Skip to content

Repository navigation

chore(deps): Bump the npm-minor-and-patch group in /service with 4 updates - #281

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/service/npm-minor-and-patch-4d0db78e8f
Oct 5, 2026
Merged

chore(deps): Bump the npm-minor-and-patch group in /service with 4 updates#281
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/service/npm-minor-and-patch-4d0db78e8f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group in /service with 4 updates: @anthropic-ai/sdk, @types/node, globals and vitest.

Updates @anthropic-ai/sdk from 0.129.0 to 0.131.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.131.0

0.131.0 (2026-09-30)

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

  • api: add list spend limits endpoint (cfb78c8)

Chores

  • client: deprecate sonnet 4.5 (d72cfaf)

sdk: v0.130.0

0.130.0 (2026-09-30)

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

  • api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)
  • api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)
  • api: add per-user usage and cost reports to the Admin API analytics (0a74a28)
  • api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)
  • api: add repository error types to Managed Agents session errors (6735615)
  • api: allow removing a plugin's org-wide installation setting (c7d120f)
  • api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)
  • api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

  • api: make memory store description, metadata, archived_at required (ed68900)
  • api: type admin plugin preference and marketplace fields as enums (942ae01)
  • pagination: auto-paging continues past an empty page while next_page is set (2d75266)
  • tool-runner: only send API fields for runnable tools (#404) (a62c2a2)
  • tools: stop the session tool runner after any idle that ends the turn (#878) (cab32f8)

Chores

  • api: update MCP Tunnels types and descriptions (394d60c)
  • docs: remove placeholder enum descriptions (04f0812)
  • tests: fixture update (#381) (9cfe4d4)
Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.131.0 (2026-09-30)

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

  • api: add list spend limits endpoint (cfb78c8)

Chores

  • client: deprecate sonnet 4.5 (d72cfaf)

0.130.0 (2026-09-30)

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

  • api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)
  • api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)
  • api: add per-user usage and cost reports to the Admin API analytics (0a74a28)
  • api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)
  • api: add repository error types to Managed Agents session errors (6735615)
  • api: allow removing a plugin's org-wide installation setting (c7d120f)
  • api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)
  • api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

  • api: make memory store description, metadata, archived_at required (ed68900)
  • api: type admin plugin preference and marketplace fields as enums (942ae01)
  • pagination: auto-paging continues past an empty page while next_page is set (2d75266)
  • tool-runner: only send API fields for runnable tools (#404) (a62c2a2)
  • tools: stop the session tool runner after any idle that ends the turn (#878) (cab32f8)

Chores

  • api: update MCP Tunnels types and descriptions (394d60c)
  • docs: remove placeholder enum descriptions (04f0812)
  • tests: fixture update (#381) (9cfe4d4)
Commits
  • d49bdab Merge pull request #1230 from anthropics/release-please--branches--main--chan...
  • 4759f20 chore: release main
  • 9ded9f3 codegen metadata
  • d72cfaf chore(client): deprecate sonnet 4.5
  • cfb78c8 feat(api): add list spend limits endpoint
  • e8f4c28 Merge branch 'main' into next
  • e6ca605 Merge pull request #1229 from anthropics/release-please--branches--main--chan...
  • 2dd6192 chore: release main
  • cab32f8 fix(tools): stop the session tool runner after any idle that ends the turn (#...
  • 0a74a28 feat(api): add per-user usage and cost reports to the Admin API analytics
  • Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.4

Commits

Updates globals from 17.12.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

  • Update globals (2026-10-01) (#354) b007369

sindresorhus/globals@v17.12.0...v17.13.0

Commits

Updates vitest from 5.0.2 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the npm-minor-and-patch group
02f6882 
Bumps the npm-minor-and-patch group in /service with 4 updates: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [globals](https://github.com/sindresorhus/globals) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@anthropic-ai/sdk` from 0.129.0 to 0.131.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.129.0...sdk-v0.131.0)

Updates `@types/node` from 26.6.3 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `globals` from 17.12.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.12.0...v17.13.0)

Updates `vitest` from 5.0.2 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.131.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: vitest
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) October 5, 2026 09:29
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

PR guide

Auto-generated from changed paths. Fill in Summary and How to verify in the PR description above.

Touches: tooling config

Diff: 2 files changed, 111 insertions(+), 111 deletions(-)

Suggested verify

  • npm run lint
  • npm run format:check
  • npm run test:run or targeted Vitest files for the changed area
  • npm run build

Checklist (applies to this PR)

  • No unintended secrets or local-only config committed

Reviewer focus

  • Dependency, Vite, TypeScript, ESLint, and Prettier changes that can affect local and CI runs

Commits

  • 02f6882 chore(deps): Bump the npm-minor-and-patch group

Files by area

Area Files
tooling config 2

CI

Required checks: verify runs format/lint/audit/typecheck/test/build as separate per-concern checks for every PR. Coverage tables are posted separately.

Template: pull_request_template.md

@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@anthropic-ai/sdk 0.131.0 UnknownUnknown
npm/@oxc-project/types 0.152.0 UnknownUnknown
npm/@rolldown/binding-android-arm-eabi 1.2.12 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.2.12 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.2.12 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.2.12 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.2.12 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.2.12 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.2.12 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.2.12 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.2.12 UnknownUnknown
npm/@types/node 26.6.4 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@vitest/mocker 5.0.3 UnknownUnknown
npm/@vitest/spy 5.0.3 UnknownUnknown
npm/globals 17.13.0 🟢 4.6
Details
CheckScoreReason
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 6/22 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 9security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/rolldown 1.2.12 UnknownUnknown
npm/source-map-js 1.2.2 ⚠️ 2.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/vite 8.3.2 🟢 7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 20/26 approved changesets -- score normalized to 7
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 7detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts⚠️ 1binaries present in source code
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
SAST🟢 10SAST tool is run on all commits
npm/vitest 5.0.3 UnknownUnknown
npm/why-is-node-running 3.2.1 🟢 3.8
Details
CheckScoreReason
Code-Review⚠️ 1Found 4/30 approved changesets -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
Packaging⚠️ -1packaging workflow not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • service/package-lock.json

@github-actions
github-actions Bot merged commit e3f70ca into main Oct 5, 2026
24 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/service/npm-minor-and-patch-4d0db78e8f branch October 5, 2026 09:30
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

Lighthouse CI report

Thresholds are informational (warn-level) for now; see ./.lighthouserc.json.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants