724a2b1)
  • internal: ignore .eslintcache (56a5f30)

0.64.0 (2025-09-26)

Full Changelog: sdk-v0.63.1...sdk-v0.64.0

Features

  • toolRunner: support custom headers (ac6a7a3)

Performance Improvements

Chores

  • internal: fix incremental formatting in some cases (2bdf8ee)
  • internal: remove deprecated compilerOptions.baseUrl from tsconfig.json (2817c45)

0.63.1 (2025-09-23)

Full Changelog: sdk-v0.63.0...sdk-v0.63.1

Bug Fixes

  • helpers/zod: fix compat with zod 3 (a2952e1)

Chores

  • do not install brew dependencies in ./scripts/bootstrap by default (115d81a)
  • internal: update CI (dfa991a)
  • package: lower zod peer dependency constraints (b40cfec)

0.63.0 (2025-09-17)

... (truncated)

Commits
  • 293c5db chore: release main
  • b0b7200 feat(api): adds support for Claude Sonnet 4.5 and context management features
  • f994798 chore(internal): ignore .eslintcache
  • a8c35bc chore(internal): codegen related update
  • 1bb06f7 chore: release main
  • d823e52 chore(internal): fix incremental formatting in some cases
  • 8ee0c3a feat(toolRunner): support custom headers
  • ba3eadd chore(internal): remove deprecated compilerOptions.baseUrl from tsconfig.json
  • 5be54cb perf: faster formatting
  • d3be31f chore: release main
  • Additional commits viewable in compare view

Updates @babel/runtime from 7.28.6 to 7.29.2

Release notes

Sourced from @​babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • babel-preset-env
    • #17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@​JLHwung)

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

  • babel-types
  • babel-standalone

🐛 Bug Fix

  • babel-parser
  • babel-traverse
    • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

... (truncated)

Commits

Updates @borewit/text-codec from 0.2.1 to 0.2.2

Release notes

Sourced from @​borewit/text-codec's releases.

v0.2.2

Changes

🐛 Bug Fixes

  • fix: improve encoding correctness and update README @​Borewit (#36)

NPM release

NPM release: @​borewit/text-codec@0.2.2

Commits
  • c2ce9c5 0.2.2
  • e2f0705 Merge pull request #23 from Borewit/dependabot/npm_and_yarn/master/chai-6.2.2
  • 5e58cb8 Bump chai from 5.2.1 to 6.2.2
  • bc315b8 Merge pull request #37 from Borewit/update-biome
  • f32adfc Update biome to 2.4.6
  • 7776373 Merge pull request #36 from Borewit/fix-most-issue-exodus
  • 068d7d4 fix: improve encoding correctness and update README
  • See full diff in compare view

Updates @google/genai from 1.42.0 to 1.52.0

Release notes

Sourced from @​google/genai's releases.

v1.52.0

1.52.0 (2026-05-04)

Features

  • [Python] Multimodal file search (e626bef)
  • Multimodal file search (54caf6b)

v1.51.0

1.51.0 (2026-04-29)

Features

  • [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (9e08ba9)
  • Add output_info to BatchJob (5327c60)
  • Add gemini-3.1-flash-tts-preview model to options (35c941b)
  • Add ImageResizeMode for GenerateVideos (faa1088)
  • Add new Gemini Deep Research agent models (6f83a05)
  • Add Vertex Dataset input and output options for batch jobs (6aa848e)
  • interaction-api: Add grounding tool usage breakdown to Interaction Usage. (e1c31ad)
  • introduce enterprise flag and GOOGLE_GENAI_USE_ENTERPRISE env var (cf7ad52)
  • Replace the more ambiguous rate field with sample_rate. (6c80464)

v1.50.1

1.50.1 (2026-04-14)

Bug Fixes

  • Refactor Webhook types in GenAI SDKs for easier useage (5100abc)
  • Rename webhooks.retrieve to webhooks.get. (db6e771)

v1.50.0

1.50.0 (2026-04-13)

[!CAUTION] CRITICAL WARNING: Do not use this version if you are implementing or relying on webhooks. This release contains known issues regarding webhook sdk. Please use v1.51.0 or later.

Features

  • Add "eu" as a supported service location for Vertex AI platform. (2493f9c)
  • Add DeepResearchAgentConfig fields (3615ca2)
  • Add Live Avatar new fields (6a0ff96)
  • Add support for new audio MIME types: opus, alaw, and mulaw (7137f13)
  • add webhook and webhookConfig for js and python sdk (0f89605)
  • Add webhook_config to batches.create() and models.generate_videos() (894bc93)
  • Wire the webhook into python and js client. (b6c5d18)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

1.52.0 (2026-05-04)

Features

  • [Python] Multimodal file search (e626bef)
  • Multimodal file search (54caf6b)

1.51.0 (2026-04-29)

Features

  • [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (9e08ba9)
  • Add output_info to BatchJob (5327c60)
  • Add gemini-3.1-flash-tts-preview model to options (35c941b)
  • Add ImageResizeMode for GenerateVideos (faa1088)
  • Add new Gemini Deep Research agent models (6f83a05)
  • Add Vertex Dataset input and output options for batch jobs (6aa848e)
  • interaction-api: Add grounding tool usage breakdown to Interaction Usage. (e1c31ad)
  • introduce enterprise flag and GOOGLE_GENAI_USE_ENTERPRISE env var (cf7ad52)
  • Replace the more ambiguous rate field with sample_rate. (6c80464)

1.50.1 (2026-04-14)

Bug Fixes

  • Refactor Webhook types in GenAI SDKs for easier useage (5100abc)
  • Rename webhooks.retrieve to webhooks.get. (db6e771)

1.50.0 (2026-04-13)

Features

  • Add "eu" as a supported service location for Vertex AI platform. (2493f9c)
  • Add DeepResearchAgentConfig fields (3615ca2)
  • Add Live Avatar new fields (6a0ff96)
  • Add support for new audio MIME types: opus, alaw, and mulaw (7137f13)
  • add webhook and webhookConfig for js and python sdk (0f89605)
  • Add webhook_config to batches.create() and models.generate_videos() (894bc93)
  • Wire the webhook into python and js client. (b6c5d18)

1.49.0 (2026-04-08)

Features

  • Introduce TYPE_L16 audio content and optional fields. (c62cb9a)

... (truncated)

Commits
  • e8c8c44 chore(main): release 1.52.0 (#1546)
  • 50d81ca chore: [Multimodal FileSearch] Move embedding_model to body
  • 54caf6b feat: Multimodal file search
  • e626bef feat: [Python] Multimodal file search
  • 61013d6 chore(main): release 1.51.0 (#1503)
  • 8137d23 chore: add the deprecation marker back
  • 734dab0 chore: no-op
  • 006286b chore: Add page number
  • 986bbed chore: Adjust Webhook update to better reflect modifiable fields
  • e1c31ad feat(interaction-api): Add grounding tool usage breakdown to Interaction Usage.
  • Additional commits viewable in compare view
Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.


Updates @hono/node-server from 1.19.9 to 1.19.14

Release notes

Sourced from @​hono/node-server's releases.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.29.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

@dependabot
chore(deps)(deps): bump the production-dependencies group across 1 di…
a2e3029 
…rectory with 69 updates

