Skip to content

chore(deps): bump the minor-and-patch group with 12 updates - #3956

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-ceef04920d
Open

chore(deps): bump the minor-and-patch group with 12 updates#3956
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-ceef04920d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates:

Package From To
@ai-sdk/provider-utils 5.0.28 5.0.29
@astryxdesign/cli 0.4.5 0.4.7
@biomejs/biome 2.5.9 2.5.10
@ai-sdk/anthropic 4.0.40 4.0.41
@ai-sdk/code-mode 1.0.27 1.0.34
@ai-sdk/cohere 4.0.28 4.0.29
@ai-sdk/google 4.0.47 4.0.50
@ai-sdk/open-responses 2.0.29 2.0.30
@ai-sdk/openai 4.0.44 4.0.46
@ai-sdk/openai-compatible 3.0.32 3.0.35
ai 7.0.70 7.0.77
@jackwener/opencli 1.8.6 1.8.7

Updates @ai-sdk/provider-utils from 5.0.28 to 5.0.29

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.29

Patch Changes

  • b74971f: Preserve schema-valued additional properties when converting Zod 4 schemas.
Commits

Updates @astryxdesign/cli from 0.4.5 to 0.4.7

Release notes

Sourced from @​astryxdesign/cli's releases.

v0.4.7

Astryx 0.4.7 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

Fixes

  • BottomSheet: a non-modal sheet now colours the iOS 26 Safari toolbar strip with its own surface instead of letting the page show through behind the address bar (#5342).

  • BottomSheet: a tap inside the sheet is a tap, and the sheet leaves on an exit curve (#5326). Two defects, both of which read as "the sheet closes with no animation" — reported against the touch DateInput picker, which is a Bottom Sheet.

    A tap inside the sheet started a one-pixel drag. The sheet body carries the pull-to-dismiss handlers, and they promoted to a sheet drag on any downward movement. A finger is never still, so the pixel or two a tap drifts began a drag — and a live drag suppresses the panel's transition, correctly, because a dragged sheet must track the finger rather than lag it. The close that the tap triggered landed inside that window, so the sheet jumped to its closed position with no transition. Tapping the picker's Save button hit this every time; tapping the scrim never did, because the scrim is the dialog itself and arms no gesture. Promotion now needs 8px of travel — the conventional tap slop, well under what a deliberate pull covers in its first frames — in both the pointer and touch paths. The gesture's transition suppression is also scoped to a sheet that is open, so it cannot straddle an exit.

    The exit ran on the entrance's curve. --ease-standard is cubic-bezier(0.24, 1, 0.4, 1), a decelerate curve: it spends its speed immediately and coasts. Right for an entrance, wrong for an exit. Measured on device (iPhone, real Safari), a scrim tap put the sheet half off-screen in 59ms of the 410ms transition and 90% off in 163ms, with the dim gone before it — so the close was over before the eye could follow it. The closing state now carries an accelerating curve of its own, cubic-bezier(0.3, 0, 0.6, 0.6): away from rest, gathering speed, quickest as it leaves the screen, and moving within ~50ms so it reads as one departure rather than a hesitation and a snap. Only the curve changes — the exit keeps --duration-medium, the entrance's band, which is what keeps it legible under a theme that scales the motion scale down (neutral's medium is 300ms against the base 410ms).

    The scrim leaves with the sheet: while closing, the dim runs linear rather than the decelerate token. A fade covers no distance, so front-loading its progress just ends it early — the reasoning the touch date picker's surface swap already carries. BottomSheetSwitcher gets the same treatment when its flow closes; a handoff between two sheets is not a close and is unchanged.

  • useListFocus no longer swallows Escape when no onEscape was supplied. The hook called preventDefault() on every Escape — a habit inherited from the arrow keys, which share the handler and need it to suppress page scroll — so a list with nothing to dismiss still marked the key handled, and a surrounding layer that defers to defaultPrevented (a focus trap, a native popover) never got its turn. Escape is now consumed only when an onEscape is passed. Arrow, Home and End handling is unchanged (#5346). Behaviour change: AvatarGroup, ButtonGroup, Outline, Pagination, SegmentedControl, TabList and Toolbar pass no onEscape, so an Escape pressed inside one of them now reaches the surrounding layer and can dismiss it — the point of the fix, but a host that counted on the key stopping there will notice. NavHeadingMenu does the same when it renders without a menu close handler. Menus and flyouts that do pass onEscape are unaffected. patch, not [breaking]: the swallowing was never a contract — the hook documented Escape only as "custom callback", and no component advertised consuming the key.

  • TabList: the selected tab now carries aria-current="true" — ARIA's generic "current item within a set" — instead of aria-current="page". The strip is a <nav> and stays one, but it is used to switch views in place at least as often as it is used to navigate, and on those uses page asserted a page change that never happened. Assistive tech announced the selected tab as the current page even when nothing had navigated; it now announces it as the current item, which is true either way. A tab given an href still renders an anchor and still reads as a link — its current marker is just less specific than it was. No role changes and no new props. (#5347)

Contributors

Thanks to everyone who contributed to this release:

@​cixzhang @​imdreamrunner

Full Changelog: facebook/astryx@v0.4.6...v0.4.7

v0.4.6

Astryx 0.4.6 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

  • DateInput fits the pointer: a touch picker on a finger, the text field on a mouse (#5243)

    DateInput has always been a control for a mouse — a field you type into with a calendar in a popover beside it. On a phone or a tablet that is the wrong shape: the popover is a desktop calendar operated by thumb, and focusing the field summons a keyboard that covers the thing it is meant to fill in.

    The same component now renders a second surface where the primary pointer is a finger (pointer: coarse): a bottom sheet holding one month per screen, swiped sideways, with month and year wheels behind the header title for the far jumps swiping is bad at, arrows in the header corner for a single step, and every target floored at 44px. A day commits the moment it is tapped and leaves the sheet up, so a mistake can be corrected in place; Save closes the picker, and Reset puts it back to how it opened — no date, current month. The grid spills adjacent-month days, muted and unselectable, and the weekday header is three letters rather than two, both as the desktop calendar has them.

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.4.7

0.4.6

New Features

  • An integration can contribute reference-doc topics: point docs at a root in astryx.integration.* and every {topic}.doc.{ts,mjs,js} under it is served by astryx docs, indexed by astryx search, and named in the agent-docs block, beside the built-in topics. A topic may also declare replaces: '<topic>' to take over an existing one (renaming it leaves the old name resolving as an alias) or extends: '<topic>' to merge onto one section by section. A name that collides without declaring either is an invalid_doc issue rather than a silent override, and validate-integration reports it. (#5311) Also fixes the agent-docs block's topic list, which scanned for \w+ and so silently dropped every hyphenated topic — getting-started, cli-integrations, browser-support, styling-libraries and working-with-ai were missing from every block ever written, and an agent cannot ask for a topic it was never told about.
  • Five dashboard page templates: dashboard-cohort-funnel, dashboard-data, dashboard-executive-summary, dashboard-project-status and dashboard-service-monitoring. Each is a complete page — layout, realistic sample data, and the component choices that go with the shape of the data — so astryx template <name> gives you something to edit rather than a blank frame (#5245).

Fixes

  • component built the import specifier for an integration component by joining the package name and the component name, which assumes every component is exported from a subpath named after itself. Components are commonly grouped behind a single entry point named after the concept, so the suggested import pointed at a subpath the package does not export and did not resolve (#4810). The specifier is now resolved against the owning package's exports map, keyed on the directory the component's doc file sits in, and falls back to the package root when that directory is not an exported subpath. A specifier a doc file states for itself is also no longer overwritten.
  • The upgrade codemod no longer collapses significant JSX whitespace when it renames an element tag. Renaming <OldName> next to text and a {expression} (e.g. hello {name} world) previously dropped the adjacent space (hello {name}world); element-tag renames are now spliced into the output so the surrounding JSX is left untouched (#5149).
  • The XDS-prefix codemod no longer produces a file that will not compile. Dropping the prefix renames XDSButton to Button, but if the file already had a local binding called Button the rewrite collided with it and shadowed one of the two. The import is now aliased instead, so both survive and the file still typechecks (#5225).

Contributors

Thanks to everyone who contributed to this release:

Commits
  • 2ce1983 chore: version packages for v0.4.7
  • f1d4034 chore: version packages for v0.4.6
  • 580c1bc fix(breadcrumbs): audit pass, hit target, theme targets, focus ring, RTL sepa...
  • 61463fd fix(AvatarGroup): overflow indicator sizing, first-child overlap, negative co...
  • 660c7c0 feat(cli): let an integration contribute doc topics, and replace or extend on...
  • 86ba54b docs: replace em dashes in theme and Selector block doc prose (#5251)
  • 4773c78 docs: replace em dashes in useScrollLock, Tooltip, and service-monitoring pro...
  • 9e106a2 docs: replace em dashes in theme-build, TextArea, and BottomSheet prose (#5180)
  • 6f36dda fix(cli): resolve integration import specifiers against the package exports m...
  • 53db047 feat(templates): add five dashboard page templates (#5245)
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.9 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

    <!-- c -->

... (truncated)

Commits

Updates @ai-sdk/anthropic from 4.0.40 to 4.0.41

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.41

Patch Changes

  • Updated dependencies [b74971f]
    • @​ai-sdk/provider-utils@​5.0.29
Commits

Updates @ai-sdk/code-mode from 1.0.27 to 1.0.34

Changelog

Sourced from @​ai-sdk/code-mode's changelog.

1.0.34

Patch Changes

  • ai@7.0.77

1.0.33

Patch Changes

  • Updated dependencies [c6d57f3]
  • Updated dependencies [677a707]
    • ai@7.0.76

1.0.32

Patch Changes

  • Updated dependencies [8978ad8]
    • ai@7.0.75

1.0.31

Patch Changes

  • ai@7.0.74

1.0.30

Patch Changes

  • ai@7.0.73

1.0.29

Patch Changes

  • ai@7.0.72

1.0.28

Patch Changes

  • Updated dependencies [9a37469]
    • ai@7.0.71
Commits

Updates @ai-sdk/cohere from 4.0.28 to 4.0.29

Changelog

Sourced from @​ai-sdk/cohere's changelog.

4.0.29

Patch Changes

  • Updated dependencies [b74971f]
    • @​ai-sdk/provider-utils@​5.0.29
Commits

Updates @ai-sdk/google from 4.0.47 to 4.0.50

Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.50

Patch Changes

  • Updated dependencies [b74971f]
    • @​ai-sdk/provider-utils@​5.0.29

4.0.49

Patch Changes

  • f607a12: chore(google): drop support for Imagen models and their integration following API shutdown

4.0.48

Patch Changes

  • 6c5a1ed: Inline local JSON Schema references in Google tool and structured-output schemas.
Commits

Updates @ai-sdk/open-responses from 2.0.29 to 2.0.30

Changelog

Sourced from @​ai-sdk/open-responses's changelog.

2.0.30

Patch Changes

  • Updated dependencies [b74971f]
    • @​ai-sdk/provider-utils@​5.0.29
Commits

Updates @ai-sdk/openai from 4.0.44 to 4.0.46

Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.46

Patch Changes

  • Updated dependencies [b74971f]
    • @​ai-sdk/provider-utils@​5.0.29

4.0.45

Patch Changes

  • 6be0f51: fix(openai): expand internal parallel tool call wrappers from the Responses API while preserving stateful continuation and streaming fallbacks
Commits

Updates @ai-sdk/openai-compatible from 3.0.32 to 3.0.35

Changelog

Sourced from @​ai-sdk/openai-compatible's changelog.

3.0.35

Patch Changes

  • 7dd9ec3: feat(openai-compatible): convert video file parts to video_url content parts
  • Updated dependencies [b74971f]
    • @​ai-sdk/provider-utils@​5.0.29

3.0.34

Patch Changes

  • 99989ba: feat(provider/openai-compatible): report image generation token usage

3.0.33

Patch Changes

  • d68139c: fix(openai-compatible): report truncated chat streams as errors
Commits

Updates ai from 7.0.70 to 7.0.77

Changelog

Sourced from ai's changelog.

7.0.77

Patch Changes

  • Updated dependencies [b74971f]
  • Updated dependencies [a371615]
    • @​ai-sdk/provider-utils@​5.0.29
    • @​ai-sdk/gateway@​4.0.62

7.0.76

Patch Changes

  • c6d57f3: fix(ai): prevent duplicate text and reasoning part ids
  • 677a707: fix(ai): allow nullish metadata schemas for UI messages with branded IDs

7.0.75

Patch Changes

  • 8978ad8: feat(ai): add experimental_startVideo and experimental_videoStatus — user-facing fire-and-forget wrappers over the video model doStart/doStatus spec methods, with the same sparse-options DX as generateVideo
  • Updated dependencies [dedac59]
    • @​ai-sdk/gateway@​4.0.61

7.0.74

Patch Changes

  • Updated dependencies [5941bd6]
  • Updated dependencies [9a4337d]
    • @​ai-sdk/gateway@​4.0.60

7.0.73

Patch Changes

  • Updated dependencies [f607a12]
    • @​ai-sdk/gateway@​4.0.59

7.0.72

Patch Changes

  • Updated dependencies [fdcc814]
    • @​ai-sdk/gateway@​4.0.58

7.0.71

Patch Changes

... (truncated)

Commits

Updates @jackwener/opencli from 1.8.6 to 1.8.7

Release notes

Sourced from @​jackwener/opencli's releases.

v1.8.7

What's Changed

... (truncated)

Commits
  • 87b60a3 chore(release): bump version to 1.8.7 (#2359)
  • 432cf23 chore(linkedin): share people search auth helpers (#2358)
  • dfc13ea chore(linkedin): share messaging thread URL helpers
  • f2de8ab chore(linkedin): reuse shared unwrap in connect flows
  • b158a4a chore(linkedin): reuse shared unwrap in salesnav
  • 77a4e19 chore(linkedin): reuse shared evaluate unwrap
  • de16476 chore(linkedin): share safety URL decoder
  • e48aac2 chore(xueqiu): share html stripping helper
  • dcab73f chore(browser): share CDP page capabilities
  • 6058c15 chore(instagram): share current user helper
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 12 updates
c23b47c 
Bumps the minor-and-patch group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `5.0.28` | `5.0.29` |
| [@astryxdesign/cli](https://github.com/facebook/astryx/tree/HEAD/packages/cli) | `0.4.5` | `0.4.7` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.10` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `4.0.40` | `4.0.41` |
| [@ai-sdk/code-mode](https://github.com/vercel/ai/tree/HEAD/packages/code-mode) | `1.0.27` | `1.0.34` |
| [@ai-sdk/cohere](https://github.com/vercel/ai/tree/HEAD/packages/cohere) | `4.0.28` | `4.0.29` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `4.0.47` | `4.0.50` |
| [@ai-sdk/open-responses](https://github.com/vercel/ai/tree/HEAD/packages/open-responses) | `2.0.29` | `2.0.30` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.44` | `4.0.46` |
| [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `3.0.32` | `3.0.35` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.70` | `7.0.77` |
| [@jackwener/opencli](https://github.com/jackwener/opencli) | `1.8.6` | `1.8.7` |


Updates `@ai-sdk/provider-utils` from 5.0.28 to 5.0.29
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@5.0.29/packages/provider-utils)

Updates `@astryxdesign/cli` from 0.4.5 to 0.4.7
- [Release notes](https://github.com/facebook/astryx/releases)
- [Changelog](https://github.com/facebook/astryx/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/facebook/astryx/commits/v0.4.7/packages/cli)

Updates `@biomejs/biome` from 2.5.9 to 2.5.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome)

Updates `@ai-sdk/anthropic` from 4.0.40 to 4.0.41
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.41/packages/anthropic)

Updates `@ai-sdk/code-mode` from 1.0.27 to 1.0.34
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/code-mode/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/code-mode@1.0.34/packages/code-mode)

Updates `@ai-sdk/cohere` from 4.0.28 to 4.0.29
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/cohere/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/cohere@4.0.29/packages/cohere)

Updates `@ai-sdk/google` from 4.0.47 to 4.0.50
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.50/packages/google)

Updates `@ai-sdk/open-responses` from 2.0.29 to 2.0.30
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/open-responses/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/open-responses@2.0.30/packages/open-responses)

Updates `@ai-sdk/openai` from 4.0.44 to 4.0.46
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.46/packages/openai)

Updates `@ai-sdk/openai-compatible` from 3.0.32 to 3.0.35
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai-compatible/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@3.0.35/packages/openai-compatible)

Updates `ai` from 7.0.70 to 7.0.77
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.77/packages/ai)

Updates `@jackwener/opencli` from 1.8.6 to 1.8.7
- [Release notes](https://github.com/jackwener/opencli/releases)
- [Changelog](https://github.com/jackwener/OpenCLI/blob/main/CHANGELOG.md)
- [Commits](jackwener/OpenCLI@v1.8.6...v1.8.7)

---
updated-dependencies:
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 5.0.29
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@astryxdesign/cli"
  dependency-version: 0.4.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/code-mode"
  dependency-version: 1.0.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/cohere"
  dependency-version: 4.0.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/open-responses"
  dependency-version: 2.0.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ai-sdk/openai-compatible"
  dependency-version: 3.0.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ai
  dependency-version: 7.0.77
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@jackwener/opencli"
  dependency-version: 1.8.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 26, 2026
@Astro-Han

Astro-Han commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

I reviewed this PR at exact head c23b47cbcb75468ef0237d1afb926d4911636034 (base 6762085e, 4 files +106−106, 1 commit).

Spec: NO-GO — 1×P1 + 1×P2

  • P1 — grouped update is incomplete. Version-pinned shipping artifacts were not carried forward: the provider-utils override for 5.0.28, the code-mode embedded-license inventory at 1.0.27, the committed third-party notices, and the provider-utils patch at 5.0.28. The hosted red checks directly exercise this release contract (test and package fail on the provider-utils 5.0.29 tarball lacking LICENSE/COPYING/NOTICE and the exact-version override). Review the new tarballs, refresh patches/inventories, and regenerate notices.
  • P2 — OpenCLI exact-lock intent drifted. apps/desktop/package.json:45 declares exact 1.8.7, but package-lock.json:46 records the workspace metadata as ^1.8.7 (the base was exact in both). The resolved tarball is 1.8.7 and the dry-run is up to date, but the lock no longer records the manifest's exact intent. Correct and regenerate that entry.

Standards: NO-GO — 2×P1 + 2×P2

  • P1 — legal inventories are stale. package.json:91 moves provider-utils to 5.0.29, while scripts/generate-third-party-notices.mjs:105-112,427-433 remains pinned to provider-utils 5.0.28 and code-mode 1.0.27. The committed notice still names provider-utils 5.0.28, code-mode 1.0.27, and OpenCLI 1.8.6. The exact-head check:third-party-notices, hosted test, and hosted Windows package all fail first on the 5.0.29 tarball lacking an exact-version override; updating that override then exposes the independent code-mode 1.0.34 embedded-component review gate.
  • P1 — Astryx outputs are stale. package.json:93 bumps Astryx CLI 0.4.5→0.4.7, but npm run astryx:theme -- --check reports all three generated files stale: apps/desktop/src/renderer/astryx-theme/{maka.css,maka.js,maka.d.ts}. scripts/build-astryx-theme.mjs:119-145 is authoritative and .github/workflows/ci.yml:175-177 gates it. Regenerate and commit the outputs.
  • P2 — patched dependency was not repatched. Provider-utils is now 5.0.29, but patches/@ai-sdk+provider-utils+5.0.28.patch and patches/README.md:40 remain at 5.0.28; README 22-24 requires rerunning patch-package after a bump. CI warns that the 5.0.28 patch is being applied to 5.0.29.
  • P2 — required PR template was replaced. The stock Dependabot body omits Summary, Verification, AI disclosure/checklist, and behavior declaration required by CONTRIBUTING.md:79-85.

Other checks: git diff --check clean; npm ci --ignore-scripts succeeds; notice checks and Astryx theme checks fail as above; Astryx surface inventory passes (214/1); format check passes (1689). The hosted audit, Gitoxide 3 platforms, windows_recovery, and owner macOS/Windows lanes are green; test and package are terminal FAILURE for this exact head (directly related). OPEN / MERGEABLE / BLOCKED / REVIEW_REQUIRED, no reviews/comments, head did not drift.

What I did not check: full local test suite beyond the focused 213/213 provider/code-mode run (which passes only after manually applying the old patch).

Gate: exact head has P1/P2 findings and failing required checks; it cannot be approved or merged until the patch/inventories/notices and Astryx outputs are regenerated and the OpenCLI lock entry is corrected.

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Astro-Han