Skip to content

chore: bump the npm-dependencies group with 11 updates - #48

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-9edbbf0be8
Closed

chore: bump the npm-dependencies group with 11 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-9edbbf0be8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 11 updates:

Package From To
@ai-sdk/devtools 0.0.24 1.0.4
@ai-sdk/anthropic 3.0.96 4.0.12
@ai-sdk/google 3.0.91 4.0.12
@ai-sdk/openai 3.0.84 4.0.11
@nx/js 22.7.7 23.0.2
@tanstack/intent 0.0.44 0.3.5
@types/node 25.9.5 26.1.1
ai 6.0.224 7.0.22
nx 22.7.7 23.0.2
typescript 6.0.3 7.0.2
vite 6.4.3 8.1.4

Updates @ai-sdk/devtools from 0.0.24 to 1.0.4

Release notes

Sourced from @​ai-sdk/devtools's releases.

@​ai-sdk/devtools@​1.0.4

Patch Changes

  • c29e0d7: chore (devtools): remove leftover module field from package.json (dual CJS/ESM publishing was removed in AI SDK 7)
Changelog

Sourced from @​ai-sdk/devtools's changelog.

1.0.4

Patch Changes

  • c29e0d7: chore (devtools): remove leftover module field from package.json (dual CJS/ESM publishing was removed in AI SDK 7)

1.0.3

Patch Changes

  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3

1.0.2

Patch Changes

  • 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
  • Updated dependencies [5c5c0f5]
    • @​ai-sdk/provider@​4.0.2

1.0.1

Patch Changes

  • Updated dependencies [0274f34]
    • @​ai-sdk/provider@​4.0.1

1.0.0

Major Changes

  • 1949571: feat(ai): make experimental_telemetry stable
  • 6542d93: feat(ai): change naming nomenclature for *TelemetryIntegration to *Telemetry
  • cf93359: feat(ai): remove/refactor event data sent via callbacks
  • 116c89f: feat(ai): remove telemetry data from the user-facing event data
  • 8359612: Start v7 pre-release

Patch Changes

  • 19736ee: feat(ai): rename onStepFinish to onStepEnd
  • 4757690: feat(ai): rename onObjectStepFinish to onObjectStepEnd
  • 7bf7d7f: feat(ai): enable:true for telemetry by default
  • b567a6c: dependency updates
  • ddfcdc7: Fix ToolItem expand/collapse logic: chevron now shows whenever there's expandable content (parameters or description), expanded view shows full description plus parameters, collapsed view shows truncated description only.
  • b05f5ee: fix: bump hono to ^4.12.25 to resolve CVE-2026-54290 (CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard)
  • ee7bb67: fix(devtools): add pointer cursor to DevTools buttons
  • 98627e5: feat(ai): remove onChunk event from telemetry
  • 29d8cf4: feat(ai): rename the core-event types
  • 32ce45c: fix(devtools): secure devtools viewer api access

... (truncated)

Commits

Updates @ai-sdk/anthropic from 3.0.96 to 4.0.12

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/anthropic@​4.0.12

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod
Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.12

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod

4.0.11

Patch Changes

  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

4.0.10

Patch Changes

  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6

4.0.9

Patch Changes

  • 2e45d9c: fix(anthropic): wrap invalid tool input in object

4.0.8

Patch Changes

  • 0aa0ff3: fix(anthropic): forward thinking: { type: 'disabled' } to the API instead of stripping it

    Previously, setting providerOptions.anthropic.thinking = { type: 'disabled' } (or top-level reasoning: 'none') was accepted by the schema but silently dropped from the outgoing request. For models that default thinking on (e.g. Sonnet 5), this left thinking enabled and could consume a small max_tokens budget entirely. The disabled value is now sent to the Anthropic Messages API.

4.0.7

Patch Changes

  • 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
  • Updated dependencies [5c5c0f5]
    • @​ai-sdk/provider@​4.0.2
    • @​ai-sdk/provider-utils@​5.0.5

4.0.6

Patch Changes

  • c6f5e62: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose secureJsonParse from provider-utils.
  • 679c52a: Normalize a bare https://api.anthropic.com base URL to include /v1.

