Skip to content

chore: bump the npm-dependencies group across 1 directory with 15 updates#52

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-58ee5a15cb
Open

chore: bump the npm-dependencies group across 1 directory with 15 updates#52
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-58ee5a15cb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 15 updates in the / directory:

Package From To
@ai-sdk/devtools 0.0.24 1.0.6
@ai-sdk/anthropic 3.0.96 4.0.16
@ai-sdk/google 3.0.91 4.0.18
@ai-sdk/openai 3.0.84 4.0.16
@biomejs/biome 2.5.3 2.5.4
@nx/js 22.7.7 23.1.0
@swc-node/register 1.11.1 1.12.1
@swc/core 1.15.43 1.15.46
@tanstack/intent 0.0.44 0.3.6
@types/node 25.9.5 26.1.1
ai 6.0.224 7.0.31
nx 22.7.7 23.1.0
tsx 4.23.0 4.23.1
typescript 6.0.3 7.0.2
vite 6.4.3 8.1.5

Updates @ai-sdk/devtools from 0.0.24 to 1.0.6

Release notes

Sourced from @​ai-sdk/devtools's releases.

@​ai-sdk/huggingface@​0.0.29

Patch Changes

  • Updated dependencies [2fd6076]
    • @​ai-sdk/provider-utils@​3.0.30
    • @​ai-sdk/openai-compatible@​1.0.46

@​ai-sdk/mcp@​0.0.25

Patch Changes

  • Updated dependencies [2fd6076]
    • @​ai-sdk/provider-utils@​3.0.30
Changelog

Sourced from @​ai-sdk/devtools's changelog.

1.0.6

Patch Changes

  • 5be55f1: Use an explicit latest tag in the DevTools viewer command so it starts from monorepo workspaces where DevTools is only installed transitively.

1.0.5

Patch Changes

  • 27d294d: feat(ai): group orphaned tool calls after tool approvals under parent span

1.0.4

Patch Changes

  • c29e0d7: chore (devtools): remove leftover module field from package.json (dual CJS/ESM publishing was removed in AI SDK 7)

1.0.3

Patch Changes

  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3

1.0.2

Patch Changes

  • 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
  • Updated dependencies [5c5c0f5]
    • @​ai-sdk/provider@​4.0.2

1.0.1

Patch Changes

  • Updated dependencies [0274f34]
    • @​ai-sdk/provider@​4.0.1

1.0.0

Major Changes

  • 1949571: feat(ai): make experimental_telemetry stable
  • 6542d93: feat(ai): change naming nomenclature for *TelemetryIntegration to *Telemetry
  • cf93359: feat(ai): remove/refactor event data sent via callbacks
  • 116c89f: feat(ai): remove telemetry data from the user-facing event data
  • 8359612: Start v7 pre-release

... (truncated)

Commits

Updates @ai-sdk/anthropic from 3.0.96 to 4.0.16

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/openai@​4.0.16

Patch Changes

  • 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

    A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

  • Updated dependencies [cd06458]

    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/xai@​4.0.16

Patch Changes

  • 1e2ae1f: fix(xai): handle empty HTTP 202 responses while polling videos
  • 54e5498: fix(provider/xai): preserve images in Responses API tool results
  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
    • @​ai-sdk/openai-compatible@​3.0.12

@​ai-sdk/mistral@​4.0.13

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/groq@​4.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/klingai@​4.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/perplexity@​4.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/react@​3.0.232

Patch Changes

  • Updated dependencies [19093fd]
    • ai@6.0.230
    • @​ai-sdk/provider-utils@​4.0.40

... (truncated)

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.16

Patch Changes

  • afcf19c: fix(provider/anthropic): preserve web search citations when replaying assistant messages
  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.15

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8

4.0.12

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod

4.0.11

... (truncated)

Commits

Updates @ai-sdk/google from 3.0.91 to 4.0.18

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​4.0.18

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.18

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.17

Patch Changes

  • 5b4a299: fix(provider/google): forward Vertex-only imageConfig options (personGeneration, prominentPeople, imageOutputOptions)

4.0.16

Patch Changes

  • 662ddfc: Allow google.interactions agent requests to include supported tools, including file_search.

4.0.15

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

  • Updated dependencies [e193290]

... (truncated)

Commits

Updates @ai-sdk/openai from 3.0.84 to 4.0.16

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​4.0.16

Patch Changes

  • 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

    A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

  • Updated dependencies [cd06458]

    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/openai@​3.0.86

Patch Changes

  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40
Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.16

Patch Changes

  • 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

    A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

  • Updated dependencies [cd06458]

    • @​ai-sdk/provider-utils@​5.0.11

4.0.15

Patch Changes

  • 0063c2d: Add the client-executed OpenAI Responses API computer tool with batched actions and screenshot outputs.

4.0.14

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.13

Patch Changes

  • 7805e4a: Fix realtime transcription auth header handling: per-call authorization headers now override configuration headers regardless of header-key casing (last case-variant wins), and the Bearer scheme is matched case-insensitively.
  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
  • Updated dependencies [4be62c1]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9

4.0.12

Patch Changes

  • e193290: Add connectToWebSocket to @ai-sdk/provider-utils: a shared WebSocket connect layer (constructor resolution, header hygiene, abort wiring, message decoding) analogous to postToApi for HTTP. The openai and xai streaming transcription models now use it instead of hand-rolled connects. For openai and xai this also means WebSocket constructor failures now surface as stream errors instead of throwing synchronously from doStream, an already-aborted signal no longer constructs a socket, and the caller's audio stream is cancelled on pre-open failures. Messages are processed in order with close handling deferred behind pending frames, audio send loops apply backpressure via the socket's bufferedAmount, and failed sends cancel the caller's audio stream.
  • e193290: Fix streaming transcription over header-capable WebSocket implementations: the realtime WebSocket handshake sent the api key in both the openai-insecure-api-key subprotocol and the Authorization header, which OpenAI rejects ("You must only send one of protocol api key and Authorization header"). The Authorization header is now stripped when the subprotocol carries the key.
  • e193290: Strip undefined header values before the streaming transcription WebSocket constructor (header-capable implementations like ws throw on undefined values).
  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8

4.0.11

Patch Changes

... (truncated)

Commits
  • 9352ac1 Version Packages (#17417)
  • 75f86f4 fix(provider/openai, provider/open-responses): guard Responses API responses ...
  • b8241a6 Version Packages (#17264)
  • 0063c2d feat: add OpenAI Responses API computer tool support (#17290)
  • 6976682 Version Packages (#17196)
  • cb68fa6 Version Packages (#17175)
  • cd12954 fix: reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful e...
  • 7805e4a feat(provider-utils): experimental transcription-stream WebSocket envelope (#...
  • cc3ab3a Version Packages (#17172)
  • e193290 fix: streaming transcription WebSocket fixes + shared connect layer (#17093)
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.3 to 2.5.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.4

2.5.4

Patch Changes

  • #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

  • #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

  • #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

  • #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

  • #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

    The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

  • #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

  • #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

    - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

  • #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

What's Changed

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.4

Patch Changes

  • #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

  • #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

  • #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

  • #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

  • #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

    The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

  • #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

  • #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

    - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

  • #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

Commits

Updates @nx/js from 22.7.7 to 23.1.0

Release notes

Sourced from @​nx/js's releases.

23.1.0 (2026-07-13)

🚀 Features

  • ⚠️ angular: support angular v22 (#35851, #35910)
  • core: show a performance report at the end of every run (#36077)
  • core: support filtered targetDefaults via the nested-array shape (#36049)
  • core: re-add isCacheableTask helper (#36177)
  • core: add mouse support to the terminal UI (#35868)
  • core: scaffold create-nx-workspace into the current directory (#36134)
  • expo: support Expo SDK 56 (#35904, #35714)
  • ⚠️ linter: drop eslint v8 support (#36006)
  • linter: add migration to drop typescript-eslint v8-removed rules from flat configs (#36123)
  • misc: add next 14 to 15 and react 18 to 19 upgrade paths (#36031)
  • nx-cloud: add utm tracking to clickable cloud prompt links (#36028)
  • nx-dev: show product hunt launch banner in docs (#36112)
  • nx-dev: show product hunt launch banner in docs" (#36129, #36112)
  • release: add option to force changelog generation for programmatic usage (#36242)
  • repo: enable the tsgo compiler workspace-wide (#35926, #35047, #35167)
  • rspack: support @​rspack/core@​2 and @​rsbuild/core@​2 (multi-version compliance) (#35682, #35764, #13420, #781)
  • storybook: update Storybook to support Angular 22 (#36293)
  • testing: add migration to verify typecheck after the 23.1 migration (#36106)
  • vite: add configurable ts paths build/test targets and stabilize build coordination (#34890)

🩹 Fixes

  • angular: resolve esbuild option paths relative to the workspace root (#36017, #35936)
  • angular: bump prescribed angular version to 22.0.4 (#36130)
  • angular: make nx migrate to Angular 22 leave a buildable workspace (#36183)
  • angular-rspack: surface compilation failures as build errors and release resources on teardown (#36018)
  • bundling: restore preprocessor extensions in postcss normalizeOp… (#36057, #35854)
  • bundling: prevent TS6059 when an app imports a workspace lib from source (#36217, #35017)
  • core: avoid tsconfig path false positives for sibling project roots (#35796, #35795, #35786)
  • core: do not write minimumReleaseAgeExclude during nx migrate (#36045)
  • core: do not crash nx migrate on non-semver dependency specifiers (#36051)
  • core: format AI-edited files after agentic migrations (#36064)
  • core: prefer module.registerHooks to avoid DEP0205 deprecation warning (#36081)
  • core: prevent nx migrate crash when include=optional filters out the target package (#36087)
  • core: make nx migrate honor preapproved packages and emit a valid temp workspace (#36086)
  • core: skip daemon project-graph recompute on no-op file rewrites (#36082)
  • core: prevent the TUI from auto-selecting a completed task when a batch finishes (#35833)
  • core: deregister pseudo-terminal exit handlers when tasks finish (#36115)
  • core: prevent path traversal / zip-slip in self-hosted remote cache (#36116)
  • core: respect explicit --nxCloud=skip for AI agents in create-nx-workspace (#36131)
  • core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#36132, #36116)
  • core: throw actionable error when pnpm .modules.yaml is missing (#35666, #35635)
  • core: support ${configDir} in tsconfig path alias resolution (#36037, #35804)
  • core: prevent non-npm devEngines pin from breaking npm registry lookups (#36020, #35815)
  • core: clarify nx sync remediation messaging and surface spinner output in non-tty (#35747)
  • core: exclude direct-dependency overrides from generated package.json (#36040, #35675)

... (truncated)

Commits
  • a88e494 chore(repo): migrate to nx 23.1.0-rc.2 (#36269)
  • ba1d651 fix(js): bump @​swc/cli to 0.8.1 to patch critical decompress advisory (#36294)
  • 03483ea fix(js): pin rootDir on composite tsconfigs for ts6 (ts-jest strips composite...
  • 60ac6f3 fix(js): pin tsconfig root dir even when it matches the config directory (#36...
  • c74bbcb fix(js): wait for process tree exit when stopping node executor tasks (#36230)
  • c425d95 fix(js): keep tsconfigs compiling and config files loading under TypeScript 6...
  • 1082577 fix(js): preserve esModuleInterop default when migrating to TypeScript 6 (#36...
  • 80cabcd fix(js): prevent Windows TS6059 rootDir errors in tsc builds (#36184)
  • 6486e86 fix(devkit): restore prettier v2 support in formatFiles (#36193)
  • 94bf233 fix(js): restore the pre-TypeScript 6 default of loading all @​types (#36163)
  • Additional commits viewable in compare view

Updates @swc-node/register from 1.11.1 to 1.12.1

Commits
  • 8fdebc5 chore(release): publish
  • b2663d0 chore(deps): update pnpm to v11.14.0 (#1061)
  • 986094d fix(register): always inline source maps in auto mode so debuggers work (#1062)
  • eec0e8c chore(register): replace json-stable-stringify (#1060)
  • f3462b2 chore(release): publish
  • 0ee7282 chore: migrate to workspace versions
  • fd2a91f chore: remove useless npm version script
  • 9729f75 chore(deps): update dependency ava to v8 (#1033)
  • 1f1c80b chore(deps): update pnpm to v11.13.1 (#1058)
  • e249b6d fix(@​swc-node/register): import of dynamically loaded files; fixes #883 (#965)
  • Additional commits viewable in compare view

Updates @swc/core from 1.15.43 to 1.15.46

Changelog

Sourced from @​swc/core's changelog.

[1.15.46] - 2026-07-19

Bug Fixes

  • (deps) Update crossbeam-epoch to 0.9.20 (#12004) (fababa1)

  • (es/fixer) Normalize for-head ident patterns (#11968) (af681bc)

  • (es/fixer) Preserve parens around PURE-annotated receivers (#12022) (73d8941)

  • (es/hygiene) Ignore eval in default hygiene pass (#12003) (dd43ad6)

  • (es/minifier) Eliminate unused classes with cyclic references (#11963) (63a94b9)

  • (es/minifier) Preserve switch fallthrough termination (#11971) (a5d19ae)

  • (es/minifier) Check last case (#11972) (060c7ac)

  • (es/minifier) Disable IIFE invoke when there's eval (#11984) (eabe4be)

  • (es/minifier) Invoke IIFE when has eval (#11987) (457df11)

  • (es/minifier) Make Infect Collect collect every used ident (#11998) (fb9ebee)

  • (es/minifier) Measure number length precisely (#12026) (54d139a)

  • (es/module) Rewrite .tsx imports to .js unless JSX is preserved (#11995) (c341d9c)

  • (es/module) Rewrite SystemJS transform (#11996) (2f47530)

  • (es/modules) Resolve relative symlinked inputs from cwd (#11883) (01e857d)

  • (es/react) Emit jsxdev source for fragments (#11993) (a70ce24)

... (truncated)

Commits
  • 9383162 chore: Publish 1.15.46 with swc_core v74.0.1
  • 035084a chore: Publish 1.15.46-nightly-20260719.1 with swc_core v74.0.1
  • 42d599f chore: Publish 1.15.45-nightly-20260719.1 with swc_core v74.0.1
  • 715eab8 chore: Publish 1.15.44-nightly-20260718.1 with swc_core v74.0.0
  • d6833cc refactor(es/lexer): remove smartstring dependency (#12013)
  • 5761a2b refactor: remove direct rkyv dependencies (#12010)
  • f36e4b6 refactor(es/helpers): Generate inline helpers from canonical ESM sources (#12...
  • 2f47530 fix(es/module): Rewrite SystemJS transform (#11996)
  • 26d8a28 build: Remove vergen dependency (#11976)
  • See full diff in compare view

Updates @tanstack/intent from 0.0.44 to 0.3.6

Release notesDescription has been truncated

@dependabot
chore: bump the npm-dependencies group across 1 directory with 15 upd…
9b04c92 
…ates

Bumps the npm-dependencies group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/devtools](https://github.com/vercel/ai/tree/HEAD/packages/devtools) | `0.0.24` | `1.0.6` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `3.0.96` | `4.0.16` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `3.0.91` | `4.0.18` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.84` | `4.0.16` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.3` | `2.5.4` |
| [@nx/js](https://github.com/nrwl/nx/tree/HEAD/packages/js) | `22.7.7` | `23.1.0` |
| [@swc-node/register](https://github.com/swc-project/swc-node) | `1.11.1` | `1.12.1` |
| [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.15.43` | `1.15.46` |
| [@tanstack/intent](https://github.com/TanStack/intent) | `0.0.44` | `0.3.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.1.1` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.224` | `7.0.31` |
| [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx) | `22.7.7` | `23.1.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.3` | `8.1.5` |



Updates `@ai-sdk/devtools` from 0.0.24 to 1.0.6
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/devtools/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/devtools@1.0.6/packages/devtools)

Updates `@ai-sdk/anthropic` from 3.0.96 to 4.0.16
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.16/packages/anthropic)

Updates `@ai-sdk/google` from 3.0.91 to 4.0.18
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.18/packages/google)

Updates `@ai-sdk/openai` from 3.0.84 to 4.0.16
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.16/packages/openai)

Updates `@biomejs/biome` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.4/packages/@biomejs/biome)

Updates `@nx/js` from 22.7.7 to 23.1.0
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.0/packages/js)

Updates `@swc-node/register` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/swc-project/swc-node/releases)
- [Commits](https://github.com/swc-project/swc-node/compare/@swc-node/register@1.11.1...@swc-node/register@1.12.1)

Updates `@swc/core` from 1.15.43 to 1.15.46
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.15.46/packages/core)

Updates `@tanstack/intent` from 0.0.44 to 0.3.6
- [Release notes](https://github.com/TanStack/intent/releases)
- [Commits](https://github.com/TanStack/intent/compare/@tanstack/intent@0.0.44...@tanstack/intent@0.3.6)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `ai` from 6.0.224 to 7.0.31
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.31/packages/ai)

Updates `nx` from 22.7.7 to 23.1.0
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.0/packages/nx)

Updates `tsx` from 4.23.0 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.0...v4.23.1)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `vite` from 6.4.3 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@ai-sdk/devtools"
  dependency-version: 1.0.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.18
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@nx/js"
  dependency-version: 23.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@swc-node/register"
  dependency-version: 1.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@swc/core"
  dependency-version: 1.15.46
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/intent"
  dependency-version: 0.3.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: ai
  dependency-version: 7.0.31
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: nx
  dependency-version: 23.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026
@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednx@​23.1.04310093100100
Added@​ai-sdk/​google@​4.0.18721008898100
Added@​nx/​js@​23.1.0731009399100
Added@​ai-sdk/​openai@​4.0.16781008898100
Added@​tanstack/​intent@​0.3.67810010098100
Added@​ai-sdk/​anthropic@​4.0.16781008898100
Added@​types/​node@​26.1.11001008195100
Addedtsx@​4.23.11001008192100
Addedvite@​8.1.5981008298100
Added@​ai-sdk/​devtools@​1.0.68710010098100
Updatedtypescript@​6.0.3 ⏵ 7.0.294 -610089 -1100100 +10
Added@​swc-node/​register@​1.12.19810010090100
Added@​swc/​core@​1.15.469210010096100
Added@​biomejs/​biome@​2.5.410010010099100
Addedai@​7.0.319910010099100

View full report

@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @ai-sdk/devtools is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@ai-sdk/devtools@1.0.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ai-sdk/devtools@1.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/vite@8.1.5 → npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @nx/workspace is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@nx/js@23.1.0 → npm/@nx/workspace@23.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nx/workspace@23.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm nx is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/nx@23.1.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/nx@23.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants