chore(deps)(deps): bump the production-dependencies group across 1 directory with 81 updates

[dependabot]

Bumps the production-dependencies group with 65 updates in the / directory:

Package	From	To
ajv	8.18.0	8.20.0
cosmiconfig	9.0.0	9.0.2
handlebars	4.7.8	4.7.9
js-yaml	4.1.1	4.3.0
@anthropic-ai/claude-code	2.1.50	2.1.220
@babel/code-frame	7.29.0	7.29.7
@babel/runtime	7.28.6	7.29.7
@borewit/text-codec	0.2.1	0.2.2
@google/genai	1.42.0	1.52.0
@hono/node-server	1.19.9	1.19.17
@modelcontextprotocol/sdk	1.26.0	1.29.0
@protobufjs/codegen	2.0.4	2.0.5
@protobufjs/eventemitter	1.1.0	1.1.1
@protobufjs/fetch	1.1.0	1.1.1
@protobufjs/inquire	1.1.0	1.1.2
@protobufjs/utf8	1.1.0	1.1.2
@supabase/supabase-js	2.97.0	2.110.8
fastmcp	3.33.0	3.35.0
axios	1.13.5	1.18.1
b4a	1.8.0	1.8.1
bare-events	2.8.2	2.9.1
bare-fs	4.5.4	4.7.4
bare-os	3.6.2	3.9.3
bare-path	3.0.0	3.1.1
bare-stream	2.8.0	2.13.3
bare-url	2.3.2	2.4.6
body-parser	2.2.2	2.3.0
chardet	2.1.1	2.2.0
es-object-atoms	1.1.1	1.1.2
eventsource-parser	3.0.6	3.1.0
express-rate-limit	8.2.1	8.6.1
fast-uri	3.1.0	3.1.4
figlet	1.10.0	1.11.3
file-type	21.3.0	21.3.4
form-data	4.0.5	4.0.6
fs-extra	11.3.3	11.4.0
fuse.js	7.1.0	7.5.0
gaxios	7.1.3	7.3.0
gcp-metadata	8.1.2	8.1.4
get-east-asian-width	1.5.0	1.6.0
google-auth-library	10.5.0	10.9.1
hono	4.12.1	4.12.32
http-proxy-middleware	3.0.5	3.0.7
iconv-lite	0.7.2	0.7.3
jsonfile	6.2.0	6.2.1
koa	3.1.1	3.2.1
mcp-proxy	6.4.0	6.5.4
media-typer	1.1.0	1.1.1
nan	2.25.0	2.28.0
node-abi	3.87.0	3.94.0
protobufjs	6.11.4	6.11.6
path-to-regexp	8.3.0	8.4.2
pipenet	1.4.0	1.4.2
pump	3.0.3	3.0.4
range-parser	1.2.1	1.3.0
tar-fs	2.1.4	2.1.5
sql.js	1.14.0	1.14.1
strtok3	10.3.4	10.3.5
undici	7.22.0	7.29.0
validator	13.15.26	13.15.35
ws	8.19.0	8.21.1
yaml	2.8.2	2.9.0
yargs	18.0.0	18.1.0
yoctocolors	2.1.2	2.2.0
zod-to-json-schema	3.25.1	3.25.2

Updates ajv from 8.18.0 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

• fix: add support for node 22/24, drop node 16/21 by @​jasoniangreen in ajv-validator/ajv#2580
• fix: add ES2022.RegExp for RegExpIndicesArray by @​SignpostMarv in ajv-validator/ajv#2604

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

• fix prototype pollution via format keyword using $data ref by @​epoberezkin in ajv-validator/ajv#2607

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

Commits

• 0fba0b8 8.20.0
• 9caf8d6 fix: add ES2022.RegExp for RegExpIndicesArray; fixes ajv-validator/ajv#2603 (...
• 2065350 fix: add support for node 22/24, drop node 16/21 (#2580)
• 154b58d 8.19.0
• e8d2bdc test/fix prototype pollution via $data ref with format keyword (#2607)
• See full diff in compare view

Updates cosmiconfig from 9.0.0 to 9.0.2

Changelog

Sourced from cosmiconfig's changelog.

9.0.2

• Fixed a prototype chain issue that may happen when merging different config objects.
• Fixed the project search strategy not correctly stopping at the package boundary.

9.0.1

• Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
• Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.

Commits

• See full diff in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5
  • GHSA-2w6w-674q-4c4q
  • GHSA-3mfm-83xf-c92r
  • GHSA-xhpv-hc6g-r9c6
  • GHSA-xjpj-3mr7-gcpf
  • GHSA-9cx6-37pm-9jff
  • GHSA-2qvq-rjwj-gvw9
  • GHSA-7rx3-28cr-v5wh
  • GHSA-442j-39wm-28r2

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5

Commits

Commits

• dce542c v4.7.9
• 8a41389 Update release notes
• 68d8df5 Fix security issues
• b2a0831 Fix browser tests
• 9f98c16 Fix release script
• 45443b4 Revert "Improve partial indenting performance"
• 8841a5f Fix CI errors with linting
• e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
• e914d60 Improve rendering performance
• 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
• Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• Additional commits viewable in compare view

Updates @anthropic-ai/claude-code from 2.1.50 to 2.1.220

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.220

What's changed

• Bug fixes and reliability improvements

v2.1.219

What's changed

• Added Claude Opus 5 (claude-opus-5), now the default Opus model — 1M context, fast mode at $10/$50 per Mtok
• Added sandbox.network.strictAllowlist setting to deny non-allowlisted hosts for sandboxed commands without prompting
• Added DirectoryAdded hook that fires after /add-dir or the SDK register_repo_root control request registers a new working directory mid-session
• Added mcp_server_errors to the headless stream-json init event, listing --mcp-config entries skipped by config validation; terminal runs print a startup warning
• Added the workflowSizeGuideline settings key so the advisory Dynamic workflow size guideline can be set from any settings file; the /config row is hidden while one does
• Added nested subagent forwarding in stream-json: subagents spawned at depth-2+ now appear when --forward-subagent-text is set, keyed by their spawning Agent tool_use id
• Fixed claude -p text output dropping the answer already produced when a turn dies on a mid-stream API error
• Added HTTP status and error text to claude mcp list and /mcp when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace
• Fixed a permission you approved while a self-hosted runner was restarting being dropped when the session resumed, so the approved action now runs
• Fixed the Fable model row showing "Requires usage credits" for plans that include it, when a stale cache had baked the label in
• Fixed a SIGTERM arriving while a self-hosted runner was starting up leaving a stale active row until the lease expired; it now deregisters cleanly
• Added structured failure categories to self-hosted runner spawn and session failures, so hook errors, runner crashes and config errors can be told apart
• Fixed the /model picker showing the merged Opus row as plain "Opus" instead of "Opus (1M context)"
• Fixed copy-on-select inside GNU screen printing base64 into the terminal instead of copying the selection
• Fixed Remote Control clients keeping a stale fast-mode status after a model switch, reconnect, or failed org check
• Fixed CLAUDE_CODE_GIT_BASH_PATH on Windows exiting or being used as bash when the path isn't a bash/sh binary; it's now ignored with a warning
• Fixed Vim mode: pressing ← on an empty prompt now returns to the agent view from NORMAL mode, not just INSERT
• Fixed screen-reader mode rewriting the entire input line on every keystroke instead of echoing only the typed character
• Improved the "Remote Control is only available via api.anthropic.com" error to name the specific setting that caused it
• Improved claude --teleport to show which repo your current checkout points at when it doesn't match the session's repo
• Changed dynamic workflows to default to a medium size guideline (aim for fewer than 15 agents); pick another size or unrestricted with Dynamic workflow size in /config
• Changed managed MCP allowlist/denylist ${VAR} entries to resolve from the startup environment and managed-settings env instead of settings-file env
• Changed the /model picker to highlight only the newest model's name, so the highlight marks the new release rather than an arbitrary subset of the list
• Added the current default workflow size to the running-workflow status line, with a pointer to /config for changing it
• Removed Opus 4.7 from fast mode; /fast now applies to Opus 5 and Opus 4.8
• Updated the claude-api skill to default to Claude Opus 5, with a migration path from Opus 4.8
• Subagents can now spawn nested subagents up to depth 3 by default (was 1); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to disable nesting

v2.1.218

What's changed

• Changed /code-review to run as a background subagent, so review work no longer fills your conversation and keeps stacked slash commands as its review target
• Added screen-reader announcements of deleted text for word and line deletions (Option+Delete, Ctrl+W, Cmd+Backspace, Ctrl+U, Ctrl+K) in --ax-screen-reader mode
• Fixed Windows paths with \u-prefixed segments (like C:\Users\unicorn) being corrupted into CJK characters in tool inputs, which made those files inaccessible
• Fixed the left arrow key discarding the conversation with no undo: presses right after editing now ask to confirm, and Esc in the agent view returns to the conversation it backgrounded
• Added HTTP status and error text to claude mcp list and /mcp when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace
• Fixed multi-line paste collapsing into one line with j in place of newlines in terminals that encode pasted newlines as Ctrl+J
• Fixed /context reporting stale pre-compact token usage after compacting from the message picker
• Fixed /ultrareview failing on descriptive arguments like "review my auth changes" — they now run a review of your current branch with the text applied as a note to the findings
• Fixed /code-review ultra silently running a local review in non-interactive sessions — it now launches the cloud review
• Fixed gateway spend metering to price Bedrock application-inference-profile ARNs and other config-mapped upstream model IDs at the configured model's rates
• Fixed mojibake when a long IDE selection was truncated mid-emoji, and a case where a tool executor error could be silently dropped

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.220

• Bug fixes and reliability improvements

2.1.219

• Added Claude Opus 5 (claude-opus-5), now the default Opus model — 1M context, fast mode at $10/$50 per Mtok
• Added sandbox.network.strictAllowlist setting to deny non-allowlisted hosts for sandboxed commands without prompting
• Added DirectoryAdded hook that fires after /add-dir or the SDK register_repo_root control request registers a new working directory mid-session
• Added mcp_server_errors to the headless stream-json init event, listing --mcp-config entries skipped by config validation; terminal runs print a startup warning
• Added the workflowSizeGuideline settings key so the advisory Dynamic workflow size guideline can be set from any settings file; the /config row is hidden while one does
• Added nested subagent forwarding in stream-json: subagents spawned at depth-2+ now appear when --forward-subagent-text is set, keyed by their spawning Agent tool_use id
• Fixed claude -p text output dropping the answer already produced when a turn dies on a mid-stream API error
• Added HTTP status and error text to claude mcp list and /mcp when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace
• Fixed the Fable model row showing "Requires usage credits" for plans that include it, when a stale cache had baked the label in
• Fixed the /model picker showing the merged Opus row as plain "Opus" instead of "Opus (1M context)"
• Fixed copy-on-select inside GNU screen printing base64 into the terminal instead of copying the selection
• Fixed Remote Control clients keeping a stale fast-mode status after a model switch, reconnect, or failed org check
• Fixed CLAUDE_CODE_GIT_BASH_PATH on Windows exiting or being used as bash when the path isn't a bash/sh binary; it's now ignored with a warning
• Fixed Vim mode: pressing ← on an empty prompt now returns to the agent view from NORMAL mode, not just INSERT
• Fixed screen-reader mode rewriting the entire input line on every keystroke instead of echoing only the typed character
• Improved the "Remote Control is only available via api.anthropic.com" error to name the specific setting that caused it
• Improved claude --teleport to show which repo your current checkout points at when it doesn't match the session's repo
• Changed dynamic workflows to default to a medium size guideline (aim for fewer than 15 agents); pick another size or unrestricted with Dynamic workflow size in /config
• Changed managed MCP allowlist/denylist ${VAR} entries to resolve from the startup environment and managed-settings env instead of settings-file env
• Changed the /model picker to highlight only the newest model's name, so the highlight marks the new release rather than an arbitrary subset of the list
• Added the current default workflow size to the running-workflow status line, with a pointer to /config for changing it
• Removed Opus 4.7 from fast mode; /fast now applies to Opus 5 and Opus 4.8
• Updated the claude-api skill to default to Claude Opus 5, with a migration path from Opus 4.8
• Subagents can now spawn nested subagents up to depth 3 by default (was 1); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to disable nesting

2.1.218

• Changed /code-review to run as a background subagent, so review work no longer fills your conversation and keeps stacked slash commands as its review target
• Added screen-reader announcements of deleted text for word and line deletions (Option+Delete, Ctrl+W, Cmd+Backspace, Ctrl+U, Ctrl+K) in --ax-screen-reader mode
• Fixed Windows paths with \u-prefixed segments (like C:\Users\unicorn) being corrupted into CJK characters in tool inputs, which made those files inaccessible
• Fixed the left arrow key discarding the conversation with no undo: presses right after editing now ask to confirm, and Esc in the agent view returns to the conversation it backgrounded
• Fixed multi-line paste collapsing into one line with j in place of newlines in terminals that encode pasted newlines as Ctrl+J
• Fixed /context reporting stale pre-compact token usage after compacting from the message picker
• Fixed /ultrareview failing on descriptive arguments like "review my auth changes" — they now run a review of your current branch with the text applied as a note to the findings
• Fixed /code-review ultra silently running a local review in non-interactive sessions — it now launches the cloud review
• Fixed gateway spend metering to price Bedrock application-inference-profile ARNs and other config-mapped upstream model IDs at the configured model's rates
• Fixed mojibake when a long IDE selection was truncated mid-emoji, and a case where a tool executor error could be silently dropped
• Fixed an engine teardown race that could start and abandon a phantom turn, and made input pushed after close consistently rejected
• Fixed spurious "[Request interrupted by user]" messages after interrupted tool calls, and an unpaired tool_use block left in the transcript when a tool aborted mid-response
• Fixed VoiceOver reading "new line" instead of echoing the typed space at the end of the input in --ax-screen-reader mode
• Fixed plugin and settings panels not moving the terminal cursor to the focused row, so screen readers and magnifiers can follow arrow-key navigation
• Fixed crashes (maximum call stack exceeded) when a deeply nested watched directory tree was deleted or moved, and when rendering deeply nested UI trees
• Fixed pull request events occasionally being lost when a session exited immediately after creating or linking a PR
• Fixed the Bedrock setup wizard failing profile verification for assume-role profiles in partitioned AWS regions and on proxy-only networks

... (truncated)

Commits

• 7ef6eec chore: Update CHANGELOG.md and feed.xml
• 0c18827 chore: Update CHANGELOG.md and feed.xml
• 2982f95 chore: Update CHANGELOG.md and feed.xml
• ac062f3 chore: Update CHANGELOG.md and feed.xml
• c4dbd74 Merge pull request #79898 from anthropics/royarsan/gateway-aws-example
• 843297f Add Claude apps gateway on AWS example deployment assets
• b799fca chore: Update CHANGELOG.md and feed.xml
• 4d07874 chore: Update CHANGELOG.md and feed.xml
• 015170d chore: Update CHANGELOG.md and feed.xml
• 07dcb0e chore: Update CHANGELOG.md and feed.xml
• Additional commits viewable in compare view

Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.

Updates @babel/code-frame from 7.29.0 to 7.29.7

Release notes

Sourced from @​babel/code-frame's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• See full diff in compare view

Updates @babel/helper-validator-identifier from 7.28.5 to 7.29.7

Release notes

Sourced from @​babel/helper-validator-identifier's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• See full diff in compare view

Updates @babel/runtime from 7.28.6 to 7.29.7

Release notes

Sourced from @​babel/runtime's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• 37d5595 v7.29.2
• See full diff in compare view

Updates @borewit/text-codec from 0.2.1 to 0.2.2

Release notes

Sourced from @​borewit/text-codec's releases.

v0.2.2

Changes

🐛 Bug Fixes

• fix: improve encoding correctness and update README @​Borewit (#36)

NPM release

NPM release: @​borewit/text-codec@0.2.2

Commits

• c2ce9c5 0.2.2
• e2f0705 Merge pull request #23 from Borewit/dependabot/npm_and_yarn/master/chai-6.2.2
• 5e58cb8 Bump chai from 5.2.1 to 6.2.2
• bc315b8 Merge pull request #37 from Borewit/update-biome
• f32adfc Update biome to 2.4.6
• 7776373 Merge pull request #36 from Borewit/fix-most-issue-exodus
• 068d7d4 fix: improve encoding correctness and update README
• See full diff in compare view

Updates @google/genai from 1.42.0 to 1.52.0

Release notes

Sourced from @​google/genai's releases.

v1.52.0

1.52.0 (2026-05-04)

Features

• [Python] Multimodal file search (e626bef)
• Multimodal file search (54caf6b)

v1.51.0

1.51.0 (2026-04-29)

Features

• [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (9e08ba9)
• Add output_info to BatchJob (5327c60)
• Add gemini-3.1-flash-tts-preview model to options (35c941b)
• Add ImageResizeMode for GenerateVideos (faa1088)
• Add new Gemini Deep Research agent models (6f83a05)
• Add Vertex Dataset input and output options for batch jobs (6aa848e)
• interaction-api: Add grounding tool usage breakdown to Interaction Usage. (e1c31ad)
• introduce enterprise flag and GOOGLE_GENAI_USE_ENTERPRISE env var (cf7ad52)
• Replace the more ambiguous rate field with sample_rate. (6c80464)

v1.50.1

1.50.1 (2026-04-14)

Bug Fixes

• Refactor Webhook types in GenAI SDKs for easier useage (5100abc)
• Rename webhooks.retrieve to webhooks.get. (db6e771)

v1.50.0

1.50.0 (2026-04-13)

[!CAUTION] CRITICAL WARNING: Do not use this version if you are implementing or relying on webhooks. This release contains known issues regarding webhook sdk. Please use v1.51.0 or later.

Features

• Add "eu" as a supported service location for Vertex AI platform. (2493f9c)
• Add DeepResearchAgentConfig fields (3615ca2)
• Add Live Avatar new fields (6a0ff96)
• Add support for new audio MIME types: opus, alaw, and mulaw (7137f13)
• add webhook and webhookConfig for js and python sdk (0f89605)
• Add webhook_config to batches.create() and models.generate_videos() (894bc93)
• Wire the webhook into python and js client. (b6c5d18)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

1.52.0 (2026-05-04)

Features

• [Python] Multimodal file search (e626bef)
• Multimodal file search (54caf6b)

1.51.0 (2026-04-29)

Features

• [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (9e08ba9)
• Add output_info to BatchJob (5327c60)
• Add gemini-3.1-flash-tts-preview model to options (35c941b)
• Add ImageResizeMode for GenerateVideos (faa1088)
• Add new Gemini Deep Research agent models (6f83a05)
• Add Vertex Dataset input and output options for batch jobs (6aa848e)
• interaction-api: Add grounding tool usage breakdown to Interaction Usage. (e1c31ad)
• introduce enterprise flag and GOOGLE_GENAI_USE_ENTERPRISE env var (cf7ad52)
• Replace the more ambiguous rate field with sample_rate. (6c80464)

1.50.1 (2026-04-14)

Bug Fixes

• Refactor Webhook types in GenAI SDKs for easier useage (5100abc)
• Rename webhooks.retrieve to webhooks.get. (db6e771)

1.50.0 (2026-04-13)

Features

• Add "eu" as a supported service location for Vertex AI platform. (2493f9c)
• Add DeepResearchAgentConfig fields (3615ca2)
• Add Live Avatar new fields (6a0ff96)
• Add support for new audio MIME types: opus, alaw, and mulaw (7137f13)
• add webhook and webhookConfig for js and python sdk (0f89605)
• Add webhook_config to batches.create() and models.generate_videos() (894bc93)
• Wire the webhook into python and js client. (b6c5d18)

1.49.0 (2026-04-08)

Features

• Introduce TYPE_L16 audio content and optional fields. (c62cb9a)

... (truncated)

Commits

• e8c8c44 chore(main): release 1.52.0 (#1546)
• 50d81ca chore: [Multimodal FileSearch] Move embedding_model to body
• 54caf6b feat: Multimodal file search
• e626bef feat: [Python] Multimodal file search
• 61013d6 chore(main): release 1.51.0 (#1503)
• 8137d23 chore: add the deprecation marker back
• 734dab0 chore: no-op
• 006286b chore: Add page number
• 986bbed chore: Adjust Webhook update to better reflect modifiable fields
• e1c31ad feat(interaction-api): Add grounding tool usage breakdown to Interaction Usage.
• Additional commits viewable in compare view

Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.

Updates @hono/node-server from 1.19.9 to 1.19.17

Release notes

Sourced from @​hono/node-server's releases.

v1.19.17

No release notes provided.

v1.19.14

What's Changed

• fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @​usualoma in honojs/node-server#340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

• chore: ignore claude setting by @​yusukebe in honojs/node-server#314
• fix: request draining for early 413 responses by @​usualoma in honojs/node-server#329

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

• fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @​usualoma in honojs/node-server#309

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

• 71941da 1.19.17
• 0208500 ci: add stage option for publishing (#386)
• cbdf713 1.19.16
• 86e96c2 ci: add an action for trusted publisher (#385)
• 99c1a1a ci: run on v1.x branch pushes
• 84cb2ee Merge commit from fork
• b5e63a3 1.19.14
• c02d777 fix: add custom inspect to lightweight Request/Response to prevent TypeError ...
• fd64e65 1.19.13
• 025c30f Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.29.0

Release notes

Sourced from...

Description has been truncated

[dependabot]

Assignees

The following users could not be added as assignees: llm-dev-ops/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔒 Security Scan Results

Scan Type	Status
Dependency Scan	⚠️ failure
CodeQL Analysis	✅ success
Secret Scan	✅ success
License Check	⚠️ failure
SAST	⚠️ failure

⚠️ Some security scans have warnings or failed. Please review the details.

---

Automated security scanning by GitHub Actions