... (truncated)

Commits

Updates @ai-sdk/google from 3.0.91 to 4.0.12

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​4.0.12

Patch Changes

  • e40118c: Forward text file references as documents when using the Google Interactions API.
Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.12

Patch Changes

  • e40118c: Forward text file references as documents when using the Google Interactions API.

4.0.11

Patch Changes

  • 17d66c5: Fix Google tool result conversion to send file data as inline data instead of JSON text on the legacy tool-result path.
  • 96d40bc: Expand standalone Google threshold provider options into safety settings.
  • 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation
  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

4.0.10

Patch Changes

  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6

4.0.9

Patch Changes

  • 7401c2c: Pass documented Gemini external HTTPS file URLs through without downloading them.

4.0.8

Patch Changes

  • 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
  • Updated dependencies [5c5c0f5]
    • @​ai-sdk/provider@​4.0.2
    • @​ai-sdk/provider-utils@​5.0.5

4.0.7

Patch Changes

  • c6f5e62: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose secureJsonParse from provider-utils.
  • bd8d172: Fix Google embedding batch size to respect the Gemini API limit of 100 requests per batch.
  • Updated dependencies [c6f5e62]
    • @​ai-sdk/provider-utils@​5.0.4

4.0.6

... (truncated)

Commits

Updates @ai-sdk/openai from 3.0.84 to 4.0.11

Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.11

Patch Changes

  • b2b1bb9: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls

4.0.10

Patch Changes

  • fdb6d5d: feat(provider/openai,provider/gateway): add gpt-5.6 model ids
  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

4.0.9

Patch Changes

  • ac306ed: Fix StreamingToolCallTracker finalizing streaming tool calls on parsable partial JSON. Tool calls now only finalize during stream flush, restoring the behavior of #13137: a parsable argument buffer can still be the prefix of a longer argument string, so finalizing early could act on truncated tool inputs.
  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6

4.0.8

Patch Changes

  • b51ed36: Send inline image file parts in OpenAI chat requests as data URLs instead of bare base64 strings.

4.0.7

Patch Changes

  • 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
  • Updated dependencies [5c5c0f5]
    • @​ai-sdk/provider@​4.0.2
    • @​ai-sdk/provider-utils@​5.0.5

4.0.6

Patch Changes

  • Updated dependencies [c6f5e62]
    • @​ai-sdk/provider-utils@​5.0.4

4.0.5

Patch Changes

  • Updated dependencies [8c616f0]

... (truncated)

Commits

Updates @nx/js from 22.7.7 to 23.0.2

Release notes

Sourced from @​nx/js's releases.

23.0.2 (2026-07-10)

🚀 Features

  • core: re-add isCacheableTask helper (#36177)

