Skip to content

fix(deps): update all non-major dependencies - #57

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#57
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@ai-sdk/openai (source) 3.0.9 → 3.0.97 age confidence dependencies patch
@ai-sdk/valibot (source) 2.0.5 → 2.0.47 age confidence dependencies patch
@biomejs/biome (source) 2.3.14 → 2.5.9 age confidence devDependencies minor
@cloudflare/vitest-pool-workers (source) ^0.12.0 → ^0.21.0 age confidence devDependencies minor
@cloudflare/workers-types 4.20260113.0 → 4.20260702.1 age confidence devDependencies minor
@crxjs/vite-plugin (source) 2.3.0 → 2.7.1 age confidence devDependencies minor
@fontsource-variable/inter (source) 5.2.8 → 5.3.0 age confidence dependencies minor
@fontsource/geist-mono (source) 5.2.7 → 5.3.0 age confidence dependencies minor
@playwright/test (source) 1.57.0 → 1.62.1 age confidence devDependencies minor
@radix-ui/react-avatar (source) 1.1.11 → 1.2.6 age confidence dependencies minor
@radix-ui/react-checkbox (source) 1.3.3 → 1.3.11 age confidence dependencies patch
@radix-ui/react-collapsible (source) 1.1.12 → 1.1.20 age confidence dependencies patch
@radix-ui/react-context-menu (source) 2.2.16 → 2.3.7 age confidence dependencies minor
@radix-ui/react-dialog (source) 1.1.15 → 1.1.23 age confidence dependencies patch
@radix-ui/react-dropdown-menu (source) 2.1.16 → 2.1.24 age confidence dependencies patch
@radix-ui/react-label (source) 2.1.8 → 2.1.15 age confidence dependencies patch
@radix-ui/react-popover (source) 1.1.15 → 1.1.23 age confidence dependencies patch
@radix-ui/react-progress (source) 1.1.8 → 1.1.16 age confidence dependencies patch
@radix-ui/react-scroll-area (source) 1.2.10 → 1.2.18 age confidence dependencies patch
@radix-ui/react-select (source) 2.2.6 → 2.3.7 age confidence dependencies minor
@radix-ui/react-separator (source) 1.1.8 → 1.1.15 age confidence dependencies patch
@radix-ui/react-slot (source) 1.2.4 → 1.3.3 age confidence dependencies minor
@radix-ui/react-switch (source) 1.2.6 → 1.3.7 age confidence dependencies minor
@radix-ui/react-tabs (source) 1.1.13 → 1.1.21 age confidence dependencies patch
@radix-ui/react-tooltip (source) 1.2.8 → 1.2.16 age confidence dependencies patch
@tailwindcss/vite (source) 4.1.18 → 4.3.3 age confidence devDependencies minor
@tanstack/devtools-vite (source) ^0.5.0 → ^0.8.0 age confidence devDependencies minor
@tanstack/react-devtools (source) ^0.9.0 → ^0.10.0 age confidence devDependencies minor
@tanstack/react-form (source) 1.27.7 → 1.33.5 age confidence dependencies minor
@tanstack/react-query (source) 5.90.16 → 5.101.4 age confidence dependencies minor
@tanstack/react-router (source) 1.156.0 → 1.170.29 age confidence dependencies minor
@tanstack/react-router-devtools (source) 1.156.0 → 1.167.1 age confidence devDependencies minor
@tanstack/router-plugin (source) 1.156.0 → 1.168.32 age confidence devDependencies minor
@testing-library/react 16.3.1 → 16.3.2 age confidence devDependencies patch
@types/chrome (source) ^0.1.32 → ^0.2.0 age confidence devDependencies minor
@types/node (source) 25.0.7 → 25.9.5 age confidence devDependencies minor
@types/react (source) 19.2.8 → 19.2.18 age confidence devDependencies patch
@types/react-dom (source) 19.2.3 → 19.2.4 age confidence devDependencies patch
@typescript-eslint/eslint-plugin (source) 8.53.0 → 8.67.0 age confidence devDependencies minor
@typescript-eslint/parser (source) 8.53.0 → 8.67.0 age confidence devDependencies minor
@uiw/react-heat-map (source) 2.3.3 → 2.3.4 age confidence dependencies patch
@valibot/to-json-schema (source) 1.5.0 → 1.7.1 age confidence dependencies minor
@vitejs/plugin-react (source) 5.1.2 → 5.2.0 age confidence devDependencies minor
ai (source) 6.0.30 → 6.0.257 age confidence dependencies patch
ai-gateway-provider (source) 3.0.2 → 3.2.0 age confidence dependencies minor
better-auth-cloudflare ^0.2.9 → ^0.3.0 age confidence dependencies minor
date-fns 4.1.0 → 4.4.0 age confidence dependencies minor
drizzle-kit (source) 0.31.8 → 0.31.10 age confidence devDependencies patch
eslint (source) 9.39.2 → 9.39.5 age confidence devDependencies patch
eslint-import-resolver-typescript 4.4.4 → 4.4.5 age confidence devDependencies patch
eslint-plugin-boundaries 5.3.1 → 5.4.0 age confidence devDependencies minor
filepond (source) 4.32.11 → 4.32.12 age confidence dependencies patch
jsdom 28.0.0 → 28.1.0 age confidence devDependencies minor
lucide-react (source) ^0.563.0 → ^0.577.0 age confidence dependencies minor
miniflare (source) 4.20260107.0 → 4.20260730.0 age confidence pnpm.overrides minor
node (source) 24.13.0 → 24.19.0 age confidence volta minor
pnpm (source) 10.28.2 → 10.34.5 age confidence packageManager minor
react (source) 19.2.3 → 19.2.8 age confidence dependencies patch
react-day-picker (source) 9.13.0 → 9.14.0 age confidence dependencies minor
react-dom (source) 19.2.3 → 19.2.8 age confidence dependencies patch
recharts 3.6.0 → 3.10.1 age confidence dependencies minor
sonner (source) 2.0.7 → 2.0.8 age confidence dependencies patch
tailwind-merge 3.4.0 → 3.6.0 age confidence dependencies minor
tailwindcss (source) 4.1.18 → 4.3.3 age confidence devDependencies minor
tsx (source) 4.21.0 → 4.23.12 age confidence devDependencies minor
valibot (source) 1.2.0 → 1.4.2 age confidence dependencies minor
wrangler (source) 4.59.1 → 4.123.0 age confidence devDependencies minor

Release Notes

vercel/ai (@​ai-sdk/openai)

v3.0.97

Compare Source

Patch Changes

v3.0.96

Compare Source

Patch Changes
  • 64facff: Reconstruct provider-executed shell calls when continuing OpenAI Responses with storage disabled.

v3.0.95

Compare Source

Patch Changes
  • bdb46fe: Avoid duplicate MCP approval request references when continuing stored OpenAI Responses.

v3.0.94

Compare Source

Patch Changes
  • d3247d7: Keep client-executed function calls paired with their outputs when chaining OpenAI Responses with a previous response ID.
  • Updated dependencies [b2a4d5a]

v3.0.93

Compare Source

Patch Changes
  • f471a1c: Accept serviceTier: 'fast' on OpenAI chat and responses models. OpenAI renamed priority processing to Fast mode and accepts service_tier: 'fast' and 'priority' interchangeably, so 'fast' is now passed through verbatim and gated on the same model capability as 'priority'.
  • Updated dependencies [2171d15]

v3.0.92

Compare Source

Patch Changes

v3.0.91

Compare Source

Patch Changes

v3.0.90

Compare Source

Patch Changes

v3.0.89

Compare Source

Patch Changes
  • 23632b1: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.

v3.0.88

Compare Source

Patch Changes
  • 8100830: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.

v3.0.87

Compare Source

Patch Changes
  • 2f11af1: Preserve stored tool search output item IDs from provider metadata.

v3.0.86

Compare Source

Patch Changes

v3.0.85

Compare Source

Patch Changes

v3.0.84

Compare Source

Patch Changes
  • 356918c: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls

v3.0.83

Compare Source

v3.0.82

Compare Source

v3.0.81

Compare Source

v3.0.80

Compare Source

Patch Changes

v3.0.79

Compare Source

Patch Changes

v3.0.78

Compare Source

Patch Changes
  • 64a701d: Return a helpful error when the Responses stream parser receives Chat Completions chunks.

v3.0.77

Compare Source

Patch Changes

v3.0.76

Compare Source

Patch Changes

v3.0.75

Compare Source

Patch Changes

v3.0.74

Compare Source

Patch Changes
  • 466544d: feat(openai): add orchestration token usage details to Responses API usage

v3.0.73

Compare Source

Patch Changes
  • 1274c07: fix(provider/openai): send client-executed tool calls as full function_call items in the Responses API so they pair with their function_call_output by call_id

v3.0.72

Compare Source

Patch Changes

v3.0.71

Patch Changes

v3.0.69

Compare Source

Patch Changes
  • 9a55f6d: feat(openai): add namespaces for tool definitions

v3.0.68

Compare Source

Patch Changes

  • c65c952: fix(openai): round-trip namespace on function_call input items

    When tool_search dispatches a deferred tool, the resulting function_call carries a namespace field identifying which deferred-tool group the model picked. #14789 preserved this on the read side (providerMetadata.openai.namespace), but the write side still serialized function_call input items without namespace. Multi-step / multi-turn conversations then failed with Missing namespace for function_call '<name>'. ... Round-trip the model's function_call item with its namespace field included.

    convert-to-openai-responses-input.ts now reads namespace from providerOptions.openai.namespace (or providerMetadata.openai.namespace) on tool-call parts and includes it on the serialized function_call item, mirroring how itemId is round-tripped.

v3.0.67

Compare Source

Patch Changes
  • c679fec: feat(provider/azure):web search tool in the Azure OpenAI Responses API.

v3.0.66

Compare Source

Patch Changes
  • c82ab42: feat(openai): forward web_search_call.action.queries from Responses API

v3.0.65

Compare Source

Patch Changes
  • eb52378: fix(openai): skip passing reasoning items when using previous response id

v3.0.64

Compare Source

Patch Changes
  • b7ed8bd: feat(openai): add opt-in pass-through for unsupported file media types

v3.0.63

Compare Source

Patch Changes

v3.0.62

Compare Source

Patch Changes
  • 65edcca: feat: add allowedTools provider option for OpenAI Responses

v3.0.61

Compare Source

Patch Changes
  • b93f9b4: feat(provider/openai): forward imageDetail providerOptions on tool-result image content

v3.0.60

Compare Source

Patch Changes
  • 6dcd8e6: feat(openai): add GPT-5.5 chat model IDs

v3.0.59

Compare Source

Patch Changes
  • 38966ab: fix(openai, openai-compatible): only send null content for assistant messages with tool calls

v3.0.58

Compare Source

Patch Changes
  • 2370948: feat(openai): preserve namespace on function_call output items

v3.0.57

Compare Source

Patch Changes
  • d33e7cc: chore(provider/openai): add type for image model options for type-safe processing

v3.0.55

Compare Source

Patch Changes

v3.0.54

Compare Source

Patch Changes

v3.0.53

Compare Source

Patch Changes
  • 953385d: fix(openai): default undefined tool-call input to empty object before serializing tool arguments

v3.0.52

Compare Source

Patch Changes
  • d42076d: Add AI Gateway hint to provider READMEs

v3.0.51

Compare Source

Patch Changes

v3.0.50

Compare Source

Patch Changes

v3.0.49

Patch Changes
  • bc01093: fix(openai): support file-url parts in tool output content

v3.0.48

Patch Changes

  • 9c548de: Add gpt-5.4-mini, gpt-5.4-mini-2026-03-17, gpt-5.4-nano, and gpt-5.4-nano-2026-03-17 models.

