chore(deps)(deps): bump the production-dependencies group across 1 directory with 84 updates

[dependabot]

Bumps the production-dependencies group with 67 updates in the / directory:

Package	From	To
ajv	8.18.0	8.20.0
cosmiconfig	9.0.0	9.0.2
handlebars	4.7.8	4.7.9
js-yaml	4.1.1	4.3.2
@anthropic-ai/claude-code	2.1.50	2.1.263
@babel/code-frame	7.29.0	7.29.7
@babel/runtime	7.28.6	7.29.7
@borewit/text-codec	0.2.1	0.2.2
@google/genai	1.42.0	1.52.0
@hono/node-server	1.19.9	1.19.17
@modelcontextprotocol/sdk	1.26.0	1.30.0
@protobufjs/codegen	2.0.4	2.0.5
@protobufjs/eventemitter	1.1.0	1.1.1
@protobufjs/fetch	1.1.0	1.1.1
@protobufjs/inquire	1.1.0	1.1.2
@protobufjs/utf8	1.1.0	1.1.2
@supabase/supabase-js	2.97.0	2.115.0
fastmcp	3.33.0	3.35.0
axios	1.13.5	1.20.0
b4a	1.8.0	1.8.1
bare-events	2.8.2	2.9.2
bare-fs	4.5.4	4.8.1
bare-os	3.6.2	3.9.3
bare-path	3.0.0	3.1.2
bare-stream	2.8.0	2.13.4
bare-url	2.3.2	2.5.4
body-parser	2.2.2	2.3.0
chardet	2.1.1	2.2.0
es-object-atoms	1.1.1	1.1.2
eventsource-parser	3.0.6	3.1.1
express-rate-limit	8.2.1	8.7.0
fast-uri	3.1.0	3.1.7
fastq	1.20.1	1.20.3
figlet	1.10.0	1.11.4
file-type	21.3.0	21.3.4
fs-extra	11.3.3	11.4.0
fuse.js	7.1.0	7.5.0
gaxios	7.1.3	7.3.1
gcp-metadata	8.1.2	8.1.4
get-east-asian-width	1.5.0	1.6.0
google-auth-library	10.5.0	10.9.1
hono	4.12.1	4.13.7
http-proxy-middleware	3.0.5	3.0.7
iconv-lite	0.7.2	0.7.3
is-plain-object	5.0.0	5.1.0
jsonfile	6.2.0	6.2.1
koa	3.1.1	3.2.1
mcp-proxy	6.4.0	6.7.14
media-typer	1.1.0	1.1.1
nan	2.25.0	2.28.0
node-abi	3.87.0	3.96.0
protobufjs	6.11.4	6.11.6
path-to-regexp	8.3.0	8.4.2
pipenet	1.4.0	1.4.2
pretty-ms	9.3.0	9.3.1
pump	3.0.3	3.0.4
range-parser	1.2.1	1.3.0
tar-fs	2.1.4	2.1.5
sql.js	1.14.0	1.14.2
strtok3	10.3.4	10.3.5
undici	7.22.0	7.29.1
validator	13.15.26	13.15.35
ws	8.19.0	8.21.3
yaml	2.8.2	2.9.0
yargs	18.0.0	18.1.0
yoctocolors	2.1.2	2.2.0
zod-to-json-schema	3.25.1	3.25.2

Updates ajv from 8.18.0 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

• fix: add support for node 22/24, drop node 16/21 by @​jasoniangreen in ajv-validator/ajv#2580
• fix: add ES2022.RegExp for RegExpIndicesArray by @​SignpostMarv in ajv-validator/ajv#2604

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

• fix prototype pollution via format keyword using $data ref by @​epoberezkin in ajv-validator/ajv#2607

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

Commits

• 0fba0b8 8.20.0
• 9caf8d6 fix: add ES2022.RegExp for RegExpIndicesArray; fixes ajv-validator/ajv#2603 (...
• 2065350 fix: add support for node 22/24, drop node 16/21 (#2580)
• 154b58d 8.19.0
• e8d2bdc test/fix prototype pollution via $data ref with format keyword (#2607)
• See full diff in compare view

Updates cosmiconfig from 9.0.0 to 9.0.2

Changelog

Sourced from cosmiconfig's changelog.

9.0.2

• Fixed a prototype chain issue that may happen when merging different config objects.
• Fixed the project search strategy not correctly stopping at the package boundary.

9.0.1

• Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
• Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.

Commits

• See full diff in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5
  • GHSA-2w6w-674q-4c4q
  • GHSA-3mfm-83xf-c92r
  • GHSA-xhpv-hc6g-r9c6
  • GHSA-xjpj-3mr7-gcpf
  • GHSA-9cx6-37pm-9jff
  • GHSA-2qvq-rjwj-gvw9
  • GHSA-7rx3-28cr-v5wh
  • GHSA-442j-39wm-28r2

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5

Commits

Commits

• dce542c v4.7.9
• 8a41389 Update release notes
• 68d8df5 Fix security issues
• b2a0831 Fix browser tests
• 9f98c16 Fix release script
• 45443b4 Revert "Improve partial indenting performance"
• 8841a5f Fix CI errors with linting
• e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
• e914d60 Improve rendering performance
• 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
• Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• Additional commits viewable in compare view

Updates @anthropic-ai/claude-code from 2.1.50 to 2.1.263

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.263

What's changed

• Bug fixes and reliability improvements

v2.1.261

What's changed

• Added an "Organization policy" line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through
• Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
• Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
• Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
• Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat
• Fixed /add-dir <subdirectory> printing a false "couldn't be resolved" error when the working directory is on a /net automount
• Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy
• Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail
• Fixed being unable to delete the character immediately before an inline [Image #N] chip in the prompt input
• Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request
• Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal
• Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear
• Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion
• Fixed Remote Control uploading a session pulled with /teleport into the connected session, which appeared appended to the original on phone and web
• Fixed Remote Control's inbound event stream failing behind TLS-inspecting corporate proxies on native Windows
• Fixed Remote Control sessions showing the default effort level on claude.ai when the effort comes from settings
• Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid
• Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background
• Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop
• Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine
• Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup
• Fixed claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead
• Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running
• Fixed a rare layout glitch where a box could render with the wrong height after its container switched between row and column direction
• Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403
• Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data
• Fixed Desktop and web showing a session as busy while it only watches an artifact for updates
• Fixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app
• Fixed SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects
• Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw <claude-code-hint> tag no longer leaks into the conversation
• Fixed in-process agent-team teammates re-sending their first-turn tool and skill announcements on the second turn, which changed the request prefix and missed the prompt cache
• Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it
• Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes
• Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update
• Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts
• Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change
• Changed a Claude apps gateway 403 on the managed settings load (at startup or after /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in
• Changed machines whose managed settings pin forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected
• Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it
• Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect
• Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests
• [VSCode] Added a "Build a custom style" walkthrough to the Output styles menu that writes a custom output style file and lists it right away

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.263

• Bug fixes and reliability improvements

2.1.261

• Added an "Organization policy" line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through
• Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
• Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
• Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
• Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat
• Fixed /add-dir <subdirectory> printing a false "couldn't be resolved" error when the working directory is on a /net automount
• Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy
• Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail
• Fixed being unable to delete the character immediately before an inline [Image #N] chip in the prompt input
• Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request
• Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal
• Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear
• Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion
• Fixed Remote Control uploading a session pulled with /teleport into the connected session, which appeared appended to the original on phone and web
• Fixed Remote Control's inbound event stream failing behind TLS-inspecting corporate proxies on native Windows
• Fixed Remote Control sessions showing the default effort level on claude.ai when the effort comes from settings
• Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid
• Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background
• Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop
• Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine
• Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup
• Fixed claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead
• Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running
• Fixed a rare layout glitch where a box could render with the wrong height after its container switched between row and column direction
• Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403
• Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data
• Fixed Desktop and web showing a session as busy while it only watches an artifact for updates
• Fixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app
• Fixed SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects
• Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw <claude-code-hint> tag no longer leaks into the conversation
• Fixed in-process agent-team teammates re-sending their first-turn tool and skill announcements on the second turn, which changed the request prefix and missed the prompt cache
• Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it
• Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes
• Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update
• Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts
• Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change
• Changed a Claude apps gateway 403 on the managed settings load (at startup or after /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in
• Changed machines whose managed settings pin forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected
• Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it
• Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect
• Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests
• [VSCode] Added a "Build a custom style" walkthrough to the Output styles menu that writes a custom output style file and lists it right away
• [VSCode] Added an Add server form and a Remove action to the MCP servers dialog, so MCP servers can be added and removed without leaving the IDE
• [VSCode] Added a hollow ring in the session list for sessions open in a terminal, another VS Code window, or Claude Desktop, so they no longer look closed

... (truncated)

Commits

• ab9b2cf chore: Update CHANGELOG.md and feed.xml
• d7dbd9a chore: Update CHANGELOG.md and feed.xml
• b3f0e50 chore: Update CHANGELOG.md and feed.xml
• ee2a058 Merge pull request #91894 from williamqian12/frontend-design-skill-update
• f173a69 chore: Update CHANGELOG.md and feed.xml
• dbdd79c Update /frontend-design SKILL.md
• aef74af chore: Update CHANGELOG.md and feed.xml
• a1e64dc chore: Update CHANGELOG.md and feed.xml
• f275fa2 chore: Update CHANGELOG.md and feed.xml
• f1af9b1 chore: Update CHANGELOG.md and feed.xml
• Additional commits viewable in compare view

Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.

Updates @babel/code-frame from 7.29.0 to 7.29.7

Release notes

Sourced from @​babel/code-frame's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• See full diff in compare view

Updates @babel/helper-validator-identifier from 7.28.5 to 7.29.7

Release notes

Sourced from @​babel/helper-validator-identifier's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• See full diff in compare view

Updates @babel/runtime from 7.28.6 to 7.29.7

Release notes

Sourced from @​babel/runtime's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• 37d5595 v7.29.2
• See full diff in compare view

Updates @borewit/text-codec from 0.2.1 to 0.2.2

Release notes

Sourced from @​borewit/text-codec's releases.

v0.2.2

Changes

🐛 Bug Fixes

• fix: improve encoding correctness and update README @​Borewit (#36)

NPM release

NPM release: @​borewit/[email protected]

Commits

• c2ce9c5 0.2.2
• e2f0705 Merge pull request #23 from Borewit/dependabot/npm_and_yarn/master/chai-6.2.2
• 5e58cb8 Bump chai from 5.2.1 to 6.2.2
• bc315b8 Merge pull request #37 from Borewit/update-biome
• f32adfc Update biome to 2.4.6
• 7776373 Merge pull request #36 from Borewit/fix-most-issue-exodus
• 068d7d4 fix: improve encoding correctness and update README
• See full diff in compare view

Updates @google/genai from 1.42.0 to 1.52.0

Release notes

Sourced from @​google/genai's releases.

v1.52.0

1.52.0 (2026-05-04)

Features

• [Python] Multimodal file search (e626bef)
• Multimodal file search (54caf6b)

v1.51.0

1.51.0 (2026-04-29)

Features

• [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (9e08ba9)
• Add output_info to BatchJob (5327c60)
• Add gemini-3.1-flash-tts-preview model to options (35c941b)
• Add ImageResizeMode for GenerateVideos (faa1088)
• Add new Gemini Deep Research agent models (6f83a05)
• Add Vertex Dataset input and output options for batch jobs (6aa848e)
• interaction-api: Add grounding tool usage breakdown to Interaction Usage. (e1c31ad)
• introduce enterprise flag and GOOGLE_GENAI_USE_ENTERPRISE env var (cf7ad52)
• Replace the more ambiguous rate field with sample_rate. (6c80464)

v1.50.1

1.50.1 (2026-04-14)

Bug Fixes

• Refactor Webhook types in GenAI SDKs for easier useage (5100abc)
• Rename webhooks.retrieve to webhooks.get. (db6e771)

v1.50.0

1.50.0 (2026-04-13)

[!CAUTION] CRITICAL WARNING: Do not use this version if you are implementing or relying on webhooks. This release contains known issues regarding webhook sdk. Please use v1.51.0 or later.

Features

• Add "eu" as a supported service location for Vertex AI platform. (2493f9c)
• Add DeepResearchAgentConfig fields (3615ca2)
• Add Live Avatar new fields (6a0ff96)
• Add support for new audio MIME types: opus, alaw, and mulaw (7137f13)
• add webhook and webhookConfig for js and python sdk (0f89605)
• Add webhook_config to batches.create() and models.generate_videos() (894bc93)
• Wire the webhook into python and js client. (b6c5d18)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

1.52.0 (2026-05-04)

Features

• [Python] Multimodal file search (e626bef)
• Multimodal file search (54caf6b)

1.51.0 (2026-04-29)

Features

• [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (9e08ba9)
• Add output_info to BatchJob (5327c60)
• Add gemini-3.1-flash-tts-preview model to options (35c941b)
• Add ImageResizeMode for GenerateVideos (faa1088)
• Add new Gemini Deep Research agent models (6f83a05)
• Add Vertex Dataset input and output options for batch jobs (6aa848e)
• interaction-api: Add grounding tool usage breakdown to Interaction Usage. (e1c31ad)
• introduce enterprise flag and GOOGLE_GENAI_USE_ENTERPRISE env var (cf7ad52)
• Replace the more ambiguous rate field with sample_rate. (6c80464)

1.50.1 (2026-04-14)

Bug Fixes

• Refactor Webhook types in GenAI SDKs for easier useage (5100abc)
• Rename webhooks.retrieve to webhooks.get. (db6e771)

1.50.0 (2026-04-13)

Features

• Add "eu" as a supported service location for Vertex AI platform. (2493f9c)
• Add DeepResearchAgentConfig fields (3615ca2)
• Add Live Avatar new fields (6a0ff96)
• Add support for new audio MIME types: opus, alaw, and mulaw (7137f13)
• add webhook and webhookConfig for js and python sdk (0f89605)
• Add webhook_config to batches.create() and models.generate_videos() (894bc93)
• Wire the webhook into python and js client. (b6c5d18)

1.49.0 (2026-04-08)

Features

• Introduce TYPE_L16 audio content and optional fields. (c62cb9a)

... (truncated)

Commits

• e8c8c44 chore(main): release 1.52.0 (#1546)
• 50d81ca chore: [Multimodal FileSearch] Move embedding_model to body
• 54caf6b feat: Multimodal file search
• e626bef feat: [Python] Multimodal file search
• 61013d6 chore(main): release 1.51.0 (#1503)
• 8137d23 chore: add the deprecation marker back
• 734dab0 chore: no-op
• 006286b chore: Add page number
• 986bbed chore: Adjust Webhook update to better reflect modifiable fields
• e1c31ad feat(interaction-api): Add grounding tool usage breakdown to Interaction Usage.
• Additional commits viewable in compare view

Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.

Updates @hono/node-server from 1.19.9 to 1.19.17

Release notes

Sourced from @​hono/node-server's releases.

v1.19.17

No release notes provided.

v1.19.14

What's Changed

• fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @​usualoma in honojs/node-server#340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

• chore: ignore claude setting by @​yusukebe in honojs/node-server#314
• fix: request draining for early 413 responses by @​usualoma in honojs/node-server#329

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

• fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @​usualoma in honojs/node-server#309

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Sta...

Description has been truncated

[dependabot]

Assignees

The following users could not be added as assignees: llm-dev-ops/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔒 Security Scan Results

Scan Type	Status
Dependency Scan	⚠️ failure
CodeQL Analysis	✅ success
Secret Scan	✅ success
License Check	⚠️ failure
SAST	⚠️ failure

⚠️ Some security scans have warnings or failed. Please review the details.

---

Automated security scanning by GitHub Actions