🩹 Fixes

  • bundling: prevent TS6059 when an app imports a workspace lib from source (#36217, #35017)
  • core: prefer module.registerHooks to avoid DEP0205 deprecation warning (#36081)
  • core: prevent nx migrate crash when include=optional filters out the target package (#36087)
  • core: make nx migrate honor preapproved packages and emit a valid temp workspace (#36086)
  • core: skip daemon project-graph recompute on no-op file rewrites (#36082)
  • core: prevent the TUI from auto-selecting a completed task when a batch finishes (#35833)
  • core: deregister pseudo-terminal exit handlers when tasks finish (#36115)
  • core: prevent path traversal / zip-slip in self-hosted remote cache (#36116)
  • core: respect explicit --nxCloud=skip for AI agents in create-nx-workspace (#36131)
  • core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#36132, #36116)
  • core: throw actionable error when pnpm .modules.yaml is missing (#35666, #35635)
  • core: support ${configDir} in tsconfig path alias resolution (#36037, #35804)
  • core: prevent non-npm devEngines pin from breaking npm registry lookups (#36020, #35815)
  • core: clarify nx sync remediation messaging and surface spinner output in non-tty (#35747)
  • core: exclude direct-dependency overrides from generated package.json (#36040, #35675)
  • core: apply target defaults when project.json overrides an inferred run-commands target with different commands (#36142, #36067)
  • core: run the nx.bat wrapper for dot-nx setup on windows (#36048)
  • core: speed up bun lockfile parsing (#36198)
  • core: set NX_CLI_SET in batch worker processes (#36214, #36210)
  • core: preserve comments in catalog YAML updates (#35733)
  • core: box JsonFileSet payload to keep HashInstruction small (#36247, #35248, #36244, #36152)
  • core: share workspace fileset hash results instead of deep-cloning per task (#36244, #34971, #34942)
  • core: replace per-input visited clones with undo-log scoping in hash planner (#36248, #35071, #36152, #34971, #36244, #35248, #36247)
  • core: intern hash instructions in a pool and plan with id lists (#36249, #35071, #36152, #36248)
  • core: detect Codex sandbox on Linux to disable daemon and plugin isolation (#36273)
  • devkit: restore prettier v2 support in formatFiles (#36193)
  • graph: prevent project details web view top from being clipped (#36154)
  • js: prevent doubled output paths in buildable library path mappings (#36138, #36079)
  • js: scope incremental type-check .tsbuildinfo per project (#36137, #36113)
  • js: preserve npm allowScripts allowlist in pruned package.json (#36016, #35931)
  • js: resolve catalog references in pruned package.json output (#35805, #35419)
  • js: avoid import locator unicode position panic (#36133, #36128)
  • js: prevent Windows TS6059 rootDir errors in tsc builds (#36184, #35696)
  • js: wait for process tree exit when stopping node executor tasks (#36230)
  • linter: update terminal cli regex for local-dist build (#36201, #36199)
  • maven: de-flake maven e2e by dropping -X debug forks and widening timeout (#36091)
  • misc: bump axios to 1.16.1 (#36120)
  • misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
  • misc: remove duplicate nx init cloud-prompt telemetry event (#36145)
  • nx-cloud: use standard utm params on cloud prompt links (#36227, #36226)
  • nx-dev: remove empty SaaS and Mobile template filters (#36085)
  • react: reserve ports in rspack e2e test to avoid default port collisions (#36090)

... (truncated)

Commits
  • 569f2ec fix(js): wait for process tree exit when stopping node executor tasks (#36230)
  • 6cceec8 fix(js): prevent Windows TS6059 rootDir errors in tsc builds (#36184)
  • 9382b07 fix(devkit): restore prettier v2 support in formatFiles (#36193)
  • 453df7d chore(repo): migrate to nx 23.1.0-beta.4 (#36122)
  • 5f893e9 fix(js): resolve catalog references in pruned package.json output (#35805)
  • 877b241 fix(js): preserve npm allowScripts allowlist in pruned package.json (#36016)
  • ec59132 fix(js): scope incremental type-check .tsbuildinfo per project (#36137)
  • b7df1dd fix(js): prevent doubled output paths in buildable library path mappings (#36...
  • 462f598 fix(js): correct inferred tsbuildinfo output path when rootDir is set (#36011)
  • 71bbc70 feat(core): revert array-shape targetDefaults support pending redesign and re...
  • Additional commits viewable in compare view

Updates @tanstack/intent from 0.0.44 to 0.3.5

Release notes

Sourced from @​tanstack/intent's releases.

@​tanstack/intent@​0.3.5

Patch Changes

  • #194 e885566 - Fix setup, setup-github-actions, meta, and scaffold failing with "No templates directory found" / "Meta-skills directory not found" in the published package. getMetaDir hardcoded ../../meta, which is correct for the src/commands/ source layout but overshoots to @tanstack/meta from the flat dist/ layout the build ships. Walk up to the first meta/ directory instead so resolution works in both layouts (and symlinked installs).

  • #191 3620cca - Tighten skill-source identity to (kind, id) instead of name alone: workspace:foo no longer authorizes an npm-installed foo (and vice versa) in intent.skills, the "declared but not discovered" notice, and skill loading via intent load.

@​tanstack/intent@​0.3.4

Patch Changes

  • #190 45c863d - Improve the maintainer skill-authoring workflow:

    - Add `validate --set-version <version>`, which stamps `metadata.library_version` across matched skills via YAML surgery (preserving comments, line endings, and body) and then re-validates.
- Correct the `generate-skill` meta-skill so it no longer emits slash-path `name` values that fail validation, and the `skill-staleness-check` meta-skill so it points at the real `intent stale` command instead of a non-existent script.

  • #188 2a25b36 - Refuse to load a Yarn PnP runtime resolved from within node_modules; only a project root or ancestor .pnp.cjs is trusted.

@​tanstack/intent@​0.3.3

Patch Changes

  • #185 b7920e9 - Fix intent list suppressing the allow-all risk warning.

    When intent.skills is set to allow-all ("*"), intent list --no-notices and INTENT_NO_NOTICES=1 no longer hide the warning that all skill sources are permitted. This banner is a security-relevant signal, not a migration tip, so it's now excluded from suppression while other notices remain suppressible as before.

  • #187 fb3c08b - Fix potential hangs on slow or large environments:

    • Bound the npm registry staleness check with a request timeout so intent list and other staleness checks can't hang indefinitely on a slow or unreachable registry.
    • Bound global package-manager detection with a command timeout so it can't hang indefinitely when the environment's global node_modules is slow to resolve.
    • Avoid enumerating a workspace package's entire skill tree just to check whether it has any skills, reducing filesystem work in large monorepos.

@​tanstack/intent@​0.3.2

Patch Changes

  • #180 d67a5d6 - Add proactive skill catalogs to installed Intent hooks.

    intent hooks install now installs session-start catalog hooks for supported agents alongside the existing edit gate. Agents see the allowed local Intent skills at session start, resume, clear, and compact where the agent supports those lifecycle events, then still need to run intent load before editing.

    The generated hook loads the catalog through the Intent CLI with agent audience redaction instead of importing package code from the target repository.

@​tanstack/intent@​0.3.1

Patch Changes

  • #176 5419b02 - Add agent-safe hidden skill source handling to intent list.

    intent list now detects agent sessions with std-env and redacts unlisted allowlist candidates from agent-facing output. Agents see allowed skills plus a count-only hidden-source notice, while intent list --show-hidden reveals hidden source names only outside agent sessions.

    Agent-mode JSON output includes hiddenSourceCount but leaves hiddenSources empty, preventing structured output from leaking package names that could be added to package.json#intent.skills.

@​tanstack/intent@​0.3.0

Minor Changes

... (truncated)

Commits
  • 6039a26 ci: changeset release (#192)
  • e885566 fix(intent): walk up to meta/ instead of hardcoded depth (#194)
  • 3620cca Distinguish npm and workspace sources with the same package name (#191)
  • 7e320ab ci: changeset release (#189)
  • 45c863d Improve maintainer skill-authoring DX (#190)
  • 2a25b36 Harden scanner trust boundaries: non-suppressible permit-all banner + reject ...
  • 8a25a7b ci: changeset release (#186)
  • fb3c08b perf: batch of low-risk fixes for hangs and unnecessary FS work (#187)
  • b7920e9 chore: lint cleanup and notice-suppressibility fix (#185)
  • 79902ee chore(deps): update tanstack/config digest to b313637 (#178)
  • Additional commits viewable in compare view

Updates @types/node from 25.9.5 to 26.1.1

Commits

Updates ai from 6.0.224 to 7.0.22

Release notes

Sourced from ai's releases.

ai@7.0.22

Patch Changes

  • 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

ai@7.0.21

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod
  • Updated dependencies [308a519]
  • Updated dependencies [7fe53d2]
    • @​ai-sdk/gateway@​4.0.16

ai@7.0.20

Patch Changes

  • b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
  • a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.
Changelog

Sourced from ai's changelog.

7.0.22

Patch Changes

  • 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

7.0.21

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod
  • Updated dependencies [308a519]
  • Updated dependencies [7fe53d2]
    • @​ai-sdk/gateway@​4.0.16

7.0.20

Patch Changes

  • b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
  • a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

7.0.19

Patch Changes

  • be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

  • ee55a07: Preserve tool approval signatures when approvals transition to responded.

  • aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

    • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
    • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

  • 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

  • Updated dependencies [e12411e]

  • Updated dependencies [5d894a7]

  • Updated dependencies [fdb6d5d]

  • Updated dependencies [0f93c57]

  • Updated dependencies [d25a084]

    • @​ai-sdk/gateway@​4.0.15
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

7.0.18

Patch Changes

  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6
    • @​ai-sdk/gateway@​4.0.14

... (truncated)

Commits

Updates nx from 22.7.7 to 23.0.2

Release notes

Sourced from nx's releases.

23.0.2 (2026-07-10)

🚀 Features

  • core: re-add isCacheableTask helper (#36177)

🩹 Fixes

  • bundling: prevent TS6059 when an app imports a workspace lib from source (#36217, #35017)
  • core: prefer module.registerHooks to avoid DEP0205 deprecation warning (#36081)
  • core: prevent nx migrate crash when include=optional filters out the target package (#36087)
  • core: make nx migrate honor preapproved packages and emit a valid temp workspace (#36086)
  • core: skip daemon project-graph recompute on no-op file rewrites (#36082)
  • core: prevent the TUI from auto-selecting a completed task when a batch finishes (#35833)
  • core: deregister pseudo-terminal exit handlers when tasks finish (#36115)
  • core: prevent path traversal / zip-slip in self-hosted remote cache (#36116)
  • core: respect explicit --nxCloud=skip for AI agents in create-nx-workspace (#36131)
  • core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#36132, #36116)
  • core: throw actionable error when pnpm .modules.yaml is missing (#35666, #35635)
  • core: support ${configDir} in tsconfig path alias resolution (#36037, #35804)
  • core: prevent non-npm devEngines pin from breaking npm registry lookups (#36020, #35815)
  • core: clarify nx sync remediation messaging and surface spinner output in non-tty (#35747)
  • core: exclude direct-dependency overrides from generated package.json (#36040, #35675)
  • core: apply target defaults when project.json overrides an inferred run-commands target with different commands (#36142, #36067)
  • core: run the nx.bat wrapper for dot-nx setup on windows (#36048)
  • core: speed up bun lockfile parsing (#36198)
  • core: set NX_CLI_SET in batch worker processes (#36214, #36210)
  • core: preserve comments in catalog YAML updates (#35733)
  • core: box JsonFileSet payload to keep HashInstruction small (#36247, #35248, #36244, #36152)
  • core: share workspace fileset hash results instead of deep-cloning per task (#36244, #34971, #34942)
  • core: replace per-input visited clones with undo-log scoping in hash planner (#36248, #35071, #36152, #34971, #36244, #35248, #36247)
  • core: intern hash instructions in a pool and plan with id lists (#36249, #35071, #36152, #36248)
  • core: detect Codex sandbox on Linux to disable daemon and plugin isolation (#36273)
  • devkit: restore prettier v2 support in formatFiles (#36193)
  • graph: prevent project details web view top from being clipped (#36154)
  • js: prevent doubled output paths in buildable library path mappings (#36138, #36079)
  • js: scope incremental type-check .tsbuildinfo per project (#36137, #36113)
  • js: preserve npm allowScripts allowlist in pruned package.json (#36016, #35931)
  • js: resolve catalog references in pruned package.json output (#35805, #35419)
  • js: avoid import locator unicode position panic (#36133, #36128)
  • js: prevent Windows TS6059 rootDir errors in tsc builds (#36184, #35696)
  • js: wait for process tree exit when stopping node executor tasks (#36230)
  • linter: update terminal cli regex for local-dist build (#36201, #36199)
  • maven: de-flake maven e2e by dropping -X debug forks and widening timeout (#36091)
  • misc: bump axios to 1.16.1 (#36120)
  • misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
  • misc: remove duplicate nx init cloud-prompt telemetry event (#36145)
  • nx-cloud: use standard utm params on cloud prompt links (#36227, #36226)
  • nx-dev: remove empty SaaS and Mobile template filters (#36085)
  • react: reserve ports in rspack e2e test to avoid default port collisions (#36090)

... (truncated)

Commits
  • e095537 chore(core): apply cargo fmt to tasks_list.rs
  • c02ed72 fix(core): detect Codex sandbox on Linux to disable daemon and plugin isolati...
  • a60514e docs(misc): refresh angular docs pages and fix broken angular urls (#36276)
  • 15e01d7 fix(core): intern hash instructions in a pool and plan with id lists (#36249)
  • 3524863 fix(core): replace per-input visited clones with undo-log scoping in hash pla...
  • 033a94a fix(core): share workspace fileset hash results instead of deep-cloning per t...
  • bf79d75 fix(core): box JsonFileSet payload to keep HashInstruction small (#36247)
  • fd4b65d fix(core): preserve comments in catalog YAML updates (#35733)
  • 2970003 fix(nx-cloud): use standard utm params on cloud prompt links (#36227)
  • f853ab3 cleanup(core): reduce redundant work in project graph construction (#36224)
  • Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates vite from 6.4.3 to 8.1.4

Release notes

Sourced from vite's releases.

v8.1.4

...

Description has been truncated

@dependabot
chore: bump the npm-dependencies group with 11 updates
eeca853 
Bumps the npm-dependencies group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/devtools](https://github.com/vercel/ai/tree/HEAD/packages/devtools) | `0.0.24` | `1.0.4` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `3.0.96` | `4.0.12` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `3.0.91` | `4.0.12` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.84` | `4.0.11` |
| [@nx/js](https://github.com/nrwl/nx/tree/HEAD/packages/js) | `22.7.7` | `23.0.2` |
| [@tanstack/intent](https://github.com/TanStack/intent) | `0.0.44` | `0.3.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.1.1` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.224` | `7.0.22` |
| [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx) | `22.7.7` | `23.0.2` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.3` | `8.1.4` |


Updates `@ai-sdk/devtools` from 0.0.24 to 1.0.4
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/devtools/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/devtools@1.0.4/packages/devtools)

Updates `@ai-sdk/anthropic` from 3.0.96 to 4.0.12
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.12/packages/anthropic)

Updates `@ai-sdk/google` from 3.0.91 to 4.0.12
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.12/packages/google)

Updates `@ai-sdk/openai` from 3.0.84 to 4.0.11
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.11/packages/openai)

Updates `@nx/js` from 22.7.7 to 23.0.2
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.0.2/packages/js)

Updates `@tanstack/intent` from 0.0.44 to 0.3.5
- [Release notes](https://github.com/TanStack/intent/releases)
- [Commits](https://github.com/TanStack/intent/compare/@tanstack/intent@0.0.44...@tanstack/intent@0.3.5)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `ai` from 6.0.224 to 7.0.22
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.22/packages/ai)

Updates `nx` from 22.7.7 to 23.0.2
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.0.2/packages/nx)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `vite` from 6.4.3 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@ai-sdk/devtools"
  dependency-version: 1.0.4
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.12
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.12
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.11
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@nx/js"
  dependency-version: 23.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/intent"
  dependency-version: 0.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: ai
  dependency-version: 7.0.22
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: nx
  dependency-version: 23.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 12, 2026
@socket-security

socket-security Bot commented Jul 12, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednx@​23.0.25810093100100
Updated@​ai-sdk/​openai@​3.0.84 ⏵ 4.0.11661008898100
Updated@​ai-sdk/​anthropic@​3.0.96 ⏵ 4.0.1270 -71008898100
Updated@​ai-sdk/​google@​3.0.91 ⏵ 4.0.12721008898100
Added@​nx/​js@​23.0.2771009399100
Added@​tanstack/​intent@​0.3.57810010098100
Added@​types/​node@​26.1.11001008196100
Addedvite@​8.1.4991008298100
Updatedai@​6.0.224 ⏵ 7.0.2286 +1010010099100
Added@​ai-sdk/​devtools@​1.0.48710010098100
Updatedtypescript@​6.0.3 ⏵ 7.0.294 -610089 -1100100 +10

View full report

@socket-security

socket-security Bot commented Jul 12, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @ai-sdk/devtools is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@ai-sdk/devtools@1.0.4

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ai-sdk/devtools@1.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/vite@8.1.4 → npm/@swc-node/register@1.11.1 → npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @nx/workspace is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@nx/js@23.0.2 → npm/@nx/workspace@23.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nx/workspace@23.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm nx is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/nx@23.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/nx@23.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@anandpant

anandpant commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Closing this grouped major-version update because it mixes breaking AI SDK 7, provider v4, Nx 23, TypeScript 7, Vite 8, and other incompatible upgrades. CI confirms the migration is not drop-in; these should be handled as an intentional migration rather than an automated dependency refresh.

@anandpant anandpant closed this Jul 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-9edbbf0be8 branch July 12, 2026 23:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@anandpant