  • bcb04df: fix(openai): preserve raw finish reason for failed responses stream events

    Handle response.failed chunks in Responses API streaming so finishReason.raw is preserved from incomplete_details.reason (e.g. max_output_tokens), and map failed-without-reason cases to unified error instead of other.

v3.0.47

Patch Changes

v3.0.46

Patch Changes
  • 75fc0e7: feat(openai): add new tool search tool

v3.0.45

Patch Changes
  • 023088c: feat(provider/openai): add gpt-5.3-chat-latest

v3.0.44

Patch Changes
  • f4a734a: fix(provider/openai): drop reasoning parts without encrypted content when store: false

v3.0.43

Patch Changes

v3.0.42

Patch Changes
  • 2589004: feat(provider/openai): add GPT-5.4 model support

v3.0.41

Patch Changes

v3.0.40

Patch Changes

v3.0.39

Patch Changes

v3.0.38

Patch Changes
  • 64a8fae: chore: remove obsolete model IDs for Anthropic, Google, OpenAI, xAI

v3.0.37

Patch Changes

v3.0.36

Patch Changes

  • 53bdfa5: fix(openai): allow null/undefined type in streaming tool call deltas

    Azure AI Foundry and Mistral deployed on Azure omit the type field in
    streaming tool_calls deltas. The chat stream parser now accepts a missing
    type field (treating it as "function") instead of throwing
    InvalidResponseDataError: Expected 'function' type.

    Fixes #​12770

v3.0.35

Patch Changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​radix-ui/​react-label@​2.1.151001006698100
Added@​radix-ui/​react-separator@​1.1.151001006698100
Added@​radix-ui/​react-progress@​1.1.161001006898100
Updated@​radix-ui/​react-slot@​1.2.3 ⏵ 1.3.3100 +110069 +198100
Added@​radix-ui/​react-avatar@​1.2.6991006998100
Added@​radix-ui/​react-collapsible@​1.1.20991006998100
Added@​radix-ui/​react-tabs@​1.1.21991007098100
Added@​radix-ui/​react-switch@​1.3.7991007098100
Added@​radix-ui/​react-checkbox@​1.3.11991007198100
Added@​radix-ui/​react-dropdown-menu@​2.1.24991007198100
Added@​radix-ui/​react-popover@​1.1.23991007198100
Added@​radix-ui/​react-context-menu@​2.3.71001007198100
Added@​radix-ui/​react-dialog@​1.1.23991007198100
Added@​typescript-eslint/​parser@​8.67.01001007298100
Added@​radix-ui/​react-tooltip@​1.2.16991007298100
Added@​radix-ui/​react-scroll-area@​1.2.18991007298100
Added@​ai-sdk/​openai@​3.0.97731008898100
Added@​radix-ui/​react-select@​2.3.7991007398100
Added@​tanstack/​react-router-devtools@​1.167.1741007697100
Added@​types/​react-dom@​19.2.41001007588100
Added@​tanstack/​devtools-vite@​0.8.31001007698100
Added@​tanstack/​router-plugin@​1.168.32991007898100
Added@​types/​react@​19.2.181001007992100
Added@​types/​chrome@​0.2.61001007996100
Added@​ai-sdk/​valibot@​2.0.47951007998100
Added@​typescript-eslint/​eslint-plugin@​8.67.0991008098100
Added@​cloudflare/​vitest-pool-workers@​0.21.3991008096100
Added@​types/​node@​25.9.51001008195100
Addedtsx@​4.23.121001008194100
Addedsonner@​2.0.81001008385100
Addedbetter-auth-cloudflare@​0.3.18310010090100
Added@​valibot/​to-json-schema@​1.7.110010010083100
See 32 more rows in the dashboard

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 20 times, most recently from dcf78d4 to 033a411 Compare April 25, 2026 17:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 9f368fc to abc438e Compare April 29, 2026 21:36
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 1a7bad6 to c91c888 Compare May 5, 2026 18:49
@socket-security

socket-security Bot commented May 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm eslint-plugin-boundaries is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/eslint-plugin-boundaries@5.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-boundaries@5.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: packages/web/package.json → npm/jsdom@28.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@28.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm rollup is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@crxjs/vite-plugin@2.7.1 → npm/rollup@2.80.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@2.80.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from c23fdd9 to 166f465 Compare May 11, 2026 22:27
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from c386f7b to dc2c62e Compare July 23, 2026 02:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants