[dependabot]

Bumps promptfoo from 0.121.19 to 0.122.2.

Release notes

Sourced from promptfoo's releases.

0.122.2

0.122.2 (2026-08-28)

Features

• auth: support configurable Cloud auth header name (#10375) (997cb56)
• providers: add Codex Security SDK provider (#10467) (df8a5ab)

0.122.1

0.122.1 (2026-08-26)

Features

• eval: distinguish scan footprint from incurred token usage (#10497) (8df8ef0)
• providers: add Gemini 3.7 Flash and Flash-Lite (#10389) (bc6b189)
• redteam: account for multi-turn attacker and grading tokens (#10407) (33cc8bc)
• redteam: report generation, target, attacker, and grading tokens (#10408) (0891e4e)
• tracing: add test-case roots and universal target spans (#10328) (334586e)
• tracing: align spans with OpenTelemetry GenAI conventions (#10361) (e6f44f8)
• tracing: fetch external spans from Grafana Tempo (#10327) (1b445b0)
• tracing: fetch external traces from Braintrust (#10329) (f372318)
• tracing: fetch external traces from Langfuse (#10372) (f7809f6)
• tracing: harden trace span persistence (#10326) (d9d0e82)
• tracing: instrument grading and red-team execution (#10362) (a53ba32)
• tracing: integrate OpenAI Agents and Vercel SDK telemetry (#10364) (8f89002)
• tracing: standardize tool execution across providers (#10363) (b54ccbd)
• tracing: support Claude and Codex subprocess telemetry (#10365) (84c518f)

Bug Fixes

• app: clarify red team grading actions (#10366) (84a5cf2)
• assertions: avoid regex backtracking in GLEU and SQL parsing (#10373) (57243cf)
• assertions: correct inverse JSON failure messages (#9824) (d1d8de3)
• assertions: reject out-of-range trace-span-duration percentile (#10089) (49c0f6d)
• assertions: score tokenless GLEU inputs as zero (#9850) (cc8c0c6)
• deps: align Chevrotain CST generator with parser (#10360) (6ae80cd)
• deps: block install scripts in Docker builds (#10330) (c4454c4)
• deps: bundle the runtime cache dependency (#10302) (b5f8ea3)
• deps: enforce npm release age during lockfile maintenance (#10396) (42c1076)
• deps: hold jsdom below the release our Node floor cannot install (#10351) (2dcb128)
• deps: hold tanstack table below incompatible v9 (#10388) (fded938)
• deps: keep Renovate on the supported npm major (#10393) (f5034c1)
• deps: limit pnpm install scripts and new releases (#10331) (0dbf6c8)
• deps: patch vulnerable transitive js-yaml releases (#10356) (2626fd0)
• deps: prevent incompatible Chevrotain parser updates (#10306) (77c08d5)
• deps: prevent incompatible chevrotain-allstar upgrades (#10399) (5357d06)
• deps: restore standard cache dependency resolution (#10314) (ca65846)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.122.2 (2026-08-28)

Features

• auth: support configurable Cloud auth header name (#10375) (997cb56)
• providers: add Codex Security SDK provider (#10467) (df8a5ab)

0.122.1 (2026-08-26)

Features

• eval: distinguish scan footprint from incurred token usage (#10497) (8df8ef0)
• providers: add Gemini 3.7 Flash and Flash-Lite (#10389) (bc6b189)
• redteam: account for multi-turn attacker and grading tokens (#10407) (33cc8bc)
• redteam: report generation, target, attacker, and grading tokens (#10408) (0891e4e)
• tracing: add test-case roots and universal target spans (#10328) (334586e)
• tracing: align spans with OpenTelemetry GenAI conventions (#10361) (e6f44f8)
• tracing: fetch external spans from Grafana Tempo (#10327) (1b445b0)
• tracing: fetch external traces from Braintrust (#10329) (f372318)
• tracing: fetch external traces from Langfuse (#10372) (f7809f6)
• tracing: harden trace span persistence (#10326) (d9d0e82)
• tracing: instrument grading and red-team execution (#10362) (a53ba32)
• tracing: integrate OpenAI Agents and Vercel SDK telemetry (#10364) (8f89002)
• tracing: standardize tool execution across providers (#10363) (b54ccbd)
• tracing: support Claude and Codex subprocess telemetry (#10365) (84c518f)

Bug Fixes

• app: clarify red team grading actions (#10366) (84a5cf2)
• assertions: avoid regex backtracking in GLEU and SQL parsing (#10373) (57243cf)
• assertions: correct inverse JSON failure messages (#9824) (d1d8de3)
• assertions: reject out-of-range trace-span-duration percentile (#10089) (49c0f6d)
• assertions: score tokenless GLEU inputs as zero (#9850) (cc8c0c6)
• deps: align Chevrotain CST generator with parser (#10360) (6ae80cd)
• deps: block install scripts in Docker builds (#10330) (c4454c4)
• deps: bundle the runtime cache dependency (#10302) (b5f8ea3)
• deps: enforce npm release age during lockfile maintenance (#10396) (42c1076)
• deps: hold jsdom below the release our Node floor cannot install (#10351) (2dcb128)
• deps: hold tanstack table below incompatible v9 (#10388) (fded938)
• deps: keep Renovate on the supported npm major (#10393) (f5034c1)
• deps: limit pnpm install scripts and new releases (#10331) (0dbf6c8)
• deps: patch vulnerable transitive js-yaml releases (#10356) (2626fd0)
• deps: prevent incompatible Chevrotain parser updates (#10306) (77c08d5)
• deps: prevent incompatible chevrotain-allstar upgrades (#10399) (5357d06)
• deps: restore standard cache dependency resolution (#10314) (ca65846)
• deps: update anthropic packages (#10426) (ef4cd6b)
• deps: update anthropic packages (#10471) (ed5bae3)
• deps: update dependency @​apidevtools/json-schema-ref-parser to v16 (#10474) (7600c55)
• deps: update dependency @​hono/node-server to v2.1.0 (#10385) (af026d0)
• deps: update dependency @​hono/node-server to v2.1.1 (#10472) (24ef223)

... (truncated)

Commits

• 8905230 chore(main): release 0.122.2 (#10515)
• 2873066 chore(deps): update Node.js to 24.20.0 (#10508)
• 1fda52f chore(deps): update dependency @​anthropic-ai/claude-agent-sdk to v0.3.234 (#1...
• f2f5682 chore(deps): update dependency @​langfuse/client to v5.10.1 (#10520)
• 997cb56 feat(auth): support configurable Cloud auth header name (#10375)
• e3b3645 chore(deps): update dependency @​asamuzakjp/css-color to v6 (#10500)
• df8a5ab feat(providers): add Codex Security SDK provider (#10467)
• e1cd400 chore(main): release 0.122.1 (#10304)
• 4868649 fix(redteam): preserve cached generation and retry accounting (#10507)
• 8df8ef0 feat(eval): distinguish scan footprint from incurred token usage (#10497)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ManintheCrowds]

Lockfile repair moved to a rebased branch so npm ci can succeed. Follow-up: will close this if the lockfix PR's required CI job is green, or leave both open if eval regresses (local RT11 fail on Windows).

[dependabot]

Superseded by #57.