chore(deps): bump the minor-and-patch group with 7 updates

DE
2d ago
+766-301

Bumps the minor-and-patch group with 7 updates:

PackageFromTo
@anthropic-ai/sdk0.72.10.137.0
@fast-check/vitest0.2.40.5.0
@hono/mcp0.1.50.3.2
@tanstack/ai-openai0.3.00.31.0
@tanstack/ai0.3.00.71.0
tsdown0.17.20.23.2
unplugin-unused0.5.60.6.0

Updates @anthropic-ai/sdk from 0.72.1 to 0.137.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.137.0

Features

  • api: add org webhook endpoints and user profile enforcement events

Chores

  • ci: run the changelog check on a standard runner
  • tests: make credential tests independent of the caller's environment

sdk-v0.136.0

Features

  • api: add data_refreshed_at and has_more to analytics report pages
  • api: add workspace rate-limit updates to the Admin API
  • api: make User Profiles generally available
  • client: yield server-sent events with unrecognized event names
  • tools: accept every tool definition field in the tool helpers

Bug Fixes

  • client: treat x-amz-security-token as a sensitive header
  • tools: keep $ sequences literal in memory tool str_replace

Chores

  • ci: skip the changelog check on draft pull requests
  • docs: add credential expiry descriptions to the Managed Agents API reference
  • docs: add Messages API request descriptions
  • docs: correct plugin manifest_version and reach descriptions
  • docs: improve Managed Agents memory store descriptions
  • docs: improve Managed Agents vault and credential descriptions
  • internal: bump playwright-core in the browser ecosystem tests
  • tests: cover OpenTelemetry failures, propagation and environment variables

sdk-v0.135.0

Features

  • api: add between_tools to thinking types in model capabilities
  • api: add the speed parameter and usage.speed to Messages
  • api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

  • client: close streams dropped without being read to the end
  • client: keep an unread JSONL response open while it is held

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.137.0 (2026-10-20)

Features

  • api: add org webhook endpoints and user profile enforcement events

Chores

  • ci: run the changelog check on a standard runner
  • tests: make credential tests independent of the caller's environment

0.136.0 (2026-10-20)

Features

  • api: add data_refreshed_at and has_more to analytics report pages
  • api: add workspace rate-limit updates to the Admin API
  • api: make User Profiles generally available
  • client: yield server-sent events with unrecognized event names
  • tools: accept every tool definition field in the tool helpers

Bug Fixes

  • client: treat x-amz-security-token as a sensitive header
  • tools: keep $ sequences literal in memory tool str_replace

Chores

  • ci: skip the changelog check on draft pull requests
  • docs: add credential expiry descriptions to the Managed Agents API reference
  • docs: add Messages API request descriptions
  • docs: correct plugin manifest_version and reach descriptions
  • docs: improve Managed Agents memory store descriptions
  • docs: improve Managed Agents vault and credential descriptions
  • internal: bump playwright-core in the browser ecosystem tests
  • tests: cover OpenTelemetry failures, propagation and environment variables

0.135.0 (2026-10-15)

Features

  • api: add between_tools to thinking types in model capabilities
  • api: add the speed parameter and usage.speed to Messages
  • api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

... (truncated)

Commits
  • 9c65624 release: 0.137.0
  • 04151db Merge pull request #970 from anthropics/synced/published
  • 5aae8ce feat(api): add org webhook endpoints and user profile enforcement events
  • 261ead0 codegen metadata
  • 20d7c14 codegen metadata
  • a7736e6 chore(ci): run the changelog check on a standard runner
  • 48ecaa4 Merge branch 'main'
  • accbdd8 release: packages/aws-sdk 0.9.0, packages/bedrock-sdk 0.36.0, packages/vertex...
  • b00aefc Merge pull request #968 from anthropics/synced/published
  • 521ffc1 Merge branch 'main'
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates @fast-check/vitest from 0.2.4 to 0.5.0

Release notes

Sourced from @​fast-check/vitest's releases.

Fix declaration of the script

[Code][Diff]

Fixes

  • (PR#5706) Bug: Add node shebang on script
  • (PR#5807) CI: Update tsconfig to ES2020

Drop support to fast-check v3

[Code][Diff]

Fixes

  • (PR#5769) Clean: Drop support for v3 of fast-check

Support for plugins and for Vitest v5

[Code][Diff]

Features

  • (PR#7219) Support plugin API of fast-check
  • (PR#7244) Support Vitest 5

Typos in the changelog

[Code][Diff]

Fixes

  • (PR#5401) Doc: Fix typos in CHANGELOG.md

Support fast-check v4

[Code][Diff]

Fixes

  • (PR#5810) CI: Update tsconfig to common config
  • (PR#5793) Dependencies: Add support for fast-check v4

Rework our testing stack

[Code][Diff]

Fixes

Rework our testing stack

[Code][Diff]

... (truncated)

Changelog

Sourced from @​fast-check/vitest's changelog.

0.5.0

Support for plugins and for Vitest v5 [Code][Diff]

Features

  • (PR#7219) Support plugin API of fast-check
  • (PR#7244) Support Vitest 5

0.4.1

Support test.each [Code][Diff]

Fixes

  • (PR#6804) Bug: Fix runtime exception with test.each
  • (PR#6865) Test: Strip AI env vars in child processes

0.4.0

Move to modern APIs introduced by vitest 4.1 [Code][Diff]

Features

  • (PR#6766) Get rid of deprecated vitest/suite imports

Fixes

  • (PR#6812) Doc: Document requirements for 0.4.0

0.3.0

Support beforeEach/afterEach hooks and ESM-only bundle [Code][Diff]

Breaking changes

  • (PR#6499) Drop CommonJS support
  • (PR#6504) Drop useless "typesVersions"
  • (PR#6695) Support for beforeEach/afterEach in @fast-check/vitest

Fixes

... (truncated)

Commits

Updates @hono/mcp from 0.1.5 to 0.3.2

Release notes

Sourced from @​hono/mcp's releases.

@​hono/mcp@​0.3.2

Patch Changes

@​hono/mcp@​0.3.1

Patch Changes

@​hono/mcp@​0.3.0

Minor Changes

  • #1774 9575cbc4b8b32bb1605a465a414a9728f1a6ef9b Thanks @​bookernath! - relax Accept header validation to accept application/json, text/event-stream, or */* individually, improving compatibility with Gemini CLI, Java MCP SDK, Open WebUI, and curl. Add strictAcceptHeader option for strict MCP spec compliance.

@​hono/mcp@​0.2.5

Patch Changes

@​hono/mcp@​0.2.4

Patch Changes

Changelog

Sourced from @​hono/mcp's changelog.

0.3.2

Patch Changes

0.3.1

Patch Changes

0.3.0

Minor Changes

  • #1774 9575cbc4b8b32bb1605a465a414a9728f1a6ef9b Thanks @​bookernath! - relax Accept header validation to accept application/json, text/event-stream, or */* individually, improving compatibility with Gemini CLI, Java MCP SDK, Open WebUI, and curl. Add strictAcceptHeader option for strict MCP spec compliance.

0.2.5

Patch Changes

0.2.4

Patch Changes

0.2.3

Patch Changes

0.2.2

Patch Changes

0.2.1

Patch Changes

0.2.0

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/mcp since your current version.


Updates @tanstack/ai-openai from 0.3.0 to 0.31.0

Changelog

Sourced from @​tanstack/ai-openai's changelog.

0.31.0

Minor Changes

  • #1837 824ee98 - Add computer use that runs the same code on OpenAI and on Anthropic. A driver controls the machine. The Playwright and sandbox drivers give each thread its own machine.

    New packages:

    • @tanstack/ai-computer-use adds createComputerUse(). It returns tools, a middleware, a safety-check interrupt, and close. Each threadId gets its own machine, action queue, and approvals. A thread that stays idle for idleTimeout (10 minutes by default) closes.
    • @tanstack/ai-computer-playwright adds playwrightComputer(), which opens one browser page for each thread. createPlaywrightComputerDriver() controls one page that you give it. Both add a navigate tool that opens http: and https: URLs.
    • @tanstack/ai-computer-sandbox adds sandboxComputer(), which creates one Linux desktop sandbox for each thread from any @tanstack/ai-sandbox provider, like e2bSandbox({ template: 'desktop' }). createSandboxComputerDriver() controls one sandbox that you give it.
    • @tanstack/ai-computer-local adds localComputer(), which lets the model use the mouse, keyboard, and main screen of the machine that runs chat(). It works on Windows, macOS, and Linux with @jitsi/robotjs.

    Changes in existing packages:

    • @tanstack/ai adds threadId to ToolExecutionContext. It also adds the computer tool metadata reader in @tanstack/ai/adapter-internals.
    • @tanstack/ai-anthropic and @tanstack/openai-base send the generic computer tool to the model as the native computer tool of the provider.
    • @tanstack/ai-openai marks the models that support the computer tool.
    const computerUse = createComputerUse({
  driver: playwrightComputer({ startUrl: 'https://tanstack.com' }),
})

    chat({
adapter,
messages,
threadId,
tools: computerUse.tools,
middleware: [computerUse.middleware],
interrupts: [computerUse.interrupt],
})
    

    await computerUse.close(threadId) // one thread
await computerUse.close() // every thread, and the browser

    The ai-core agent skill routes computer use to @tanstack/ai-computer-use and its three drivers.

  • #1837 824ee98 - computerUseTool({ type: 'computer' }) adds the computer tool of the newer OpenAI models, for example gpt-6.1-sol. The tool name is computer. Each call has the batched actions of the model and the pending_safety_checks, and the replay sends the actions back as they came. computerUseTool({ type: 'computer_use_preview', ... }) for the computer-use-preview model works as before. The Responses tool choice type also accepts computer. Computer screenshots now go out with detail: 'original', as in OpenAI's computer use guide.

Patch Changes

0.30.1

Patch Changes

... (truncated)

Commits
  • 928dfde ci: Version Packages (#1841)
  • 824ee98 feat(ai-computer-use, ai-computer-playwright, ai-computer-sandbox, ai-compute...
  • 7095ebb ci: Version Packages (#1749)
  • 293aea9 ci: Version Packages (#1699)
  • 20954cc feat(openai-base, ai-openai): work with GitHub Copilot and a ChatGPT plan tok...
  • b881627 fix(ai, openai-base, adapters): a watching ChatClient ends each run, a chunk ...
  • 7532b2b feat(ai, adapters)!: chat({ reasoning }) with per-model levels in model-meta ...
  • cef1911 feat(ai, adapters): automatic prompt caching and mid-conversation changes (#1...
  • 1bfcee3 feat(ai, adapters): keep block order and replay history across models (#1698)
  • 3920a88 ci: Version Packages (#1693)
  • Additional commits viewable in compare view

Updates @tanstack/ai from 0.3.0 to 0.71.0

Release notes

Sourced from @​tanstack/ai's releases.

@​tanstack/ai@​0.71.0

Minor Changes

  • #1837 824ee98 - Add computer use that runs the same code on OpenAI and on Anthropic. A driver controls the machine. The Playwright and sandbox drivers give each thread its own machine.

    New packages:

    • @tanstack/ai-computer-use adds createComputerUse(). It returns tools, a middleware, a safety-check interrupt, and close. Each threadId gets its own machine, action queue, and approvals. A thread that stays idle for idleTimeout (10 minutes by default) closes.
    • @tanstack/ai-computer-playwright adds playwrightComputer(), which opens one browser page for each thread. createPlaywrightComputerDriver() controls one page that you give it. Both add a navigate tool that opens http: and https: URLs.
    • @tanstack/ai-computer-sandbox adds sandboxComputer(), which creates one Linux desktop sandbox for each thread from any @tanstack/ai-sandbox provider, like e2bSandbox({ template: 'desktop' }). createSandboxComputerDriver() controls one sandbox that you give it.
    • @tanstack/ai-computer-local adds localComputer(), which lets the model use the mouse, keyboard, and main screen of the machine that runs chat(). It works on Windows, macOS, and Linux with @jitsi/robotjs.

    Changes in existing packages:

    • @tanstack/ai adds threadId to ToolExecutionContext. It also adds the computer tool metadata reader in @tanstack/ai/adapter-internals.
    • @tanstack/ai-anthropic and @tanstack/openai-base send the generic computer tool to the model as the native computer tool of the provider.
    • @tanstack/ai-openai marks the models that support the computer tool.
    const computerUse = createComputerUse({
  driver: playwrightComputer({ startUrl: 'https://tanstack.com' }),
})

    chat({
adapter,
messages,
threadId,
tools: computerUse.tools,
middleware: [computerUse.middleware],
interrupts: [computerUse.interrupt],
})
    

    await computerUse.close(threadId) // one thread
await computerUse.close() // every thread, and the browser

    The ai-core agent skill routes computer use to @tanstack/ai-computer-use and its three drivers.

Changelog

Sourced from @​tanstack/ai's changelog.

0.71.0

Minor Changes

  • #1837 824ee98 - Add computer use that runs the same code on OpenAI and on Anthropic. A driver controls the machine. The Playwright and sandbox drivers give each thread its own machine.

    New packages:

    • @tanstack/ai-computer-use adds createComputerUse(). It returns tools, a middleware, a safety-check interrupt, and close. Each threadId gets its own machine, action queue, and approvals. A thread that stays idle for idleTimeout (10 minutes by default) closes.
    • @tanstack/ai-computer-playwright adds playwrightComputer(), which opens one browser page for each thread. createPlaywrightComputerDriver() controls one page that you give it. Both add a navigate tool that opens http: and https: URLs.
    • @tanstack/ai-computer-sandbox adds sandboxComputer(), which creates one Linux desktop sandbox for each thread from any @tanstack/ai-sandbox provider, like e2bSandbox({ template: 'desktop' }). createSandboxComputerDriver() controls one sandbox that you give it.
    • @tanstack/ai-computer-local adds localComputer(), which lets the model use the mouse, keyboard, and main screen of the machine that runs chat(). It works on Windows, macOS, and Linux with @jitsi/robotjs.

    Changes in existing packages:

    • @tanstack/ai adds threadId to ToolExecutionContext. It also adds the computer tool metadata reader in @tanstack/ai/adapter-internals.
    • @tanstack/ai-anthropic and @tanstack/openai-base send the generic computer tool to the model as the native computer tool of the provider.
    • @tanstack/ai-openai marks the models that support the computer tool.
    const computerUse = createComputerUse({
  driver: playwrightComputer({ startUrl: 'https://tanstack.com' }),
})

    chat({
adapter,
messages,
threadId,
tools: computerUse.tools,
middleware: [computerUse.middleware],
interrupts: [computerUse.interrupt],
})
    

    await computerUse.close(threadId) // one thread
await computerUse.close() // every thread, and the browser

    The ai-core agent skill routes computer use to @tanstack/ai-computer-use and its three drivers.

0.70.0

Minor Changes

  • #1723 1d0f8f1 - Subagent limits, and provider keys for agents.

    • subagents.limits: maxDepth, maxConcurrent, maxCalls, and timeoutMs for the whole tree of children the model starts through tools. The tree shares one budget (SubagentBudget), which a child's ctx.chat({ subagents }) passes on, so a child cannot reset it. A refused start reaches the model as a tool error.
    • subagents.keys and ctx.keys (ProviderKeys: get, require, and adapter). Pass an object by provider id, for example { openai: userKey }, or a function, for example (provider) => getByokKey(request, provider). An agent builds a keyedAdapter with await ctx.keys.adapter(adapter). A missing key falls back to the provider's env names. When there is no key at all, the call throws an error that names the env var. A child's ctx.chat({ subagents }) passes the keys on to its own children. Keys that the child sets itself win for those providers.

  • #1723 1d0f8f1 - A subagent can now return a plain value and call any activity.

    • defineAgent's run can return a promise of any value, such as an image result. The value arrives on SUBAGENT_FINISHED.result, and the parent model gets it as the tool result. A very long string inside an object result (for example a base64 image) reaches the parent model as a short note (compactForModel). A string result also streams as the child's text. The result of ctx.chat({ stream: false }) streams like the chat stream.
    • run gets the activities on ctx (ctx.chat, ctx.generateImage, ctx.generateVideo, and the rest), which fill in the thread id, a run id, and the abort signal. ctx.forward holds the fields for a plain chat() call. The optional produces field says what an agent makes.
    • A host can set subagents.binding (SubagentBinding) to add chat and generation middleware to every activity call of a child. A child's ctx.chat({ subagents }) passes it down to its own children.
    • Children inherit the prompt cache retention of the parent call.

... (truncated)

Commits
  • 928dfde ci: Version Packages (#1841)
  • 824ee98 feat(ai-computer-use, ai-computer-playwright, ai-computer-sandbox, ai-compute...
  • 7095ebb ci: Version Packages (#1749)
  • 85c2956 feat(openai-base, ai-openrouter, ai-groq, ai-utils): send json_object when st...
  • 4298480 fix(ai): keep REASONING_MESSAGE_START metadata on the assistant message (#1789)
  • f68da51 fix(ai): file each model call on its own assistant message (#1776)
  • 5f95dbd fix(ai): report evaluate usage when answer mapping fails (#1742)
  • 30fa651 fix(ai, ai-persistence): close subagent budget and continue edges (#1786)
  • 3170517 feat(ai): check tool input after approval edits and middleware, just before i...
  • 1d0f8f1 feat(ai, ai-persistence): subagent results, run context, limits, keys, and fo...
  • Additional commits viewable in compare view

Updates tsdown from 0.17.2 to 0.23.2

Release notes

Sourced from tsdown's releases.

v0.23.2

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v0.23.1

   🐞 Bug Fixes

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

  • config:
    • bundle: false → unbundle: true; bundle: true can be removed
    • outExtension → outExtensions
    • publicDir / --public-dir → copy / --copy
    • removeNodeProtocol: true → nodeProtocol: 'strip'
    • injectStyle → css.inject
  • deps:
    • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
    • skipNodeModulesBundle: true → deps.neverBundle: true
    • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
  • dts:
    • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
    • dts.oxc: true → dts.generator: 'oxc'
    • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
    • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
    • Custom languages, including vue, now throw when combined with an incompatible generator
    • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
  • attw:
    • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
  • programmatic API:
    • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
  • requirements:
    • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
    • rolldown-plugin-dts now requires Rolldown 1.2.x
    • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

... (truncated)

Commits

Updates unplugin-unused from 0.5.6 to 0.6.0

Release notes

Sourced from unplugin-unused's releases.

v0.6.0

   🚨 Breaking Changes

  • Drop support for Node.js versions below 22.18.0  -  by @​sxzz (a5d3f)
    View changes on GitHub

v0.5.7

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps seven dependencies in the minor-and-patch group, updating the version catalogs and lockfile.

Migration

  • tsdown 0.23.0 renames several config options (bundle: false → unbundle: true, outExtension → outExtensions, and more) and requires Node ^22.18.0 || ^24.11.0 || >=26.0.0.
  • @fast-check/vitest 0.5.0 drops fast-check v3 and requires vitest ^4.1.0 || ^5.0.0.
  • @hono/mcp 0.3.0 relaxes Accept header validation, adds a strictAcceptHeader option, and now requires hono-rate-limiter and zod peers.
  • unplugin-unused 0.6.0 drops support for Node versions below 22.18.0.