[dependabot]

Bumps the production-minor group with 3 updates in the / directory: @tanstack/react-query, @upstash/redis and eve.

Updates @tanstack/react-query from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Commits

• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
• 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
• 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
• d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
• Additional commits viewable in compare view

Updates @upstash/redis from 1.39.0 to 1.40.0

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.40.0

Minor Changes

• 2254796: Default responseEncoding to false. The server now returns string values as plain JSON instead of base64, which cuts response sizes by up to 25%. Set responseEncoding: "base64" to keep the previous behavior.

  Behavior changes with the new default:

  • String values that start with a UTF-8 BOM keep it. Automatic deserialization still ignores the BOM, so a BOM-prefixed JSON value is parsed as before; other BOM-prefixed strings, and all strings with automaticDeserialization: false, are returned exactly, BOM included.
  • Invalid UTF-8 (binary data) is still replaced with U+FFFD, but the server now replaces each invalid byte, so the number of replacement characters can differ. Binary values were not preserved before either.
  • A nested OK status reply (e.g. a Lua script returning {redis.call("SET", ...)}) no longer sometimes decodes to 8.
  • Error replies nested in arrays (e.g. Lua pcall results) are no longer garbled.

  Static aborted signal (all encodings):

  • abort() with no reason or with an Error returns null. With responseEncoding: false it used to return a serialized error object.
  • abort(null) returns null instead of "Aborted".
  • With the new default, other reasons are returned as is: strings that look like base64 (e.g. "abcd") are no longer garbled, and booleans and objects are no longer dropped.
  • Non-Latin-1 string reasons no longer throw a TypeError on Node.

Commits

• f2f9bc8 chore: version packages (#1460)
• b2a1126 DX-3137: deserialize values with a leading UTF-8 BOM (#1461)
• 2254796 DX-3137: default responseEncoding to plain JSON (#1458)
• e9a21c5 Fix the document set order in search tests (#1459)
• See full diff in compare view

Updates eve from 0.83.2 to 0.84.0

Release notes

Sourced from eve's releases.

[email protected]

Minor Changes

• 4a4951e: Tools and connections now share the Approval policy contract; approvalKey and ApprovalContext.approvedTools are removed. once() remembers the latest approval or denial per resolved tool for the session; custom policies must return its decision unchanged to reuse or record consent.

• 4a4951e: Session commands now return Delivery receipts with independent stream() and result() reads; the eve HTTP message route accepts idempotencyKey for retries within a session's recent-key window. Session creation returns { session, delivery } when a message is supplied and { session } otherwise; import shared contracts from eve/sessions.

• 4a4951e: Public APIs now use eve-owned contracts for history, decisions, channel integrations, and sandboxes; legacy aliases and internal helpers are no longer exported. decide takes signal instead of abortSignal and returns only answers and usage; update other imports using the v27 upgrade guide.

• 4a4951e: Define dynamic capabilities with defineDynamic(ctx => value) instead of lifecycle maps, and use ordinary functions and schemas instead of defineDurableCallback and defineDurableSchema. Cache external JSON observations with ctx.memo(key, fn).

• 4a4951e: Extension distributions now record the eve version they were built with and a distribution generation instead of per-capability epochs. Extensions built with the old epoch-based manifest must be rebuilt with this release and republished; eve rejects old manifests with rebuild guidance before loading extension code.

• 4a4951e: Recalled memory is supplied to the model outside durable conversation history, and dynamic user instructions are added only when their content changes. Memory no longer supports compaction recall or visibility, and compaction fails if memory capture fails.

• 4a4951e: Sends, channels, and schedules now accept eve-owned MessageContent; images use file parts, and Chat SDK's messageToUserContent is renamed to messageContentOf. File parts sent through ctx.agent().send() must contain HTTP(S) URLs, not inline bytes or base64.

• 4a4951e: SessionStore replaces EveAgentStore, and clients and frontend bindings use baseUrl instead of host. Frontend bindings expose view, messages, and agents directly with native tool and interaction parts; use followWhile(view) instead of followIdle, and activeTurn(view) rather than busy status for Stop controls.

• 4a4951e: followAgents: true now observes child sessions recursively, including workflow-created children, with predicate selection, bounded traversal, and per-session positions and progress. SessionStore.observe() supports headless capture; child readers require source-positioned opening events to verify each hop through its parent.

• 69346ff: Remote agents no longer serve callers on eve 0.66 through 0.68 (remote agent protocol 1), and callers no longer accept remote agents on those releases. Calls in either direction now fail at start with REMOTE_AGENT_PROTOCOL_MISMATCH; upgrade both deployments to the same eve release. The /eve/v1/task-input/:token route is gone. It accepted unauthenticated answers that settled approvals and added turn input as the session's current user.

• 4a4951e: Replace eve remote invoke and its resumable JSON workflow with eve remote connect --print <prompt> for one-shot requests that print the final assistant text and exit. Interactive eve remote connect is unchanged; use eve/client for scripted multi-turn sessions and input responses.

• 8efe110: eve's default sandbox image is now tagged by its Dockerfile contents instead of the eve version, so upgrading eve reuses existing sandbox templates unless the image itself changed. Expect one template rebuild on the first upgrade to this release.

  The default sandbox image no longer includes pnpm or pip, which makes it smaller. Install them in your sandbox prepare callback when your agent needs them: run npm install -g pnpm for pnpm, and use a Python virtual environment for pip.

• 4a4951e: The eve HTTP channel now rejects unknown top-level fields on session creation, message, and control requests with HTTP 400 and a list of accepted fields. Correct unsupported options and misspellings instead of relying on them being ignored.

• 4a4951e: Channel delivery hooks now receive typed ChannelDelivery payloads and return replacements; use channel.state for state changes. kindHint is removed; use path-derived channel:<name> identities, audience() visibility classification, and the renamed CORS options described in the v27 upgrade guide.

• 4a4951e: Slack's renderers.taskCard now receives TaskCard instead of TaskCardView; use callState and callLabel from eve/events for call rendering. Teams channel state replaces pendingAuthActivityId with pendingAuthActivityIds.

• 4a4951e: Evals now use v27 facts and interaction projections, with call matchers such as turn.waitForToolCall() and renamed helpers such as calledAgent() and awaitingInput(). The remoteUrl field and matcher are removed; use the v27 upgrade guide to migrate legacy assertions.

• 4a4951e: Hooks and channel handlers now receive v27 facts with coordinates in event.scope and session state in ctx.view. Update channel handlers to (event, ctx) with ctx.channel, and migrate instrumentation providers to InstrumentationEvent<K> and the new lifecycle names.

• 4a4951e: Approvals, questions, sign-ins, and budget prompts now share the Interaction model, with answers shaped as { interactionId, optionId?, text? } and approval choices approve / deny. Turns pause only for human input, and cancelling an agent task retires it.

• 4a4951e: Remote agents now use protocol 3 and can still relay approvals, questions, and sign-ins from protocol-2 children. Upgrade callers before their remote agents, or both together: protocol-3 children cannot relay human-input requests to older callers.

• 4a4951e: Session streams now use v27 facts, line-based cursors, and immutable SessionView snapshots queried through eve/events. Checkpoints require version 18; keep older sessions on their original deployments and follow the v27 upgrade guide before updating event consumers or restoring persisted history.

Patch Changes

• 4a4951e: Deliver concurrent messages to the same ctx.agent() session in send order, preventing out-of-order delivery from leaving calls waiting indefinitely for a reply.
• 4a4951e: Parent session streams now record accepted child deliveries as child.sent; use agentCallActivity(state, callId) from eve/client to inspect per-call child activity, including shared turns.
• 4a4951e: An unhandled hook error now fails the running turn instead of only being logged. Cancellation requested with ctx.cancel() takes effect only if the handler returns successfully.
• caa9172: The bundled eve dev self-modification subagent is now offered only to the local developer: sessions authenticated by localDev() or by the linked project's Vercel development token. Chat users and principals from authored authenticators, including HTTP Basic operators, no longer get the editor and must edit files directly; there is no local authorization override, and callers forwarded by a same-machine tunnel can still get the editor if the channel uses localDev().
• 4a4951e: Remote child sessions no longer fail solely because the parent has already consumed their result or stopped waiting for it, such as after a lost acknowledgement.
• 4a4951e: Remote session stream proxies now reject unexpected content types and prevent upstream responses from being served as executable content. Error responses with unexpected content types are replaced with generic JSON while preserving the error status.
• e7453f1: Session callbacks now reach only public addresses. The eve channel rejects callback URLs with a non-HTTP scheme or a loopback host, and callback delivery refuses to connect when a callback hostname resolves to a loopback, private, link-local, or reserved address. Loopback callbacks still work on local development servers (eve dev and vercel dev).
• 4a4951e: Built-in channels keep sign-in links and codes out of shared messages; when private delivery is unavailable, they show a credential-free status instead.
• 4a4951e: Interrupted durable steps recover from recorded outcomes without automatically replaying observed tool calls. Exhausted step retries fail the turn without closing the session, but external effects with unrecorded outcomes still require application-level idempotency.
• 4a4951e: v27 deployments can read v26 session history through the v27 client and stream APIs. Convert previously saved legacy events with convertLegacyEvents from eve/internal/legacy-events, a temporary migration aid.
• 4a4951e: eve dev now validates session event lines before writing them and rejects lines larger than 8 MiB. Set EVE_CHECK_SESSION_EVENTS=0 to disable validation or =1 to enable it outside development.

[email protected]

Patch Changes

• 3e96a14: An optimistic message no longer stays in the submitted state when its turn is cancelled or fails before the agent reads it. EveAgentStore now marks that message failed, so it keeps its own text, and later messages reconcile against their own submissions. A steered message the cancelled turn never read now also lets its send() settle. Thanks @​brettcrane for reporting this in #3102.
• 8077f2d: With otel({ traceChannelRequests: true }), the agent.channel.request span now ends when the response body finishes, fails, or is cancelled, not when the route handler returns. Session stream requests no longer log You can only call end() on a span once. for workflow.stream.read.connect, and request spans now cover the full streaming time. Thanks @​ahcarpenter for reporting this and proposing the fix in #4256.
• 54adf15: chatSdkChannel now reports failed final reply delivery with an error-id notice and a note to the model, avoids reposting streamed replies, and skips unchanged final edits after state restoration. Thanks @​diegojohnsonl for reporting this in #4801.
• 4280d51: A hook that cancels the turn at compaction.completed no longer drops the compaction's summary call from the session's usage. session.waiting and session limits now count it.
• 181caed: Compaction no longer re-runs on every step when the current user message is most of the context window. After a compaction, eve keeps at most 20,000 tokens of the latest conversation word for word next to the summary, with tool results shortened to 2,000 characters; a current message larger than that keeps its start and end, and the cut-out middle is summarized. A compaction that cannot bring the history under the threshold now fails the session, without retrying the step, with an error that says to start a new session or send a smaller message.
• cea4eb0: Declare next as an optional peer dependency, so eve/next types resolve the app's own next in pnpm workspaces that install more than one next version. Thanks @​laugharn for reporting this in #5341.
• 80db4b3: A session started before eve 0.57 now imports on its next message instead of failing with IncompatibleStateLayoutError for eve.mode. The import drops the framework context keys that those builds saved and the current build no longer defines. Thanks @​sunlanchang for reporting this in #5213.

... (truncated)

Changelog

Sourced from eve's changelog.

0.84.0

Minor Changes

• 4a4951e: Tools and connections now share the Approval policy contract; approvalKey and ApprovalContext.approvedTools are removed. once() remembers the latest approval or denial per resolved tool for the session; custom policies must return its decision unchanged to reuse or record consent.

• 4a4951e: Session commands now return Delivery receipts with independent stream() and result() reads; the eve HTTP message route accepts idempotencyKey for retries within a session's recent-key window. Session creation returns { session, delivery } when a message is supplied and { session } otherwise; import shared contracts from eve/sessions.

• 4a4951e: Public APIs now use eve-owned contracts for history, decisions, channel integrations, and sandboxes; legacy aliases and internal helpers are no longer exported. decide takes signal instead of abortSignal and returns only answers and usage; update other imports using the v27 upgrade guide.

• 4a4951e: Define dynamic capabilities with defineDynamic(ctx => value) instead of lifecycle maps, and use ordinary functions and schemas instead of defineDurableCallback and defineDurableSchema. Cache external JSON observations with ctx.memo(key, fn).

• 4a4951e: Extension distributions now record the eve version they were built with and a distribution generation instead of per-capability epochs. Extensions built with the old epoch-based manifest must be rebuilt with this release and republished; eve rejects old manifests with rebuild guidance before loading extension code.

• 4a4951e: Recalled memory is supplied to the model outside durable conversation history, and dynamic user instructions are added only when their content changes. Memory no longer supports compaction recall or visibility, and compaction fails if memory capture fails.

• 4a4951e: Sends, channels, and schedules now accept eve-owned MessageContent; images use file parts, and Chat SDK's messageToUserContent is renamed to messageContentOf. File parts sent through ctx.agent().send() must contain HTTP(S) URLs, not inline bytes or base64.

• 4a4951e: SessionStore replaces EveAgentStore, and clients and frontend bindings use baseUrl instead of host. Frontend bindings expose view, messages, and agents directly with native tool and interaction parts; use followWhile(view) instead of followIdle, and activeTurn(view) rather than busy status for Stop controls.

• 4a4951e: followAgents: true now observes child sessions recursively, including workflow-created children, with predicate selection, bounded traversal, and per-session positions and progress. SessionStore.observe() supports headless capture; child readers require source-positioned opening events to verify each hop through its parent.

• 69346ff: Remote agents no longer serve callers on eve 0.66 through 0.68 (remote agent protocol 1), and callers no longer accept remote agents on those releases. Calls in either direction now fail at start with REMOTE_AGENT_PROTOCOL_MISMATCH; upgrade both deployments to the same eve release. The /eve/v1/task-input/:token route is gone. It accepted unauthenticated answers that settled approvals and added turn input as the session's current user.

• 4a4951e: Replace eve remote invoke and its resumable JSON workflow with eve remote connect --print <prompt> for one-shot requests that print the final assistant text and exit. Interactive eve remote connect is unchanged; use eve/client for scripted multi-turn sessions and input responses.

• 8efe110: eve's default sandbox image is now tagged by its Dockerfile contents instead of the eve version, so upgrading eve reuses existing sandbox templates unless the image itself changed. Expect one template rebuild on the first upgrade to this release.

  The default sandbox image no longer includes pnpm or pip, which makes it smaller. Install them in your sandbox prepare callback when your agent needs them: run npm install -g pnpm for pnpm, and use a Python virtual environment for pip.

• 4a4951e: The eve HTTP channel now rejects unknown top-level fields on session creation, message, and control requests with HTTP 400 and a list of accepted fields. Correct unsupported options and misspellings instead of relying on them being ignored.

• 4a4951e: Channel delivery hooks now receive typed ChannelDelivery payloads and return replacements; use channel.state for state changes. kindHint is removed; use path-derived channel:<name> identities, audience() visibility classification, and the renamed CORS options described in the v27 upgrade guide.

• 4a4951e: Slack's renderers.taskCard now receives TaskCard instead of TaskCardView; use callState and callLabel from eve/events for call rendering. Teams channel state replaces pendingAuthActivityId with pendingAuthActivityIds.

• 4a4951e: Evals now use v27 facts and interaction projections, with call matchers such as turn.waitForToolCall() and renamed helpers such as calledAgent() and awaitingInput(). The remoteUrl field and matcher are removed; use the v27 upgrade guide to migrate legacy assertions.

• 4a4951e: Hooks and channel handlers now receive v27 facts with coordinates in event.scope and session state in ctx.view. Update channel handlers to (event, ctx) with ctx.channel, and migrate instrumentation providers to InstrumentationEvent<K> and the new lifecycle names.

• 4a4951e: Approvals, questions, sign-ins, and budget prompts now share the Interaction model, with answers shaped as { interactionId, optionId?, text? } and approval choices approve / deny. Turns pause only for human input, and cancelling an agent task retires it.

• 4a4951e: Remote agents now use protocol 3 and can still relay approvals, questions, and sign-ins from protocol-2 children. Upgrade callers before their remote agents, or both together: protocol-3 children cannot relay human-input requests to older callers.

• 4a4951e: Session streams now use v27 facts, line-based cursors, and immutable SessionView snapshots queried through eve/events. Checkpoints require version 18; keep older sessions on their original deployments and follow the v27 upgrade guide before updating event consumers or restoring persisted history.

Patch Changes

• 4a4951e: Deliver concurrent messages to the same ctx.agent() session in send order, preventing out-of-order delivery from leaving calls waiting indefinitely for a reply.
• 4a4951e: Parent session streams now record accepted child deliveries as child.sent; use agentCallActivity(state, callId) from eve/client to inspect per-call child activity, including shared turns.
• 4a4951e: An unhandled hook error now fails the running turn instead of only being logged. Cancellation requested with ctx.cancel() takes effect only if the handler returns successfully.
• caa9172: The bundled eve dev self-modification subagent is now offered only to the local developer: sessions authenticated by localDev() or by the linked project's Vercel development token. Chat users and principals from authored authenticators, including HTTP Basic operators, no longer get the editor and must edit files directly; there is no local authorization override, and callers forwarded by a same-machine tunnel can still get the editor if the channel uses localDev().
• 4a4951e: Remote child sessions no longer fail solely because the parent has already consumed their result or stopped waiting for it, such as after a lost acknowledgement.
• 4a4951e: Remote session stream proxies now reject unexpected content types and prevent upstream responses from being served as executable content. Error responses with unexpected content types are replaced with generic JSON while preserving the error status.
• e7453f1: Session callbacks now reach only public addresses. The eve channel rejects callback URLs with a non-HTTP scheme or a loopback host, and callback delivery refuses to connect when a callback hostname resolves to a loopback, private, link-local, or reserved address. Loopback callbacks still work on local development servers (eve dev and vercel dev).
• 4a4951e: Built-in channels keep sign-in links and codes out of shared messages; when private delivery is unavailable, they show a credential-free status instead.
• 4a4951e: Interrupted durable steps recover from recorded outcomes without automatically replaying observed tool calls. Exhausted step retries fail the turn without closing the session, but external effects with unrecorded outcomes still require application-level idempotency.
• 4a4951e: v27 deployments can read v26 session history through the v27 client and stream APIs. Convert previously saved legacy events with convertLegacyEvents from eve/internal/legacy-events, a temporary migration aid.
• 4a4951e: eve dev now validates session event lines before writing them and rejects lines larger than 8 MiB. Set EVE_CHECK_SESSION_EVENTS=0 to disable validation or =1 to enable it outside development.

0.83.3

Patch Changes

• 3e96a14: An optimistic message no longer stays in the submitted state when its turn is cancelled or fails before the agent reads it. EveAgentStore now marks that message failed, so it keeps its own text, and later messages reconcile against their own submissions. A steered message the cancelled turn never read now also lets its send() settle. Thanks @​brettcrane for reporting this in #3102.
• 8077f2d: With otel({ traceChannelRequests: true }), the agent.channel.request span now ends when the response body finishes, fails, or is cancelled, not when the route handler returns. Session stream requests no longer log You can only call end() on a span once. for workflow.stream.read.connect, and request spans now cover the full streaming time. Thanks @​ahcarpenter for reporting this and proposing the fix in #4256.
• 54adf15: chatSdkChannel now reports failed final reply delivery with an error-id notice and a note to the model, avoids reposting streamed replies, and skips unchanged final edits after state restoration. Thanks @​diegojohnsonl for reporting this in #4801.
• 4280d51: A hook that cancels the turn at compaction.completed no longer drops the compaction's summary call from the session's usage. session.waiting and session limits now count it.
• 181caed: Compaction no longer re-runs on every step when the current user message is most of the context window. After a compaction, eve keeps at most 20,000 tokens of the latest conversation word for word next to the summary, with tool results shortened to 2,000 characters; a current message larger than that keeps its start and end, and the cut-out middle is summarized. A compaction that cannot bring the history under the threshold now fails the session, without retrying the step, with an error that says to start a new session or send a smaller message.

... (truncated)

Commits

• 189e999 Version Packages (#5376)
• 8efe110 fix(eve): tag the sandbox image by its Dockerfile contents (#5378)
• e7453f1 fix(eve): block session callbacks to non-public destinations (#5364)
• caa9172 fix(eve): offer local self-modification only to the local developer (#5375)
• 69346ff feat(eve)!: remove legacy remote agent protocol (#5371)
• 4a4951e feat(eve)!: consolidate pre-1.0 agent and session contracts (#4855)
• b83e100 Version Packages (#5345)
• 243a4a4 fix(eve): refuse localDev() callers on other machines (#5354)
• 200d2d8 fix(eve): refuse cross-site browser requests in localDev() (#5353)
• da515dc fix(eve): match OpenAPI operation filters against the spec's operationId (#5351)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 30, 2026 3:38am UTC

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1793330425733
• lhr-1793330438456
• lhr-1793330450564
• lhr-1793330462020
• lhr-1793330473426
• lhr-1793330484772
• lhr-1793330496048
• lhr-1793330507324
• lhr-1793330518634

Reports are also available as workflow artifacts

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1793331037562
• lhr-1793331049401
• lhr-1793331060797
• lhr-1793331071667
• lhr-1793331082445
• lhr-1793331093220
• lhr-1793331103951
• lhr-1793331114949
• lhr-1793331126124

Reports are also available as workflow artifacts

[daggerstuff]

@dependabot rebase

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1793331675228
• lhr-1793331687892
• lhr-1793331699923
• lhr-1793331711240
• lhr-1793331722497
• lhr-1793331733723
• lhr-1793331745010
• lhr-1793331756256
• lhr-1793331767538

Reports are also available as workflow artifacts