Bumps the production-dependencies group with 42 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ajv](https://github.com/ajv-validator/ajv) | `8.18.0` | `8.20.0` |
| [cosmiconfig](https://github.com/cosmiconfig/cosmiconfig) | `9.0.0` | `9.0.1` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [@anthropic-ai/claude-code](https://github.com/anthropics/claude-code) | `2.1.50` | `2.1.143` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.60.0` | `0.65.0` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.28.6` | `7.29.2` |
| [@borewit/text-codec](https://github.com/Borewit/text-codec) | `0.2.1` | `0.2.2` |
| [@google/genai](https://github.com/googleapis/js-genai) | `1.42.0` | `1.52.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.29.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.97.0` | `2.106.0` |
| [fastmcp](https://github.com/punkpeye/fastmcp) | `3.33.0` | `3.35.0` |
| [b4a](https://github.com/holepunchto/b4a) | `1.8.0` | `1.8.1` |
| [bare-events](https://github.com/holepunchto/bare-events) | `2.8.2` | `2.8.3` |
| [bare-fs](https://github.com/holepunchto/bare-fs) | `4.5.4` | `4.7.1` |
| [bare-os](https://github.com/holepunchto/bare-os) | `3.6.2` | `3.9.1` |
| [bare-stream](https://github.com/holepunchto/bare-stream) | `2.8.0` | `2.13.1` |
| [bare-url](https://github.com/holepunchto/bare-url) | `2.3.2` | `2.4.3` |
| [stdin-discarder](https://github.com/sindresorhus/stdin-discarder) | `0.1.0` | `0.2.2` |
| [eventsource-parser](https://github.com/rexxars/eventsource-parser) | `3.0.6` | `3.0.8` |
| [figlet](https://github.com/patorjk/figlet.js) | `1.10.0` | `1.11.0` |
| [mime-db](https://github.com/jshttp/mime-db) | `1.52.0` | `1.54.0` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.3` | `11.3.5` |
| [fuse.js](https://github.com/krisk/Fuse) | `7.1.0` | `7.3.0` |
| [gaxios](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/gaxios) | `7.1.3` | `7.1.4` |
| [get-east-asian-width](https://github.com/sindresorhus/get-east-asian-width) | `1.5.0` | `1.6.0` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/google-auth-library-nodejs) | `10.5.0` | `10.6.2` |
| [hasown](https://github.com/inspect-js/hasOwn) | `2.0.2` | `2.0.3` |
| [is-arrayish](https://github.com/qix-/node-is-arrayish) | `0.2.1` | `0.3.4` |
| [jsonfile](https://github.com/jprichardson/node-jsonfile) | `6.2.0` | `6.2.1` |
| [mcp-proxy](https://github.com/punkpeye/mcp-proxy) | `6.4.0` | `6.5.0` |
| [nan](https://github.com/nodejs/nan) | `2.25.0` | `2.27.0` |
| [node-abi](https://github.com/electron/node-abi) | `3.87.0` | `3.92.0` |
| [pipenet](https://github.com/punkpeye/pipenet) | `1.4.0` | `1.4.2` |
| [pump](https://github.com/mafintosh/pump) | `3.0.3` | `3.0.4` |
| [qs](https://github.com/ljharb/qs) | `6.15.0` | `6.15.2` |
| [side-channel-list](https://github.com/ljharb/side-channel-list) | `1.0.0` | `1.0.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.0` | `1.14.1` |
| [strtok3](https://github.com/Borewit/strtok3) | `10.3.4` | `10.3.5` |
| [type-is](https://github.com/jshttp/type-is) | `2.0.1` | `2.1.0` |
| [validator](https://github.com/validatorjs/validator.js) | `13.15.26` | `13.15.35` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.1` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.1` | `3.25.2` |



Updates `ajv` from 8.18.0 to 8.20.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.18.0...v8.20.0)

Updates `cosmiconfig` from 9.0.0 to 9.0.1
- [Release notes](https://github.com/cosmiconfig/cosmiconfig/releases)
- [Changelog](https://github.com/cosmiconfig/cosmiconfig/blob/main/CHANGELOG.md)
- [Commits](cosmiconfig/cosmiconfig@v9.0.0...v9.0.1)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `@anthropic-ai/claude-code` from 2.1.50 to 2.1.143
- [Release notes](https://github.com/anthropics/claude-code/releases)
- [Changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-code@v2.1.50...v2.1.143)

Updates `@anthropic-ai/sdk` from 0.60.0 to 0.65.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.60.0...sdk-v0.65.0)

Updates `@babel/runtime` from 7.28.6 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime)

Updates `@borewit/text-codec` from 0.2.1 to 0.2.2
- [Release notes](https://github.com/Borewit/text-codec/releases)
- [Commits](Borewit/text-codec@v0.2.1...v0.2.2)

Updates `@google/genai` from 1.42.0 to 1.52.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v1.42.0...v1.52.0)

Updates `@hono/node-server` from 1.19.9 to 1.19.14
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.9...v1.19.14)

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.29.0)

Updates `@protobufjs/codegen` from 2.0.4 to 2.0.5
- [Release notes](https://github.com/dcodeIO/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dcodeIO/protobuf.js/commits/2.0.5)

Updates `@protobufjs/fetch` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/dcodeIO/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...fetch-v1.1.1)

Updates `@protobufjs/inquire` from 1.1.0 to 1.1.2
- [Release notes](https://github.com/dcodeIO/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...inquire-v1.1.2)

Updates `@protobufjs/utf8` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/dcodeIO/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...fetch-v1.1.1)

Updates `@supabase/supabase-js` from 2.97.0 to 2.106.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.106.0/packages/core/supabase-js)

Updates `agent-base` from 7.1.4 to 6.0.2
- [Release notes](https://github.com/TooTallNate/proxy-agents/releases)
- [Changelog](https://github.com/TooTallNate/proxy-agents/blob/main/packages/agent-base/CHANGELOG.md)
- [Commits](https://github.com/TooTallNate/proxy-agents/commits/get-uri@6.0.2/packages/agent-base)

Updates `fastmcp` from 3.33.0 to 3.35.0
- [Release notes](https://github.com/punkpeye/fastmcp/releases)
- [Commits](punkpeye/fastmcp@v3.33.0...v3.35.0)

Updates `xsschema` from 0.4.0-beta.5 to 0.4.4
- [Release notes](https://github.com/moeru-ai/xsai/releases)
- [Commits](https://github.com/moeru-ai/xsai/commits/v0.4.4/packages-top/xsschema)

Updates `jose` from 5.10.0 to 6.1.3
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.10.0...v6.1.3)

Updates `axios` from 1.13.5 to 1.16.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.16.1)

Updates `b4a` from 1.8.0 to 1.8.1
- [Release notes](https://github.com/holepunchto/b4a/releases)
- [Commits](holepunchto/b4a@v1.8.0...v1.8.1)

Updates `bare-events` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/holepunchto/bare-events/releases)
- [Commits](holepunchto/bare-events@v2.8.2...v2.8.3)

Updates `bare-fs` from 4.5.4 to 4.7.1
- [Release notes](https://github.com/holepunchto/bare-fs/releases)
- [Commits](holepunchto/bare-fs@v4.5.4...v4.7.1)

Updates `bare-os` from 3.6.2 to 3.9.1
- [Release notes](https://github.com/holepunchto/bare-os/releases)
- [Commits](holepunchto/bare-os@v3.6.2...v3.9.1)

Updates `bare-stream` from 2.8.0 to 2.13.1
- [Release notes](https://github.com/holepunchto/bare-stream/releases)
- [Commits](holepunchto/bare-stream@v2.8.0...v2.13.1)

Updates `bare-url` from 2.3.2 to 2.4.3
- [Release notes](https://github.com/holepunchto/bare-url/releases)
- [Commits](holepunchto/bare-url@v2.3.2...v2.4.3)

Updates `stdin-discarder` from 0.1.0 to 0.2.2
- [Release notes](https://github.com/sindresorhus/stdin-discarder/releases)
- [Commits](sindresorhus/stdin-discarder@v0.1.0...v0.2.2)

Updates `content-disposition` from 0.5.4 to 1.0.1
- [Release notes](https://github.com/jshttp/content-disposition/releases)
- [Changelog](https://github.com/jshttp/content-disposition/blob/v1.0.1/HISTORY.md)
- [Commits](jshttp/content-disposition@v0.5.4...v1.0.1)

Updates `eventsource-parser` from 3.0.6 to 3.0.8
- [Release notes](https://github.com/rexxars/eventsource-parser/releases)
- [Changelog](https://github.com/rexxars/eventsource-parser/blob/main/CHANGELOG.md)
- [Commits](rexxars/eventsource-parser@v3.0.6...v3.0.8)

Updates `express-rate-limit` from 8.2.1 to 8.5.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.2.1...v8.5.2)

Updates `fast-uri` from 3.1.0 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.2)

Updates `figlet` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/patorjk/figlet.js/releases)
- [Commits](patorjk/figlet.js@v1.10.0...v1.11.0)

Updates `file-type` from 21.3.0 to 21.3.4
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v21.3.0...v21.3.4)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `mime-db` from 1.52.0 to 1.54.0
- [Release notes](https://github.com/jshttp/mime-db/releases)
- [Changelog](https://github.com/jshttp/mime-db/blob/master/HISTORY.md)
- [Commits](jshttp/mime-db@v1.52.0...v1.54.0)

Updates `fs-extra` from 11.3.3 to 11.3.5
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.3.3...11.3.5)

Updates `fuse.js` from 7.1.0 to 7.3.0
- [Release notes](https://github.com/krisk/Fuse/releases)
- [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md)
- [Commits](krisk/Fuse@v7.1.0...v7.3.0)

Updates `gaxios` from 7.1.3 to 7.1.4
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/gaxios/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/gaxios-v7.1.4/packages/gaxios)

Updates `jackspeak` from 3.4.3 to 4.2.3
- [Changelog](https://github.com/isaacs/jackspeak/blob/main/changelog.md)
- [Commits](isaacs/jackspeak@v3.4.3...v4.2.3)

Updates `lru-cache` from 10.4.3 to 11.2.6
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v10.4.3...v11.2.6)

Updates `path-scurry` from 1.11.1 to 2.0.2
- [Changelog](https://github.com/isaacs/path-scurry/blob/main/CHANGELOG.md)
- [Commits](isaacs/path-scurry@v1.11.1...v2.0.2)

Updates `get-east-asian-width` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/sindresorhus/get-east-asian-width/releases)
- [Commits](sindresorhus/get-east-asian-width@v1.5.0...v1.6.0)

Updates `google-auth-library` from 10.5.0 to 10.6.2
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/google-auth-library-v10.6.2/packages/google-auth-library-nodejs)

Updates `hasown` from 2.0.2 to 2.0.3
- [Changelog](https://github.com/inspect-js/hasOwn/blob/main/CHANGELOG.md)
- [Commits](inspect-js/hasOwn@v2.0.2...v2.0.3)

Updates `hono` from 4.12.1 to 4.12.19
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.1...v4.12.19)

Updates `https-proxy-agent` from 7.0.6 to 5.0.1
- [Release notes](https://github.com/TooTallNate/proxy-agents/releases)
- [Changelog](https://github.com/TooTallNate/proxy-agents/blob/main/packages/https-proxy-agent/CHANGELOG.md)
- [Commits](https://github.com/TooTallNate/proxy-agents/commits/5.0.1/packages/https-proxy-agent)

Updates `ip-address` from 10.0.1 to 10.2.0
- [Commits](https://github.com/beaugunderson/ip-address/commits)

Updates `is-arrayish` from 0.2.1 to 0.3.4
- [Release notes](https://github.com/qix-/node-is-arrayish/releases)
- [Commits](Qix-/node-is-arrayish@0.2.1...0.3.4)

Updates `jsonfile` from 6.2.0 to 6.2.1
- [Changelog](https://github.com/jprichardson/node-jsonfile/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-jsonfile@6.2.0...6.2.1)

Updates `koa` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v3.1.1...v3.2.0)

Updates `mcp-proxy` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/punkpeye/mcp-proxy/releases)
- [Commits](punkpeye/mcp-proxy@v6.4.0...v6.5.0)

Updates `nan` from 2.25.0 to 2.27.0
- [Changelog](https://github.com/nodejs/nan/blob/main/CHANGELOG.md)
- [Commits](nodejs/nan@v2.25.0...v2.27.0)

Updates `node-abi` from 3.87.0 to 3.92.0
- [Release notes](https://github.com/electron/node-abi/releases)
- [Commits](electron/node-abi@v3.87.0...v3.92.0)

Updates `protobufjs` from 6.11.4 to 6.11.6
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@v6.11.4...v6.11.6)

Updates `path-to-regexp` from 8.3.0 to 8.4.2
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.2)

Updates `pipenet` from 1.4.0 to 1.4.2
- [Release notes](https://github.com/punkpeye/pipenet/releases)
- [Commits](punkpeye/pipenet@v1.4.0...v1.4.2)

Updates `proxy-from-env` from 1.1.0 to 2.1.0
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.1.0)

Updates `pump` from 3.0.3 to 3.0.4
- [Commits](mafintosh/pump@v3.0.3...v3.0.4)

Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)

Updates `side-channel-list` from 1.0.0 to 1.0.1
- [Changelog](https://github.com/ljharb/side-channel-list/blob/main/CHANGELOG.md)
- [Commits](ljharb/side-channel-list@v1.0.0...v1.0.1)

Updates `sql.js` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.0...v1.14.1)

Updates `streamx` from 2.23.0 to 2.25.0
- [Commits](mafintosh/streamx@v2.23.0...v2.25.0)

Updates `strtok3` from 10.3.4 to 10.3.5
- [Release notes](https://github.com/Borewit/strtok3/releases)
- [Commits](Borewit/strtok3@v10.3.4...v10.3.5)

Updates `type-is` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/jshttp/type-is/releases)
- [Commits](jshttp/type-is@2.0.1...v2.1.0)

Updates `undici` from 7.22.0 to 7.25.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.25.0)

Updates `validator` from 13.15.26 to 13.15.35
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.15.26...13.15.35)

Updates `ws` from 8.19.0 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.20.1)

Updates `yaml` from 2.8.2 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.9.0)

Updates `zod-to-json-schema` from 3.25.1 to 3.25.2
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: cosmiconfig
  dependency-version: 9.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/claude-code"
  dependency-version: 2.1.143
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.65.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@babel/runtime"
  dependency-version: 7.29.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@borewit/text-codec"
  dependency-version: 0.2.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@google/genai"
  dependency-version: 1.52.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.14
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.29.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@protobufjs/codegen"
  dependency-version: 2.0.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@protobufjs/fetch"
  dependency-version: 1.1.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@protobufjs/inquire"
  dependency-version: 1.1.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@protobufjs/utf8"
  dependency-version: 1.1.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.106.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: agent-base
  dependency-version: 6.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: fastmcp
  dependency-version: 3.35.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: xsschema
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.1.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: b4a
  dependency-version: 1.8.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: bare-events
  dependency-version: 2.8.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: bare-fs
  dependency-version: 4.7.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-os
  dependency-version: 3.9.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-stream
  dependency-version: 2.13.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-url
  dependency-version: 2.4.3
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: stdin-discarder
  dependency-version: 0.2.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: content-disposition
  dependency-version: 1.0.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: eventsource-parser
  dependency-version: 3.0.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.5.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: figlet
  dependency-version: 1.11.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: file-type
  dependency-version: 21.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mime-db
  dependency-version: 1.54.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fs-extra
  dependency-version: 11.3.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fuse.js
  dependency-version: 7.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gaxios
  dependency-version: 7.1.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jackspeak
  dependency-version: 4.2.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lru-cache
  dependency-version: 11.2.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: path-scurry
  dependency-version: 2.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: get-east-asian-width
  dependency-version: 1.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-auth-library
  dependency-version: 10.6.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hasown
  dependency-version: 2.0.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.19
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: https-proxy-agent
  dependency-version: 5.0.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ip-address
  dependency-version: 10.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: is-arrayish
  dependency-version: 0.3.4
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: jsonfile
  dependency-version: 6.2.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: koa
  dependency-version: 3.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mcp-proxy
  dependency-version: 6.5.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: nan
  dependency-version: 2.27.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: node-abi
  dependency-version: 3.92.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: protobufjs
  dependency-version: 6.11.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: path-to-regexp
  dependency-version: 8.4.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pipenet
  dependency-version: 1.4.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: proxy-from-env
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pump
  dependency-version: 3.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: side-channel-list
  dependency-version: 1.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sql.js
  dependency-version: 1.14.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: streamx
  dependency-version: 2.25.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: strtok3
  dependency-version: 10.3.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: type-is
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 7.25.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: validator
  dependency-version: 13.15.35
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 18, 2026

Assignees

The following users could not be added as assignees: llm-dev-ops/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 18, 2026

🔒 Security Scan Results

Scan Type Status
Dependency Scan ⚠️ failure
CodeQL Analysis ✅ success
Secret Scan ✅ success
License Check ⚠️ failure
SAST ⚠️ failure

⚠️ Some security scans have warnings or failed. Please review the details.

Automated security scanning by GitHub Actions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants