langgraphjs

mirror of https://github.com/langchain-ai/langgraphjs.git synced 2026-07-21 16:45:24 -04:00

Author	SHA1	Message	Date
dependabot[bot]	4468bdf512	chore(deps): bump the npm_and_yarn group across 16 directories with 1 update (#2487 ) Bumps the npm_and_yarn group with 1 update in the /internal/bench directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /internal/environment_tests/test-exports-cf directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/checkpoint directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/checkpoint-mongodb directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/checkpoint-postgres directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/checkpoint-redis directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/checkpoint-sqlite directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/checkpoint-validation directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-api directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-cli directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-core directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-cua directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-supervisor directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-swarm directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/langgraph-ui directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /libs/sdk directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `vitest` from 3.2.4 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li> <li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li> <li>Add <code>--detect-async-leaks</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li> <li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code> - by <a href="https://github.com/thor-juhasz"><code>@thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li> <li>Support <code>update: "none"</code> and add docs about snapshots behavior on CI - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li> <li>Support playwright <code>launchOptions</code> with <code>connectOptions</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li> <li>Add <code>page/locator.mark</code> API to enhance playwright trace - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: <ul> <li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code> - by <a href="https://github.com/jgillick"><code>@jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li> <li>Add filters to <code>createSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li> <li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li> <li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li> <li>Allow passing down test cases to <code>toTestSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Add <code>userEvent.wheel</code> API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li> <li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li> <li>Support playwright persistent context - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li> <li>Added <code>detailsPanelPosition</code> option and button - by <a href="https://github.com/shairez"><code>@shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li> <li>Use BlazeDiff instead of pixelmatch - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li> <li>Add <code>findElement</code> and enable strict mode in webdriverio and preview - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>cli</strong>: <ul> <li>Add <a href="https://github.com/bomb"><code>@bomb</code></a>.sh/tab completions - by <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li>Support <code>ignore start/stop</code> ignore hints - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li> <li>Add <code>coverage.changed</code> option to report only changed files - by <a href="https://github.com/kykim00"><code>@kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>experimental</strong>: <ul> <li>Add <code>onModuleRunner</code> hook to <code>worker.init</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li> <li>Option to disable the module runner - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Updates `vitest` from 0.34.3 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li> <li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li> <li>Add <code>--detect-async-leaks</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li> <li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code> - by <a href="https://github.com/thor-juhasz"><code>@thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li> <li>Support <code>update: "none"</code> and add docs about snapshots behavior on CI - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li> <li>Support playwright <code>launchOptions</code> with <code>connectOptions</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li> <li>Add <code>page/locator.mark</code> API to enhance playwright trace - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: <ul> <li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code> - by <a href="https://github.com/jgillick"><code>@jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li> <li>Add filters to <code>createSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li> <li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li> <li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li> <li>Allow passing down test cases to <code>toTestSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Add <code>userEvent.wheel</code> API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li> <li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li> <li>Support playwright persistent context - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li> <li>Added <code>detailsPanelPosition</code> option and button - by <a href="https://github.com/shairez"><code>@shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li> <li>Use BlazeDiff instead of pixelmatch - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li> <li>Add <code>findElement</code> and enable strict mode in webdriverio and preview - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>cli</strong>: <ul> <li>Add <a href="https://github.com/bomb"><code>@bomb</code></a>.sh/tab completions - by <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li>Support <code>ignore start/stop</code> ignore hints - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li> <li>Add <code>coverage.changed</code> option to report only changed files - by <a href="https://github.com/kykim00"><code>@kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>experimental</strong>: <ul> <li>Add <code>onModuleRunner</code> hook to <code>worker.init</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li> <li>Option to disable the module runner - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Updates `vitest` from 0.34.3 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li> <li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li> <li>Add <code>--detect-async-leaks</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li> <li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code> - by <a href="https://github.com/thor-juhasz"><code>@thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li> <li>Support <code>update: "none"</code> and add docs about snapshots behavior on CI - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li> <li>Support playwright <code>launchOptions</code> with <code>connectOptions</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li> <li>Add <code>page/locator.mark</code> API to enhance playwright trace - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: <ul> <li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code> - by <a href="https://github.com/jgillick"><code>@jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li> <li>Add filters to <code>createSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li> <li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li> <li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li> <li>Allow passing down test cases to <code>toTestSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Add <code>userEvent.wheel</code> API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li> <li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li> <li>Support playwright persistent context - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li> <li>Added <code>detailsPanelPosition</code> option and button - by <a href="https://github.com/shairez"><code>@shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li> <li>Use BlazeDiff instead of pixelmatch - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li> <li>Add <code>findElement</code> and enable strict mode in webdriverio and preview - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>cli</strong>: <ul> <li>Add <a href="https://github.com/bomb"><code>@bomb</code></a>.sh/tab completions - by <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li>Support <code>ignore start/stop</code> ignore hints - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li> <li>Add <code>coverage.changed</code> option to report only changed files - by <a href="https://github.com/kykim00"><code>@kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>experimental</strong>: <ul> <li>Add <code>onModuleRunner</code> hook to <code>worker.init</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li> <li>Option to disable the module runner - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Updates `vitest` from 0.34.3 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-07 14:10:31 -07:00
dependabot[bot]	f552c05813	chore(deps): bump hono from 4.12.18 to 4.12.21 (#2492 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.21. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.21</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths</h3> <p>Affects: <code>app.mount()</code>. Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3</p> <h3>IP Restriction bypasses static deny rules for non-canonical IPv6</h3> <p>Affects: <code>hono/ip-restriction</code>. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5</p> <h3>Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection</h3> <p>Affects: <code>hono/cookie</code>. Fixes missing validation of <code>sameSite</code> and <code>priority</code> options against injection characters (<code>;</code>, <code>\r</code>, <code>\n</code>), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x</p> <h3>JWT middleware accepts any Authorization scheme, not only Bearer</h3> <p>Affects: <code>hono/jwt</code>, <code>hono/jwk</code>. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474</p> <hr /> <p>Users who use <code>app.mount()</code>, <code>hono/ip-restriction</code>, <code>hono/cookie</code>, or <code>hono/jwt</code>/<code>hono/jwk</code> are encouraged to upgrade to this version.</p> <h2>v4.12.20</h2> <h2>What's Changed</h2> <ul> <li>fix(route): preserve the base path of the mounted route() app by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4942">honojs/hono#4942</a></li> <li>fix(jsx): widen jsx and jsxFn children to Child[] by <a href="https://github.com/ashunar0"><code>@ashunar0</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4947">honojs/hono#4947</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ashunar0"><code>@ashunar0</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/4947">honojs/hono#4947</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.19...v4.12.20">https://github.com/honojs/hono/compare/v4.12.19...v4.12.20</a></p> <h2>v4.12.19</h2> <h2>What's Changed</h2> <ul> <li>ci: pin GitHub Actions to SHAs by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4932">honojs/hono#4932</a></li> <li>fix(serveStatic): make options parameter optional in all adapters by <a href="https://github.com/mixelburg"><code>@mixelburg</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4934">honojs/hono#4934</a></li> <li>fix(cookie): return the first cookie when there are multiple cookies with the same name by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4922">honojs/hono#4922</a></li> <li>feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by <a href="https://github.com/justinnais"><code>@justinnais</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4913">honojs/hono#4913</a></li> <li>feat(cache): key cache entries by configured vary headers by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4915">honojs/hono#4915</a></li> <li>feat(request): add <code>bytes()</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4921">honojs/hono#4921</a></li> <li>fix(stream): upgrade <code>@hono/node-server</code> to v2 and fix abort handling by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4940">honojs/hono#4940</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/justinnais"><code>@justinnais</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/4913">honojs/hono#4913</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.18...v4.12.19">https://github.com/honojs/hono/compare/v4.12.18...v4.12.19</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/a83ddb882e0c0b8c336050dba087bb2e1b12488e"><code>a83ddb8</code></a> 4.12.21</li> <li><a href="https://github.com/honojs/hono/commit/6cbb025ff87fca1a3d00d0ccca0eaf3a6385c3f1"><code>6cbb025</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/c831020fb1fa2e929d222f6c84e1abfe013e512b"><code>c831020</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/905aedbc20661e0e2fa378783a7ec44a5c3df43d"><code>905aedb</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/5463db2735476959b8af67756f4e513f4fe19115"><code>5463db2</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/c657a39ccc8d3194d345d9e82c8587bd25b5b6e8"><code>c657a39</code></a> 4.12.20</li> <li><a href="https://github.com/honojs/hono/commit/eb2d0c238adbcee5933d0f8c15f1a65a88f50565"><code>eb2d0c2</code></a> fix(jsx): widen jsx and jsxFn children to Child[] (<a href="https://redirect.github.com/honojs/hono/issues/4947">#4947</a>)</li> <li><a href="https://github.com/honojs/hono/commit/dcabbece347817ef7193439c39d28546b8ac3a85"><code>dcabbec</code></a> fix(route): preserve the base path of the mounted route() app (<a href="https://redirect.github.com/honojs/hono/issues/4942">#4942</a>)</li> <li><a href="https://github.com/honojs/hono/commit/7e62bcd22fa4e8f0e83cb564bac85e32f5434dd3"><code>7e62bcd</code></a> 4.12.19</li> <li><a href="https://github.com/honojs/hono/commit/e2f252a8745eb25f06485b8d43e8410bf027c8ef"><code>e2f252a</code></a> fix(stream): upgrade <code>@hono/node-server</code> to v2 and fix abort handling (<a href="https://redirect.github.com/honojs/hono/issues/4940">#4940</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.18...v4.12.21">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 22:35:51 -07:00
Christian Bromann	c6528b2ff4	chore(sdk): update vitest browser dependency (#2493 ) Updating Vitest dependencies due to vulnerability concerns.	2026-06-04 14:21:50 -07:00
dependabot[bot]	a4919b667e	chore(deps): bump the langchain group across 1 directory with 8 updates (#2476 ) Bumps the langchain group with 8 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) \| `1.3.28` \| `1.4.0` \| \| [@langchain/core](https://github.com/langchain-ai/langchainjs) \| `1.1.44` \| `1.1.48` \| \| [langchain](https://github.com/langchain-ai/langchainjs) \| `1.4.0-dev-1777615538778` \| `1.4.4` \| \| [@langchain/openai](https://github.com/langchain-ai/langchainjs) \| `1.4.5` \| `1.4.7` \| \| [@langchain/groq](https://github.com/langchain-ai/langchainjs) \| `1.2.0` \| `1.2.1` \| \| [@langchain/mistralai](https://github.com/langchain-ai/langchainjs) \| `1.0.8` \| `1.1.0` \| \| [@langchain/classic](https://github.com/langchain-ai/langchainjs) \| `1.0.32` \| `1.0.34` \| \| [langsmith](https://github.com/langchain-ai/langsmith-sdk) \| `0.6.0` \| `0.7.4` \| Updates `@langchain/anthropic` from 1.3.28 to 1.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/anthropic's releases</a>.</em></p> <blockquote> <h2><code>@langchain/anthropic</code><a href="https://github.com/1"><code>@1</code></a>.4.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10777">#10777</a> <a href="https://github.com/langchain-ai/langchainjs/commit/0cfcfc66897d8fafeb7e7ed90b7299eace9a7c37"><code>0cfcfc6</code></a> Thanks <a href="https://github.com/jonaslalin"><code>@jonaslalin</code></a>! - feat(anthropic): support strict tool calling for custom tools</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits/@langchain/anthropic@1.4.0">compare view</a></li> </ul> </details> <br /> Updates `@langchain/core` from 1.1.44 to 1.1.48 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/core's releases</a>.</em></p> <blockquote> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.48</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10832">#10832</a> <a href="https://github.com/langchain-ai/langchainjs/commit/1b24369a970ad6f56f1f428027f48601f87e62eb"><code>1b24369</code></a> Thanks <a href="https://github.com/info-arnav"><code>@info-arnav</code></a>! - fix(core, openrouter): make CJS default re-exports callable</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10666">#10666</a> <a href="https://github.com/langchain-ai/langchainjs/commit/2bb55b053f49f89e81e3252a7af08e86d71ddd95"><code>2bb55b0</code></a> Thanks <a href="https://github.com/hnustwjj"><code>@hnustwjj</code></a>! - feat(openrouter): surface reasoning content as v1 standard content blocks</p> <p><code>convertOpenRouterResponseToBaseMessage</code> and <code>convertOpenRouterDeltaToBaseMessageChunk</code> now copy OpenRouter's <code>reasoning</code> (flat string) and <code>reasoning_details</code> (structured array) fields onto <code>additional_kwargs.reasoning_content</code> / <code>additional_kwargs.reasoning_details</code>. A new <code>ChatOpenRouterTranslator</code> is registered in <code>@langchain/core</code> under the <code>"openrouter"</code> provider key so <code>AIMessage.contentBlocks</code> emits standard <code>{type: "reasoning"}</code> blocks alongside text and tool calls.</p> <p>Previously, reasoning text returned by reasoning-capable models routed through OpenRouter (DeepSeek R1, Minimax M2, Claude extended thinking, o-series, etc.) was silently dropped: only the <code>reasoning_tokens</code> count was preserved via <code>usage_metadata</code>. Consumers using standard content blocks (including the frontend agent UI patterns shown in the docs) could not display the model's chain of thought.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10918">#10918</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3999fab55870c6eea22d6d90c08aa472f9b2fac3"><code>3999fab</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(openai): stream custom tool calls through Responses API chunks</p> </li> </ul> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.47</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10906">#10906</a> <a href="https://github.com/langchain-ai/langchainjs/commit/f61b3450f275831e47e69c08899b4a2b67b4bdb3"><code>f61b345</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - feat(core): add uuid v6 utility support</p> <p>Add <code>v6</code> UUID generation support to <code>@langchain/core/utils/uuid</code> by vendoring the upstream uuidjs <code>v6</code> implementation and its <code>v1ToV6</code> helper, exporting <code>v6</code> from the UUID utils index, and adding tests for deterministic generation, buffer/offset behavior, validation/versioning, and ordering.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10872">#10872</a> <a href="https://github.com/langchain-ai/langchainjs/commit/a64007997a4940f51bba3c1c83dae89d1ccfb692"><code>a640079</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - chore(deps): remove redundant <code>@types/uuid</code> declarations</p> <p>Remove <code>@types/uuid</code> from package manifests that rely on <code>@langchain/core/utils/uuid</code> or do not require uuid type stubs directly, and refresh the lockfile entries accordingly.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10792">#10792</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3682268cd1844b2573b01f07bee367e21cb7bdc7"><code>3682268</code></a> Thanks <a href="https://github.com/Genmin"><code>@Genmin</code></a>! - fix(core): apply v1 message casting after implicit streaming aggregation</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10901">#10901</a> <a href="https://github.com/langchain-ai/langchainjs/commit/f26fc4a6f461d6d0f86d59bd00197ad510432c4a"><code>f26fc4a</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(testing): share fakeModel invocation state across bindTools instances</p> </li> </ul> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.46</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10847">#10847</a> <a href="https://github.com/langchain-ai/langchainjs/commit/1659e7d36e31e315c890fa98f43db887f7a2d52b"><code>1659e7d</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - chore(core): reduce transitive dependency exposure and tighten release hygiene</p> <p>Remove direct runtime dependencies on <code>ansi-styles</code>, <code>camelcase</code>, and <code>decamelize</code> by inlining equivalent logic in core internals, and enable npm provenance in the release workflow.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10790">#10790</a> <a href="https://github.com/langchain-ai/langchainjs/commit/ef78bc6a21f9a8808ba95c98db2023f0a6b51bcc"><code>ef78bc6</code></a> Thanks <a href="https://github.com/Genmin"><code>@Genmin</code></a>! - fix(core): keep different content block types separate when merging chunks</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits/@langchain/core@1.1.48">compare view</a></li> </ul> </details> <br /> Updates `langchain` from 1.4.0-dev-1777615538778 to 1.4.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">langchain's releases</a>.</em></p> <blockquote> <h2>langchain@1.4.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10900">#10900</a> <a href="https://github.com/langchain-ai/langchainjs/commit/6bbddca1f8f7f280583fd839bb40c00bf19a0d51"><code>6bbddca</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(langchain): unwrap tool message outputs in agent streams</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10706">#10706</a> <a href="https://github.com/langchain-ai/langchainjs/commit/4ecb6606feae3156a07de67e39e2027f857c476e"><code>4ecb660</code></a> Thanks <a href="https://github.com/JadenKim-dev"><code>@JadenKim-dev</code></a>! - fix(langchain): set name on todoListMiddleware ToolMessages</p> </li> </ul> <h2>langchain@1.4.1</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10879">#10879</a> <a href="https://github.com/langchain-ai/langchainjs/commit/eb480cb6df8e0fa792826155bfa00a6db4536444"><code>eb480cb</code></a> Thanks <a href="https://github.com/vignesh-gep"><code>@vignesh-gep</code></a>! - fix(langchain/createAgent): throw on terminal <code>providerStrategy</code> parse failure instead of silently resolving with <code>structuredResponse: undefined</code></p> <p>When <code>createAgent</code> was configured with <code>responseFormat</code> resolving to a <code>providerStrategy</code> (either passed explicitly or auto-promoted from a bare Zod / JSON schema for models whose profile reports <code>structuredOutput: true</code>), and the model produced a terminal response (no <code>tool_calls</code>) whose text could not be JSON-parsed or did not satisfy the schema, the agent silently exited with no <code>structuredResponse</code>, surfacing later as <code>TypeError: Cannot read properties of undefined</code>. The agent now throws a <code>StructuredOutputParsingError</code> in that case while still allowing the agent loop to continue when tool calls are present. Closes <a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10878">#10878</a>.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10872">#10872</a> <a href="https://github.com/langchain-ai/langchainjs/commit/a64007997a4940f51bba3c1c83dae89d1ccfb692"><code>a640079</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - chore(deps): remove redundant <code>@types/uuid</code> declarations</p> <p>Remove <code>@types/uuid</code> from package manifests that rely on <code>@langchain/core/utils/uuid</code> or do not require uuid type stubs directly, and refresh the lockfile entries accordingly.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10160">#10160</a> <a href="https://github.com/langchain-ai/langchainjs/commit/bba900c7c8781c7efec856d5d3e539a93f14e797"><code>bba900c</code></a> Thanks <a href="https://github.com/JadenKim-dev"><code>@JadenKim-dev</code></a>! - fix(langchain): prevent llmToolSelectorMiddleware from leaking into message stream</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits/@langchain/openai@1.4.4">compare view</a></li> </ul> </details> <br /> Updates `@langchain/openai` from 1.4.5 to 1.4.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/openai's releases</a>.</em></p> <blockquote> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.7</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10918">#10918</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3999fab55870c6eea22d6d90c08aa472f9b2fac3"><code>3999fab</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(openai): stream custom tool calls through Responses API chunks</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10791">#10791</a> <a href="https://github.com/langchain-ai/langchainjs/commit/fce9ab418901323618fdfaaa9fc350fa1c0d50e0"><code>fce9ab4</code></a> Thanks <a href="https://github.com/Genmin"><code>@Genmin</code></a>! - fix(openai): preserve top-level Responses API ids on AI messages</p> </li> </ul> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.6</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10902">#10902</a> <a href="https://github.com/langchain-ai/langchainjs/commit/229a7ad67b9a7ebd8df3ca451e0b8195bea0190e"><code>229a7ad</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(openai): preserve v1 assistant tool calls</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10895">#10895</a> <a href="https://github.com/langchain-ai/langchainjs/commit/36fb0ef1dc76c096dcfa0c777e10c9f9365a5240"><code>36fb0ef</code></a> Thanks <a href="https://github.com/BertBR"><code>@BertBR</code></a>! - fix(openai): guard bare <code>JSON.parse</code> in Responses API converter against trailing non-whitespace characters</p> <p><code>convertResponsesDeltaToChatGenerationChunk</code> previously called <code>JSON.parse(msg.text)</code> directly when <code>response.text.format.type === "json_schema"</code>. Some models (observed with <code>gpt-5-mini</code> on <code>service_tier: "auto"</code>) intermittently emit trailing non-whitespace characters (extra tokens, control characters) after a valid JSON object, causing a <code>SyntaxError</code> that propagates as an unhandled exception and kills the entire streaming response mid-flight. The parse is now wrapped in a <code>try</code>/<code>catch</code>: on failure, <code>additional_kwargs.parsed</code> is left undefined, the stream completes normally, and the existing <code>withStructuredOutput</code> pipeline handles the typed failure — <code>includeRaw: true</code> returns <code>{ raw, parsed: null }</code> via its <code>withFallbacks</code> wrapper, <code>includeRaw: false</code> throws a typed <code>OutputParserException</code> that the caller can catch and retry. Closes <a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10894">#10894</a>.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits/@langchain/openai@1.4.7">compare view</a></li> </ul> </details> <br /> Updates `@langchain/groq` from 1.2.0 to 1.2.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/groq's releases</a>.</em></p> <blockquote> <h2><code>@langchain/groq</code><a href="https://github.com/1"><code>@1</code></a>.2.1</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10872">#10872</a> <a href="https://github.com/langchain-ai/langchainjs/commit/a64007997a4940f51bba3c1c83dae89d1ccfb692"><code>a640079</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - chore(deps): remove redundant <code>@types/uuid</code> declarations</p> <p>Remove <code>@types/uuid</code> from package manifests that rely on <code>@langchain/core/utils/uuid</code> or do not require uuid type stubs directly, and refresh the lockfile entries accordingly.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/1b19e4f84d747b481879363b4884c20eb1c0f1a4"><code>1b19e4f</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10899">#10899</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/426e3aba21016d9ee070c3d130f74ae0047c9ce5"><code>426e3ab</code></a> chore: fix uuid changeset (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10916">#10916</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/245c98216ce4a6c4340954711a7ad60203283424"><code>245c982</code></a> chore(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10914">#10914</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/126dac5a7a2fac5978448185893038ac8ea6d994"><code>126dac5</code></a> chore(deps): bump brace-expansion from 5.0.5 to 5.0.6 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10912">#10912</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/1abe24becdddce94c5bd2acfaf920b60a683f22b"><code>1abe24b</code></a> chore(deps): bump fast-uri from 3.1.0 to 3.1.2 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10913">#10913</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/229a7ad67b9a7ebd8df3ca451e0b8195bea0190e"><code>229a7ad</code></a> fix(openai): preserve v1 assistant tool calls (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10902">#10902</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f26fc4a6f461d6d0f86d59bd00197ad510432c4a"><code>f26fc4a</code></a> fix(core): share fakeModel invocation state across bindTools instances (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10901">#10901</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/a0cd7477e59677c8d15e0e70b374afa0a2410582"><code>a0cd747</code></a> chore(deps): bump fast-xml-builder from 1.1.5 to 1.1.9 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10910">#10910</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/b208e625865fc7487876b652f479dbf854263e68"><code>b208e62</code></a> chore(deps): bump ip-address from 10.1.0 to 10.2.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10909">#10909</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f7e50fb8b98bd9969c0f5cf0967a06df15453453"><code>f7e50fb</code></a> feat(google): Service tier and custom headers (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10704">#10704</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/groq@1.2.0...@langchain/groq@1.2.1">compare view</a></li> </ul> </details> <br /> Updates `@langchain/mistralai` from 1.0.8 to 1.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/mistralai's releases</a>.</em></p> <blockquote> <h2><code>@langchain/mistralai</code><a href="https://github.com/1"><code>@1</code></a>.1.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10873">#10873</a> <a href="https://github.com/langchain-ai/langchainjs/commit/a74d574f7f086bea2f5c7a852e869f7d24be2f55"><code>a74d574</code></a> Thanks <a href="https://github.com/baptistejamin"><code>@baptistejamin</code></a>! - chore(mistralai): upgrade to <code>@mistralai/mistralai</code> v2</p> <p>Also populates <code>response_metadata.model</code> on chat completions (was missing before).</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/caad0914f068477293009dbf27a220fa96bdc4b8"><code>caad091</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10919">#10919</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f4a6149e3e754203f5886dd8c2bccaa7a6fd4f81"><code>f4a6149</code></a> chore(deps): bump fast-uri from 3.1.0 to 3.1.2 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10926">#10926</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/7b12f6dfa537932073f96b561d7c851b30d69132"><code>7b12f6d</code></a> chore(deps): bump protobufjs from 7.5.6 to 7.6.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10930">#10930</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5c6c5fef0cb392e782675ca5926e291a4295a653"><code>5c6c5fe</code></a> chore(deps): bump ws from 5.2.4 to 8.20.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10915">#10915</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/a8652ceeb5e36434565c96fc1a6bd9a4a36304cc"><code>a8652ce</code></a> docs: fix typos, add Ollama setup, update outdated references (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10922">#10922</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/2bb55b053f49f89e81e3252a7af08e86d71ddd95"><code>2bb55b0</code></a> feat(openrouter): surface reasoning as v1 standard content blocks (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10666">#10666</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/4ecb6606feae3156a07de67e39e2027f857c476e"><code>4ecb660</code></a> fix(langchain): set name on todoListMiddleware ToolMessages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10706">#10706</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/20f27dff08a4bd5a1a16c1c71a88405c9df82914"><code>20f27df</code></a> fix(ibm): handle API errors in streaming responses (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10721">#10721</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/45668734c3205e631cdd33ac071bbf733f4558c7"><code>4566873</code></a> feat(ibm): add integration test to IBM implementation (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10732">#10732</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/6e4337fec1a7707c1a1c709a7b6aa0c5efb7b11d"><code>6e4337f</code></a> fix(aws): add claude-haiku-4 to supportedToolChoiceValuesForModel (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10743">#10743</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/classic@1.0.8...@langchain/mistralai@1.1.0">compare view</a></li> </ul> </details> <br /> Updates `@langchain/classic` from 1.0.32 to 1.0.34 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/classic's releases</a>.</em></p> <blockquote> <h2><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.34</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/3999fab55870c6eea22d6d90c08aa472f9b2fac3"><code>3999fab</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/fce9ab418901323618fdfaaa9fc350fa1c0d50e0"><code>fce9ab4</code></a>]: <ul> <li><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.7</li> </ul> </li> </ul> <h2><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.33</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10872">#10872</a> <a href="https://github.com/langchain-ai/langchainjs/commit/a64007997a4940f51bba3c1c83dae89d1ccfb692"><code>a640079</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - chore(deps): remove redundant <code>@types/uuid</code> declarations</p> <p>Remove <code>@types/uuid</code> from package manifests that rely on <code>@langchain/core/utils/uuid</code> or do not require uuid type stubs directly, and refresh the lockfile entries accordingly.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/229a7ad67b9a7ebd8df3ca451e0b8195bea0190e"><code>229a7ad</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/36fb0ef1dc76c096dcfa0c777e10c9f9365a5240"><code>36fb0ef</code></a>]:</p> <ul> <li><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.6</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits/@langchain/classic@1.0.34">compare view</a></li> </ul> </details> <br /> Updates `langsmith` from 0.6.0 to 0.7.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.7.4</h2> <h2>What's Changed</h2> <ul> <li>fix(google-adk): add wrapt dependency by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2436">langchain-ai/langsmith-sdk#2436</a></li> <li>chore: lock dependencies by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2439">langchain-ai/langsmith-sdk#2439</a></li> <li>release(py): 0.7.4 by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2441">langchain-ai/langsmith-sdk#2441</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.3...v0.7.4">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.3...v0.7.4</a></p> <h2>v0.7.3</h2> <h2>What's Changed</h2> <ul> <li>fix: propagate tracingEnabled to nested traceables by <a href="https://github.com/hntrl"><code>@hntrl</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2427">langchain-ai/langsmith-sdk#2427</a></li> <li>chore(python): openai agents: delay span start for spans without inputs on start event by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2424">langchain-ai/langsmith-sdk#2424</a></li> <li>release(py): 0.7.3 by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2428">langchain-ai/langsmith-sdk#2428</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.2...v0.7.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.2...v0.7.3</a></p> <h2>v0.7.2</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.5.1 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2389">langchain-ai/langsmith-sdk#2389</a></li> <li>fix(js): Remove <a href="https://github.com/internal"><code>@internal</code></a> by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2391">langchain-ai/langsmith-sdk#2391</a></li> <li>release(js): 0.5.2 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2392">langchain-ai/langsmith-sdk#2392</a></li> <li>chore(deps-dev): bump openai from 5.8.2 to 6.18.0 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2378">langchain-ai/langsmith-sdk#2378</a></li> <li>chore(deps-dev): bump cross-env from 7.0.3 to 10.1.0 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2379">langchain-ai/langsmith-sdk#2379</a></li> <li>chore(deps-dev): bump the js-minor-and-patch group in /js with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2376">langchain-ai/langsmith-sdk#2376</a></li> <li>chore(deps-dev): bump node-fetch from 2.7.0 to 3.3.2 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2380">langchain-ai/langsmith-sdk#2380</a></li> <li>Google ADK LangSmith tracing enhancements by <a href="https://github.com/j-broekhuizen"><code>@j-broekhuizen</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2394">langchain-ai/langsmith-sdk#2394</a></li> <li>chore: update dependabot.yml to comply with posture checks by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2393">langchain-ai/langsmith-sdk#2393</a></li> <li>chore(deps): bump cryptography from 46.0.3 to 46.0.5 in /python in the uv group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2397">langchain-ai/langsmith-sdk#2397</a></li> <li>chore(deps-dev): bump the js-minor-and-patch group in /js with 6 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2398">langchain-ai/langsmith-sdk#2398</a></li> <li>chore(deps-dev): bump eslint-config-prettier from 8.10.0 to 10.1.8 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2399">langchain-ai/langsmith-sdk#2399</a></li> <li>chore(deps): bump packaging from 25.0 to 26.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2403">langchain-ai/langsmith-sdk#2403</a></li> <li>chore(deps-dev): bump pytest from 8.4.2 to 9.0.2 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2405">langchain-ai/langsmith-sdk#2405</a></li> <li>chore(deps): bump the py-minor-and-patch group across 1 directory with 20 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2406">langchain-ai/langsmith-sdk#2406</a></li> <li>fix(js): Log Vitest/Jest outputs even if test throws an error by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2408">langchain-ai/langsmith-sdk#2408</a></li> <li>fix(js): Remove async by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2409">langchain-ai/langsmith-sdk#2409</a></li> <li>release(js): 0.5.3 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2410">langchain-ai/langsmith-sdk#2410</a></li> <li>fix: ignoring p-queue dep by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2414">langchain-ai/langsmith-sdk#2414</a></li> <li>feat(js): add feedback config CRUD and annotation queue rubric items (closes LSPE-67) by <a href="https://github.com/bentanny"><code>@bentanny</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2420">langchain-ai/langsmith-sdk#2420</a></li> <li>fix(js): Add on_start handler for traceable, use in evaluate by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2421">langchain-ai/langsmith-sdk#2421</a></li> <li>release(js): 0.5.4 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2422">langchain-ai/langsmith-sdk#2422</a></li> <li>feat(python): add feedback config CRUD and annotation queue rubric items (closes LSPE-67) by <a href="https://github.com/bentanny"><code>@bentanny</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2419">langchain-ai/langsmith-sdk#2419</a></li> <li>feat(python): add exceptions_to_handle to <a href="https://github.com/traceable"><code>@traceable</code></a> by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2423">langchain-ai/langsmith-sdk#2423</a></li> <li>release(py): 0.7.2 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2426">langchain-ai/langsmith-sdk#2426</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/j-broekhuizen"><code>@j-broekhuizen</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2394">langchain-ai/langsmith-sdk#2394</a></li> <li><a href="https://github.com/bentanny"><code>@bentanny</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2420">langchain-ai/langsmith-sdk#2420</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1132e6ce6391d08158a93acb5c96b90521ac3230"><code>1132e6c</code></a> release(py): 0.7.4 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2441">#2441</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8c7cc783806e4a6d71300982d58ecb3c9bc658cd"><code>8c7cc78</code></a> chore: lock dependencies (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2439">#2439</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/62c256ea56fdee0bc539275c749a427e510ded8f"><code>62c256e</code></a> fix(google-adk): add wrapt dependency (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2436">#2436</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/e32d4c18a681553f47c93350f03dc0a0f0cc4890"><code>e32d4c1</code></a> release(py): 0.7.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2428">#2428</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1c51bf881dafaeb01432db629de7cafaabca79dc"><code>1c51bf8</code></a> chore(python): openai agents: delay span start for spans without inputs on st...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/a41bf22dadaea489a156dc06a9d0fbf1a977ff6d"><code>a41bf22</code></a> fix: propagate tracingEnabled to nested traceables (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2427">#2427</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/3a6e9dac4bf3a940f7ee47e420cc1422f9f4a4b4"><code>3a6e9da</code></a> release(py): 0.7.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2426">#2426</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/f665e865e7ab7a0ba1de447f2a1cf14c719af00a"><code>f665e86</code></a> feat(python): add exceptions_to_handle to <a href="https://github.com/traceable"><code>@traceable</code></a> (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2423">#2423</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/565c4a2c5769e698ecffbf7f43131ff9cc467f8d"><code>565c4a2</code></a> feat(python): add feedback config CRUD and annotation queue rubric items (clo...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/e1b1fe13c382371ebe4cffa1b95eba3bf74e2f37"><code>e1b1fe1</code></a> release(js): 0.5.4 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2422">#2422</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.6.0...v0.7.4">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>	2026-06-03 19:51:50 -07:00
dependabot[bot]	2a346a9d12	chore(deps): bump the angular group across 1 directory with 12 updates (#2477 ) Bumps the angular group with 12 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) \| `21.2.11` \| `22.0.0` \| \| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) \| `21.2.11` \| `22.0.0` \| \| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) \| `21.2.11` \| `22.0.0` \| \| [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) \| `21.2.11` \| `22.0.0` \| \| [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) \| `21.2.11` \| `22.0.0` \| \| [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) \| `21.2.11` \| `22.0.0` \| \| [@angular/build](https://github.com/angular/angular-cli) \| `21.2.9` \| `22.0.0` \| \| [@angular/cli](https://github.com/angular/angular-cli) \| `21.2.9` \| `22.0.0` \| \| [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) \| `21.2.11` \| `22.0.0` \| \| [@analogjs/vite-plugin-angular](https://github.com/analogjs/analog) \| `2.5.0` \| `2.6.0` \| \| [@analogjs/vitest-angular](https://github.com/analogjs/analog) \| `2.5.0` \| `2.6.0` \| \| [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) \| `21.2.11` \| `22.0.0` \| Updates `@angular/common` from 21.2.11 to 22.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/common's releases</a>.</em></p> <blockquote> <h2>VSCode Extension: 22.0.0</h2> <h3>Breaking Changes</h3> <p>The extension now bundles TypeScript version 6.0, which itself includes breaking changes, including <a href="https://www.typescriptlang.org/docs/handbook/release-notes/typescript-6-0.html#simple-default-changes">new defaults</a> such as <code>strict</code> being <code>true</code>. You will need to explicitly set <code>"strict": false</code> in your <code>tsconfig.json</code>. Alternatively, the extension supports configuring the <code>tsdk</code> in the <a href="https://code.visualstudio.com/docs/typescript/typescript-transpiling#_using-the-workspace-version-of-typescript">same way</a> as the built in TS/JS extension.</p> <h3>Fixes and features</h3> <ul> <li>fix(language-service): Add support for <code>@Input</code> with transforms (<a href="https://github.com/angular/angular/commit/dc9c72da9b4ca499eebf6e78d7ccc31ea6f63580">dc9c72da9b</a>)</li> <li>feat(language-service): add Document Symbols support for Angular templates (<a href="https://github.com/angular/angular/commit/cfd0f9950c08324e1c56f16d98a2e3081feeda58">cfd0f9950c</a>)</li> <li>feat(language-service): add angular template inlay hints support (<a href="https://github.com/angular/angular/commit/5a6d88626b604db937287a501cb723c088412a7e">5a6d88626b</a>)</li> <li>feat(language-service): Add support for idle timeout in defer blocks (<a href="https://github.com/angular/angular/commit/c6f98c723cdd2c209092927855f8cbaf63ecce30">c6f98c723c</a>)</li> </ul> <h2>22.0.0</h2> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/47fcbc470462192c4f9e273d8dce8b353d5baaa2"><img src="https://img.shields.io/badge/47fcbc4704-feat-blue" alt="feat - 47fcbc4704" /></a></td> <td>allow safe navigation to correctly narrow down nullables</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2896c93cc1077e1306acd91f4ed62fed4204a26b"><img src="https://img.shields.io/badge/2896c93cc1-feat-blue" alt="feat - 2896c93cc1" /></a></td> <td>Angular expressions with optional chaining returns <code>undefined</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e850643b1b8dca8cfdc12705be51441197cd987a"><img src="https://img.shields.io/badge/e850643b1b-feat-blue" alt="feat - e850643b1b" /></a></td> <td>Support comments in html element.</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/96be4f429ba316c75d2d4a39ececcc529ec10943"><img src="https://img.shields.io/badge/96be4f429b-fix-green" alt="fix - 96be4f429b" /></a></td> <td>abstract emitter producing incorrect code for dynamic imports</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/488d962bc700fb7189749c63ba63eac50a54e363"><img src="https://img.shields.io/badge/488d962bc7-fix-green" alt="fix - 488d962bc7" /></a></td> <td>Don't bind inputs/outputs for <code>data-</code> attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2c5aabb9daf5da3ad539381ef1e430c77583e3bf"><img src="https://img.shields.io/badge/2c5aabb9da-fix-green" alt="fix - 2c5aabb9da" /></a></td> <td>don't escape dollar sign in literal expression</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c7aef8ec5dd12b5b1d4c703a61bd1dd43f998e18"><img src="https://img.shields.io/badge/c7aef8ec5d-fix-green" alt="fix - c7aef8ec5d" /></a></td> <td>enforce parentheses containing arguments for :host-context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/b225a5d902f0ee1f6f68cde42266748cb1f2b1f8"><img src="https://img.shields.io/badge/b225a5d902-fix-green" alt="fix - b225a5d902" /></a></td> <td>invalid type checking code if field name needs to be quoted</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab9154ab75bdd36759c77917216b57285b243ea4"><img src="https://img.shields.io/badge/ab9154ab75-fix-green" alt="fix - ab9154ab75" /></a></td> <td>normalize tag names with custom namespaces in DomElementSchemaRegistry (<a href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/8a1533c9ad7c306e03d7c50676f87b56bade5bf6"><img src="https://img.shields.io/badge/8a1533c9ad-fix-green" alt="fix - 8a1533c9ad" /></a></td> <td>preserve leading commas in animation definitions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/194f723f6620ea3cdf490b762ecbef8df6bb2c8a"><img src="https://img.shields.io/badge/194f723f66-fix-green" alt="fix - 194f723f66" /></a></td> <td>remove dedicated support for legacy shadow DOM selectors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4c25a42e988e7a59d4d4dc3121cd77f7b344c048"><img src="https://img.shields.io/badge/4c25a42e98-fix-green" alt="fix - 4c25a42e98" /></a></td> <td>remove deprecated shadow CSS encapsulation polyfills</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6ff620a03364d6ab60cea47de942a04ec5a26c50"><img src="https://img.shields.io/badge/6ff620a033-fix-green" alt="fix - 6ff620a033" /></a></td> <td>sanitize dynamic href and xlink:href bindings on SVG a elements (<a href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7dc1017e517c077a6aa8fd749392a2af1277e1b7"><img src="https://img.shields.io/badge/7dc1017e51-fix-green" alt="fix - 7dc1017e51" /></a></td> <td>simplify handling of colon host with a selector list</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d99ab0e0400d256021d6cc601e2a6e16f784a406"><img src="https://img.shields.io/badge/d99ab0e040-fix-green" alt="fix - d99ab0e040" /></a></td> <td>stop generating unused field</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/03db2aefaa88bc73b6af6ed1c9c722b65079ab3b"><img src="https://img.shields.io/badge/03db2aefaa-fix-green" alt="fix - 03db2aefaa" /></a></td> <td>throw on duplicate input/outputs</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/786ef8261f4faca0693ef73938d3a6275b5baf7f"><img src="https://img.shields.io/badge/786ef8261f-fix-green" alt="fix - 786ef8261f" /></a></td> <td>throw on invalid in expressions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ccb7d427e4f07506c14c50ce0cbe87c57930ebb5"><img src="https://img.shields.io/badge/ccb7d427e4-fix-green" alt="fix - ccb7d427e4" /></a></td> <td>type check invalid for loops</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b8d3f36ed962bd4f5abd6bf6e55078b56ce9fffa"><img src="https://img.shields.io/badge/b8d3f36ed9-feat-blue" alt="feat - b8d3f36ed9" /></a></td> <td>add support for Node.js 26.0.0</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7f9450219f5c30d1ce0a90061864e8c844c8807c"><img src="https://img.shields.io/badge/7f9450219f-feat-blue" alt="feat - 7f9450219f" /></a></td> <td>Adds warning for prefetch without main defer trigger</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2eae497a04a6a9b34397181dcd64dbd103f76c47"><img src="https://img.shields.io/badge/2eae497a04-feat-blue" alt="feat - 2eae497a04" /></a></td> <td>support external TCBs with copied content in specific mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e5f96c2d8813f95c91761ae3080065575ca3b536"><img src="https://img.shields.io/badge/e5f96c2d88-fix-green" alt="fix - e5f96c2d88" /></a></td> <td>animation events not type checked properly when bound through HostListener decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9218140348cb2e3ad301c1e7f37db4b0cdad4f9d"><img src="https://img.shields.io/badge/9218140348-fix-green" alt="fix - 9218140348" /></a></td> <td>resolve TCB mapping failure for safe property reads with as any</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a0d6b8df21ca6a407e5c63dc0af753bc39c90c5"><img src="https://img.shields.io/badge/7a0d6b8df2-fix-green" alt="fix - 7a0d6b8df2" /></a></td> <td>transform dropping exclamationToken from properties</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ca67828ee247bdff46736661e51f43f2ca736a24"><img src="https://img.shields.io/badge/ca67828ee2-refactor-yellow" alt="refactor - ca67828ee2" /></a></td> <td>introduce NG8023 compile-time diagnostic for duplicate selectors</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/17d3ea44e25e077b18178aa8108828f36eb821f4"><img src="https://img.shields.io/badge/17d3ea44e2-feat-blue" alt="feat - 17d3ea44e2" /></a></td> <td>add <code>IdleRequestOptions</code> support to <code>IdleService</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3b0ae5fef0328477ee0f5d51980217e7c583a606"><img src="https://img.shields.io/badge/3b0ae5fef0-feat-blue" alt="feat - 3b0ae5fef0" /></a></td> <td>add <code>provideWebMcpTools</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/common's changelog</a>.</em></p> <blockquote> <h1>22.0.0 (2026-06-03)</h1> <p><a href="https://goo.gle/angular-v22-blog">Blog post "Announcing Angular v22"</a>.</p> <h2>Breaking Changes</h2> <h3>compiler</h3> <ul> <li>This change will trigger the <code>nullishCoalescingNotNullable</code> and <code>optionalChainNotNullable</code> diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your <code>tsconfig</code> temporarily.</li> <li>data prefixed attribute no-longer bind inputs nor outputs.</li> <li>The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.</li> <li><code>in</code> variables will throw in template expressions.</li> </ul> <h3>compiler-cli</h3> <ul> <li>Elements with multiple matching selectors will now throw at compile time.</li> </ul> <h3>core</h3> <ul> <li>The second arguement of appRef.bootstrap does not accept <code>any</code> anymore. Make sure the element you pass is not nullable.</li> <li> <ul> <li>TypeScript versions older than 6.0 are no longer supported.</li> </ul> </li> <li>Leave animations are no longer limited to the element being removed.</li> <li>Component with undefined <code>changeDetection</code> property are now <code>OnPush</code> by default. Specify <code>changeDetection: ChangeDetectionStrategy.Eager</code> to keep the previous behavior.</li> <li>change AnimationCallbackEvent.animationComplete signature</li> <li><code>ChangeDetectorRef.checkNoChanges</code> was removed. In tests use <code>fixture.detectChanges()</code> instead.</li> <li><code>createNgModuleRef</code> was removed, use <code>createNgModule</code> instead</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponentFunction</code>.</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponent</code> function.</li> </ul> <h3>forms</h3> <ul> <li><code>min</code> and <code>max</code> validation rules no longer support string values. Bound values must be numbers or null.</li> </ul> <h3>http</h3> <ul> <li>Use the <code>HttpXhrBackend</code> with <code>provideHttpClient(withXhr)</code> if you want to keep supporting upload progress reports.</li> </ul> <h3>platform-browser</h3> <ul> <li>This removes styles when they appear to no longer be used by an associated <code>host</code>. However other DOM on the page may still be affected by those styles if not leveraging <code>ViewEncapsulation.Emulated</code> or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.</li> <li>Hammer.js integration has been removed. Use your own implementation.</li> </ul> <h3>router</h3> <ul> <li> <p>The return type for <code>TitleStrategy.getResolvedTitleForRoute</code> was previously 'any' while the actual return type could only be either <code>string</code> or <code>undefined</code>. The return type now reflects the possible values correctly. Code that reads the value may need to be adjusted.</p> <p>(cherry picked from commit ad37f52c1212164c51ffcc533067af05c2c33c89)</p> </li> <li> <p>The <code>currentSnapshot</code> parameter in <code>CanMatchFn</code> and the <code>canMatch</code> method of the <code>CanMatch</code> interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of <code>CanMatch</code> must now include the third argument to satisfy the interface.</p> </li> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> <li> <p><code>provideRoutes()</code> has been removed. Use <code>provideRouter()</code> or <code>ROUTES</code> as multi token if necessary.</p> </li> </ul> <h3>upgrade</h3> <ul> <li>Deprecated <code>getAngularLib</code>/<code>setAngularLib</code> have been removed use <code>getAngularJSGlobal</code>/<code>setAngularJSGlobal</code> instead.</li> </ul> <h2>Deprecations</h2> <h3>http</h3> <ul> <li><code>withFetch</code> is now deprecated, it can be safely removed.</li> <li>The <code>reportProgress</code> option is deprecated please use <code>reportUploadProgress</code> & <code>reportDownloadProgress</code> instead.</li> </ul> <h3>compiler</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/4795b35d5be5a7217f648a349c281e674294ef97"><code>4795b35</code></a> fix(common): only strip a literal /index.html suffix from URLs</li> <li><a href="https://github.com/angular/angular/commit/f7b3ed8db28c69ee0de9144465da351bda7e85e4"><code>f7b3ed8</code></a> fix(http): Introduce a max buffer size for fetch requests on SSR</li> <li><a href="https://github.com/angular/angular/commit/618c8502829a1f2ca8ce048fdf4d8085b956734c"><code>618c850</code></a> fix(http): exclude withCredentials requests from transfer cache</li> <li><a href="https://github.com/angular/angular/commit/86390f2be41b2aae352b0c1ce4a5285fd065ef17"><code>86390f2</code></a> fix(http): skip TransferCache for cookie-bearing requests by default</li> <li><a href="https://github.com/angular/angular/commit/e6cfaf567256f5e89903f6b5625540e5a4a3bde3"><code>e6cfaf5</code></a> fix(http): prevent <code>httpResource</code> from leaking a subscription</li> <li><a href="https://github.com/angular/angular/commit/a97d5ec22d8997665dc2de3d5a78f6e2bac67afd"><code>a97d5ec</code></a> build: update minimum supported Node.js versions</li> <li><a href="https://github.com/angular/angular/commit/7d1fbc170a90ca12a3c1b805645bc37d12ed744d"><code>7d1fbc1</code></a> fix(common): sanitize placeholder</li> <li><a href="https://github.com/angular/angular/commit/ae2cb00398954d9332e9f1f5abecce902cfc7658"><code>ae2cb00</code></a> fix(common): add upper bounds for digitsInfo</li> <li><a href="https://github.com/angular/angular/commit/cc0fa6e3ded6dd3faa58800a140e49302adc38c8"><code>cc0fa6e</code></a> refactor(http): update HTTP resource options APIs to stable</li> <li><a href="https://github.com/angular/angular/commit/ad717dff1d1aa3d18461b68b5048324001ac4417"><code>ad717df</code></a> refactor(core): use the <code>@Service</code> decorator where possible.</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v22.0.0/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.11 to 22.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/compiler's releases</a>.</em></p> <blockquote> <h2>VSCode Extension: 22.0.0</h2> <h3>Breaking Changes</h3> <p>The extension now bundles TypeScript version 6.0, which itself includes breaking changes, including <a href="https://www.typescriptlang.org/docs/handbook/release-notes/typescript-6-0.html#simple-default-changes">new defaults</a> such as <code>strict</code> being <code>true</code>. You will need to explicitly set <code>"strict": false</code> in your <code>tsconfig.json</code>. Alternatively, the extension supports configuring the <code>tsdk</code> in the <a href="https://code.visualstudio.com/docs/typescript/typescript-transpiling#_using-the-workspace-version-of-typescript">same way</a> as the built in TS/JS extension.</p> <h3>Fixes and features</h3> <ul> <li>fix(language-service): Add support for <code>@Input</code> with transforms (<a href="https://github.com/angular/angular/commit/dc9c72da9b4ca499eebf6e78d7ccc31ea6f63580">dc9c72da9b</a>)</li> <li>feat(language-service): add Document Symbols support for Angular templates (<a href="https://github.com/angular/angular/commit/cfd0f9950c08324e1c56f16d98a2e3081feeda58">cfd0f9950c</a>)</li> <li>feat(language-service): add angular template inlay hints support (<a href="https://github.com/angular/angular/commit/5a6d88626b604db937287a501cb723c088412a7e">5a6d88626b</a>)</li> <li>feat(language-service): Add support for idle timeout in defer blocks (<a href="https://github.com/angular/angular/commit/c6f98c723cdd2c209092927855f8cbaf63ecce30">c6f98c723c</a>)</li> </ul> <h2>22.0.0</h2> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/47fcbc470462192c4f9e273d8dce8b353d5baaa2"><img src="https://img.shields.io/badge/47fcbc4704-feat-blue" alt="feat - 47fcbc4704" /></a></td> <td>allow safe navigation to correctly narrow down nullables</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2896c93cc1077e1306acd91f4ed62fed4204a26b"><img src="https://img.shields.io/badge/2896c93cc1-feat-blue" alt="feat - 2896c93cc1" /></a></td> <td>Angular expressions with optional chaining returns <code>undefined</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e850643b1b8dca8cfdc12705be51441197cd987a"><img src="https://img.shields.io/badge/e850643b1b-feat-blue" alt="feat - e850643b1b" /></a></td> <td>Support comments in html element.</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/96be4f429ba316c75d2d4a39ececcc529ec10943"><img src="https://img.shields.io/badge/96be4f429b-fix-green" alt="fix - 96be4f429b" /></a></td> <td>abstract emitter producing incorrect code for dynamic imports</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/488d962bc700fb7189749c63ba63eac50a54e363"><img src="https://img.shields.io/badge/488d962bc7-fix-green" alt="fix - 488d962bc7" /></a></td> <td>Don't bind inputs/outputs for <code>data-</code> attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2c5aabb9daf5da3ad539381ef1e430c77583e3bf"><img src="https://img.shields.io/badge/2c5aabb9da-fix-green" alt="fix - 2c5aabb9da" /></a></td> <td>don't escape dollar sign in literal expression</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c7aef8ec5dd12b5b1d4c703a61bd1dd43f998e18"><img src="https://img.shields.io/badge/c7aef8ec5d-fix-green" alt="fix - c7aef8ec5d" /></a></td> <td>enforce parentheses containing arguments for :host-context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/b225a5d902f0ee1f6f68cde42266748cb1f2b1f8"><img src="https://img.shields.io/badge/b225a5d902-fix-green" alt="fix - b225a5d902" /></a></td> <td>invalid type checking code if field name needs to be quoted</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab9154ab75bdd36759c77917216b57285b243ea4"><img src="https://img.shields.io/badge/ab9154ab75-fix-green" alt="fix - ab9154ab75" /></a></td> <td>normalize tag names with custom namespaces in DomElementSchemaRegistry (<a href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/8a1533c9ad7c306e03d7c50676f87b56bade5bf6"><img src="https://img.shields.io/badge/8a1533c9ad-fix-green" alt="fix - 8a1533c9ad" /></a></td> <td>preserve leading commas in animation definitions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/194f723f6620ea3cdf490b762ecbef8df6bb2c8a"><img src="https://img.shields.io/badge/194f723f66-fix-green" alt="fix - 194f723f66" /></a></td> <td>remove dedicated support for legacy shadow DOM selectors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4c25a42e988e7a59d4d4dc3121cd77f7b344c048"><img src="https://img.shields.io/badge/4c25a42e98-fix-green" alt="fix - 4c25a42e98" /></a></td> <td>remove deprecated shadow CSS encapsulation polyfills</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6ff620a03364d6ab60cea47de942a04ec5a26c50"><img src="https://img.shields.io/badge/6ff620a033-fix-green" alt="fix - 6ff620a033" /></a></td> <td>sanitize dynamic href and xlink:href bindings on SVG a elements (<a href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7dc1017e517c077a6aa8fd749392a2af1277e1b7"><img src="https://img.shields.io/badge/7dc1017e51-fix-green" alt="fix - 7dc1017e51" /></a></td> <td>simplify handling of colon host with a selector list</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d99ab0e0400d256021d6cc601e2a6e16f784a406"><img src="https://img.shields.io/badge/d99ab0e040-fix-green" alt="fix - d99ab0e040" /></a></td> <td>stop generating unused field</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/03db2aefaa88bc73b6af6ed1c9c722b65079ab3b"><img src="https://img.shields.io/badge/03db2aefaa-fix-green" alt="fix - 03db2aefaa" /></a></td> <td>throw on duplicate input/outputs</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/786ef8261f4faca0693ef73938d3a6275b5baf7f"><img src="https://img.shields.io/badge/786ef8261f-fix-green" alt="fix - 786ef8261f" /></a></td> <td>throw on invalid in expressions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ccb7d427e4f07506c14c50ce0cbe87c57930ebb5"><img src="https://img.shields.io/badge/ccb7d427e4-fix-green" alt="fix - ccb7d427e4" /></a></td> <td>type check invalid for loops</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b8d3f36ed962bd4f5abd6bf6e55078b56ce9fffa"><img src="https://img.shields.io/badge/b8d3f36ed9-feat-blue" alt="feat - b8d3f36ed9" /></a></td> <td>add support for Node.js 26.0.0</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7f9450219f5c30d1ce0a90061864e8c844c8807c"><img src="https://img.shields.io/badge/7f9450219f-feat-blue" alt="feat - 7f9450219f" /></a></td> <td>Adds warning for prefetch without main defer trigger</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2eae497a04a6a9b34397181dcd64dbd103f76c47"><img src="https://img.shields.io/badge/2eae497a04-feat-blue" alt="feat - 2eae497a04" /></a></td> <td>support external TCBs with copied content in specific mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e5f96c2d8813f95c91761ae3080065575ca3b536"><img src="https://img.shields.io/badge/e5f96c2d88-fix-green" alt="fix - e5f96c2d88" /></a></td> <td>animation events not type checked properly when bound through HostListener decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9218140348cb2e3ad301c1e7f37db4b0cdad4f9d"><img src="https://img.shields.io/badge/9218140348-fix-green" alt="fix - 9218140348" /></a></td> <td>resolve TCB mapping failure for safe property reads with as any</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a0d6b8df21ca6a407e5c63dc0af753bc39c90c5"><img src="https://img.shields.io/badge/7a0d6b8df2-fix-green" alt="fix - 7a0d6b8df2" /></a></td> <td>transform dropping exclamationToken from properties</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ca67828ee247bdff46736661e51f43f2ca736a24"><img src="https://img.shields.io/badge/ca67828ee2-refactor-yellow" alt="refactor - ca67828ee2" /></a></td> <td>introduce NG8023 compile-time diagnostic for duplicate selectors</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/17d3ea44e25e077b18178aa8108828f36eb821f4"><img src="https://img.shields.io/badge/17d3ea44e2-feat-blue" alt="feat - 17d3ea44e2" /></a></td> <td>add <code>IdleRequestOptions</code> support to <code>IdleService</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3b0ae5fef0328477ee0f5d51980217e7c583a606"><img src="https://img.shields.io/badge/3b0ae5fef0-feat-blue" alt="feat - 3b0ae5fef0" /></a></td> <td>add <code>provideWebMcpTools</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/compiler's changelog</a>.</em></p> <blockquote> <h1>22.0.0 (2026-06-03)</h1> <p><a href="https://goo.gle/angular-v22-blog">Blog post "Announcing Angular v22"</a>.</p> <h2>Breaking Changes</h2> <h3>compiler</h3> <ul> <li>This change will trigger the <code>nullishCoalescingNotNullable</code> and <code>optionalChainNotNullable</code> diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your <code>tsconfig</code> temporarily.</li> <li>data prefixed attribute no-longer bind inputs nor outputs.</li> <li>The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.</li> <li><code>in</code> variables will throw in template expressions.</li> </ul> <h3>compiler-cli</h3> <ul> <li>Elements with multiple matching selectors will now throw at compile time.</li> </ul> <h3>core</h3> <ul> <li>The second arguement of appRef.bootstrap does not accept <code>any</code> anymore. Make sure the element you pass is not nullable.</li> <li> <ul> <li>TypeScript versions older than 6.0 are no longer supported.</li> </ul> </li> <li>Leave animations are no longer limited to the element being removed.</li> <li>Component with undefined <code>changeDetection</code> property are now <code>OnPush</code> by default. Specify <code>changeDetection: ChangeDetectionStrategy.Eager</code> to keep the previous behavior.</li> <li>change AnimationCallbackEvent.animationComplete signature</li> <li><code>ChangeDetectorRef.checkNoChanges</code> was removed. In tests use <code>fixture.detectChanges()</code> instead.</li> <li><code>createNgModuleRef</code> was removed, use <code>createNgModule</code> instead</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponentFunction</code>.</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponent</code> function.</li> </ul> <h3>forms</h3> <ul> <li><code>min</code> and <code>max</code> validation rules no longer support string values. Bound values must be numbers or null.</li> </ul> <h3>http</h3> <ul> <li>Use the <code>HttpXhrBackend</code> with <code>provideHttpClient(withXhr)</code> if you want to keep supporting upload progress reports.</li> </ul> <h3>platform-browser</h3> <ul> <li>This removes styles when they appear to no longer be used by an associated <code>host</code>. However other DOM on the page may still be affected by those styles if not leveraging <code>ViewEncapsulation.Emulated</code> or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.</li> <li>Hammer.js integration has been removed. Use your own implementation.</li> </ul> <h3>router</h3> <ul> <li> <p>The return type for <code>TitleStrategy.getResolvedTitleForRoute</code> was previously 'any' while the actual return type could only be either <code>string</code> or <code>undefined</code>. The return type now reflects the possible values correctly. Code that reads the value may need to be adjusted.</p> <p>(cherry picked from commit ad37f52c1212164c51ffcc533067af05c2c33c89)</p> </li> <li> <p>The <code>currentSnapshot</code> parameter in <code>CanMatchFn</code> and the <code>canMatch</code> method of the <code>CanMatch</code> interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of <code>CanMatch</code> must now include the third argument to satisfy the interface.</p> </li> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> <li> <p><code>provideRoutes()</code> has been removed. Use <code>provideRouter()</code> or <code>ROUTES</code> as multi token if necessary.</p> </li> </ul> <h3>upgrade</h3> <ul> <li>Deprecated <code>getAngularLib</code>/<code>setAngularLib</code> have been removed use <code>getAngularJSGlobal</code>/<code>setAngularJSGlobal</code> instead.</li> </ul> <h2>Deprecations</h2> <h3>http</h3> <ul> <li><code>withFetch</code> is now deprecated, it can be safely removed.</li> <li>The <code>reportProgress</code> option is deprecated please use <code>reportUploadProgress</code> & <code>reportDownloadProgress</code> instead.</li> </ul> <h3>compiler</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/2891f7e7879238d941a7c40ebd51896fcd2fe6bb"><code>2891f7e</code></a> fix(compiler): move projection attributes into constants</li> <li><a href="https://github.com/angular/angular/commit/94d520fb671fc7774341947b872ed0e387689db9"><code>94d520f</code></a> fix(compiler): prevent namespaced SVG <style> elements from being stripped</li> <li><a href="https://github.com/angular/angular/commit/d9c38e552db7efd868c4de815d6cde4ab0b14bc0"><code>d9c38e5</code></a> docs: fix typos in source code comments</li> <li><a href="https://github.com/angular/angular/commit/a08e4fb93c371252da16b3b22cbf78f4ac180fa2"><code>a08e4fb</code></a> fix(core): normalize tag names in runtime i18n attribute security context loo...</li> <li><a href="https://github.com/angular/angular/commit/ab9154ab75bdd36759c77917216b57285b243ea4"><code>ab9154a</code></a> fix(compiler): normalize tag names with custom namespaces in DomElementSchema...</li> <li><a href="https://github.com/angular/angular/commit/6ff620a03364d6ab60cea47de942a04ec5a26c50"><code>6ff620a</code></a> fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...</li> <li><a href="https://github.com/angular/angular/commit/a97d5ec22d8997665dc2de3d5a78f6e2bac67afd"><code>a97d5ec</code></a> build: update minimum supported Node.js versions</li> <li><a href="https://github.com/angular/angular/commit/2200b4a85481abde02e40eb8f6d67227f6ac21e9"><code>2200b4a</code></a> refactor(compiler): add support for compiling NgModules under isolatedDeclara...</li> <li><a href="https://github.com/angular/angular/commit/b2b8dea7325c8d0d6788bbee6100d406f6ebe355"><code>b2b8dea</code></a> fix(compiler): strip namespaced SVG script elements during template compilation</li> <li><a href="https://github.com/angular/angular/commit/88d138ccc84b839784f59575fddcda3fcaf18d35"><code>88d138c</code></a> fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v22.0.0/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.11 to 22.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/core's releases</a>.</em></p> <blockquote> <h2>VSCode Extension: 22.0.0</h2> <h3>Breaking Changes</h3> <p>The extension now bundles TypeScript version 6.0, which itself includes breaking changes, including <a href="https://www.typescriptlang.org/docs/handbook/release-notes/typescript-6-0.html#simple-default-changes">new defaults</a> such as <code>strict</code> being <code>true</code>. You will need to explicitly set <code>"strict": false</code> in your <code>tsconfig.json</code>. Alternatively, the extension supports configuring the <code>tsdk</code> in the <a href="https://code.visualstudio.com/docs/typescript/typescript-transpiling#_using-the-workspace-version-of-typescript">same way</a> as the built in TS/JS extension.</p> <h3>Fixes and features</h3> <ul> <li>fix(language-service): Add support for <code>@Input</code> with transforms (<a href="https://github.com/angular/angular/commit/dc9c72da9b4ca499eebf6e78d7ccc31ea6f63580">dc9c72da9b</a>)</li> <li>feat(language-service): add Document Symbols support for Angular templates (<a href="https://github.com/angular/angular/commit/cfd0f9950c08324e1c56f16d98a2e3081feeda58">cfd0f9950c</a>)</li> <li>feat(language-service): add angular template inlay hints support (<a href="https://github.com/angular/angular/commit/5a6d88626b604db937287a501cb723c088412a7e">5a6d88626b</a>)</li> <li>feat(language-service): Add support for idle timeout in defer blocks (<a href="https://github.com/angular/angular/commit/c6f98c723cdd2c209092927855f8cbaf63ecce30">c6f98c723c</a>)</li> </ul> <h2>22.0.0</h2> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/47fcbc470462192c4f9e273d8dce8b353d5baaa2"><img src="https://img.shields.io/badge/47fcbc4704-feat-blue" alt="feat - 47fcbc4704" /></a></td> <td>allow safe navigation to correctly narrow down nullables</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2896c93cc1077e1306acd91f4ed62fed4204a26b"><img src="https://img.shields.io/badge/2896c93cc1-feat-blue" alt="feat - 2896c93cc1" /></a></td> <td>Angular expressions with optional chaining returns <code>undefined</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e850643b1b8dca8cfdc12705be51441197cd987a"><img src="https://img.shields.io/badge/e850643b1b-feat-blue" alt="feat - e850643b1b" /></a></td> <td>Support comments in html element.</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/96be4f429ba316c75d2d4a39ececcc529ec10943"><img src="https://img.shields.io/badge/96be4f429b-fix-green" alt="fix - 96be4f429b" /></a></td> <td>abstract emitter producing incorrect code for dynamic imports</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/488d962bc700fb7189749c63ba63eac50a54e363"><img src="https://img.shields.io/badge/488d962bc7-fix-green" alt="fix - 488d962bc7" /></a></td> <td>Don't bind inputs/outputs for <code>data-</code> attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2c5aabb9daf5da3ad539381ef1e430c77583e3bf"><img src="https://img.shields.io/badge/2c5aabb9da-fix-green" alt="fix - 2c5aabb9da" /></a></td> <td>don't escape dollar sign in literal expression</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c7aef8ec5dd12b5b1d4c703a61bd1dd43f998e18"><img src="https://img.shields.io/badge/c7aef8ec5d-fix-green" alt="fix - c7aef8ec5d" /></a></td> <td>enforce parentheses containing arguments for :host-context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/b225a5d902f0ee1f6f68cde42266748cb1f2b1f8"><img src="https://img.shields.io/badge/b225a5d902-fix-green" alt="fix - b225a5d902" /></a></td> <td>invalid type checking code if field name needs to be quoted</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab9154ab75bdd36759c77917216b57285b243ea4"><img src="https://img.shields.io/badge/ab9154ab75-fix-green" alt="fix - ab9154ab75" /></a></td> <td>normalize tag names with custom namespaces in DomElementSchemaRegistry (<a href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/8a1533c9ad7c306e03d7c50676f87b56bade5bf6"><img src="https://img.shields.io/badge/8a1533c9ad-fix-green" alt="fix - 8a1533c9ad" /></a></td> <td>preserve leading commas in animation definitions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/194f723f6620ea3cdf490b762ecbef8df6bb2c8a"><img src="https://img.shields.io/badge/194f723f66-fix-green" alt="fix - 194f723f66" /></a></td> <td>remove dedicated support for legacy shadow DOM selectors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4c25a42e988e7a59d4d4dc3121cd77f7b344c048"><img src="https://img.shields.io/badge/4c25a42e98-fix-green" alt="fix - 4c25a42e98" /></a></td> <td>remove deprecated shadow CSS encapsulation polyfills</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6ff620a03364d6ab60cea47de942a04ec5a26c50"><img src="https://img.shields.io/badge/6ff620a033-fix-green" alt="fix - 6ff620a033" /></a></td> <td>sanitize dynamic href and xlink:href bindings on SVG a elements (<a href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7dc1017e517c077a6aa8fd749392a2af1277e1b7"><img src="https://img.shields.io/badge/7dc1017e51-fix-green" alt="fix - 7dc1017e51" /></a></td> <td>simplify handling of colon host with a selector list</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d99ab0e0400d256021d6cc601e2a6e16f784a406"><img src="https://img.shields.io/badge/d99ab0e040-fix-green" alt="fix - d99ab0e040" /></a></td> <td>stop generating unused field</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/03db2aefaa88bc73b6af6ed1c9c722b65079ab3b"><img src="https://img.shields.io/badge/03db2aefaa-fix-green" alt="fix - 03db2aefaa" /></a></td> <td>throw on duplicate input/outputs</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/786ef8261f4faca0693ef73938d3a6275b5baf7f"><img src="https://img.shields.io/badge/786ef8261f-fix-green" alt="fix - 786ef8261f" /></a></td> <td>throw on invalid in expressions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ccb7d427e4f07506c14c50ce0cbe87c57930ebb5"><img src="https://img.shields.io/badge/ccb7d427e4-fix-green" alt="fix - ccb7d427e4" /></a></td> <td>type check invalid for loops</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b8d3f36ed962bd4f5abd6bf6e55078b56ce9fffa"><img src="https://img.shields.io/badge/b8d3f36ed9-feat-blue" alt="feat - b8d3f36ed9" /></a></td> <td>add support for Node.js 26.0.0</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7f9450219f5c30d1ce0a90061864e8c844c8807c"><img src="https://img.shields.io/badge/7f9450219f-feat-blue" alt="feat - 7f9450219f" /></a></td> <td>Adds warning for prefetch without main defer trigger</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2eae497a04a6a9b34397181dcd64dbd103f76c47"><img src="https://img.shields.io/badge/2eae497a04-feat-blue" alt="feat - 2eae497a04" /></a></td> <td>support external TCBs with copied content in specific mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e5f96c2d8813f95c91761ae3080065575ca3b536"><img src="https://img.shields.io/badge/e5f96c2d88-fix-green" alt="fix - e5f96c2d88" /></a></td> <td>animation events not type checked properly when bound through HostListener decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9218140348cb2e3ad301c1e7f37db4b0cdad4f9d"><img src="https://img.shields.io/badge/9218140348-fix-green" alt="fix - 9218140348" /></a></td> <td>resolve TCB mapping failure for safe property reads with as any</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a0d6b8df21ca6a407e5c63dc0af753bc39c90c5"><img src="https://img.shields.io/badge/7a0d6b8df2-fix-green" alt="fix - 7a0d6b8df2" /></a></td> <td>transform dropping exclamationToken from properties</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ca67828ee247bdff46736661e51f43f2ca736a24"><img src="https://img.shields.io/badge/ca67828ee2-refactor-yellow" alt="refactor - ca67828ee2" /></a></td> <td>introduce NG8023 compile-time diagnostic for duplicate selectors</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/17d3ea44e25e077b18178aa8108828f36eb821f4"><img src="https://img.shields.io/badge/17d3ea44e2-feat-blue" alt="feat - 17d3ea44e2" /></a></td> <td>add <code>IdleRequestOptions</code> support to <code>IdleService</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3b0ae5fef0328477ee0f5d51980217e7c583a606"><img src="https://img.shields.io/badge/3b0ae5fef0-feat-blue" alt="feat - 3b0ae5fef0" /></a></td> <td>add <code>provideWebMcpTools</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/core's changelog</a>.</em></p> <blockquote> <h1>22.0.0 (2026-06-03)</h1> <p><a href="https://goo.gle/angular-v22-blog">Blog post "Announcing Angular v22"</a>.</p> <h2>Breaking Changes</h2> <h3>compiler</h3> <ul> <li>This change will trigger the <code>nullishCoalescingNotNullable</code> and <code>optionalChainNotNullable</code> diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your <code>tsconfig</code> temporarily.</li> <li>data prefixed attribute no-longer bind inputs nor outputs.</li> <li>The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.</li> <li><code>in</code> variables will throw in template expressions.</li> </ul> <h3>compiler-cli</h3> <ul> <li>Elements with multiple matching selectors will now throw at compile time.</li> </ul> <h3>core</h3> <ul> <li>The second arguement of appRef.bootstrap does not accept <code>any</code> anymore. Make sure the element you pass is not nullable.</li> <li> <ul> <li>TypeScript versions older than 6.0 are no longer supported.</li> </ul> </li> <li>Leave animations are no longer limited to the element being removed.</li> <li>Component with undefined <code>changeDetection</code> property are now <code>OnPush</code> by default. Specify <code>changeDetection: ChangeDetectionStrategy.Eager</code> to keep the previous behavior.</li> <li>change AnimationCallbackEvent.animationComplete signature</li> <li><code>ChangeDetectorRef.checkNoChanges</code> was removed. In tests use <code>fixture.detectChanges()</code> instead.</li> <li><code>createNgModuleRef</code> was removed, use <code>createNgModule</code> instead</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponentFunction</code>.</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponent</code> function.</li> </ul> <h3>forms</h3> <ul> <li><code>min</code> and <code>max</code> validation rules no longer support string values. Bound values must be numbers or null.</li> </ul> <h3>http</h3> <ul> <li>Use the <code>HttpXhrBackend</code> with <code>provideHttpClient(withXhr)</code> if you want to keep supporting upload progress reports.</li> </ul> <h3>platform-browser</h3> <ul> <li>This removes styles when they appear to no longer be used by an associated <code>host</code>. However other DOM on the page may still be affected by those styles if not leveraging <code>ViewEncapsulation.Emulated</code> or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.</li> <li>Hammer.js integration has been removed. Use your own implementation.</li> </ul> <h3>router</h3> <ul> <li> <p>The return type for <code>TitleStrategy.getResolvedTitleForRoute</code> was previously 'any' while the actual return type could only be either <code>string</code> or <code>undefined</code>. The return type now reflects the possible values correctly. Code that reads the value may need to be adjusted.</p> <p>(cherry picked from commit ad37f52c1212164c51ffcc533067af05c2c33c89)</p> </li> <li> <p>The <code>currentSnapshot</code> parameter in <code>CanMatchFn</code> and the <code>canMatch</code> method of the <code>CanMatch</code> interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of <code>CanMatch</code> must now include the third argument to satisfy the interface.</p> </li> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> <li> <p><code>provideRoutes()</code> has been removed. Use <code>provideRouter()</code> or <code>ROUTES</code> as multi token if necessary.</p> </li> </ul> <h3>upgrade</h3> <ul> <li>Deprecated <code>getAngularLib</code>/<code>setAngularLib</code> have been removed use <code>getAngularJSGlobal</code>/<code>setAngularJSGlobal</code> instead.</li> </ul> <h2>Deprecations</h2> <h3>http</h3> <ul> <li><code>withFetch</code> is now deprecated, it can be safely removed.</li> <li>The <code>reportProgress</code> option is deprecated please use <code>reportUploadProgress</code> & <code>reportDownloadProgress</code> instead.</li> </ul> <h3>compiler</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/3ad9eb0217b519d756392bf8d0a471cb7a6b80d3"><code>3ad9eb0</code></a> Revert "fix(core): harden inherit definition feature against polluted prototy...</li> <li><a href="https://github.com/angular/angular/commit/f3c924926fa2da7ab144fd4b3439b6b834005dee"><code>f3c9249</code></a> fix(core): harden inherit definition feature against polluted prototypes</li> <li><a href="https://github.com/angular/angular/commit/9d9855a41597c116ca102e672867047ddf7b4545"><code>9d9855a</code></a> fix(migrations): Make the safe optional chaining idempotent</li> <li><a href="https://github.com/angular/angular/commit/5f14b82af8047f1f77c6bea839b2347cdaaa0df5"><code>5f14b82</code></a> refactor(core): Update webmcp support to use <code>document.modelContext</code></li> <li><a href="https://github.com/angular/angular/commit/6fee7aaf89be8d67dd7612af410d39cde0c00020"><code>6fee7aa</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/e3e25b5a535c3e9cc08fcd2f9f85b78b8456a9f8"><code>e3e25b5</code></a> fix(core): use Object.create(null) for LOCALE_DATA as a hardening measure</li> <li><a href="https://github.com/angular/angular/commit/d88b79651824453ca97489082fe5f7e9d073cacc"><code>d88b796</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/394c9983455368511b1d3822ed010f6f3eee9e8a"><code>394c998</code></a> refactor(core): replace the type of the getDirectiveMetadata property of Exte...</li> <li><a href="https://github.com/angular/angular/commit/76a8c877251443bfd77ca1265034a6da0509b2e1"><code>76a8c87</code></a> refactor(core): Split the ng global into internal and external objects</li> <li><a href="https://github.com/angular/angular/commit/f7b3ed8db28c69ee0de9144465da351bda7e85e4"><code>f7b3ed8</code></a> fix(http): Introduce a max buffer size for fetch requests on SSR</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v22.0.0/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@angular/forms` from 21.2.11 to 22.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/forms's releases</a>.</em></p> <blockquote> <h2>VSCode Extension: 22.0.0</h2> <h3>Breaking Changes</h3> <p>The extension now bundles TypeScript version 6.0, which itself includes breaking changes, including <a href="https://www.typescriptlang.org/docs/handbook/release-notes/typescript-6-0.html#simple-default-changes">new defaults</a> such as <code>strict</code> being <code>true</code>. You will need to explicitly set <code>"strict": false</code> in your <code>tsconfig.json</code>. Alternatively, the extension supports configuring the <code>tsdk</code> in the <a href="https://code.visualstudio.com/docs/typescript/typescript-transpiling#_using-the-workspace-version-of-typescript">same way</a> as the built in TS/JS extension.</p> <h3>Fixes and features</h3> <ul> <li>fix(language-service): Add support for <code>@Input</code> with transforms (<a href="https://github.com/angular/angular/commit/dc9c72da9b4ca499eebf6e78d7ccc31ea6f63580">dc9c72da9b</a>)</li> <li>feat(language-service): add Document Symbols support for Angular templates (<a href="https://github.com/angular/angular/commit/cfd0f9950c08324e1c56f16d98a2e3081feeda58">cfd0f9950c</a>)</li> <li>feat(language-service): add angular template inlay hints support (<a href="https://github.com/angular/angular/commit/5a6d88626b604db937287a501cb723c088412a7e">5a6d88626b</a>)</li> <li>feat(language-service): Add support for idle timeout in defer blocks (<a href="https://github.com/angular/angular/commit/c6f98c723cdd2c209092927855f8cbaf63ecce30">c6f98c723c</a>)</li> </ul> <h2>22.0.0</h2> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/47fcbc470462192c4f9e273d8dce8b353d5baaa2"><img src="https://img.shields.io/badge/47fcbc4704-feat-blue" alt="feat - 47fcbc4704" /></a></td> <td>allow safe navigation to correctly narrow down nullables</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2896c93cc1077e1306acd91f4ed62fed4204a26b"><img src="https://img.shields.io/badge/2896c93cc1-feat-blue" alt="feat - 2896c93cc1" /></a></td> <td>Angular expressions with optional chaining returns <code>undefined</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e850643b1b8dca8cfdc12705be51441197cd987a"><img src="https://img.shields.io/badge/e850643b1b-feat-blue" alt="feat - e850643b1b" /></a></td> <td>Support comments in html element.</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/96be4f429ba316c75d2d4a39ececcc529ec10943"><img src="https://img.shields.io/badge/96be4f429b-fix-green" alt="fix - 96be4f429b" /></a></td> <td>abstract emitter producing incorrect code for dynamic imports</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/488d962bc700fb7189749c63ba63eac50a54e363"><img src="https://img.shields.io/badge/488d962bc7-fix-green" alt="fix - 488d962bc7" /></a></td> <td>Don't bind inputs/outputs for <code>data-</code> attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2c5aabb9daf5da3ad539381ef1e430c77583e3bf"><img src="https://img.shields.io/badge/2c5aabb9da-fix-green" alt="fix - 2c5aabb9da" /></a></td> <td>don't escape dollar sign in literal expression</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c7aef8ec5dd12b5b1d4c703a61bd1dd43f998e18"><img src="https://img.shields.io/badge/c7aef8ec5d-fix-green" alt="fix - c7aef8ec5d" /></a></td> <td>enforce parentheses containing arguments for :host-context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/b225a5d902f0ee1f6f68cde42266748cb1f2b1f8"><img src="https://img.shields.io/badge/b225a5d902-fix-green" alt="fix - b225a5d902" /></a></td> <td>invalid type checking code if field name needs to be quoted</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab9154ab75bdd36759c77917216b57285b243ea4"><img src="https://img.shields.io/badge/ab9154ab75-fix-green" alt="fix - ab9154ab75" /></a></td> <td>normalize tag names with custom namespaces in DomElementSchemaRegistry (<a href="https://github.com/angular/angular/tree/HEAD/packages/forms/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/8a1533c9ad7c306e03d7c50676f87b56bade5bf6"><img src="https://img.shields.io/badge/8a1533c9ad-fix-green" alt="fix - 8a1533c9ad" /></a></td> <td>preserve leading commas in animation definitions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/194f723f6620ea3cdf490b762ecbef8df6bb2c8a"><img src="https://img.shields.io/badge/194f723f66-fix-green" alt="fix - 194f723f66" /></a></td> <td>remove dedicated support for legacy shadow DOM selectors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4c25a42e988e7a59d4d4dc3121cd77f7b344c048"><img src="https://img.shields.io/badge/4c25a42e98-fix-green" alt="fix - 4c25a42e98" /></a></td> <td>remove deprecated shadow CSS encapsulation polyfills</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6ff620a03364d6ab60cea47de942a04ec5a26c50"><img src="https://img.shields.io/badge/6ff620a033-fix-green" alt="fix - 6ff620a033" /></a></td> <td>sanitize dynamic href and xlink:href bindings on SVG a elements (<a href="https://github.com/angular/angular/tree/HEAD/packages/forms/issues/68868">#68868</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7dc1017e517c077a6aa8fd749392a2af1277e1b7"><img src="https://img.shields.io/badge/7dc1017e51-fix-green" alt="fix - 7dc1017e51" /></a></td> <td>simplify handling of colon host with a selector list</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d99ab0e0400d256021d6cc601e2a6e16f784a406"><img src="https://img.shields.io/badge/d99ab0e040-fix-green" alt="fix - d99ab0e040" /></a></td> <td>stop generating unused field</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/03db2aefaa88bc73b6af6ed1c9c722b65079ab3b"><img src="https://img.shields.io/badge/03db2aefaa-fix-green" alt="fix - 03db2aefaa" /></a></td> <td>throw on duplicate input/outputs</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/786ef8261f4faca0693ef73938d3a6275b5baf7f"><img src="https://img.shields.io/badge/786ef8261f-fix-green" alt="fix - 786ef8261f" /></a></td> <td>throw on invalid in expressions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ccb7d427e4f07506c14c50ce0cbe87c57930ebb5"><img src="https://img.shields.io/badge/ccb7d427e4-fix-green" alt="fix - ccb7d427e4" /></a></td> <td>type check invalid for loops</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b8d3f36ed962bd4f5abd6bf6e55078b56ce9fffa"><img src="https://img.shields.io/badge/b8d3f36ed9-feat-blue" alt="feat - b8d3f36ed9" /></a></td> <td>add support for Node.js 26.0.0</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7f9450219f5c30d1ce0a90061864e8c844c8807c"><img src="https://img.shields.io/badge/7f9450219f-feat-blue" alt="feat - 7f9450219f" /></a></td> <td>Adds warning for prefetch without main defer trigger</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2eae497a04a6a9b34397181dcd64dbd103f76c47"><img src="https://img.shields.io/badge/2eae497a04-feat-blue" alt="feat - 2eae497a04" /></a></td> <td>support external TCBs with copied content in specific mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e5f96c2d8813f95c91761ae3080065575ca3b536"><img src="https://img.shields.io/badge/e5f96c2d88-fix-green" alt="fix - e5f96c2d88" /></a></td> <td>animation events not type checked properly when bound through HostListener decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9218140348cb2e3ad301c1e7f37db4b0cdad4f9d"><img src="https://img.shields.io/badge/9218140348-fix-green" alt="fix - 9218140348" /></a></td> <td>resolve TCB mapping failure for safe property reads with as any</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a0d6b8df21ca6a407e5c63dc0af753bc39c90c5"><img src="https://img.shields.io/badge/7a0d6b8df2-fix-green" alt="fix - 7a0d6b8df2" /></a></td> <td>transform dropping exclamationToken from properties</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ca67828ee247bdff46736661e51f43f2ca736a24"><img src="https://img.shields.io/badge/ca67828ee2-refactor-yellow" alt="refactor - ca67828ee2" /></a></td> <td>introduce NG8023 compile-time diagnostic for duplicate selectors</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/17d3ea44e25e077b18178aa8108828f36eb821f4"><img src="https://img.shields.io/badge/17d3ea44e2-feat-blue" alt="feat - 17d3ea44e2" /></a></td> <td>add <code>IdleRequestOptions</code> support to <code>IdleService</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3b0ae5fef0328477ee0f5d51980217e7c583a606"><img src="https://img.shields.io/badge/3b0ae5fef0-feat-blue" alt="feat - 3b0ae5fef0" /></a></td> <td>add <code>provideWebMcpTools</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/forms's changelog</a>.</em></p> <blockquote> <h1>22.0.0 (2026-06-03)</h1> <p><a href="https://goo.gle/angular-v22-blog">Blog post "Announcing Angular v22"</a>.</p> <h2>Breaking Changes</h2> <h3>compiler</h3> <ul> <li>This change will trigger the <code>nullishCoalescingNotNullable</code> and <code>optionalChainNotNullable</code> diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your <code>tsconfig</code> temporarily.</li> <li>data prefixed attribute no-longer bind inputs nor outputs.</li> <li>The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.</li> <li><code>in</code> variables will throw in template expressions.</li> </ul> <h3>compiler-cli</h3> <ul> <li>Elements with multiple matching selectors will now throw at compile time.</li> </ul> <h3>core</h3> <ul> <li>The second arguement of appRef.bootstrap does not accept <code>any</code> anymore. Make sure the element you pass is not nullable.</li> <li> <ul> <li>TypeScript versions older than 6.0 are no longer supported.</li> </ul> </li> <li>Leave animations are no longer limited to the element being removed.</li> <li>Component with undefined <code>changeDetection</code> property are now <code>OnPush</code> by default. Specify <code>changeDetection: ChangeDetectionStrategy.Eager</code> to keep the previous behavior.</li> <li>change AnimationCallbackEvent.animationComplete signature</li> <li><code>ChangeDetectorRef.checkNoChanges</code> was removed. In tests use <code>fixture.detectChanges()</code> instead.</li> <li><code>createNgModuleRef</code> was removed, use <code>createNgModule</code> instead</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponentFunction</code>.</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponent</code> function.</li> </ul> <h3>forms</h3> <ul> <li><code>min</code> and <code>max</code> validation rules no longer support string values. Bound values must be numbers or null.</li> </ul> <h3>http</h3> <ul> <li>Use the <code>HttpXhrBackend</code> with <code>provideHttpClient(withXhr)</code> if you want to keep supporting upload progress reports.</li> </ul> <h3>platform-browser</h3> <ul> <li>This removes styles when they appear to no longer be used by an associated <code>host</code>. However other DOM on the page may still be affected by those styles if not leveraging <code>ViewEncapsulation.Emulated</code> or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.</li> <li>Hammer.js integration has been removed. Use your own implementation.</li> </ul> <h3>router</h3> <ul> <li> <p>The return type for <code>TitleStrategy.getResolvedTitleForRoute</code> was previously 'any' while the actual return type could only be either <code>string</code> or <code>undefined</code>. The return type now reflects the possible values correctly. Code that reads the value may need to be adjusted.</p> <p>(cherry picked from commit ad37f52c1212164c51ffcc533067af05c2c33c89)</p> </li> <li> <p>The <code>currentSnapshot</code> parameter in <code>CanMatchFn</code> and the <code>canMatch</code> method of the <code>CanMatch</code> interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of <code>CanMatch</code> must now include the third argument to satisfy the interface.</p> </li> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheri... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 12:47:40 -07:00
dependabot[bot]	ce7dd7e82f	chore(deps): bump the react group across 1 directory with 5 updates (#2480 ) Bumps the react group with 5 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [react](https://github.com/facebook/react/tree/HEAD/packages/react) \| `19.2.4` \| `19.2.7` \| \| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) \| `19.2.14` \| `19.2.16` \| \| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) \| `19.2.4` \| `19.2.7` \| \| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) \| `5.1.4` \| `6.0.2` \| \| [vitest-browser-react](https://github.com/vitest-community/vitest-browser-react) \| `2.0.5` \| `2.2.0` \| Updates `react` from 19.2.4 to 19.2.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.2.7 (June 1st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Fixed missing <code>FormData</code> entries in Server Actions which regressed in 19.2.6 (<a href="https://redirect.github.com/facebook/react/pull/36566">#36566</a> by <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> <h2>19.2.6 (May 6th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Type hardening and performance improvements (<a href="https://redirect.github.com/facebook/react/pull/36425">#36425</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> <h2>19.2.5 (April 8th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Add more cycle protections (<a href="https://redirect.github.com/facebook/react/pull/36236">#36236</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/react/commit/6117d7cca4906492c51fe6a03381e35adfd86e7d"><code>6117d7c</code></a> Version 19.2.7 (<a href="https://github.com/facebook/react/tree/HEAD/packages/react/issues/36591">#36591</a>)</li> <li><a href="https://github.com/facebook/react/commit/eaf3e95ca92be7a23d3c9cc8ffd6f199a40be401"><code>eaf3e95</code></a> Version 19.2.6</li> <li><a href="https://github.com/facebook/react/commit/23f4f9f30da9e9af2108c18bb197bae75ab584ea"><code>23f4f9f</code></a> 19.2.5</li> <li>See full diff in <a href="https://github.com/facebook/react/commits/v19.2.7/packages/react">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for react since your current version.</p> </details> <br /> Updates `@types/react` from 19.2.14 to 19.2.16 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.4 to 19.2.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.2.7 (June 1st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Fixed missing <code>FormData</code> entries in Server Actions which regressed in 19.2.6 (<a href="https://redirect.github.com/facebook/react/pull/36566">#36566</a> by <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> <h2>19.2.6 (May 6th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Type hardening and performance improvements (<a href="https://redirect.github.com/facebook/react/pull/36425">#36425</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> <h2>19.2.5 (April 8th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Add more cycle protections (<a href="https://redirect.github.com/facebook/react/pull/36236">#36236</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/react/commit/6117d7cca4906492c51fe6a03381e35adfd86e7d"><code>6117d7c</code></a> Version 19.2.7 (<a href="https://github.com/facebook/react/tree/HEAD/packages/react-dom/issues/36591">#36591</a>)</li> <li><a href="https://github.com/facebook/react/commit/eaf3e95ca92be7a23d3c9cc8ffd6f199a40be401"><code>eaf3e95</code></a> Version 19.2.6</li> <li><a href="https://github.com/facebook/react/commit/23f4f9f30da9e9af2108c18bb197bae75ab584ea"><code>23f4f9f</code></a> 19.2.5</li> <li>See full diff in <a href="https://github.com/facebook/react/commits/v19.2.7/packages/react-dom">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for react-dom since your current version.</p> </details> <br /> Updates `@types/react` from 19.2.14 to 19.2.16 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `@vitejs/plugin-react` from 5.1.4 to 6.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's releases</a>.</em></p> <blockquote> <h2>plugin-react@6.0.2</h2> <h3>Allow all options in reactCompilerPreset (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1189">#1189</a>)</h3> <p>This is a type only change. Only <code>compilationMode</code> and <code>target</code> options were available for <code>reactCompilerPreset</code>.</p> <h2>plugin-react@6.0.1</h2> <h3>Expand <code>@rolldown/plugin-babel</code> peer dep range (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1146">#1146</a>)</h3> <p>Expanded <code>@rolldown/plugin-babel</code> peer dep range to include <code>^0.2.0</code>.</p> <h2>plugin-react@6.0.0</h2> <h3>Remove Babel Related Features (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1123">#1123</a>)</h3> <p>Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.</p> <p>If you are using Babel, you can use <code>@rolldown/plugin-babel</code> together with this plugin:</p> <pre lang="diff"><code> import { defineConfig } from 'vite' import react from '@vitejs/plugin-react' +import babel from '@rolldown/plugin-babel' <p>export default defineConfig({ plugins: [</p> <ul> <li> <pre><code>react({ </code></pre> </li> <li> <pre><code> babel: { </code></pre> </li> <li> <pre><code> plugins: ['@babel/plugin-proposal-throw-expressions'], </code></pre> </li> <li> <pre><code> }, </code></pre> </li> <li> <pre><code>}), </code></pre> </li> </ul> <ul> <li> <pre><code>react(), </code></pre> </li> <li> <pre><code>babel({ </code></pre> </li> <li> <pre><code> plugins: ['@babel/plugin-proposal-throw-expressions'], </code></pre> </li> <li> <pre><code>}), </code></pre> ] }) </code></pre></li> </ul> <p>For React compiler users, you can use <code>reactCompilerPreset</code> for easier setup with preconfigured filter to improve build performance:</p> <pre lang="diff"><code> import { defineConfig } from 'vite' -import react from '@vitejs/plugin-react' +import react, { reactCompilerPreset } from '@vitejs/plugin-react' +import babel from '@rolldown/plugin-babel' <p>export default defineConfig({ plugins: [</p> <ul> <li>react({</li> <li> <pre><code> babel: { </code></pre> </li> <li> <pre><code> plugins: ['babel-plugin-react-compiler'], </code></pre> </li> </ul> <p></tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's changelog</a>.</em></p> <blockquote> <h2>6.0.2 (2026-05-14)</h2> <h3>Allow all options in reactCompilerPreset (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1189">#1189</a>)</h3> <p>This is a type only change. Only <code>compilationMode</code> and <code>target</code> options were available for <code>reactCompilerPreset</code>.</p> <h2>6.0.1 (2026-03-13)</h2> <h3>Expand <code>@rolldown/plugin-babel</code> peer dep range (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1146">#1146</a>)</h3> <p>Expanded <code>@rolldown/plugin-babel</code> peer dep range to include <code>^0.2.0</code>.</p> <h2>6.0.0 (2026-03-12)</h2> <h2>6.0.0-beta.0 (2026-03-03)</h2> <h3>Remove Babel Related Features (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1123">#1123</a>)</h3> <p>Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.</p> <p>If you are using Babel, you can use <code>@rolldown/plugin-babel</code> together with this plugin:</p> <pre lang="diff"><code> import { defineConfig } from 'vite' import react from '@vitejs/plugin-react' +import babel from '@rolldown/plugin-babel' <p>export default defineConfig({ plugins: [</p> <ul> <li> <pre><code>react({ </code></pre> </li> <li> <pre><code> babel: { </code></pre> </li> <li> <pre><code> plugins: ['@babel/plugin-proposal-throw-expressions'], </code></pre> </li> <li> <pre><code> }, </code></pre> </li> <li> <pre><code>}), </code></pre> </li> </ul> <ul> <li> <pre><code>react(), </code></pre> </li> <li> <pre><code>babel({ </code></pre> </li> <li> <pre><code> plugins: ['@babel/plugin-proposal-throw-expressions'], </code></pre> </li> <li> <pre><code>}), </code></pre> ] }) </code></pre></li> </ul> <p>For React compiler users, you can use <code>reactCompilerPreset</code> for easier setup with preconfigured filter to improve build performance:</p> <pre lang="diff"><code> import { defineConfig } from 'vite' -import react from '@vitejs/plugin-react' +import react, { reactCompilerPreset } from '@vitejs/plugin-react' +import babel from '@rolldown/plugin-babel' <p></tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/6535b55e956b425e6650ffc2cc98fd23cca1d231"><code>6535b55</code></a> release: plugin-react@6.0.2</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/bf0e43b756e3be81f8572d59727c218311f431ef"><code>bf0e43b</code></a> feat(react): whitelist debugging-options (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1189">#1189</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/3bd1f08ae0b82ee0e96feb2ff265e61c6fe74b54"><code>3bd1f08</code></a> feat: use carets for rolldown versions (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1216">#1216</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/2b8df67323265d1ff5ddf47b2db9ab0b9de5c688"><code>2b8df67</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1218">#1218</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/8fa9619e1b1f51b079f4c1df6bcf076dcafc5aed"><code>8fa9619</code></a> fix(deps): update react 19.2.6 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1211">#1211</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/a4296ad2995a8d493528b8d5450a1209de2943cb"><code>a4296ad</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1209">#1209</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/323ccd72576be636b50baa7d9ce816cc94d5991e"><code>323ccd7</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1196">#1196</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/a7506e105df00cdadc58c0aecc4512d8cfdd9765"><code>a7506e1</code></a> chore(deps): update vite 8.0.10 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1198">#1198</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/02cff2a0cf5c7e9792b1612baa380228f5e4d3c1"><code>02cff2a</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1184">#1184</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/4b9c890cdb21078ac45a86873b24f7e8613b8526"><code>4b9c890</code></a> fix(deps): update react 19.2.5 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1181">#1181</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.2/packages/plugin-react">compare view</a></li> </ul> </details> <br /> Updates `vitest-browser-react` from 2.0.5 to 2.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-community/vitest-browser-react/releases">vitest-browser-react's releases</a>.</em></p> <blockquote> <h2>v2.2.0</h2> <h3> 🚀 Features</h3> <ul> <li>Add <code>createRootOptions</code> to <code>ComponentRenderOptions</code> - by <a href="https://github.com/nstepien"><code>@nstepien</code></a> in <a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/53">vitest-community/vitest-browser-react#53</a> <a href="https://github.com/vitest-community/vitest-browser-react/commit/8803d53"><!-- raw HTML omitted -->(8803d)<!-- raw HTML omitted --></a></li> <li>Expose <code>page.renderHook</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/54">vitest-community/vitest-browser-react#54</a> <a href="https://github.com/vitest-community/vitest-browser-react/commit/3838945"><!-- raw HTML omitted -->(38389)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-community/vitest-browser-react/compare/v2.1.0...v2.2.0">View changes on GitHub</a></h5> <h2>v2.1.0</h2> <h3> 🚀 Features</h3> <ul> <li>Integrate trace mark with render - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/47">vitest-community/vitest-browser-react#47</a> <a href="https://github.com/vitest-community/vitest-browser-react/commit/2b9835d"><!-- raw HTML omitted -->(2b983)<!-- raw HTML omitted --></a></li> </ul> <h3> 🐞 Bug Fixes</h3> <ul> <li>Update links to api documentation - by <a href="https://github.com/nilshartmann"><code>@nilshartmann</code></a> in <a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/48">vitest-community/vitest-browser-react#48</a> <a href="https://github.com/vitest-community/vitest-browser-react/commit/91885dd"><!-- raw HTML omitted -->(91885)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-community/vitest-browser-react/compare/v2.0.5...v2.1.0">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-community/vitest-browser-react/commit/8de0ed7fb3a9a90df86e69489b722bb24ffeadbb"><code>8de0ed7</code></a> chore: release v2.2.0</li> <li><a href="https://github.com/vitest-community/vitest-browser-react/commit/383894510b9fc5f8ce06678c473a546839b55084"><code>3838945</code></a> feat: expose <code>page.renderHook</code> (<a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/54">#54</a>)</li> <li><a href="https://github.com/vitest-community/vitest-browser-react/commit/8803d53b6b7a7dc2f55c6363188653efece4be5b"><code>8803d53</code></a> feat: add <code>createRootOptions</code> to <code>ComponentRenderOptions</code> (<a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/53">#53</a>)</li> <li><a href="https://github.com/vitest-community/vitest-browser-react/commit/fa58d74d265ef4ed56d61df5f1c9907e7d9dcebe"><code>fa58d74</code></a> chore: release v2.1.0</li> <li><a href="https://github.com/vitest-community/vitest-browser-react/commit/2b9835db315aa01afcde460d7c41d08634f31585"><code>2b9835d</code></a> feat: integrate trace mark with render (<a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/47">#47</a>)</li> <li><a href="https://github.com/vitest-community/vitest-browser-react/commit/91885dda84a285e96de5aeb7b172118515ca3e65"><code>91885dd</code></a> fix: update links to api documentation (<a href="https://redirect.github.com/vitest-community/vitest-browser-react/issues/48">#48</a>)</li> <li>See full diff in <a href="https://github.com/vitest-community/vitest-browser-react/compare/v2.0.5...v2.2.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 11:54:56 -07:00
dependabot[bot]	12e157254b	chore(deps): bump the vue group across 1 directory with 2 updates (#2479 ) Bumps the vue group with 2 updates in the / directory: [vue](https://github.com/vuejs/core) and [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue). Updates `vue` from 3.5.33 to 3.5.35 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vuejs/core/releases">vue's releases</a>.</em></p> <blockquote> <h2>v3.5.35</h2> <p>For stable releases, please refer to <a href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">CHANGELOG.md</a> for details. For pre-releases, please refer to <a href="https://github.com/vuejs/core/blob/minor/CHANGELOG.md">CHANGELOG.md</a> of the <code>minor</code> branch.</p> <h2>v3.5.34</h2> <p>For stable releases, please refer to <a href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">CHANGELOG.md</a> for details. For pre-releases, please refer to <a href="https://github.com/vuejs/core/blob/minor/CHANGELOG.md">CHANGELOG.md</a> of the <code>minor</code> branch.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">vue's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vuejs/core/compare/v3.5.34...v3.5.35">3.5.35</a> (2026-05-27)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>compiler-core:</strong> avoid double processing v-for keys with v-memo (<a href="https://redirect.github.com/vuejs/core/issues/14861">#14861</a>) (<a href="https://github.com/vuejs/core/commit/34a0ded4d27289a8f227462bd35b6341a4b51831">34a0ded</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14859">#14859</a></li> <li><strong>compiler-sfc:</strong> resolve top-level exports from files registered as global types (<a href="https://redirect.github.com/vuejs/core/issues/14805">#14805</a>) (<a href="https://github.com/vuejs/core/commit/3d077f26e33510f2ba001d14142ba76a1414dfff">3d077f2</a>), closes <a href="https://redirect.github.com/nuxt/nuxt/issues/33694">nuxt/nuxt#33694</a></li> <li><strong>runtime-core:</strong> avoid repeated hydration mismatch checks (<a href="https://redirect.github.com/vuejs/core/issues/14857">#14857</a>) (<a href="https://github.com/vuejs/core/commit/170fc95eb64b97024dcb3df770557065e2919aa8">170fc95</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14855">#14855</a></li> <li><strong>runtime-core:</strong> skip idle persisted transition hooks in keep-alive moves (<a href="https://redirect.github.com/vuejs/core/issues/14865">#14865</a>) (<a href="https://github.com/vuejs/core/commit/80fc139f90513943f1d0da20d353feec8a9ec894">80fc139</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14031">#14031</a></li> <li><strong>server-renderer:</strong> propagate sync errors from <code>ssrRenderSuspense</code> (<a href="https://redirect.github.com/vuejs/core/issues/14804">#14804</a>) (<a href="https://github.com/vuejs/core/commit/47609975e294fbcc8017b6d68c9be38fa5508f36">4760997</a>), closes <a href="https://redirect.github.com/nuxt/nuxt/issues/28162">nuxt/nuxt#28162</a></li> <li><strong>teleport:</strong> skip child unmount when pending mount discarded (<a href="https://redirect.github.com/vuejs/core/issues/14876">#14876</a>) (<a href="https://redirect.github.com/vuejs/core/issues/14877">#14877</a>) (<a href="https://github.com/vuejs/core/commit/584beb1262d1247d41ed3b463c485c57022fa922">584beb1</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>reactivity:</strong> skip type checks for cached proxies (<a href="https://redirect.github.com/vuejs/core/issues/14860">#14860</a>) (<a href="https://github.com/vuejs/core/commit/5734fe97f6e42d7abb1893c8bc38a17f7deb00b1">5734fe9</a>)</li> <li><strong>runtime-dom:</strong> optimize array event handler dispatch (<a href="https://redirect.github.com/vuejs/core/issues/14828">#14828</a>) (<a href="https://github.com/vuejs/core/commit/bb18dc8e567ce22f1e5dfbc6b16c1003b48c2785">bb18dc8</a>)</li> <li><strong>server-renderer:</strong> avoid materializing iterables in ssrRenderList (<a href="https://redirect.github.com/vuejs/core/issues/14821">#14821</a>) (<a href="https://github.com/vuejs/core/commit/1b7a2cc15c501a4b1e4be61874879381af59b74f">1b7a2cc</a>)</li> </ul> <h2><a href="https://github.com/vuejs/core/compare/v3.5.33...v3.5.34">3.5.34</a> (2026-05-06)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>compiler-sfc:</strong> infer Vue ref wrapper types when source is unresolvable (<a href="https://redirect.github.com/vuejs/core/issues/14758">#14758</a>) (<a href="https://github.com/vuejs/core/commit/7f46fd411b4e3f75ca755ee1318ea8e9aff43f56">7f46fd4</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14729">#14729</a></li> <li><strong>compiler-sfc:</strong> preserve hash hrefs on <code><image></code> elements (<a href="https://redirect.github.com/vuejs/core/issues/14756">#14756</a>) (<a href="https://github.com/vuejs/core/commit/090b2e3a5149ec951c5313b270e5400a1fc870ce">090b2e3</a>)</li> <li><strong>compiler-sfc:</strong> resolve type re-exports inside declare global (<a href="https://redirect.github.com/vuejs/core/issues/14766">#14766</a>) (<a href="https://github.com/vuejs/core/commit/acfffe34e7724a84c21bb8e51e8a5bc0da35f350">acfffe3</a>)</li> <li><strong>reactivity:</strong> prevent orphan effect when created in a stopped scope (<a href="https://redirect.github.com/vuejs/core/issues/14778">#14778</a>) (<a href="https://github.com/vuejs/core/commit/c8e2d4adc9112d2529de0434acc1188dfc399bf4">c8e2d4a</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14777">#14777</a></li> <li><strong>runtime-core:</strong> avoid symbol coercion during props validation (<a href="https://redirect.github.com/vuejs/core/issues/8539">#8539</a>) (<a href="https://github.com/vuejs/core/commit/23d4fb5a6a070df3d2d4a043f0f62c141e376095">23d4fb5</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/8487">#8487</a></li> <li><strong>suspense:</strong> avoid DOM leak with out-in transition in v-if fragment (<a href="https://redirect.github.com/vuejs/core/issues/14762">#14762</a>) (<a href="https://github.com/vuejs/core/commit/9667e0d498ab39273614682986a666c3e73024d9">9667e0d</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14761">#14761</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vuejs/core/commit/8be32d654f5c99de2801d6815e0dc798fb1f7d00"><code>8be32d6</code></a> release: v3.5.35</li> <li><a href="https://github.com/vuejs/core/commit/80fc139f90513943f1d0da20d353feec8a9ec894"><code>80fc139</code></a> fix(runtime-core): skip idle persisted transition hooks in keep-alive moves (...</li> <li><a href="https://github.com/vuejs/core/commit/d6c73713fe20c325e805583d9b2e595b8cd8a111"><code>d6c7371</code></a> ci: use backup action for size report comments</li> <li><a href="https://github.com/vuejs/core/commit/bb18dc8e567ce22f1e5dfbc6b16c1003b48c2785"><code>bb18dc8</code></a> perf(runtime-dom): optimize array event handler dispatch (<a href="https://redirect.github.com/vuejs/core/issues/14828">#14828</a>)</li> <li><a href="https://github.com/vuejs/core/commit/5734fe97f6e42d7abb1893c8bc38a17f7deb00b1"><code>5734fe9</code></a> perf(reactivity): skip type checks for cached proxies (<a href="https://redirect.github.com/vuejs/core/issues/14860">#14860</a>)</li> <li><a href="https://github.com/vuejs/core/commit/584beb1262d1247d41ed3b463c485c57022fa922"><code>584beb1</code></a> fix(teleport): skip child unmount when pending mount discarded (<a href="https://redirect.github.com/vuejs/core/issues/14876">#14876</a>) (<a href="https://redirect.github.com/vuejs/core/issues/14877">#14877</a>)</li> <li><a href="https://github.com/vuejs/core/commit/34a0ded4d27289a8f227462bd35b6341a4b51831"><code>34a0ded</code></a> fix(compiler-core): avoid double processing v-for keys with v-memo (<a href="https://redirect.github.com/vuejs/core/issues/14861">#14861</a>)</li> <li><a href="https://github.com/vuejs/core/commit/170fc95eb64b97024dcb3df770557065e2919aa8"><code>170fc95</code></a> fix(runtime-core): avoid repeated hydration mismatch checks (<a href="https://redirect.github.com/vuejs/core/issues/14857">#14857</a>)</li> <li><a href="https://github.com/vuejs/core/commit/1b7a2cc15c501a4b1e4be61874879381af59b74f"><code>1b7a2cc</code></a> perf(server-renderer): avoid materializing iterables in ssrRenderList (<a href="https://redirect.github.com/vuejs/core/issues/14821">#14821</a>)</li> <li><a href="https://github.com/vuejs/core/commit/3d077f26e33510f2ba001d14142ba76a1414dfff"><code>3d077f2</code></a> fix(compiler-sfc): resolve top-level exports from files registered as global ...</li> <li>Additional commits viewable in <a href="https://github.com/vuejs/core/compare/v3.5.33...v3.5.35">compare view</a></li> </ul> </details> <br /> Updates `@vitejs/plugin-vue` from 6.0.6 to 6.0.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-vue/releases">@vitejs/plugin-vue's releases</a>.</em></p> <blockquote> <h2>plugin-vue@6.0.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite-plugin-vue/blob/plugin-vue@6.0.7/packages/plugin-vue/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md">@vitejs/plugin-vue's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite-plugin-vue/compare/plugin-vue@6.0.6...plugin-vue@6.0.7">6.0.7</a> (2026-05-15)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>use carets for <code>@rolldown/pluginutils</code> version (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/776">#776</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/941b651d8329559fce9231aad4e178f54cccb013">941b651</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/762">#762</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/9e825b85ebe9b6006dc5927aaa8aabc0bcc7eceb">9e825b8</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/774">#774</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/77dc8bc935216bb7ed13f1c2653a80ffdc99fd45">77dc8bc</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/f93acebe8f0c73a9558bd52baf6fd4cabe986213"><code>f93aceb</code></a> release: plugin-vue@6.0.7</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/941b651d8329559fce9231aad4e178f54cccb013"><code>941b651</code></a> feat: use carets for <code>@rolldown/pluginutils</code> version (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/776">#776</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/77dc8bc935216bb7ed13f1c2653a80ffdc99fd45"><code>77dc8bc</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/774">#774</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/9e825b85ebe9b6006dc5927aaa8aabc0bcc7eceb"><code>9e825b8</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/762">#762</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.7/packages/plugin-vue">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 11:54:47 -07:00
dependabot[bot]	cc570de814	chore(deps-dev): bump the svelte group with 2 updates (#2478 ) Bumps the svelte group with 2 updates: [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) and [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte). Updates `@sveltejs/vite-plugin-svelte` from 7.1.1 to 7.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/vite-plugin-svelte/releases">@sveltejs/vite-plugin-svelte's releases</a>.</em></p> <blockquote> <h2><code>@sveltejs/vite-plugin-svelte</code><a href="https://github.com/7"><code>@7</code></a>.1.2</h2> <h3>Patch Changes</h3> <ul> <li>fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1342">#1342</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md">@sveltejs/vite-plugin-svelte's changelog</a>.</em></p> <blockquote> <h2>7.1.2</h2> <h3>Patch Changes</h3> <ul> <li>fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1342">#1342</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/471f82216d4459a90d20f21c76b84aaf20c27e6e"><code>471f822</code></a> Version Packages (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1344">#1344</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/1a9bc0858dd2448092661774b94a23719e236cd0"><code>1a9bc08</code></a> fix: always retrieve CSS using component filename first (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1342">#1342</a>)</li> <li>See full diff in <a href="https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.1.2/packages/vite-plugin-svelte">compare view</a></li> </ul> </details> <br /> Updates `svelte` from 5.55.7 to 5.56.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.56.1</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: error at compile time on duplicate snippet/declaration tag definitions (<a href="https://redirect.github.com/sveltejs/svelte/pull/18351">#18351</a>)</p> </li> <li> <p>fix: parse declaration tag contents more robustly (<a href="https://redirect.github.com/sveltejs/svelte/pull/18353">#18353</a>)</p> </li> <li> <p>fix: correctly transform references to earlier declarators in a declaration tag (e.g. <code>{let a = $state(0), b = $derived(a * 2)}</code>) (<a href="https://redirect.github.com/sveltejs/svelte/pull/18348">#18348</a>)</p> </li> <li> <p>fix: avoid spurious <code>state_referenced_locally</code> warnings for <code>$derived</code> declarations in declaration tags (<a href="https://redirect.github.com/sveltejs/svelte/pull/18348">#18348</a>)</p> </li> <li> <p>fix: tolerate whitespace before <code>let</code>/<code>const</code> in declaration tags (<a href="https://redirect.github.com/sveltejs/svelte/pull/18348">#18348</a>)</p> </li> <li> <p>fix: prevent infinite loop when a tag's expression ends with a trailing <code>/</code> at the end of the input (<a href="https://redirect.github.com/sveltejs/svelte/pull/18350">#18350</a>)</p> </li> <li> <p>fix: more robust parsing of declaration tags with regards to <code>type</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18330">#18330</a>)</p> </li> <li> <p>fix: preserve newlines in spread input values when the <code>type</code> attribute is applied after <code>value</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18345">#18345</a>)</p> </li> <li> <p>fix: update <code>SvelteURLSearchParams</code> when setting duplicate keys to the same joined value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18336">#18336</a>)</p> </li> <li> <p>fix: check references for blockers on server, too (<a href="https://redirect.github.com/sveltejs/svelte/pull/18352">#18352</a>)</p> </li> </ul> <h2>svelte@5.56.0</h2> <h3>Minor Changes</h3> <ul> <li>feat: allow declarations in the template (<a href="https://redirect.github.com/sveltejs/svelte/pull/18282">#18282</a>)</li> </ul> <h3>Patch Changes</h3> <ul> <li> <p>perf: use <code>createElement</code> instead of <code>createElementNS</code> for HTML elements (<a href="https://redirect.github.com/sveltejs/svelte/pull/18262">#18262</a>)</p> </li> <li> <p>perf: store <code>current_sources</code> as a <code>Set</code> for O(1) membership checks (<a href="https://redirect.github.com/sveltejs/svelte/pull/18278">#18278</a>)</p> </li> <li> <p>perf: deduplicate identical hoisted templates within a component (<a href="https://redirect.github.com/sveltejs/svelte/pull/18320">#18320</a>)</p> </li> <li> <p>perf: hoist <code>rest_props</code> exclude list as a module-scope <code>Set</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18252">#18252</a>)</p> </li> </ul> <h2>svelte@5.55.10</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: unlink errored and otherwise finished batch (<a href="https://redirect.github.com/sveltejs/svelte/pull/18264">#18264</a>)</p> </li> <li> <p>perf: walk composedPath() directly in delegated event propagation (<a href="https://redirect.github.com/sveltejs/svelte/pull/18268">#18268</a>)</p> </li> <li> <p>fix: transfer effects when merging batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18254">#18254</a>)</p> </li> <li> <p>fix: allow <code>$derived(await ...)</code> in disconnected effect roots (<a href="https://redirect.github.com/sveltejs/svelte/pull/18273">#18273</a>)</p> </li> <li> <p>fix: remove temporary raw-text hydration markers (<a href="https://redirect.github.com/sveltejs/svelte/pull/18269">#18269</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.56.1</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: error at compile time on duplicate snippet/declaration tag definitions (<a href="https://redirect.github.com/sveltejs/svelte/pull/18351">#18351</a>)</p> </li> <li> <p>fix: parse declaration tag contents more robustly (<a href="https://redirect.github.com/sveltejs/svelte/pull/18353">#18353</a>)</p> </li> <li> <p>fix: correctly transform references to earlier declarators in a declaration tag (e.g. <code>{let a = $state(0), b = $derived(a * 2)}</code>) (<a href="https://redirect.github.com/sveltejs/svelte/pull/18348">#18348</a>)</p> </li> <li> <p>fix: avoid spurious <code>state_referenced_locally</code> warnings for <code>$derived</code> declarations in declaration tags (<a href="https://redirect.github.com/sveltejs/svelte/pull/18348">#18348</a>)</p> </li> <li> <p>fix: tolerate whitespace before <code>let</code>/<code>const</code> in declaration tags (<a href="https://redirect.github.com/sveltejs/svelte/pull/18348">#18348</a>)</p> </li> <li> <p>fix: prevent infinite loop when a tag's expression ends with a trailing <code>/</code> at the end of the input (<a href="https://redirect.github.com/sveltejs/svelte/pull/18350">#18350</a>)</p> </li> <li> <p>fix: more robust parsing of declaration tags with regards to <code>type</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18330">#18330</a>)</p> </li> <li> <p>fix: preserve newlines in spread input values when the <code>type</code> attribute is applied after <code>value</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18345">#18345</a>)</p> </li> <li> <p>fix: update <code>SvelteURLSearchParams</code> when setting duplicate keys to the same joined value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18336">#18336</a>)</p> </li> <li> <p>fix: check references for blockers on server, too (<a href="https://redirect.github.com/sveltejs/svelte/pull/18352">#18352</a>)</p> </li> </ul> <h2>5.56.0</h2> <h3>Minor Changes</h3> <ul> <li>feat: allow declarations in the template (<a href="https://redirect.github.com/sveltejs/svelte/pull/18282">#18282</a>)</li> </ul> <h3>Patch Changes</h3> <ul> <li> <p>perf: use <code>createElement</code> instead of <code>createElementNS</code> for HTML elements (<a href="https://redirect.github.com/sveltejs/svelte/pull/18262">#18262</a>)</p> </li> <li> <p>perf: store <code>current_sources</code> as a <code>Set</code> for O(1) membership checks (<a href="https://redirect.github.com/sveltejs/svelte/pull/18278">#18278</a>)</p> </li> <li> <p>perf: deduplicate identical hoisted templates within a component (<a href="https://redirect.github.com/sveltejs/svelte/pull/18320">#18320</a>)</p> </li> <li> <p>perf: hoist <code>rest_props</code> exclude list as a module-scope <code>Set</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18252">#18252</a>)</p> </li> </ul> <h2>5.55.10</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: unlink errored and otherwise finished batch (<a href="https://redirect.github.com/sveltejs/svelte/pull/18264">#18264</a>)</p> </li> <li> <p>perf: walk composedPath() directly in delegated event propagation (<a href="https://redirect.github.com/sveltejs/svelte/pull/18268">#18268</a>)</p> </li> <li> <p>fix: transfer effects when merging batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18254">#18254</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/3ef761b87b84a7aecd0e11aa4c21a41bb1c180e1"><code>3ef761b</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18346">#18346</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5b8db1be35555fee3b938f9d7eab93f2aee48b7e"><code>5b8db1b</code></a> fix: error at compile time on duplicate snippet/declaration tag definitions (...</li> <li><a href="https://github.com/sveltejs/svelte/commit/56013a2c01454388ea5f58642377038f29cdec4a"><code>56013a2</code></a> fix: check references for blockers on server, too (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18352">#18352</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/2afb895ffabe918d69f8463e06637b060b7a4dce"><code>2afb895</code></a> fix: parse declaration tags with a division operator in the initializer (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18353">#18353</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/b471c15e61c90f820f0e059cfe90d56c135a8e3f"><code>b471c15</code></a> fix: don't hang on a tag whose expression ends with a trailing slash (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18350">#18350</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/c74f44fff99de06270c26098600f891835a15288"><code>c74f44f</code></a> fix: don't mistake <code>type</code> identifier expressions for TS <code>type</code> declarations i...</li> <li><a href="https://github.com/sveltejs/svelte/commit/b76b937e0053b7368b9a94bf2b351b181bd2eda6"><code>b76b937</code></a> fix: various declaration tag bugs (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18348">#18348</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/378bb25097088c2277aa063408c62818cc1f6c4e"><code>378bb25</code></a> fix: set input type before spread value (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18345">#18345</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/2f6307af65fdecce9e7f37ce78464d9431b266ce"><code>2f6307a</code></a> Fix searchParams.set duplicate updates (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18336">#18336</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/11985c020fe1f7f7755494929c5d59f44a45e990"><code>11985c0</code></a> docs: desloppify browser support page (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18333">#18333</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.56.1/packages/svelte">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 11:35:02 -07:00
dependabot[bot]	0125920a2c	chore(deps): bump uuid from 10.0.0 to 14.0.0 (#2344 ) Bumps [uuid](https://github.com/uuidjs/uuid) from 10.0.0 to 14.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uuidjs/uuid/releases">uuid's releases</a>.</em></p> <blockquote> <h2>v14.0.0</h2> <h2><a href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">14.0.0</a> (2026-04-19)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>expect <code>crypto</code> to be global everywhere (requires node@20+) (<a href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li> <li>drop node@18 support (<a href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li> </ul> <h3>Features</h3> <ul> <li>drop node@18 support (<a href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>) (<a href="https://github.com/uuidjs/uuid/commit/dc4ddb87272ed2843faccd130bcc41d492688bd3">dc4ddb8</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>expect <code>crypto</code> to be global everywhere (requires node@20+) (<a href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>) (<a href="https://github.com/uuidjs/uuid/commit/f2c235f93059325fa43e1106e624b5291bb523c4">f2c235f</a>)</li> <li>Use GITHUB_TOKEN for release-please and enable npm provenance (<a href="https://redirect.github.com/uuidjs/uuid/issues/925">#925</a>) (<a href="https://github.com/uuidjs/uuid/commit/ffa31383e8e4e1f0b4e22e504561272041b8738c">ffa3138</a>)</li> </ul> <h2>v13.0.2</h2> <h2><a href="https://github.com/uuidjs/uuid/compare/v13.0.1...v13.0.2">13.0.2</a> (2026-05-04)</h2> <h3>Bug Fixes</h3> <ul> <li>rerelease to fix provenance. (<a href="https://github.com/uuidjs/uuid/commit/49ccb35f78c0c4ce1409dd2f1d89f83caadba10b">49ccb35</a>)</li> </ul> <h2>v13.0.1</h2> <h2><a href="https://github.com/uuidjs/uuid/compare/v13.0.0...v13.0.1">13.0.1</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>backport fix for GHSA-w5hq-g745-h8pq (<a href="https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a">9d27ddf</a>)</li> </ul> <h2>v13.0.0</h2> <h2><a href="https://github.com/uuidjs/uuid/compare/v12.0.0...v13.0.0">13.0.0</a> (2025-09-08)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>make browser exports the default (<a href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>make browser exports the default (<a href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>) (<a href="https://github.com/uuidjs/uuid/commit/bce9d72a3ae5b9a3dcd8eb21ef6d1820288a427a">bce9d72</a>)</li> </ul> <h2>v12.0.1</h2> <h2><a href="https://github.com/uuidjs/uuid/compare/v12.0.0...v12.0.1">12.0.1</a> (2026-04-29)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md">uuid's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">14.0.0</a> (2026-04-19)</h2> <h3>Security</h3> <ul> <li>Fixes <a href="https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq">GHSA-w5hq-g745-h8pq</a>: <code>v3()</code>, <code>v5()</code>, and <code>v6()</code> did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid <code>offset</code> was provided. A <code>RangeError</code> is now thrown if <code>offset < 0</code> or <code>offset + 16 > buf.length</code>.</li> </ul> <h3>⚠ BREAKING CHANGES</h3> <ul> <li><code>crypto</code> is now expected to be globally defined (requires node@20+) (<a href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li> <li>drop node@18 support (<a href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li> <li>upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years</li> </ul> <h2><a href="https://github.com/uuidjs/uuid/compare/v12.0.0...v13.0.0">13.0.0</a> (2025-09-08)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>make browser exports the default (<a href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>make browser exports the default (<a href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>) (<a href="https://github.com/uuidjs/uuid/commit/bce9d72a3ae5b9a3dcd8eb21ef6d1820288a427a">bce9d72</a>)</li> </ul> <h2><a href="https://github.com/uuidjs/uuid/compare/v11.1.0...v12.0.0">12.0.0</a> (2025-09-05)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>update to typescript@5.2 (<a href="https://redirect.github.com/uuidjs/uuid/issues/887">#887</a>)</li> <li>remove CommonJS support (<a href="https://redirect.github.com/uuidjs/uuid/issues/886">#886</a>)</li> <li>drop node@16 support (<a href="https://redirect.github.com/uuidjs/uuid/issues/883">#883</a>)</li> </ul> <h3>Features</h3> <ul> <li>add node@24 to ci matrix (<a href="https://redirect.github.com/uuidjs/uuid/issues/879">#879</a>) (<a href="https://github.com/uuidjs/uuid/commit/42b6178aa21a593257f0a72abacd220f0b7b8a92">42b6178</a>)</li> <li>drop node@16 support (<a href="https://redirect.github.com/uuidjs/uuid/issues/883">#883</a>) (<a href="https://github.com/uuidjs/uuid/commit/0f38cf10366ab074f9328ae2021eea04d5f2e530">0f38cf1</a>)</li> <li>remove CommonJS support (<a href="https://redirect.github.com/uuidjs/uuid/issues/886">#886</a>) (<a href="https://github.com/uuidjs/uuid/commit/ae786e27265f50bcf7cead196c29f1869297c42f">ae786e2</a>)</li> <li>update to typescript@5.2 (<a href="https://redirect.github.com/uuidjs/uuid/issues/887">#887</a>) (<a href="https://github.com/uuidjs/uuid/commit/c7ee40598ed78584d81ab78dffded9fe5ff20b01">c7ee405</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>improve v4() performance (<a href="https://redirect.github.com/uuidjs/uuid/issues/894">#894</a>) (<a href="https://github.com/uuidjs/uuid/commit/5fd974c12718c8848035650b69b8948f12ace197">5fd974c</a>)</li> <li>restore node: prefix (<a href="https://redirect.github.com/uuidjs/uuid/issues/889">#889</a>) (<a href="https://github.com/uuidjs/uuid/commit/e1f42a354593093ba0479f0b4047dae82d28c507">e1f42a3</a>)</li> </ul> <h2><a href="https://github.com/uuidjs/uuid/compare/v11.0.5...v11.1.0">11.1.0</a> (2025-02-19)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uuidjs/uuid/commit/7c1ea087a8149b57380fc8bb7f68c3a215cb6e4b"><code>7c1ea08</code></a> chore(main): release 14.0.0 (<a href="https://redirect.github.com/uuidjs/uuid/issues/926">#926</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34"><code>3d2c5b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/uuidjs/uuid/commit/f2c235f93059325fa43e1106e624b5291bb523c4"><code>f2c235f</code></a> fix!: expect <code>crypto</code> to be global everywhere (requires node@20+) (<a href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/529ef0899f5dd503d2ee90d690585d63d78bc212"><code>529ef08</code></a> chore: upgrade TypeScript and fixup types (<a href="https://redirect.github.com/uuidjs/uuid/issues/927">#927</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/086fd7976f11433edf9ac80be876b3ad243fe087"><code>086fd79</code></a> chore: update dependencies (<a href="https://redirect.github.com/uuidjs/uuid/issues/933">#933</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/dc4ddb87272ed2843faccd130bcc41d492688bd3"><code>dc4ddb8</code></a> feat!: drop node@18 support (<a href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/0f1f9c9c9cedbae5a1d363d5406c5dfbabe81404"><code>0f1f9c9</code></a> chore: switch to Biome for parsing and linting (<a href="https://redirect.github.com/uuidjs/uuid/issues/932">#932</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/e2879e64bf125add903c1eff6e0860542c605013"><code>e2879e6</code></a> chore: use maintained version of npm-run-all (<a href="https://redirect.github.com/uuidjs/uuid/issues/930">#930</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/ffa31383e8e4e1f0b4e22e504561272041b8738c"><code>ffa3138</code></a> fix: Use GITHUB_TOKEN for release-please and enable npm provenance (<a href="https://redirect.github.com/uuidjs/uuid/issues/925">#925</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/0423d49df2dc8efc300c804731d25f4d7e0fccc4"><code>0423d49</code></a> docs: remove obsolete v1 option notes (<a href="https://redirect.github.com/uuidjs/uuid/issues/915">#915</a>)</li> <li>Additional commits viewable in <a href="https://github.com/uuidjs/uuid/compare/v10.0.0...v14.0.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for uuid since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> > Note > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christian Bromann <git@bromann.dev>	2026-05-31 23:19:01 -07:00
dependabot[bot]	0fc86c27c5	chore(deps): bump protobufjs from 6.11.6 to 7.6.0 (#2429 ) Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 6.11.6 to 7.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p> <blockquote> <h2>protobufjs: v7.6.0</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.9...protobufjs-v7.6.0">7.6.0</a> (2026-05-18)</h2> <h3>Features</h3> <ul> <li>Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7">f769242</a>)</li> </ul> <h2>protobufjs: v7.5.9</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.8...protobufjs-v7.5.9">7.5.9</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797">0853a62</a>)</li> </ul> <h2>protobufjs: v7.5.8</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li> </ul> <h2>protobufjs: v7.5.7</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li> </ul> <h2>protobufjs: v7.5.6</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li> </ul> <h2>v7.5.5</h2> <p>This release backports two reported security issues to 7.x branch.</p> <ul> <li>fix: do not allow setting <code>__proto__</code> in Message constructor (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2126">#2126</a>)</li> <li>fix: filter invalid characters from the type name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2127">#2127</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5">https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5</a></p> <h2>protobufjs: v7.5.4</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.0/CHANGELOG.md">protobufjs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.9...protobufjs-v7.6.0">7.6.0</a> (2026-05-18)</h2> <h3>Features</h3> <ul> <li>Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7">f769242</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.8...protobufjs-v7.5.9">7.5.9</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797">0853a62</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <h3>Bug Fixes</h3> <ul> <li>invalid syntax in descriptor.proto (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2092">#2092</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/5a3769a465fead089a533ad55c21d069299df760">5a3769a</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.2...protobufjs-v7.5.3">7.5.3</a> (2025-05-28)</h2> <h3>Bug Fixes</h3> <ul> <li>descriptor extensions handling post-editions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2075">#2075</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6e255d4ad6982cc857f26e1731c2cedcf5796f68">6e255d4</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.1...protobufjs-v7.5.2">7.5.2</a> (2025-05-14)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e30c3341382b504a975d0d83f19170218cb461c3"><code>e30c334</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2260">#2260</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7"><code>f769242</code></a> feat: Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/ab3862d133ab9b824f12eab5f993784333543dbf"><code>ab3862d</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2255">#2255</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797"><code>0853a62</code></a> fix: Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/d7035f9b7f06210ea343cab1f2f1cc18ee5cc1d6"><code>d7035f9</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2248">#2248</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26"><code>54b593f</code></a> fix: Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e88fcea1635f79c414e8a070e164d38ea99e104a"><code>e88fcea</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2239">#2239</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5"><code>cc7d595</code></a> fix: Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/3abc9b54d67a7102785c6dfd8bf6610f545d445b"><code>3abc9b5</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2190">#2190</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/a0bf2dfdd8a75aa62ce5a1ff47a52b9b8f1ea793"><code>a0bf2df</code></a> fix: Update CLI peer dependency (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2189">#2189</a>)</li> <li>Additional commits viewable in <a href="https://github.com/protobufjs/protobuf.js/compare/v6.11.6...protobufjs-v7.6.0">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepublish</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=protobufjs&package-manager=npm_and_yarn&previous-version=6.11.6&new-version=7.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-29 17:31:00 -07:00
dependabot[bot]	afa946ca04	chore(deps): bump js-cookie from 3.0.5 to 3.0.7 (#2422 ) Bumps [js-cookie](https://github.com/js-cookie/js-cookie) from 3.0.5 to 3.0.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/js-cookie/js-cookie/releases">js-cookie's releases</a>.</em></p> <blockquote> <h2>v3.0.7</h2> <ul> <li>Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)</li> <li>Add <code>Partitioned</code> attribute to readme (b994768)</li> <li>Publish to npm registry via trusted publisher exclusively (4dc71be)</li> <li>Ensure consistent behaviour for <code>get('name')</code> + <code>get()</code> (1953d30)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/js-cookie/js-cookie/commit/17bacba0171dd022728d8fdeba3203c60791bf58"><code>17bacba</code></a> Craft v3.0.7 release</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/adb823cb7e95ead47f3af4d4951e589acbde2077"><code>adb823c</code></a> Fix release workflow halting at <code>git tag</code></li> <li><a href="https://github.com/js-cookie/js-cookie/commit/5f9e759b07d2752e8407a3a43fb5f879bf384c5e"><code>5f9e759</code></a> May remove Git user config from release workflow</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/6ac921184c7b3b7d9431c88707f56521acd72ab4"><code>6ac9211</code></a> Fix release workflow not able to push commit + tag</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/2278bc55e1804c4c2d9bd2110a9b449949a52751"><code>2278bc5</code></a> Fix missing package version bump</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020"><code>eb3c40e</code></a> Prevent cookie attribute injection</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/f6f157f430d707d2ffd0c9c9138227a6cea564e5"><code>f6f157f</code></a> Bump globals from 17.5.0 to 17.6.0</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/f409d022da50a0c6fa8724f087fbc50fab9a9533"><code>f409d02</code></a> Bump eslint from 10.2.0 to 10.3.0</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/a686883c03a754c04546cfc1653911a70a640b40"><code>a686883</code></a> Bump protobufjs in the npm_and_yarn group across 1 directory</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/c6112d2d4f2881a12aaf89d9e2996ef6870eb6d0"><code>c6112d2</code></a> Bump <code>@protobufjs/utf8</code> in the npm_and_yarn group across 1 directory</li> <li>Additional commits viewable in <a href="https://github.com/js-cookie/js-cookie/compare/v3.0.5...v3.0.7">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for js-cookie since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=js-cookie&package-manager=npm_and_yarn&previous-version=3.0.5&new-version=3.0.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-30 00:17:46 +00:00
Christian Bromann	2c14b12a80	fix(sdk): add back respondAll and respond config/metadata (#2448 ) ## Summary - Add `respondAll(responsesById, options)` to the stream controller and the React/Angular/Svelte/Vue wrappers, resuming multiple interrupts pending at the same checkpoint in a single `Command({ resume })`. This is required for runs that pause on several interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot service. - Change `respond()` to take an options object (`{ interruptId?, namespace?, config?, metadata? }`), folding run-level `config`/`metadata` onto the resumed run so it applies the same configurable values and metadata a fresh `submit()` would. - Extend `ThreadStream.respondInput()` to accept a `responses` batch (mutually exclusive with the single `interrupt_id`/`response`) and clear all responded interrupts from local state. - Update the protocol-v2 reference servers (`embed/protocol.mts`, `protocol/service.mts`) to read the `responses` batch plus `config`/`metadata` leniently and fold them onto the run servicing `input.respond`. - Update docs (interrupts/use-stream) across all framework packages and add controller tests for batched resume.	2026-05-28 16:53:09 -07:00
Christian Bromann	b1d307ab84	ci(infra): run framework browser tests only when paths change (#2425 ) ## Summary - Add a `detect-changes` job to the browser test workflow using `dorny/paths-filter@v3.0.2`. - Run all four framework browser jobs when `libs/sdk/**` changes or when this workflow file changes. - Run only the matching job when `libs/sdk-react`, `libs/sdk-angular`, `libs/sdk-vue`, or `libs/sdk-svelte` changes. - Keep the full matrix on `workflow_dispatch` (manual runs and CI dispatched via workflow_dispatch).	2026-05-22 07:15:30 -07:00
dependabot[bot]	674173b8ac	chore(deps-dev): bump turbo from 2.8.15 to 2.9.14 (#2428 ) Bumps [turbo](https://github.com/vercel/turborepo) from 2.8.15 to 2.9.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.9.14</h2> <blockquote> <p>[!NOTE] This release contains important security fixes.</p> </blockquote> <h3>High:</h3> <ul> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mm">GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection</a></li> </ul> <h3>Low:</h3> <ul> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r">GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation</a></li> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726">GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection</a></li> </ul> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.9.12 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12774">vercel/turborepo#12774</a></li> <li>fix: Restore docs mobile menu by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12782">vercel/turborepo#12782</a></li> <li>ci: Use <code>pull_request</code> for PR title linting by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12787">vercel/turborepo#12787</a></li> <li>ci: Scope GitHub Actions caches by branch by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12788">vercel/turborepo#12788</a></li> <li>test: Validate lockfiles without dependency downloads by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12789">vercel/turborepo#12789</a></li> <li>Removed unneeded import form hash creation script in docs by <a href="https://github.com/dancrumb"><code>@dancrumb</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> <li>fix: Validate auth callback state by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12802">vercel/turborepo#12802</a></li> <li>fix: Harden VS Code extension command execution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12800">vercel/turborepo#12800</a></li> <li>fix: Avoid project-local Yarn during detection by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12801">vercel/turborepo#12801</a></li> <li>chore: Release 2.9.13 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12803">vercel/turborepo#12803</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dancrumb"><code>@dancrumb</code></a> made their first contribution in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14">https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14</a></p> <h2>Turborepo v2.9.13-canary.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.9.11-canary.7 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12768">vercel/turborepo#12768</a></li> <li>fix: Allow <code>$TURBO_EXTENDS$</code> in LSP diagnostics by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12770">vercel/turborepo#12770</a></li> <li>release(turborepo): 2.9.11 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12771">vercel/turborepo#12771</a></li> <li>fix: Allow transit nodes in LSP diagnostics by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12773">vercel/turborepo#12773</a></li> <li>release(turborepo): 2.9.12 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12774">vercel/turborepo#12774</a></li> <li>fix: Restore docs mobile menu by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12782">vercel/turborepo#12782</a></li> <li>ci: Use <code>pull_request</code> for PR title linting by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12787">vercel/turborepo#12787</a></li> <li>ci: Scope GitHub Actions caches by branch by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12788">vercel/turborepo#12788</a></li> <li>test: Validate lockfiles without dependency downloads by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12789">vercel/turborepo#12789</a></li> <li>Removed unneeded import form hash creation script in docs by <a href="https://github.com/dancrumb"><code>@dancrumb</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> <li>fix: Validate auth callback state by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12802">vercel/turborepo#12802</a></li> <li>fix: Harden VS Code extension command execution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12800">vercel/turborepo#12800</a></li> <li>fix: Avoid project-local Yarn during detection by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12801">vercel/turborepo#12801</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/fc62fe0d9c347d1d24f0ed8946284856593ddb93"><code>fc62fe0</code></a> publish 2.9.14 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/fb8c9aec0f9e83f95783659a5ce9c4478cf62cb9"><code>fb8c9ae</code></a> chore: Release 2.9.13 (<a href="https://redirect.github.com/vercel/turborepo/issues/12803">#12803</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/e8e629da4e1fb75231089e91b19be9d327a3e649"><code>e8e629d</code></a> fix: Avoid project-local Yarn during detection (<a href="https://redirect.github.com/vercel/turborepo/issues/12801">#12801</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/91c90cbf12f524c5c29b713d6472dd5fcdecb309"><code>91c90cb</code></a> fix: Harden VS Code extension command execution (<a href="https://redirect.github.com/vercel/turborepo/issues/12800">#12800</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/84f450894e87da1eed864d51f6f637f26980d560"><code>84f4508</code></a> fix: Validate auth callback state (<a href="https://redirect.github.com/vercel/turborepo/issues/12802">#12802</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/1779ad7901384f106236a6e196059e4929745514"><code>1779ad7</code></a> Removed unneeded import form hash creation script in docs (<a href="https://redirect.github.com/vercel/turborepo/issues/12799">#12799</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/71f8c90a807ffb9b9876ea8a04f523f473bf5c8d"><code>71f8c90</code></a> test: Validate lockfiles without dependency downloads (<a href="https://redirect.github.com/vercel/turborepo/issues/12789">#12789</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/5fcb96024d503127bb0ed760ebe159b7716c52b3"><code>5fcb960</code></a> ci: Scope GitHub Actions caches by branch (<a href="https://redirect.github.com/vercel/turborepo/issues/12788">#12788</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/4cf9fabc9a6f6c99fe4e2f2da9f35be631be062a"><code>4cf9fab</code></a> ci: Use <code>pull_request</code> for PR title linting (<a href="https://redirect.github.com/vercel/turborepo/issues/12787">#12787</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/859c629bc401f239ac7980a132746ca90478e17c"><code>859c629</code></a> fix: Restore docs mobile menu (<a href="https://redirect.github.com/vercel/turborepo/issues/12782">#12782</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.8.15...v2.9.14">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=turbo&package-manager=npm_and_yarn&previous-version=2.8.15&new-version=2.9.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christian Bromann <git@bromann.dev>	2026-05-22 07:07:17 -07:00
Christian Bromann	9d3c9dd318	fix(core): move @langchain/core back into being a peer dep (#2415 ) `@langchain/langgraph-sdk@1.9.0` promoted `@langchain/core` from a dev dependency to a runtime dependency, which caused install-size metrics for `@langchain/langgraph` to jump from ~6 MB to ~40 MB for consumers who did not already have core installed (or who use `--legacy-peer-deps`). That happened because core pulls in heavy transitive deps such as `js-tiktoken` (~21 MB) and `zod` (~6 MB), even though `@langchain/langgraph` already lists core as a peer. This PR moves `@langchain/core` back to a required peer dependency on the SDK, matching `@langchain/langgraph` and the pre-1.9.0 SDK layout. Runtime behavior is unchanged for typical LangGraph apps that already install core; SDK-only installs no longer force core into the tree. Also switches `LangChainTracer` in `types.ts` to a type-only import so the tracer subpath is not pulled as a value import.	2026-05-18 23:48:19 -07:00
dependabot[bot]	ea131491b3	chore(deps): bump brace-expansion from 1.1.12 to 5.0.6 (#2412 ) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 5.0.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <ul> <li>fmt 5a5cc17</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 0b6a978</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1">https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <ul> <li>feat: use string replaces instead of splits (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/64">#64</a>) 278132b</li> <li>fmt dd72a59</li> <li>add <code>tea.yaml</code> 70e4c1b</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0</a></p> <p>As a precaution to not risk breaking anything with 278132b, this is a new semver major release</p> <h2>v3.0.1</h2> <ul> <li>pkg: publish on tag 3.x 3059c07</li> <li>fmt 8229e6f</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 15f9b3c</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1</a></p> <h2>v3.0.0</h2> <ul> <li>Switch to ES Modules and balanced-match 3.0.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/62">#62</a>) c0360e8</li> <li>added jsdoc (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/55">#55</a>) 68c0e37</li> <li>node 16 is EOL 9e781e9</li> <li>add standard 3494c4d</li> <li>use const and let (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/57">#57</a>) dd5a4cb</li> <li>docs 6dad209</li> <li>remove <code>test</code> e3dd8ae</li> <li>ci: update node versions d23ede9</li> <li>docs: add <a href="https://github.com/lanodan"><code>@lanodan</code></a> to contributors 1eb3fa4</li> <li>docs 1e7c9cd</li> <li>switch from tape to test module (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/60">#60</a>) 2520537</li> <li>Bump minimist from 1.2.5 to 1.2.6 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/59">#59</a>) 61a94f1</li> <li>Bump path-parse from 1.0.6 to 1.0.7 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/51">#51</a>) dc741cf</li> <li>docs: add back ci badge 8ee5626</li> <li>Add github actions, remove travis. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/52">#52</a> (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/53">#53</a>) 5c8756a</li> <li>CI: Drop unused sudo: false Travis directive (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/50">#50</a>) 05978a7</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0">https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0</a></p> <h2>v2.0.2</h2> <ul> <li>pkg: publish on tag 2.x 14f1d91</li> <li>fmt ed7780a</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 36603d5</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/46317b5d8779c151d24f65c9c139cd076f91a1c3"><code>46317b5</code></a> 5.0.6</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5"><code>c0b095b</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/ec5602085a81ca7c954f6780c6a3aef0b1e200cf"><code>ec56020</code></a> Bump picomatch from 4.0.3 to 4.0.4 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/93">#93</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/87939017c6cb6be56b98c6fa2059b073315cd534"><code>8793901</code></a> 5.0.5</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051"><code>9a02af5</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a"><code>daa71bc</code></a> Bump tar from 7.5.10 to 7.5.11 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/92">#92</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/799e5f7a222b0ea29052090b80fab2125a846543"><code>799e5f7</code></a> Bump tar from 7.5.9 to 7.5.10 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/90">#90</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/012c230b7f71ca0c43febfa2dc3b710f63f129dd"><code>012c230</code></a> 5.0.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/243c491714270462decf1293b395e0aa6f6c15c4"><code>243c491</code></a> Fix handling of brackets. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/87">#87</a></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/609f8588070198ca6ff7132d2f78bbae5c991b93"><code>609f858</code></a> Correct incorrect brace-expansion import (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/89">#89</a>)</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v5.0.6">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=brace-expansion&package-manager=npm_and_yarn&previous-version=1.1.12&new-version=5.0.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-18 19:26:56 -07:00
dependabot[bot]	0e61e8cb48	chore(deps): bump protobufjs from 6.11.5 to 7.6.0 (#2411 ) Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 6.11.5 to 7.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p> <blockquote> <h2>protobufjs: v7.6.0</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.9...protobufjs-v7.6.0">7.6.0</a> (2026-05-18)</h2> <h3>Features</h3> <ul> <li>Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7">f769242</a>)</li> </ul> <h2>protobufjs: v7.5.9</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.8...protobufjs-v7.5.9">7.5.9</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797">0853a62</a>)</li> </ul> <h2>protobufjs: v7.5.8</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li> </ul> <h2>protobufjs: v7.5.7</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li> </ul> <h2>protobufjs: v7.5.6</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li> </ul> <h2>v7.5.5</h2> <p>This release backports two reported security issues to 7.x branch.</p> <ul> <li>fix: do not allow setting <code>__proto__</code> in Message constructor (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2126">#2126</a>)</li> <li>fix: filter invalid characters from the type name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2127">#2127</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5">https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5</a></p> <h2>protobufjs: v7.5.4</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.0/CHANGELOG.md">protobufjs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.9...protobufjs-v7.6.0">7.6.0</a> (2026-05-18)</h2> <h3>Features</h3> <ul> <li>Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7">f769242</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.8...protobufjs-v7.5.9">7.5.9</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797">0853a62</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <h3>Bug Fixes</h3> <ul> <li>invalid syntax in descriptor.proto (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2092">#2092</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/5a3769a465fead089a533ad55c21d069299df760">5a3769a</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.2...protobufjs-v7.5.3">7.5.3</a> (2025-05-28)</h2> <h3>Bug Fixes</h3> <ul> <li>descriptor extensions handling post-editions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2075">#2075</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6e255d4ad6982cc857f26e1731c2cedcf5796f68">6e255d4</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.1...protobufjs-v7.5.2">7.5.2</a> (2025-05-14)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e30c3341382b504a975d0d83f19170218cb461c3"><code>e30c334</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2260">#2260</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7"><code>f769242</code></a> feat: Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/ab3862d133ab9b824f12eab5f993784333543dbf"><code>ab3862d</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2255">#2255</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797"><code>0853a62</code></a> fix: Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/d7035f9b7f06210ea343cab1f2f1cc18ee5cc1d6"><code>d7035f9</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2248">#2248</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26"><code>54b593f</code></a> fix: Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e88fcea1635f79c414e8a070e164d38ea99e104a"><code>e88fcea</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2239">#2239</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5"><code>cc7d595</code></a> fix: Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/3abc9b54d67a7102785c6dfd8bf6610f545d445b"><code>3abc9b5</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2190">#2190</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/a0bf2dfdd8a75aa62ce5a1ff47a52b9b8f1ea793"><code>a0bf2df</code></a> fix: Update CLI peer dependency (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2189">#2189</a>)</li> <li>Additional commits viewable in <a href="https://github.com/protobufjs/protobuf.js/compare/v6.11.5...protobufjs-v7.6.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for protobufjs since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepublish</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=protobufjs&package-manager=npm_and_yarn&previous-version=6.11.5&new-version=7.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-18 19:26:48 -07:00
dependabot[bot]	428c4e3f29	chore(deps): bump ws from 8.19.0 to 8.20.1 (#2413 ) Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.20.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.20.1</h2> <h1>Bug fixes</h1> <ul> <li>Fixed an uninitialized memory disclosure issue in <code>websocket.close()</code> (c0327ec1).</li> </ul> <p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>) as the <code>reason</code> argument for <code>websocket.close()</code>, rather than the supported string or <code>Buffer</code> types, caused uninitialized memory to be disclosed to the remote peer.</p> <pre lang="js"><code>import { deepStrictEqual } from 'node:assert'; import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer( { port: 0, skipUTF8Validation: true }, function () { const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>, { skipUTF8Validation: true });</p> <pre><code>ws.on('close', function (code, reason) { deepStrictEqual(reason, Buffer.alloc(80)); }); </code></pre> <p>} );</p> <p>wss.on('connection', function (ws) { ws.close(1000, new Float32Array(20)); }); </code></pre></p> <p>The issue was privately reported by <a href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p> <h2>8.20.0</h2> <h1>Features</h1> <ul> <li>Added exports for the <code>PerMessageDeflate</code> class and utilities for the <code>Sec-WebSocket-Extensions</code> and <code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li><a href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a> [dist] 8.20.0</li> <li><a href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a> [minor] Export the <code>PerMessageDeflate</code> class and header utils</li> <li><a href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a> [api] Convert the <code>isServer</code> and <code>maxPayload</code> parameters to options</li> <li><a href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a> [doc] Add missing space</li> <li><a href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a> [pkg] Update eslint to version 10.0.1</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.19.0...8.20.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ws&package-manager=npm_and_yarn&previous-version=8.19.0&new-version=8.20.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-18 14:45:30 -07:00
dependabot[bot]	57a72458df	chore(deps): bump axios from 1.15.1 to 1.16.1 (#2410 ) Bumps [axios](https://github.com/axios/axios) from 1.15.1 to 1.16.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.16.1 — May 13, 2026</h2> <p>This release ships a defence-in-depth fix for prototype pollution in <code>formDataToJSON</code>, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Prototype Pollution Defence-in-Depth:</strong> Hardened <code>formDataToJSON</code> against already-polluted <code>Object.prototype</code> by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (<strong><a href="https://redirect.github.com/axios/axios/issues/7413">#7413</a></strong>)</li> <li><strong>Proxy Cleartext Leak:</strong> Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (<strong><a href="https://redirect.github.com/axios/axios/issues/10858">#10858</a></strong>)</li> <li><strong>CI Cache Removal:</strong> Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (<strong><a href="https://redirect.github.com/axios/axios/issues/10882">#10882</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Data URI Parsing:</strong> Updated the <code>fromDataURI</code> regex to match RFC 2397 more strictly, fixing edge cases in <code>data:</code> URL handling. (<strong><a href="https://redirect.github.com/axios/axios/issues/10829">#10829</a></strong>)</li> <li><strong>Unicode Headers:</strong> Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (<strong><a href="https://redirect.github.com/axios/axios/issues/10850">#10850</a></strong>)</li> <li><strong>XHR Upload Progress:</strong> Guarded against malformed <code>ProgressEvent</code> payloads emitted by some environments during XHR upload, preventing crashes when <code>loaded</code> / <code>total</code> are missing or invalid. (<strong><a href="https://redirect.github.com/axios/axios/issues/10868">#10868</a></strong>)</li> <li><strong>Webpack 4 Fetch Adapter:</strong> Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (<strong><a href="https://redirect.github.com/axios/axios/issues/10864">#10864</a></strong>)</li> <li><strong>Type Definitions:</strong> Made <code>parseReviver</code> <code>context.source</code> optional in the type definitions to align with the ES2023 specification. (<strong><a href="https://redirect.github.com/axios/axios/issues/10837">#10837</a></strong>)</li> <li><strong>URL Object Support Reverted:</strong> Reverted the change that allowed passing a <code>URL</code> object as <code>config.url</code> (originally <strong><a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a></strong>) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (<strong><a href="https://redirect.github.com/axios/axios/issues/10874">#10874</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Cycle Detection Refactor:</strong> Replaced the array-based cycle tracker in <code>toJSONObject</code> with a <code>WeakSet</code>, improving performance and memory behaviour on large nested structures. (<strong><a href="https://redirect.github.com/axios/axios/issues/10832">#10832</a></strong>)</li> <li><strong>composeSignals Cleanup:</strong> Refactored <code>composeSignals</code> to use a clearer early-return structure, simplifying the cancellation/abort composition path. (<strong><a href="https://redirect.github.com/axios/axios/issues/10844">#10844</a></strong>)</li> <li><strong>AI Readiness & Repo Docs:</strong> Added <code>AGENTS.md</code> and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (<strong><a href="https://redirect.github.com/axios/axios/issues/10835">#10835</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10841">#10841</a></strong>)</li> <li><strong>Docs Improvements:</strong> Clarified the GET request example, fixed the interceptor <code>eject</code> example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (<strong><a href="https://redirect.github.com/axios/axios/issues/10836">#10836</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10853">#10853</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10856">#10856</a></strong>)</li> <li><strong>Sponsorship Tooling:</strong> Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (<strong><a href="https://redirect.github.com/axios/axios/issues/10843">#10843</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10859">#10859</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10869">#10869</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>@commitlint/cli</code> from 20.5.0 to 20.5.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10846">#10846</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/hpinmetaverse"><code>@hpinmetaverse</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10836">#10836</a></strong>)</li> <li><strong><a href="https://github.com/tommyhgunz14"><code>@tommyhgunz14</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7413">#7413</a></strong>)</li> <li><strong><a href="https://github.com/abhu85"><code>@abhu85</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10829">#10829</a></strong>)</li> <li><strong><a href="https://github.com/divyanshuraj1095"><code>@divyanshuraj1095</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10853">#10853</a></strong>)</li> <li><strong><a href="https://github.com/sagodi97"><code>@sagodi97</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10856">#10856</a></strong>)</li> <li><strong><a href="https://github.com/rkdfx"><code>@rkdfx</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10868">#10868</a></strong>)</li> <li><strong><a href="https://github.com/Liuwei1125"><code>@Liuwei1125</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.16.0...v1.16.1">Full Changelog</a></p> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <ul> <li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and <code>maxContentLength</code>.</strong> These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li> <li><strong>Proxy requests now preserve user-supplied <code>Host</code> headers.</strong> Previously, the proxy path could overwrite a custom <code>Host</code>. Virtual-host-style routing through a proxy will now behave correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li> <li><strong>Basic auth credentials embedded in URLs are now URL-decoded.</strong> If you have percent-encoded credentials in a URL (e.g. <code>https://user:p%40ss@host</code>), the decoded value is what now goes on the wire. (<strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong><code>parseProtocol</code> now strictly requires a colon in the protocol separator.</strong> Strings that loosely parsed as protocols before may no longer match. (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Deprecated <code>unescape()</code> replaced with modern UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct; consumers depending on legacy <code>unescape()</code> quirks may see different output bytes. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong><code>transformRequest</code> input typing change was reverted.</strong> The typing change introduced in <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> was reverted in <a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a> after follow-up review — net behavior is unchanged from 1.15.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP method across adapters and type definitions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li> <li><strong>ECONNREFUSED Error Constant:</strong> Exposed <code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so callers can match connection-refused failures without comparing string literals (closes <a href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong>Encode Helper Export:</strong> Exported the internal <code>encode</code> helper from <code>buildURL</code> so userland param serializers can reuse the same encoding logic that axios uses internally. (<strong><a href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>HTTP Adapter — Redirects & Headers:</strong> Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing <code>requestDetails</code> argument on <code>beforeRedirect</code>, preserved user-supplied <code>Host</code> headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (<strong><a href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong>HTTP Adapter — Streams & Timeouts:</strong> Preserved the partial response object on <code>AxiosError</code> when a stream is aborted after headers arrive, honoured the <code>timeout</code> option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and <code>maxRedirects: 0</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li> <li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code> / <code>maxContentLength</code> in the fetch adapter, set the <code>User-Agent</code> header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a <code>TypeError</code> in restricted environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li> <li><strong>XHR Adapter:</strong> Unsubscribed the <code>cancelToken</code> and <code>AbortSignal</code> listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong>Error Handling:</strong> Attached the parsed response to <code>AxiosError</code> when <code>JSON.parse</code> fails inside <code>dispatchRequest</code>, prevented <code>settle</code> from emitting <code>undefined</code> error codes, and tightened the <code>parseProtocol</code> regex to require a colon in the protocol separator. (<strong><a href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Types & Exports:</strong> Aligned the CommonJS <code>CancelToken</code> typings with the ESM build, fixed a compiler error caused by <code>RawAxiosHeaders</code>, and re-exported <code>create</code> from the package index. (<strong><a href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li> <li><strong>UTF-8 Encoding:</strong> Replaced the deprecated <code>unescape()</code> call with a modern UTF-8 encoding implementation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong>Misc Cleanup:</strong> Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (<strong><a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Refactor — ES6 Modernisation:</strong> Modernised the <code>utils</code> module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (<strong><a href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li> <li><strong>Docs:</strong> Documented <code>paramsSerializer.encode</code> for strict RFC 3986 query encoding, updated the <code>parseReviver</code> TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li> <li><strong>Reverted:</strong> Reverted the <code>transformRequest</code> input typing change from <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> after follow-up review. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>actions/setup-node</code>, the <code>github-actions</code> group, and <code>postcss</code> (in <code>/docs</code>) to their latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li> <li><strong>Release:</strong> Updated changelog and packages, and prepared the 1.16.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/singhankit001"><code>@singhankit001</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li> <li><strong><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong><a href="https://github.com/iruizsalinas"><code>@iruizsalinas</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/1337d6b537afb2d3f501074c8ac4ef4308221197"><code>1337d6b</code></a> chore(release): prepare release 1.16.1 (<a href="https://redirect.github.com/axios/axios/issues/10877">#10877</a>)</li> <li><a href="https://github.com/axios/axios/commit/858a790cec06054547d0d3f941916d6fb2a4d18e"><code>858a790</code></a> fix: remove all caches (<a href="https://redirect.github.com/axios/axios/issues/10882">#10882</a>)</li> <li><a href="https://github.com/axios/axios/commit/34adfd90efc9c145488399e1cf7fa96de67080fa"><code>34adfd9</code></a> revert: "fix: support URL object as config.url input (<a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a>)" (<a href="https://redirect.github.com/axios/axios/issues/10874">#10874</a>)</li> <li><a href="https://github.com/axios/axios/commit/847d89b43654405d9a231e0b669832c2092b621f"><code>847d89b</code></a> fix: support URL object as config.url input (<a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a>)</li> <li><a href="https://github.com/axios/axios/commit/40948863677bb793bfff0293cce7e7b4f8a1b212"><code>4094886</code></a> fix(progress): guard malformed XHR upload events (<a href="https://redirect.github.com/axios/axios/issues/10868">#10868</a>)</li> <li><a href="https://github.com/axios/axios/commit/44f0c5bf73c45df6009365141faa394d73596bd7"><code>44f0c5b</code></a> chore: change sponsorship link and add Twicsy advertisement (<a href="https://redirect.github.com/axios/axios/issues/10869">#10869</a>)</li> <li><a href="https://github.com/axios/axios/commit/64e1095efedc64c9fecf5176bd9cf2e5e93140d6"><code>64e1095</code></a> chore: update PR and issue template to use h2 (<a href="https://redirect.github.com/axios/axios/issues/10865">#10865</a>)</li> <li><a href="https://github.com/axios/axios/commit/3e6b4e1f311b43aa1dc77d78150a601d9fe4b280"><code>3e6b4e1</code></a> fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...</li> <li><a href="https://github.com/axios/axios/commit/c4453bab70f53575175903aee60810c821f72129"><code>c4453ba</code></a> fix: add the ability to add additional sponsors to the process sponsors scrip...</li> <li><a href="https://github.com/axios/axios/commit/caa00a90b524bb67ed033474abcf4d8645ced793"><code>caa00a9</code></a> fix: https data in cleartext to proxy (<a href="https://redirect.github.com/axios/axios/issues/10858">#10858</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.15.1...v1.16.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.15.1&new-version=1.16.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-18 12:56:38 -07:00
dependabot[bot]	bd72a897e1	chore(deps): bump postcss from 8.5.8 to 8.5.14 (#2399 ) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to 8.5.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/3ec13948ae0006e1bde2dfb545346341ac8b2dcf"><code>3ec1394</code></a> Release 8.5.14 version</li> <li><a href="https://github.com/postcss/postcss/commit/f2bb827b20b591080977412555aa3e5baf588620"><code>f2bb827</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/d75953d60854ad835fd21dde0b11081522341020"><code>d75953d</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2084">#2084</a> from 43081j/raw-raws-rawing</li> <li><a href="https://github.com/postcss/postcss/commit/68bd2139b5dcaf5a682bc2e8826d8557be2d1480"><code>68bd213</code></a> fix: always call <code>raw</code> to retrieve raw values</li> <li><a href="https://github.com/postcss/postcss/commit/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1"><code>af58cf1</code></a> Release 8.5.13 version</li> <li><a href="https://github.com/postcss/postcss/commit/f227dbd0e9443e5f33e18e633b8b4d2b55aac5ee"><code>f227dbd</code></a> Temporary ignore pnpm 11 config</li> <li><a href="https://github.com/postcss/postcss/commit/d3abd40d723cf3559e5ddb5fc738b7cb64e92bb0"><code>d3abd40</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/dd06c3e11362087bc18f9c20cee30fd82bda3de9"><code>dd06c3e</code></a> Revert stringifier changes because of the conflict with postcss-scss</li> <li><a href="https://github.com/postcss/postcss/commit/ae889c815fb88d785401a88f1a7dfc8cb11915fb"><code>ae889c8</code></a> Try to fix CI</li> <li><a href="https://github.com/postcss/postcss/commit/e0093e49bcf00347383a13e40bb1f67bc823ca15"><code>e0093e4</code></a> Move to pnpm 11</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.8...8.5.14">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.8&new-version=8.5.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-16 03:30:45 -07:00
dependabot[bot]	14f7cbc517	chore(deps): bump mermaid from 11.13.0 to 11.15.0 (#2402 ) Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.13.0 to 11.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mermaid-js/mermaid/releases">mermaid's releases</a>.</em></p> <blockquote> <h2>mermaid@11.15.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7174">#7174</a> <a href="https://github.com/mermaid-js/mermaid/commit/0aca21739c0d1fcaaa206e04a6cd574ebc415483"><code>0aca217</code></a> Thanks <a href="https://github.com/milesspencer35"><code>@milesspencer35</code></a>! - feat(sequence): Add support for decimal start and increment values in the <code>autonumber</code> directive</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7512">#7512</a> <a href="https://github.com/mermaid-js/mermaid/commit/8e17492f7365ba50896382feb69a23efd9d8a22d"><code>8e17492</code></a> Thanks <a href="https://github.com/aruncveli"><code>@aruncveli</code></a>! - feat(flowchart): add datastore shape</p> <p>In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with <code>A@{ shape: datastore, label: "Datastore" }</code>.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/6440">#6440</a> <a href="https://github.com/mermaid-js/mermaid/commit/9ad8dde6d049adde85d8ed2d476c09b5820f3f4b"><code>9ad8dde</code></a> Thanks <a href="https://github.com/yordis"><code>@yordis</code></a>, <a href="https://github.com/lgazo"><code>@lgazo</code></a>! - feat: add Event Modeling diagram</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7707">#7707</a> <a href="https://github.com/mermaid-js/mermaid/commit/27db774627be1cee881961dfd0d2cb21cd01b79d"><code>27db774</code></a> Thanks <a href="https://github.com/txmxthy"><code>@txmxthy</code></a>! - feat(architecture): expose four fcose layout knobs for <code>architecture-beta</code> diagrams (<code>nodeSeparation</code>, <code>idealEdgeLengthMultiplier</code>, <code>edgeElasticity</code>, <code>numIter</code>) so authors can tune layout density and spread overlapping siblings without changing diagram source</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7604">#7604</a> <a href="https://github.com/mermaid-js/mermaid/commit/bf9502fb6012a4b724679b401ac928f5ee55161c"><code>bf9502f</code></a> Thanks <a href="https://github.com/M-a-c"><code>@M-a-c</code></a>! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting</p> <p>If you have namespaces in class diagrams that use <code>.</code>s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set <code>class.hierarchicalNamespaces=false</code> in your mermaid config:</p> <pre lang="yaml"><code>config: class: hierarchicalNamespaces: false </code></pre> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7272">#7272</a> <a href="https://github.com/mermaid-js/mermaid/commit/88cdd3dc0aab9577174561b04e14760c565a232b"><code>88cdd3d</code></a> Thanks <a href="https://github.com/xinbenlv"><code>@xinbenlv</code></a>! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f"><code>e9b0f34</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix: prevent unbalanced CSS styles in classDefs</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056"><code>37ff937</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix: create CSS styles using the CSSOM</p> <p>This removes some invalid CSS and normalizes some CSS formatting.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7508">#7508</a> <a href="https://github.com/mermaid-js/mermaid/commit/bfe60cc67b9a6dec64f9161f58e4d24a06c42b65"><code>bfe60cc</code></a> Thanks <a href="https://github.com/biiab"><code>@biiab</code></a>! - fix(stateDiagram): <code>end note</code> now only closes a note when used on a new line</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e"><code>faafb5d</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix(gantt): add iteration limit for <code>excludes</code> field</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/65f8be2a42faf869b811469571983cba7eeeca99"><code>65f8be2</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix: disallow some CSS at-rules in custom CSS</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7726">#7726</a> <a href="https://github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824"><code>1502f32</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix(wardley): fix unnecessary sanitization of text</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7578">#7578</a> <a href="https://github.com/mermaid-js/mermaid/commit/1f98db8e326299ac97a2fa60abfd509d8f5f16e2"><code>1f98db8</code></a> Thanks <a href="https://github.com/Gaston202"><code>@Gaston202</code></a>! - fix(class): self-referential class multiplicity labels no longer rendered multiple times</p> <p>Fixes <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7560">#7560</a>. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7592">#7592</a> <a href="https://github.com/mermaid-js/mermaid/commit/2343e38498a3b31f8ce5e79f1f009e0b56fbe086"><code>2343e38</code></a> Thanks <a href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7589">#7589</a> <a href="https://github.com/mermaid-js/mermaid/commit/7fb9509b8b5cb1dc48519dc60cf6cdc6afba0462"><code>7fb9509</code></a> Thanks <a href="https://github.com/NYCU-Chung"><code>@NYCU-Chung</code></a>! - fix(block): prevent column widths from shrinking when mixing different column spans</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7632">#7632</a> <a href="https://github.com/mermaid-js/mermaid/commit/3f9e0f15bedc1e2c71ddb6b34192d1a21124cfc2"><code>3f9e0f1</code></a> Thanks <a href="https://github.com/ekiauhce"><code>@ekiauhce</code></a>! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mermaid-js/mermaid/commit/41646dfd43ac83f001b03c70605feb036afae46d"><code>41646df</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7739">#7739</a> from aloisklink/ci/fix-release</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/2671f5c44a1515960ebc41c09a365c41860f95ee"><code>2671f5c</code></a> docs: fix v11.15.0 release</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/f4bf04b5db8bed603e40ed3d5ce5228d6b07754e"><code>f4bf04b</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7738">#7738</a> from mermaid-js/changeset-release/master</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/abfb563e1dcbd46d617f44a6361bd6d926dc6289"><code>abfb563</code></a> Version Packages</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/60b289f428d0a0832ad95ed4e1fb326344e23532"><code>60b289f</code></a> Release Candidate 11.15.0 (<a href="https://redirect.github.com/mermaid-js/mermaid/issues/7737">#7737</a>)</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/d37c0db39ca2405b4473361063df2c47109dc2c9"><code>d37c0db</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7730">#7730</a> from aloisklink/fix/fix-edgeLabelRightLeft-changes</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/5ab5a2895fa8b7e90de85b43a4b99aa50b39b0f1"><code>5ab5a28</code></a> docs: improve nested namespace changeset</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/18f8b4c5bf67aface3485272b48042f2fdd6fad2"><code>18f8b4c</code></a> fix: revert endEdgeLabelLeft/endEdgeLabelRight change</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/504b2eb73d4d827baa817efd47ab6f44ae769b5a"><code>504b2eb</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7726">#7726</a> from aloisklink/fix/correct-unnecessary-html-escapes...</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824"><code>1502f32</code></a> fix(wardley): fix unnecessary sanitization of text</li> <li>Additional commits viewable in <a href="https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.15.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mermaid&package-manager=npm_and_yarn&previous-version=11.13.0&new-version=11.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-16 03:30:28 -07:00
dependabot[bot]	ed630b8ce5	chore(deps): bump @protobufjs/utf8 from 1.1.0 to 1.1.1 (#2401 ) Bumps [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js) from 1.1.0 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dcodeIO/protobuf.js/releases">@protobufjs/utf8's releases</a>.</em></p> <blockquote> <h2>protobufjs-cli: v1.1.1</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1">1.1.1</a> (2023-02-02)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>cli:</strong> fix relative path to Google pb files (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/1859">#1859</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2">e42eea4</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/644d588c0495da6a570344248e1b5af901bc3b0c"><code>644d588</code></a> chore: release master (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1865">#1865</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2"><code>e42eea4</code></a> fix(cli): fix relative path to Google pb files (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1859">#1859</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/dce9a2ef92d363752e40b295b0da9bd178f82e83"><code>dce9a2e</code></a> fix: use bundled filename to fix common pb includes (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1860">#1860</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/64e8936ad9f73c68b3fa1e57857dd38323b5a745"><code>64e8936</code></a> fix: use ES5 style function syntax (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1830">#1830</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/4489fa771464bcb49b57149760e9cc4131e8077e"><code>4489fa7</code></a> Revert "fix: error should be thrown (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1817">#1817</a>)" (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1864">#1864</a>)</li> <li>See full diff in <a href="https://github.com/dcodeIO/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@protobufjs/utf8&package-manager=npm_and_yarn&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-16 03:30:12 -07:00
dependabot[bot]	4ea95d7f70	chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 (#2404 ) Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.4 to 1.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md">fast-xml-builder's changelog</a>.</em></p> <blockquote> <p><strong>1.2.0</strong> (2026-05-08)</p> <ul> <li>Add support for <code>sanitizeName</code> option</li> <li>Support xml-naming for validating and sanitizing tag and attribute names</li> </ul> <p><strong>1.1.9</strong> (2026-05-06)</p> <ul> <li>fix: format output for preserve order when indent by is set to empty string</li> </ul> <p><strong>1.1.8</strong> (2026-05-05)</p> <ul> <li>fix: skip text property for PI tags</li> <li>improve typings</li> </ul> <p><strong>1.1.7</strong> (2026--05-04)</p> <ul> <li>fix security issues when attribute value contains quotes</li> </ul> <p><strong>1.1.6</strong> (2026--05-04)</p> <ul> <li>fix security issues related to comment</li> <li>skip comment with null value</li> </ul> <p><strong>1.1.5</strong> (2026-04-17)</p> <ul> <li>fix security issues related to comment and cdata</li> </ul> <p><strong>1.1.4</strong> (2026-03-16)</p> <ul> <li>support maxNestedTags option</li> </ul> <p><strong>1.1.3</strong> (2026-03-13)</p> <ul> <li>declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher</li> </ul> <p><strong>1.1.2</strong> (2026-03-11)</p> <ul> <li>fix typings</li> </ul> <p><strong>1.1.1</strong> (2026-03-11)</p> <ul> <li>upgrade path-expression-matcher to 1.1.3</li> </ul> <p><strong>1.1.0</strong> (2026-03-10)</p> <ul> <li>Integrate <a href="https://github.com/NaturalIntelligence/path-expression-matcher">path-expression-matcher</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/a9a905b316176ef9a97bdf5450e60efbf0341f25"><code>a9a905b</code></a> for release</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/42680e8d730c48082268823fd285e10127ddba21"><code>42680e8</code></a> support name sanitization</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8b00185bf6be67981ffc40e06c18acbbbe908779"><code>8b00185</code></a> release info</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8a08f173d7b9c9a82599fe7de279ca7e12c3ad6b"><code>8a08f17</code></a> allow indentation to be empty string</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/7fc5decb9613afbd5d03747b1a0f11e0916e34ef"><code>7fc5dec</code></a> update docs</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/c241b6a8ed1863e5f518490ec1fcc38b13f2c370"><code>c241b6a</code></a> improve documentation</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/15d5668b53777400c8d80b6e21029c1a70888c78"><code>15d5668</code></a> update for release</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/98774853a696a1aee4dca830dd3eee2759676bd2"><code>9877485</code></a> fix: skip text property for PI tags</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/311a2213a817cf31558bea7c0e0807b0d4441814"><code>311a221</code></a> fix <a href="https://redirect.github.com/NaturalIntelligence/fast-xml-builder/issues/5">#5</a> typing import issues</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/e8fc5b15d9d54b559781961f066de82a55aabcdd"><code>e8fc5b1</code></a> update for releast</li> <li>Additional commits viewable in <a href="https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.4...v1.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-xml-builder&package-manager=npm_and_yarn&previous-version=1.1.4&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-16 03:29:40 -07:00
dependabot[bot]	6ddc76d25d	chore(deps): bump basic-ftp from 5.3.0 to 5.3.1 (#2398 ) Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.3.0 to 5.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/patrickjuchli/basic-ftp/releases">basic-ftp's releases</a>.</em></p> <blockquote> <h2>5.3.1</h2> <ul> <li>Fixed: Protect against unbounded control response, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md">basic-ftp's changelog</a>.</em></p> <blockquote> <h2>5.3.1</h2> <ul> <li>Fixed: Protect against unbounded control response, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/980371bb6057d78d479b5cfc18683392abd2c45f"><code>980371b</code></a> Guard against unbounded control response</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/50827c73ca6c1d786c97276e47be8a33d0f2277d"><code>50827c7</code></a> Adjust changelog to match release notes</li> <li>See full diff in <a href="https://github.com/patrickjuchli/basic-ftp/compare/v5.3.0...v5.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=basic-ftp&package-manager=npm_and_yarn&previous-version=5.3.0&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-16 03:28:58 -07:00
dependabot[bot]	67831afa7f	chore(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#2394 ) Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.55.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>svelte@5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> <li> <p>fix: abort running obsolete async branches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a> chore: bump devalue (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a> fix: keep dependencies of <code>$state.eager</code>/<code>pending</code> (alternative approach) (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li> <li><a href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a> fix: duplicated "of" in events.js comment (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a> fix: treat batches as a linked list (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=svelte&package-manager=npm_and_yarn&previous-version=5.55.5&new-version=5.55.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-15 23:19:22 -07:00
dependabot[bot]	c8aaf91753	chore(deps): bump postcss from 8.5.8 to 8.5.14 (#2391 ) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to 8.5.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/3ec13948ae0006e1bde2dfb545346341ac8b2dcf"><code>3ec1394</code></a> Release 8.5.14 version</li> <li><a href="https://github.com/postcss/postcss/commit/f2bb827b20b591080977412555aa3e5baf588620"><code>f2bb827</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/d75953d60854ad835fd21dde0b11081522341020"><code>d75953d</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2084">#2084</a> from 43081j/raw-raws-rawing</li> <li><a href="https://github.com/postcss/postcss/commit/68bd2139b5dcaf5a682bc2e8826d8557be2d1480"><code>68bd213</code></a> fix: always call <code>raw</code> to retrieve raw values</li> <li><a href="https://github.com/postcss/postcss/commit/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1"><code>af58cf1</code></a> Release 8.5.13 version</li> <li><a href="https://github.com/postcss/postcss/commit/f227dbd0e9443e5f33e18e633b8b4d2b55aac5ee"><code>f227dbd</code></a> Temporary ignore pnpm 11 config</li> <li><a href="https://github.com/postcss/postcss/commit/d3abd40d723cf3559e5ddb5fc738b7cb64e92bb0"><code>d3abd40</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/dd06c3e11362087bc18f9c20cee30fd82bda3de9"><code>dd06c3e</code></a> Revert stringifier changes because of the conflict with postcss-scss</li> <li><a href="https://github.com/postcss/postcss/commit/ae889c815fb88d785401a88f1a7dfc8cb11915fb"><code>ae889c8</code></a> Try to fix CI</li> <li><a href="https://github.com/postcss/postcss/commit/e0093e49bcf00347383a13e40bb1f67bc823ca15"><code>e0093e4</code></a> Move to pnpm 11</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.8...8.5.14">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.8&new-version=8.5.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-15 23:18:42 -07:00
dependabot[bot]	aa6deb60c7	chore(deps): bump hono from 4.12.14 to 4.12.18 (#2374 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.14 to 4.12.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.18</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage</h3> <p>Affects: Cache Middleware. Fixes missing cache-skip handling for <code>Vary: Authorization</code> and <code>Vary: Cookie</code>, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm</p> <h3>CSS Declaration Injection via Style Object Values in JSX SSR</h3> <p>Affects: hono/jsx. Fixes a missing CSS-context escape for <code>style</code> object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p</p> <h3>Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()</h3> <p>Affects: <code>hono/utils/jwt</code>. Fixes improper validation of <code>exp</code>, <code>nbf</code>, and <code>iat</code> claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36</p> <hr /> <p>Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.</p> <h2>v4.12.17</h2> <h2>What's Changed</h2> <ul> <li>fix(jsx): normalize SVG attributes on the <!-- raw HTML omitted --> root element by <a href="https://github.com/kfly8"><code>@kfly8</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li> <li>fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to <code>defaultExtensionMap</code> by <a href="https://github.com/yuintei"><code>@yuintei</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4899">honojs/hono#4899</a></li> <li>fix(cors): make origin optional in CORSOptions by <a href="https://github.com/truffle-dev"><code>@truffle-dev</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li> <li>fix(types): propagate middleware response types to app.on overloads by <a href="https://github.com/T4ko0522"><code>@T4ko0522</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4906">honojs/hono#4906</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kfly8"><code>@kfly8</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li> <li><a href="https://github.com/truffle-dev"><code>@truffle-dev</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.16...v4.12.17">https://github.com/honojs/hono/compare/v4.12.16...v4.12.17</a></p> <h2>v4.12.16</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection</h3> <p>Affects: hono/jsx. Fixes missing validation of JSX tag names when using <code>jsx()</code> or <code>createElement()</code>, which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432</p> <h3>bodyLimit() can be bypassed for chunked / unknown-length requests</h3> <p>Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v</p> <h2>v4.12.15</h2> <h2>What's Changed</h2> <ul> <li>fix(jwt): support single-line PEM keys by <a href="https://github.com/hiendv"><code>@hiendv</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4889">honojs/hono#4889</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/f10dee89ced5956b73c1cdc416d6bc0fd54d63b7"><code>f10dee8</code></a> 4.12.18</li> <li><a href="https://github.com/honojs/hono/commit/a5bd9ebead279ed9d0239ecbd854f629edfc0e57"><code>a5bd9eb</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/58d3d3ad5656e007ed99da1b73865975952de5e9"><code>58d3d3a</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/568c2ecc1dd556894fad4dfa4a7ba499db6dba9c"><code>568c2ec</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/ff2b3d31df1be35f7d597a95dd3369402b6e87f2"><code>ff2b3d3</code></a> 4.12.17</li> <li><a href="https://github.com/honojs/hono/commit/52aaaf9714b06303ce5caa655b1d80675be687e9"><code>52aaaf9</code></a> fix(types): propagate middleware response types to app.on overloads (<a href="https://redirect.github.com/honojs/hono/issues/4906">#4906</a>)</li> <li><a href="https://github.com/honojs/hono/commit/76d5589e9b0569f4e74ec37e8dd6979455f70dfa"><code>76d5589</code></a> fix(cors): make origin optional in CORSOptions (<a href="https://redirect.github.com/honojs/hono/issues/4905">#4905</a>)</li> <li><a href="https://github.com/honojs/hono/commit/8f027e5574e91e3c7f263a728656e3888559e51a"><code>8f027e5</code></a> fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to <code>defaultExtensionMap</code> (<a href="https://redirect.github.com/honojs/hono/issues/4899">#4899</a>)</li> <li><a href="https://github.com/honojs/hono/commit/bfba97ca7ea3d4541a3419f1749e5a1a3e8f1727"><code>bfba97c</code></a> fix(jsx): normalize SVG attributes on the <svg> root element (<a href="https://redirect.github.com/honojs/hono/issues/4893">#4893</a>)</li> <li><a href="https://github.com/honojs/hono/commit/90d4182aabd328e2ec6af3f25ec62ddc574ad8cb"><code>90d4182</code></a> 4.12.16</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.14...v4.12.18">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.14&new-version=4.12.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-11 14:20:47 -07:00
dependabot[bot]	c79cf7f813	chore(deps): bump the angular group across 1 directory with 9 updates (#2365 ) Bumps the angular group with 9 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) \| `21.2.7` \| `21.2.11` \| \| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) \| `21.2.7` \| `21.2.11` \| \| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) \| `21.2.7` \| `21.2.11` \| \| [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) \| `21.2.7` \| `21.2.11` \| \| [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) \| `21.2.7` \| `21.2.11` \| \| [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) \| `21.2.7` \| `21.2.11` \| \| [@angular/build](https://github.com/angular/angular-cli) \| `21.2.6` \| `21.2.9` \| \| [@angular/cli](https://github.com/angular/angular-cli) \| `21.2.6` \| `21.2.9` \| \| [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) \| `21.2.7` \| `21.2.11` \| Updates `@angular/common` from 21.2.7 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/common's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <h2>21.2.10</h2> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix - 0d5ee9ae1b" /></a></td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix - 5533ab4f56" /></a></td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img src="https://img.shields.io/badge/580212c995-fix-green" alt="fix - 580212c995" /></a></td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <p>\| Commit \| Description \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/common's changelog</a>.</em></p> <blockquote> <h1>21.2.11 (2026-04-29)</h1> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td> <td>fix</td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td> <td>fix</td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td> <td>fix</td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td> <td>fix</td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td> <td>fix</td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.9 (2026-04-22)</h1> <h2>Breaking Changes</h2> <h3>router</h3> <ul> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> </ul> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td> <td>feat</td> <td>introduce <code>@Service</code> decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td> <td>feat</td> <td>Update Testability to use PendingTasks for stability indicator</td> </tr> </tbody> </table> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td> <td>fix</td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td> <td>fix</td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td> <td>fix</td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td> <td>fix</td> <td>set default paramsInheritanceStrategy to 'always'</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a> refactor(common): fix viewport tests</li> <li><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a> fix(common): prevent focus from scrollToAnchor</li> <li><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><code>540536c</code></a> fix(http): add CSP nonce support to JsonpClientBackend</li> <li><a href="https://github.com/angular/angular/commit/8102331f82c808ca2256ba51a1d83803a61beabb"><code>8102331</code></a> test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.11/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.7 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/compiler's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <h2>21.2.10</h2> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix - 0d5ee9ae1b" /></a></td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix - 5533ab4f56" /></a></td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img src="https://img.shields.io/badge/580212c995-fix-green" alt="fix - 580212c995" /></a></td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <p>\| Commit \| Description \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/compiler's changelog</a>.</em></p> <blockquote> <h1>21.2.11 (2026-04-29)</h1> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td> <td>fix</td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td> <td>fix</td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td> <td>fix</td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td> <td>fix</td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td> <td>fix</td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.9 (2026-04-22)</h1> <h2>Breaking Changes</h2> <h3>router</h3> <ul> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> </ul> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td> <td>feat</td> <td>introduce <code>@Service</code> decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td> <td>feat</td> <td>Update Testability to use PendingTasks for stability indicator</td> </tr> </tbody> </table> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td> <td>fix</td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td> <td>fix</td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td> <td>fix</td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td> <td>fix</td> <td>set default paramsInheritanceStrategy to 'always'</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a> fix(compiler): let declaration span not including end character</li> <li><a href="https://github.com/angular/angular/commit/a4f312060cdf745e4fb0b15eda24ee2b4df0440c"><code>a4f3120</code></a> refactor(compiler): require a reference in DirectiveMeta</li> <li><a href="https://github.com/angular/angular/commit/de533fe49181ee7409fd0b0ae4c0391a1e220ee6"><code>de533fe</code></a> refactor(compiler-cli): move ClassPropertyMapping into compiler</li> <li><a href="https://github.com/angular/angular/commit/ea1e34c4ddf404cde8d5c4ba0ba762bb0b9edbf8"><code>ea1e34c</code></a> refactor(compiler): move matchSource into base metadata</li> <li><a href="https://github.com/angular/angular/commit/e40d378f3e3e7e57a45c8fbd9565ee06a3a6a13f"><code>e40d378</code></a> fix(compiler): handle nested brackets in host object bindings</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.11/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.7 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/core's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <h2>21.2.10</h2> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix - 0d5ee9ae1b" /></a></td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix - 5533ab4f56" /></a></td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img src="https://img.shields.io/badge/580212c995-fix-green" alt="fix - 580212c995" /></a></td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <p>\| Commit \| Description \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/core's changelog</a>.</em></p> <blockquote> <h1>21.2.11 (2026-04-29)</h1> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td> <td>fix</td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td> <td>fix</td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td> <td>fix</td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td> <td>fix</td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td> <td>fix</td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.9 (2026-04-22)</h1> <h2>Breaking Changes</h2> <h3>router</h3> <ul> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> </ul> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td> <td>feat</td> <td>introduce <code>@Service</code> decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td> <td>feat</td> <td>Update Testability to use PendingTasks for stability indicator</td> </tr> </tbody> </table> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td> <td>fix</td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td> <td>fix</td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td> <td>fix</td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td> <td>fix</td> <td>set default paramsInheritanceStrategy to 'always'</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a> fix(core): fix ordering of view queries metadata in JIT mode</li> <li><a href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a> refactor(core): fix bundling symbol test</li> <li><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><code>885a1a1</code></a> fix(core): guard against non-object events and avoid listener wrapper identit...</li> <li><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><code>7a64aff</code></a> fix(core): prevent event replay double-invocation when element hydrates befor...</li> <li><a href="https://github.com/angular/angular/commit/750af5b12325277e04a345aaa74256bd8a1fbf26"><code>750af5b</code></a> build: update cross-repo angular dependencies to v21.2.8</li> <li><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><code>5533ab4</code></a> fix(migrations): fix NgClass leaving trailing comma after removal</li> <li><a href="https://github.com/angular/angular/commit/2b9954fd3dab124bfd88a49fc46f77271831c778"><code>2b9954f</code></a> fix(migrations): fix NgClass leaving trailing comma after removal</li> <li><a href="https://github.com/angular/angular/commit/c9215b353975163c1d2b67d2fffe499ae82ceeef"><code>c9215b3</code></a> Revert "refactor(core): complete removal of deprecated <code>createNgModuleRef</code> al...</li> <li><a href="https://github.com/angular/angular/commit/d88d6ed69e05decd2957e1235615926f49fb35c6"><code>d88d6ed</code></a> refactor(core): complete removal of deprecated <code>createNgModuleRef</code> alias</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v21.2.11/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@angular/forms` from 21.2.7 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/forms's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <h2>21.2.10</h2> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix - 0d5ee9ae1b" /></a></td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix - 5533ab4f56" /></a></td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img src="https://img.shields.io/badge/580212c995-fix-green" alt="fix - 580212c995" /></a></td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <p>\| Commit \| Description \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/forms's changelog</a>.</em></p> <blockquote> <h1>21.2.11 (2026-04-29)</h1> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td> <td>fix</td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td> <td>fix</td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td> <td>fix</td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td> <td>fix</td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td> <td>fix</td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.9 (2026-04-22)</h1> <h2>Breaking Changes</h2> <h3>router</h3> <ul> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> </ul> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td> <td>feat</td> <td>introduce <code>@Service</code> decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td> <td>feat</td> <td>Update Testability to use PendingTasks for stability indicator</td> </tr> </tbody> </table> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td> <td>fix</td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td> <td>fix</td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td> <td>fix</td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td> <td>fix</td> <td>set default paramsInheritanceStrategy to 'always'</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/600da64ba4df4b73ee00ab1b13f490a7de436ff6"><code>600da64</code></a> docs(forms): add NG01902 error reference and link to docs</li> <li><a href="https://github.com/angular/angular/commit/dc9581469fe552faf45984362508d7e05adb5930"><code>dc95814</code></a> docs: add documentation for NG1002</li> <li><a href="https://github.com/angular/angular/commit/b0dc2fbfcb909c558c7dcff89c2fe47c89878991"><code>b0dc2fb</code></a> docs(forms): clarify disabled FormArray value behavior</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.11/packages/forms">compare view</a></li> </ul> </details> <br /> Updates `@angular/platform-browser` from 21.2.7 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/platform-browser's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <h2>21.2.10</h2> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix - 0d5ee9ae1b" /></a></td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix - 5533ab4f56" /></a></td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img src="https://img.shields.io/badge/580212c995-fix-green" alt="fix - 580212c995" /></a></td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <p>\| Commit \| Description \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/platform-browser's changelog</a>.</em></p> <blockquote> <h1>21.2.11 (2026-04-29)</h1> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td> <td>fix</td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td> <td>fix</td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td> <td>fix</td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td> <td>fix</td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td> <td>fix</td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.9 (2026-04-22)</h1> <h2>Breaking Changes</h2> <h3>router</h3> <ul> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> </ul> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td> <td>feat</td> <td>introduce <code>@Service</code> decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td> <td>feat</td> <td>Update Testability to use PendingTasks for stability indicator</td> </tr> </tbody> </table> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td> <td>fix</td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td> <td>fix</td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td> <td>fix</td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td> <td>fix</td> <td>set default paramsInheritanceStrategy to 'always'</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.11/packages/platform-browser">compare view</a></li> </ul> </details> <br /> Updates `@angular/router` from 21.2.7 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/router's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <h2>21.2.10</h2> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix - 0d5ee9ae1b" /></a></td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix - 5533ab4f56" /></a></td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img src="https://img.shields.io/badge/580212c995-fix-green" alt="fix - 580212c995" /></a></td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <p>\| Commit \| Description \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/router's changelog</a>.</em></p> <blockquote> <h1>21.2.11 (2026-04-29)</h1> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td> <td>fix</td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td> <td>fix</td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td> <td>fix</td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td> <td>fix</td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td> <td>fix</td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.9 (2026-04-22)</h1> <h2>Breaking Changes</h2> <h3>router</h3> <ul> <li> <p>paramsInheritanceStrategy now defaults to 'always'</p> <p>The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.</p> </li> </ul> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td> <td>feat</td> <td>introduce <code>@Service</code> decorator</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td> <td>feat</td> <td>Update Testability to use PendingTasks for stability indicator</td> </tr> </tbody> </table> <h3>docs</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td> <td>fix</td> <td>link formatting in "Animating your Application with CSS"</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td> <td>fix</td> <td>fix NgClass leaving trailing comma after removal</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td> <td>fix</td> <td>restore internal URL on popstate when <code>browserUrl</code> is used</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td> <td>fix</td> <td>set default paramsInheritanceStrategy to 'always'</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/fbe080f829a677610d6bc8ab68af5f4e969f8422"><code>fbe080f</code></a> docs(router): Fix method name for retrieving stored handles</li> <li><a href="https://github.com/angular/angular/commit/1be52ad880933139852ca785a5bf19098d8d6594"><code>1be52ad</code></a> docs: Align Router API docs with inject based DI</li> <li><a href="https://github.com/angular/angular/commit/fa4eff36cb288c4d16aa96bfeedaefdd211f74c2"><code>fa4eff3</code></a> docs(docs-infra): Validate case-sensitive API symbol links in <code>@link</code></li> <li><a href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><code>580212c</code></a> fix(router): restore internal URL on popstate when <code>browserUrl</code> is used</li> <li><a href="https://github.com/angular/angular/commit/684e9fd53daacb9e910f42d98c6017f9e5cb4180"><code>684e9fd</code></a> fix(router): normalize multiple leading slashes in URL parser</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.11/packages/router">compare view</a></li> </ul> </details> <br /> Updates `@angular/build` from 21.2.6 to 21.2.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular-cli/releases">@angular/build's releases</a>.</em></p> <blockquote> <h2>21.2.9</h2> <h3><code>@schematics/angular</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/e7abeb5c74024daf125070c9b4f7f8d2426bab66"><img src="https://img.shields.io/badge/e7abeb5c7-fix-green" alt="fix - e7abeb5c7" /></a></td> <td>add missing imports for focus and skip APIs in refactor-jasmine-vitest</td> </tr> </tbody> </table> <h3><code>@angular/cli</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/233deef01288c6aa39a048d6bd66a1f09595dc15"><img src="https://img.shields.io/badge/233deef01-fix-green" alt="fix - 233deef01" /></a></td> <td>fix broken img ref in ai-tutor</td> </tr> <tr> <td><a href="https://github.com/angular/angular-cli/commit/7cea9885c64a747b391b74e6434cdf005c843766"><img src="https://img.shields.io/badge/7cea9885c-fix-green" alt="fix - 7cea9885c" /></a></td> <td>introduce initial package manager workspace awareness</td> </tr> <tr> <td><a href="https://github.com/angular/angular-cli/commit/5b1a5b7434323eb383df1f53c389fe9dc948a785"><img src="https://img.s... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 22:13:16 -07:00
dependabot[bot]	58c3de24f7	chore(deps-dev): bump the svelte group across 1 directory with 3 updates (#2368 ) Bumps the svelte group with 3 updates in the / directory: [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte), [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) and [vitest-browser-svelte](https://github.com/vitest-community/vitest-browser-svelte). Updates `@sveltejs/vite-plugin-svelte` from 7.0.0 to 7.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/vite-plugin-svelte/releases">@sveltejs/vite-plugin-svelte's releases</a>.</em></p> <blockquote> <h2><code>@sveltejs/vite-plugin-svelte</code><a href="https://github.com/7"><code>@7</code></a>.1.1</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: pass <code>typescript.onlyRemoveTypeImports</code> to <code>transformWithOxc</code> in <code>vitePreprocess</code> so that value imports are not dropped when they are only referenced in Svelte template markup (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1326">#1326</a>)</p> </li> <li> <p>fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1336">#1336</a>)</p> </li> </ul> <h2><code>@sveltejs/vite-plugin-svelte</code><a href="https://github.com/7"><code>@7</code></a>.1.0</h2> <h3>Minor Changes</h3> <ul> <li>feat: enable optimizer for server environments during dev (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1328">#1328</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md">@sveltejs/vite-plugin-svelte's changelog</a>.</em></p> <blockquote> <h2>7.1.1</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: pass <code>typescript.onlyRemoveTypeImports</code> to <code>transformWithOxc</code> in <code>vitePreprocess</code> so that value imports are not dropped when they are only referenced in Svelte template markup (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1326">#1326</a>)</p> </li> <li> <p>fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1336">#1336</a>)</p> </li> </ul> <h2>7.1.0</h2> <h3>Minor Changes</h3> <ul> <li>feat: enable optimizer for server environments during dev (<a href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1328">#1328</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/508d91bbdd495d62bc99fef26b9323977c20d5a9"><code>508d91b</code></a> Version Packages (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1339">#1339</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/990e58cc9062a8d9b258d9248223e5cbd53935a1"><code>990e58c</code></a> fix: correctly resolve Svelte CSS on the server during development (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1336">#1336</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/d5458a9c5122cb81fbf2a03c4a825124eb1a0f0d"><code>d5458a9</code></a> fix: restore value imports stripped by oxc in script preprocessing (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1326">#1326</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/1c851266cb22f269156406a7c5e094aa8cdf475d"><code>1c85126</code></a> Version Packages (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1331">#1331</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/1a4d225148d17af1dbab447dc9202b82e2bc1663"><code>1a4d225</code></a> feat: enable optimizer for server environments during dev (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1328">#1328</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/d91be5f6dd2dff5806432e113c362e49aa19e356"><code>d91be5f</code></a> fix: use correct pnpm catalog syntax</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/4d3afb492087e94581be7fc77f63b379b3a1c4e2"><code>4d3afb4</code></a> chore: fix audit CI (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1327">#1327</a>)</li> <li><a href="https://github.com/sveltejs/vite-plugin-svelte/commit/8b3687bc2bf90ca81faadf42c8d9d2738851b968"><code>8b3687b</code></a> use modern JSDoc imports (<a href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1309">#1309</a>)</li> <li>See full diff in <a href="https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.1.1/packages/vite-plugin-svelte">compare view</a></li> </ul> </details> <br /> Updates `svelte` from 5.55.1 to 5.55.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.5</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: don't mark deriveds while an effect is updating (<a href="https://redirect.github.com/sveltejs/svelte/pull/18124">#18124</a>)</p> </li> <li> <p>fix: do not dispatch introstart event with animation of animate directive (<a href="https://redirect.github.com/sveltejs/svelte/pull/18122">#18122</a>)</p> </li> </ul> <h2>svelte@5.55.4</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: never mark a child effect root as inert (<a href="https://redirect.github.com/sveltejs/svelte/pull/18111">#18111</a>)</p> </li> <li> <p>fix: reset context after waiting on blockers of <code>@const</code> expressions (<a href="https://redirect.github.com/sveltejs/svelte/pull/18100">#18100</a>)</p> </li> <li> <p>fix: keep flushing new eager effects (<a href="https://redirect.github.com/sveltejs/svelte/pull/18102">#18102</a>)</p> </li> </ul> <h2>svelte@5.55.3</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: ensure proper HMR updates for dynamic components (<a href="https://redirect.github.com/sveltejs/svelte/pull/18079">#18079</a>)</p> </li> <li> <p>fix: correctly calculate <code>@const</code> blockers (<a href="https://redirect.github.com/sveltejs/svelte/pull/18039">#18039</a>)</p> </li> <li> <p>fix: freeze deriveds once their containing effects are destroyed (<a href="https://redirect.github.com/sveltejs/svelte/pull/17921">#17921</a>)</p> </li> <li> <p>fix: defer error boundary rendering in forks (<a href="https://redirect.github.com/sveltejs/svelte/pull/18076">#18076</a>)</p> </li> <li> <p>fix: avoid false positives for reactivity loss warning (<a href="https://redirect.github.com/sveltejs/svelte/pull/18088">#18088</a>)</p> </li> </ul> <h2>svelte@5.55.2</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: invalidate <code>@const</code> tags based on visible references in legacy mode (<a href="https://redirect.github.com/sveltejs/svelte/pull/18041">#18041</a>)</p> </li> <li> <p>fix: handle parens in template expressions more robustly (<a href="https://redirect.github.com/sveltejs/svelte/pull/18075">#18075</a>)</p> </li> <li> <p>fix: disallow <code>--</code> in <code>idPrefix</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18038">#18038</a>)</p> </li> <li> <p>fix: correct types for <code>ontoggle</code> on <code><details></code> elements (<a href="https://redirect.github.com/sveltejs/svelte/pull/18063">#18063</a>)</p> </li> <li> <p>fix: don't override <code>$destroy/set/on</code> instance methods in dev mode (<a href="https://redirect.github.com/sveltejs/svelte/pull/18034">#18034</a>)</p> </li> <li> <p>fix: unskip branches of earlier batches after commit (<a href="https://redirect.github.com/sveltejs/svelte/pull/18048">#18048</a>)</p> </li> <li> <p>fix: never set derived.v inside fork (<a href="https://redirect.github.com/sveltejs/svelte/pull/18037">#18037</a>)</p> </li> <li> <p>fix: skip rebase logic in non-async mode (<a href="https://redirect.github.com/sveltejs/svelte/pull/18040">#18040</a>)</p> </li> <li> <p>fix: don't reset status of uninitialized deriveds (<a href="https://redirect.github.com/sveltejs/svelte/pull/18054">#18054</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.5</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: don't mark deriveds while an effect is updating (<a href="https://redirect.github.com/sveltejs/svelte/pull/18124">#18124</a>)</p> </li> <li> <p>fix: do not dispatch introstart event with animation of animate directive (<a href="https://redirect.github.com/sveltejs/svelte/pull/18122">#18122</a>)</p> </li> </ul> <h2>5.55.4</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: never mark a child effect root as inert (<a href="https://redirect.github.com/sveltejs/svelte/pull/18111">#18111</a>)</p> </li> <li> <p>fix: reset context after waiting on blockers of <code>@const</code> expressions (<a href="https://redirect.github.com/sveltejs/svelte/pull/18100">#18100</a>)</p> </li> <li> <p>fix: keep flushing new eager effects (<a href="https://redirect.github.com/sveltejs/svelte/pull/18102">#18102</a>)</p> </li> </ul> <h2>5.55.3</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: ensure proper HMR updates for dynamic components (<a href="https://redirect.github.com/sveltejs/svelte/pull/18079">#18079</a>)</p> </li> <li> <p>fix: correctly calculate <code>@const</code> blockers (<a href="https://redirect.github.com/sveltejs/svelte/pull/18039">#18039</a>)</p> </li> <li> <p>fix: freeze deriveds once their containing effects are destroyed (<a href="https://redirect.github.com/sveltejs/svelte/pull/17921">#17921</a>)</p> </li> <li> <p>fix: defer error boundary rendering in forks (<a href="https://redirect.github.com/sveltejs/svelte/pull/18076">#18076</a>)</p> </li> <li> <p>fix: avoid false positives for reactivity loss warning (<a href="https://redirect.github.com/sveltejs/svelte/pull/18088">#18088</a>)</p> </li> </ul> <h2>5.55.2</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: invalidate <code>@const</code> tags based on visible references in legacy mode (<a href="https://redirect.github.com/sveltejs/svelte/pull/18041">#18041</a>)</p> </li> <li> <p>fix: handle parens in template expressions more robustly (<a href="https://redirect.github.com/sveltejs/svelte/pull/18075">#18075</a>)</p> </li> <li> <p>fix: disallow <code>--</code> in <code>idPrefix</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18038">#18038</a>)</p> </li> <li> <p>fix: correct types for <code>ontoggle</code> on <code><details></code> elements (<a href="https://redirect.github.com/sveltejs/svelte/pull/18063">#18063</a>)</p> </li> <li> <p>fix: don't override <code>$destroy/set/on</code> instance methods in dev mode (<a href="https://redirect.github.com/sveltejs/svelte/pull/18034">#18034</a>)</p> </li> <li> <p>fix: unskip branches of earlier batches after commit (<a href="https://redirect.github.com/sveltejs/svelte/pull/18048">#18048</a>)</p> </li> <li> <p>fix: never set derived.v inside fork (<a href="https://redirect.github.com/sveltejs/svelte/pull/18037">#18037</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/b771df346444d486243882099d2a36f88e32dde0"><code>b771df3</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18125">#18125</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/8e7319063aa609cca2cbf8cdf1958e5392dd2fa0"><code>8e73190</code></a> fix: don't mark deriveds while an effect is updating (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18124">#18124</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/51736e576d86cc8879211632e3969730c513236b"><code>51736e5</code></a> fix: do not dispatch transition event with animation (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18122">#18122</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/7fddfbdbbde8813ee107d56f70f5ea6c3d3abbc3"><code>7fddfbd</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18105">#18105</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/671fc2ea11b56f050f37f7e03564fb070bc8abea"><code>671fc2e</code></a> fix: never mark a child effect root as inert (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18111">#18111</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/0ed8c282f96960f52eaf077ffbe6e53c181b3774"><code>0ed8c28</code></a> fix: reset context after waiting on blockers of <code>@const</code> expressions (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18100">#18100</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/273f1a85a4dbe2937f2d97afa2511e828eb8ebba"><code>273f1a8</code></a> fix: keep flushing new eager effects (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18102">#18102</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/4a50e8ea3b7db1d8cd752b825032e4ce2878524b"><code>4a50e8e</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18085">#18085</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/15588f5fbfe736f65e189e56047ee08678f5509f"><code>15588f5</code></a> fix: avoid false positives for reactivity loss warning (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18088">#18088</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/0e9e76f29262b5f64ac7a5d4db37ec83c9181634"><code>0e9e76f</code></a> fix: freeze deriveds once their containing effects are destroyed (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/17921">#17921</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.5/packages/svelte">compare view</a></li> </ul> </details> <br /> Updates `vitest-browser-svelte` from 2.1.0 to 2.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-community/vitest-browser-svelte/releases">vitest-browser-svelte's releases</a>.</em></p> <blockquote> <h2>v2.1.1</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Move <code>@playwright/test</code> out of dependencies - by <a href="https://github.com/ocavue"><code>@ocavue</code></a> in <a href="https://redirect.github.com/vitest-community/vitest-browser-svelte/issues/26">vitest-community/vitest-browser-svelte#26</a> <a href="https://github.com/vitest-community/vitest-browser-svelte/commit/ff94b22"><!-- raw HTML omitted -->(ff94b)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-community/vitest-browser-svelte/compare/v2.1.0...v2.1.1">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-community/vitest-browser-svelte/commit/092253b3ee80af3de6ac708199d6e7b1bb3f2dc4"><code>092253b</code></a> chore: release v2.1.1</li> <li><a href="https://github.com/vitest-community/vitest-browser-svelte/commit/ff94b225d11b40cdfad6da1fd12044d7de842e41"><code>ff94b22</code></a> fix: move <code>@playwright/test</code> out of dependencies (<a href="https://redirect.github.com/vitest-community/vitest-browser-svelte/issues/26">#26</a>)</li> <li>See full diff in <a href="https://github.com/vitest-community/vitest-browser-svelte/compare/v2.1.0...v2.1.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 22:12:42 -07:00
dependabot[bot]	c17ee878d4	chore(deps): bump the vue group across 1 directory with 2 updates (#2361 ) Bumps the vue group with 2 updates in the / directory: [vue](https://github.com/vuejs/core) and [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue). Updates `vue` from 3.5.31 to 3.5.33 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vuejs/core/releases">vue's releases</a>.</em></p> <blockquote> <h2>v3.5.33</h2> <p>For stable releases, please refer to <a href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">CHANGELOG.md</a> for details. For pre-releases, please refer to <a href="https://github.com/vuejs/core/blob/minor/CHANGELOG.md">CHANGELOG.md</a> of the <code>minor</code> branch.</p> <h2>v3.5.32</h2> <p>For stable releases, please refer to <a href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">CHANGELOG.md</a> for details. For pre-releases, please refer to <a href="https://github.com/vuejs/core/blob/minor/CHANGELOG.md">CHANGELOG.md</a> of the <code>minor</code> branch.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">vue's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vuejs/core/compare/v3.5.32...v3.5.33">3.5.33</a> (2026-04-22)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>compiler-sfc:</strong> handle nested :deep in selector pseudos (<a href="https://redirect.github.com/vuejs/core/issues/14725">#14725</a>) (<a href="https://github.com/vuejs/core/commit/bb9d265d8dcdde2af824fc01b24f9a7b3169f5fa">bb9d265</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14724">#14724</a></li> <li><strong>reactivity:</strong> unlink effect scopes on out-of-order off (<a href="https://redirect.github.com/vuejs/core/issues/14734">#14734</a>) (<a href="https://github.com/vuejs/core/commit/e7659beafc5407e892fa70f3f4ade80263b0905d">e7659be</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14733">#14733</a></li> <li><strong>runtime-dom:</strong> preserve textarea resize dimensions (<a href="https://redirect.github.com/vuejs/core/issues/14747">#14747</a>) (<a href="https://github.com/vuejs/core/commit/11fb2fd4a246e40f6f350701dfea73ec525b4f59">11fb2fd</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14741">#14741</a></li> <li><strong>teleport:</strong> don't move teleport children if not mounted (<a href="https://redirect.github.com/vuejs/core/issues/14702">#14702</a>) (<a href="https://github.com/vuejs/core/commit/6a61f4452ba1a31fc929cadf8abe3337ac4d3a46">6a61f44</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14701">#14701</a></li> <li><strong>transition:</strong> preserve placeholder for conditional explicit default slots (<a href="https://redirect.github.com/vuejs/core/issues/14748">#14748</a>) (<a href="https://github.com/vuejs/core/commit/45990cecf4604b2f39c571ab6aefa49d362af36a">45990ce</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14727">#14727</a></li> </ul> <h2><a href="https://github.com/vuejs/core/compare/v3.5.31...v3.5.32">3.5.32</a> (2026-04-03)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>runtime-core:</strong> prevent currentInstance leak into sibling render during async setup re-entry (<a href="https://redirect.github.com/vuejs/core/issues/14668">#14668</a>) (<a href="https://github.com/vuejs/core/commit/f1663535a163057788d3285dec54a245c3efb3ad">f166353</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14667">#14667</a></li> <li><strong>teleport:</strong> handle updates before deferred mount (<a href="https://redirect.github.com/vuejs/core/issues/14642">#14642</a>) (<a href="https://github.com/vuejs/core/commit/32b44f19f67aa30899817a7e79a4510f3b52970a">32b44f1</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14640">#14640</a></li> <li><strong>types:</strong> allow customRef to have different getter/setter types (<a href="https://redirect.github.com/vuejs/core/issues/14639">#14639</a>) (<a href="https://github.com/vuejs/core/commit/e20ddb00188e9935884930046fa572eab7c9dcba">e20ddb0</a>)</li> <li><strong>types:</strong> use private branding for shallowReactive (<a href="https://redirect.github.com/vuejs/core/issues/14641">#14641</a>) (<a href="https://github.com/vuejs/core/commit/302c47a4994bc8b47b8a2af6693d8cb6bbd4b06b">302c47a</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14638">#14638</a> <a href="https://redirect.github.com/vuejs/core/issues/14493">#14493</a></li> </ul> <h3>Reverts</h3> <ul> <li>Revert "fix(server-renderer): cleanup component effect scopes after SSR render" (<a href="https://redirect.github.com/vuejs/core/issues/14674">#14674</a>) (<a href="https://github.com/vuejs/core/commit/219d83bd305ce6fc052941acaaf02e7bc70616a4">219d83b</a>), closes <a href="https://redirect.github.com/vuejs/core/issues/14674">#14674</a> <a href="https://redirect.github.com/vuejs/core/issues/14669">#14669</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vuejs/core/commit/3310eea4ececff0379ea657e633e3c18b0f647eb"><code>3310eea</code></a> release: v3.5.33</li> <li><a href="https://github.com/vuejs/core/commit/bb9d265d8dcdde2af824fc01b24f9a7b3169f5fa"><code>bb9d265</code></a> fix(compiler-sfc): handle nested :deep in selector pseudos (<a href="https://redirect.github.com/vuejs/core/issues/14725">#14725</a>)</li> <li><a href="https://github.com/vuejs/core/commit/60402cd4771be1b758cae759d27ffa6c01428364"><code>60402cd</code></a> Revert "chore(deps): update pnpm/action-setup action to v6" (<a href="https://redirect.github.com/vuejs/core/issues/14749">#14749</a>)</li> <li><a href="https://github.com/vuejs/core/commit/11fb2fd4a246e40f6f350701dfea73ec525b4f59"><code>11fb2fd</code></a> fix(runtime-dom): preserve textarea resize dimensions (<a href="https://redirect.github.com/vuejs/core/issues/14747">#14747</a>)</li> <li><a href="https://github.com/vuejs/core/commit/974e2d21b75c677e835656b8743b44c4eb285ca8"><code>974e2d2</code></a> chore(deps): update test (<a href="https://redirect.github.com/vuejs/core/issues/14713">#14713</a>)</li> <li><a href="https://github.com/vuejs/core/commit/45990cecf4604b2f39c571ab6aefa49d362af36a"><code>45990ce</code></a> fix(transition): preserve placeholder for conditional explicit default slots ...</li> <li><a href="https://github.com/vuejs/core/commit/6a61f4452ba1a31fc929cadf8abe3337ac4d3a46"><code>6a61f44</code></a> fix(teleport): don't move teleport children if not mounted (<a href="https://redirect.github.com/vuejs/core/issues/14702">#14702</a>)</li> <li><a href="https://github.com/vuejs/core/commit/e7659beafc5407e892fa70f3f4ade80263b0905d"><code>e7659be</code></a> fix(reactivity): unlink effect scopes on out-of-order off (<a href="https://redirect.github.com/vuejs/core/issues/14734">#14734</a>)</li> <li><a href="https://github.com/vuejs/core/commit/268115dc49fe8aa9a2a6c820a7b91eba6ca68208"><code>268115d</code></a> chore: update pnpm config (<a href="https://redirect.github.com/vuejs/core/issues/14694">#14694</a>)</li> <li><a href="https://github.com/vuejs/core/commit/24f26f41af5aea64b5054ec57066679a4d71aff4"><code>24f26f4</code></a> chore(deps): update pnpm/action-setup action to v6 (<a href="https://redirect.github.com/vuejs/core/issues/14716">#14716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vuejs/core/compare/v3.5.31...v3.5.33">compare view</a></li> </ul> </details> <br /> Updates `@vitejs/plugin-vue` from 6.0.5 to 6.0.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-vue/releases">@vitejs/plugin-vue's releases</a>.</em></p> <blockquote> <h2>plugin-vue@6.0.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite-plugin-vue/blob/plugin-vue@6.0.6/packages/plugin-vue/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md">@vitejs/plugin-vue's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite-plugin-vue/compare/plugin-vue@6.0.5...plugin-vue@6.0.6">6.0.6</a> (2026-04-13)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li><strong>plugin-vue:</strong> propagate multiRoot for template-only vapor components (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/745">#745</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/9e07ae94d0ca2e40cf0c2aac6a3d355a445a5e2d">9e07ae9</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/738">#738</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/050c9962660e7bb189fe8e03f0fa4cbd0b5ba766">050c996</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update dependency rollup to ^4.59.0 (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/749">#749</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/a0e1ef83bd841c22c3fddc62189b545ec7c71729">a0e1ef8</a>)</li> <li>remove unused deps (<a href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/760">#760</a>) (<a href="https://github.com/vitejs/vite-plugin-vue/commit/6d834d82614ec76eb7618a2b015b6e8b0664f096">6d834d8</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/51dbf4b494ef3e8b87febdb285d3c15b8a9c5490"><code>51dbf4b</code></a> release: plugin-vue@6.0.6</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/9e07ae94d0ca2e40cf0c2aac6a3d355a445a5e2d"><code>9e07ae9</code></a> feat(plugin-vue): propagate multiRoot for template-only vapor components (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/745">#745</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/050c9962660e7bb189fe8e03f0fa4cbd0b5ba766"><code>050c996</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/738">#738</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/6d834d82614ec76eb7618a2b015b6e8b0664f096"><code>6d834d8</code></a> chore: remove unused deps (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/760">#760</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-vue/commit/a0e1ef83bd841c22c3fddc62189b545ec7c71729"><code>a0e1ef8</code></a> chore(deps): update dependency rollup to ^4.59.0 (<a href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/749">#749</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.6/packages/plugin-vue">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 21:54:16 -07:00
Christian Bromann	085a07f569	feat(core): event based streaming (#2314 ) All stream v2 changes consolidated. --------- Co-authored-by: Hunter Lovell <hunter@hntrl.io>	2026-05-05 00:13:12 -07:00
dependabot[bot]	fe09385cb1	chore(deps): bump the langchain group across 1 directory with 9 updates (#2358 ) Bumps the langchain group with 9 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) \| `1.3.26` \| `1.3.28` \| \| [@langchain/core](https://github.com/langchain-ai/langchainjs) \| `1.1.40` \| `1.1.43` \| \| [langchain](https://github.com/langchain-ai/langchainjs) \| `1.3.0` \| `1.3.5` \| \| [@langchain/openai](https://github.com/langchain-ai/langchainjs) \| `1.4.1` \| `1.4.5` \| \| [@langchain/groq](https://github.com/langchain-ai/langchainjs) \| `1.1.5` \| `1.2.0` \| \| [@langchain/mistralai](https://github.com/langchain-ai/langchainjs) \| `1.0.7` \| `1.0.8` \| \| [@langchain/ollama](https://github.com/langchain-ai/langchainjs) \| `1.2.6` \| `1.2.7` \| \| [@langchain/classic](https://github.com/langchain-ai/langchainjs) \| `1.0.27` \| `1.0.32` \| \| [langsmith](https://github.com/langchain-ai/langsmith-sdk) \| `0.5.20` \| `0.6.0` \| Updates `@langchain/anthropic` from 1.3.26 to 1.3.28 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/anthropic's releases</a>.</em></p> <blockquote> <h2><code>@langchain/anthropic</code><a href="https://github.com/1"><code>@1</code></a>.3.27</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10726">#10726</a> <a href="https://github.com/langchain-ai/langchainjs/commit/ad153c185b6cf813d4b7695740d9a4453d2cb63f"><code>ad153c1</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - feat(anthropic): add Claude Opus 4.7 compatibility updates</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>]:</p> <ul> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.41</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits">compare view</a></li> </ul> </details> <br /> Updates `@langchain/core` from 1.1.40 to 1.1.43 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/core's releases</a>.</em></p> <blockquote> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.41</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10733">#10733</a> <a href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a> Thanks <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a>! - fix(core): Update inheritance behavior for tracer metadata for special keys</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10711">#10711</a> <a href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a> Thanks <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a>! - feat(core): Add chat model and llm invocation params to traced metadata</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits">compare view</a></li> </ul> </details> <br /> Updates `langchain` from 1.3.0 to 1.3.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">langchain's releases</a>.</em></p> <blockquote> <h2>langchain@1.3.4</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10713">#10713</a> <a href="https://github.com/langchain-ai/langchainjs/commit/49ac9e7404e5a9269b9ac047711ee96dd928b231"><code>49ac9e7</code></a> Thanks <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a>! - feat(langchain): Adds ls_agent_type to create agent runs as tracing metadata</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>]:</p> <ul> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.41</li> </ul> </li> </ul> <h2>langchain@1.3.3</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386">#9386</a> <a href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a> Thanks <a href="https://github.com/Josh-Engle"><code>@Josh-Engle</code></a>! - Prevent local file corruption when using <code>LocalFileStore</code></p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>]:</p> <ul> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.40</li> </ul> </li> </ul> <h2>langchain@1.3.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10693">#10693</a> <a href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8"><code>5a6e0ab</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix(agents): derive middleware hook state from invocation state</p> <p>Prevents middleware state from leaking across threads by deriving middleware hook input state from the current invocation state instead of cross-node cached state.</p> </li> </ul> <h2>langchain@1.3.1</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10673">#10673</a> <a href="https://github.com/langchain-ai/langchainjs/commit/f0693657b7e5bdbf888a46d04e68431e446c7bc0"><code>f069365</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - bump langgraph dependency to 1.2.8</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/6845a1ef129450cd6e75bb8a8e7390a416ab3d9c"><code>6845a1e</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10690">#10690</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8"><code>5a6e0ab</code></a> fix(agents): derive middleware hook state from invocation state (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10693">#10693</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/607696e8143ad30faeebb800028e244a11d46638"><code>607696e</code></a> chore(ci): add label-gated publish-preview workflow (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10696">#10696</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/1f8b2c0b863645da45114d8756dc5b66fcb43c98"><code>1f8b2c0</code></a> chore(ci): add label-gated publish-preview workflow (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10695">#10695</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/2ff51cf0688e45d5d237b2b435334b5fd987afa9"><code>2ff51cf</code></a> fix(aws): normalize Bedrock Converse object errors for tracing (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10688">#10688</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/4a91db32a80a1b9da3bea4f6333eff63980b28b4"><code>4a91db3</code></a> chore(deps): bump langsmith from 0.5.9 to 0.5.18 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10687">#10687</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/312d60536da66827791e9b0f4a9d5d9091439183"><code>312d605</code></a> chore(deps): bump axios from 1.13.6 to 1.15.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10686">#10686</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3e071bb44ec9c80a0eb964eff089434f4edd78b2"><code>3e071bb</code></a> chore: remove suppressed CodeQL query filter and deduplicate paths-ignore (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/1">#1</a>...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/e5b6e1c8568115cdda53eccafbdcd23537f554c5"><code>e5b6e1c</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10682">#10682</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a> fix(openai): add index to streaming reasoning content blocks for proper chunk...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/langchain@1.3.0...@langchain/aws@1.3.5">compare view</a></li> </ul> </details> <br /> Updates `@langchain/openai` from 1.4.1 to 1.4.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/openai's releases</a>.</em></p> <blockquote> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.4</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10681">#10681</a> <a href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix(openai): add index to streaming reasoning content blocks for proper chunk merging</li> </ul> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.3</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10670">#10670</a> <a href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a"><code>6b8ef6c</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(openai): preserve plain string responses content</li> </ul> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10614">#10614</a> <a href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a> Thanks <a href="https://github.com/colifran"><code>@colifran</code></a>! - feat(openai): imput placeholder filenames for openai file inputs</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:</p> <ul> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.39</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits">compare view</a></li> </ul> </details> <br /> Updates `@langchain/groq` from 1.1.5 to 1.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/groq's releases</a>.</em></p> <blockquote> <h2><code>@langchain/groq</code><a href="https://github.com/1"><code>@1</code></a>.2.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10603">#10603</a> <a href="https://github.com/langchain-ai/langchainjs/commit/66effb028baf5c923501801c989c7377efb8b77a"><code>66effb0</code></a> Thanks <a href="https://github.com/apps/dependabot"><code>@dependabot</code></a>! - chore(deps): bump groq-sdk from 0.37.0 to 1.1.2</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/daece6df71e0095c7a354270667a0b851a8cee4d"><code>daece6d</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10560">#10560</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/9781bff525bffdd3b6a75adfa8a30fdb4bfc505e"><code>9781bff</code></a> fix(google): align ChatGoogle mediaResolution with Gemini scalar type (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10550">#10550</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3bd85c17869e95d5d1a67c5fccc0c4cab2646616"><code>3bd85c1</code></a> feat(langchain): add ChatGoogle support to initChatModel (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10654">#10654</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a> feat(core): support for headless tools (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10430">#10430</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/793bc69a8af8198de9d157c21070871660e6bb13"><code>793bc69</code></a> feat(aws): impute file name for document content blocks#963 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10658">#10658</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a> feat(openai): impute placeholder filenames for openai file inputs (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10614">#10614</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/0a7a7298b719f579854e41adddb04f17dc82640b"><code>0a7a729</code></a> fix(examples): update dependencies (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10651">#10651</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/6f8dafcb9deee169473eadaae6416ad255277a5b"><code>6f8dafc</code></a> Bump vitest (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/10649">#10649</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/e89cfd29f36e0b2fee20a7443e6c30c88039d735"><code>e89cfd2</code></a> chore(deps): bump <code>@cloudflare/workers-types</code> from 4.20260207.0 to 4.20260402.1...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/0de2c14d38716d9c66c546e18a490c5bfda75134"><code>0de2c14</code></a> chore(deps): bump <code>@aws-sdk/client-bedrock-agent-runtime</code> from 3.1006.0 to 3.10...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/groq@1.1.5...@langchain/groq@1.2.0">compare view</a></li> </ul> </details> <br /> Updates `@langchain/mistralai` from 1.0.7 to 1.0.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/mistralai's releases</a>.</em></p> <blockquote> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.3</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>]: <ul> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.40</li> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.31</li> </ul> </li> </ul> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.2</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.30</li> </ul> </li> </ul> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.29</li> </ul> </li> </ul> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590">#10590</a> <a href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28"><code>ed8cda6</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - feat: scaffold <code>@langchain/neo4j</code> provider package</li> </ul> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]: <ul> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.28</li> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.39</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/7ea8874715f76c17d3ec3d2ff0503dd12abbc5e9"><code>7ea8874</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9716">#9716</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5707c3edc6a4d43934da0d3e7b9666b2fc144440"><code>5707c3e</code></a> docs(internal): add AGENTS.md file (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9742">#9742</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/8ef152555a945c95322f28209957b69605c04c91"><code>8ef1525</code></a> feat(google-common): support thinkingLevel parameter for Gemini models (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9738">#9738</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/c28d24a8770f6d0e543cde116b0e38b3baf21301"><code>c28d24a</code></a> fix(core): use getBufferString for message summarization (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9739">#9739</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f6974516b041ed12befd26e1a4cbe457865a2780"><code>f697451</code></a> fix(langchain): keep tool call / AIMessage pairings when summarizing (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9740">#9740</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/536c7ddacd6c7f80d2edf18ab9caeeab71827ccd"><code>536c7dd</code></a> fix(langchain): default strict to true in providerStrategy for OpenAI compati...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/75b3b90c5fa62cbbfa678dfb01f031caed4488ef"><code>75b3b90</code></a> fix(openai): pass runManager to _streamResponseChunks in responses API (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9737">#9737</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/13c9d5bfa3acac7ffb37642e9a50d84dc9004e88"><code>13c9d5b</code></a> fix(openai): pass through provider-native content in ToolMessage without stri...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5cfbedf064ffdc960cb2e5a97e37d7a5900560de"><code>5cfbedf</code></a> fix(langchain): support callbacks property in stream (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9728">#9728</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/9ac29de3d3f70c75933913d94ad9a47c6ce39c1d"><code>9ac29de</code></a> fix(langchain-aws): add support for Amazon Nova embedding models (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9701">#9701</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/mistralai@1.0.7...@langchain/classic@1.0.8">compare view</a></li> </ul> </details> <br /> Updates `@langchain/ollama` from 1.2.6 to 1.2.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/ollama's releases</a>.</em></p> <blockquote> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.3</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>]: <ul> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.40</li> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.31</li> </ul> </li> </ul> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.2</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.30</li> </ul> </li> </ul> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.29</li> </ul> </li> </ul> <h2><code>@langchain/neo4j</code><a href="https://github.com/0"><code>@0</code></a>.1.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590">#10590</a> <a href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28"><code>ed8cda6</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - feat: scaffold <code>@langchain/neo4j</code> provider package</li> </ul> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>, <a href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]: <ul> <li><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.28</li> <li><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.1.39</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/bd72d8eb8bde1b2282c9ec88f2ebadd0747dc7b7"><code>bd72d8e</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9762">#9762</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/578574906bdbd9cfce95e34030c1a3d97e63d1c1"><code>5785749</code></a> fix(internal): fix changeset config (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9768">#9768</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/ddd72b8122e9dc68242b8467292bbee62e1dda2e"><code>ddd72b8</code></a> chore(standard-tests): move standard-tests into ./internal (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9755">#9755</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/739d4e88cc78b8f578ab019b526c97d63d9c2144"><code>739d4e8</code></a> Feat/xai responses implementation (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9718">#9718</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/e0360d9bdc0e7725d59625902bcfc98c39931e2a"><code>e0360d9</code></a> fix(langchain): ensure models only make on write_todo call at a time (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9761">#9761</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/8619adb81f16977b3ab8d4607ad5c30f79c41e3d"><code>8619adb</code></a> fix: add properties to check valid props (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9757">#9757</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/23be5afd59b5f4806edef11937ce5e2ba300f7ee"><code>23be5af</code></a> feat(langchain): consolidate type generics in bags (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9517">#9517</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/85820be04995b4047a798ec44da6077cd1908d7a"><code>85820be</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9754">#9754</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/a46a24983fd0fea649d950725a2673b3c435275f"><code>a46a249</code></a> fix(core): allow shared object references in serialization (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9753">#9753</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3c8ba0d97f1c08e8f8c67ffddff5d57daba46f85"><code>3c8ba0d</code></a> chore(internal): Turborepo improvements (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/9744">#9744</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/ollama@1.2.6...langchain@1.2.7">compare view</a></li> </ul> </details> <br /> Updates `@langchain/classic` from 1.0.27 to 1.0.32 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/classic's releases</a>.</em></p> <blockquote> <h2><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.31</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386">#9386</a> <a href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a> Thanks <a href="https://github.com/Josh-Engle"><code>@Josh-Engle</code></a>! - Prevent local file corruption when using <code>LocalFileStore</code></li> </ul> <h2><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.30</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>]: <ul> <li><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.4</li> </ul> </li> </ul> <h2><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.29</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a"><code>6b8ef6c</code></a>]: <ul> <li><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.3</li> </ul> </li> </ul> <h2><code>@langchain/classic</code><a href="https://github.com/1"><code>@1</code></a>.0.28</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10591">#10591</a> <a href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - feat: add <code>@langchain/perplexity</code> standalone provider package</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10594">#10594</a> <a href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - feat(fireworks): extract standalone provider package</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10593">#10593</a> <a href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - feat(together-ai): migrate Together AI into provider package</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>]:</p> <ul> <li><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.4.2</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langchainjs/commits">compare view</a></li> </ul> </details> <br /> Updates `langsmith` from 0.5.20 to 0.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.6.0</h2> <h2>What's Changed</h2> <ul> <li>chore(js): bump JS to 0.4.3 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2253">langchain-ai/langsmith-sdk#2253</a></li> <li>Revert "feat: add js prompt caching" by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2258">langchain-ai/langsmith-sdk#2258</a></li> <li>Revert "feat: Replace UUID5 with deterministic UUID7 for replicas" by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2257">langchain-ai/langsmith-sdk#2257</a></li> <li>release(js): bump to 0.4.4 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2259">langchain-ai/langsmith-sdk#2259</a></li> <li>feat: add prompt cache back and setup environment tests by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2260">langchain-ai/langsmith-sdk#2260</a></li> <li>feat(python): Bump pydantic to v2 by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2248">langchain-ai/langsmith-sdk#2248</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0</a></p> <h2>v0.6.0rc0</h2> <h2>What's Changed</h2> <ul> <li>feat(js): Add support for tracing AI SDK 6 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2237">langchain-ai/langsmith-sdk#2237</a></li> <li>fix(js): Remove default Jestlike timeout by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2243">langchain-ai/langsmith-sdk#2243</a></li> <li>feat(js): Add support for tracing tool loop agent by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2244">langchain-ai/langsmith-sdk#2244</a></li> <li>feat: Replace UUID5 with deterministic UUID7 for replicas by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2249">langchain-ai/langsmith-sdk#2249</a></li> <li>feat: add prompt caching to python sdk by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2246">langchain-ai/langsmith-sdk#2246</a></li> <li>feat: add js prompt caching by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2251">langchain-ai/langsmith-sdk#2251</a></li> <li>fix(claude): correctly parse llm and tool inputs in claude agent sdk by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2255">langchain-ai/langsmith-sdk#2255</a></li> <li>bump(python): 0.5.2 by <a href="https://github.com/angus-langchain"><code>@angus-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2256">langchain-ai/langsmith-sdk#2256</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langsmith-sdk/commits/v0.6.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-04 22:42:09 -07:00
John Kennedy	7f3320cda8	fix: patch 6 medium-severity security alerts (#2333 ) ## Security Alert Patch (medium-tier follow-up) Follow-up to #2329, which patched the critical+high tier. This PR resolves the remaining 6 medium-severity Dependabot alerts via `pnpm.overrides` plus one published-path constraint bump. All fixes are patch/minor bumps within the current major — no breaking changes. ### Packages Updated \| Package \| Old Constraint \| New Constraint \| Strategy \| Scope \| CVEs Resolved \| \|---------\|---------------\|----------------\|----------\|-------\|---------------\| \| `axios` \| `>=1.13.5` (override) \| `>=1.15.0` (override); resolved 1.13.6 → 1.15.1 \| C (override) \| dev-only (via `@langchain/scripts` devDep) \| CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175 (cloud metadata exfiltration) \| \| `dompurify` \| (transitive, resolved 3.3.3) \| `>=3.4.0` (new override); resolved 3.4.0 \| C (override) \| dev-only (private `@example/ai-elements` via mermaid) \| GHSA-39q2-94rc-95cp (ADD_TAGS bypasses FORBID_TAGS) \| \| `follow-redirects` \| (transitive, resolved 1.15.11) \| `>=1.16.0` (new override); resolved 1.16.0 \| C (override) \| dev-only (via `@langchain/scripts` devDep) \| GHSA-r4q5-vmmm-2653 (auth header leak on cross-domain redirect) \| \| `langsmith` (published path) \| `langsmith: >=0.3.33 <1.0.0` in `libs/langgraph-api/package.json` \| `>=0.5.19 <1.0.0` \| A (manifest bump) \| published — direct dep of `@langchain/langgraph-api` \| CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming redaction bypass) \| \| `langsmith` (dev chains) \| (transitive 0.4.12, 0.5.16 resolved via `@langchain/classic`, `langchain@1.3.0`) \| `langsmith@<0.5.19: >=0.5.19 <1` (new override) \| C (override) \| dev-only \| same as above (flushes vulnerable transitive copies) \| Strategy C overrides follow the existing repo pattern — axios, qs, undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and defu are already overridden the same way. ### Published-path rationale `@langchain/langgraph-api` exercises `langsmith` at runtime for tracing and streaming, which touches the affected internal code paths (lodash `set()` prototype-pollution guard, token-event redaction). Therefore the fix is Strategy A (raise the published lower bound) rather than A-lockfile — this protects end users who pin `@langchain/langgraph-api`. The lockfile already resolved `langsmith@0.5.20` before this change, so installs are unchanged at HEAD; the bump is a downstream-safety constraint tightening. ### Deferred (not fixed in this PR) - `protobufjs@6.11.5` (CRITICAL, CVE-2026-41242) — reached via `@xenova/transformers@2.17.2` in `libs/langgraph-core` devDeps + examples. `@xenova/transformers` is abandoned; the successor is `@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross a breaking API boundary. Upstream issue — requires a manual migration, tracked separately. (See #2329 body for full context.) - `elliptic@6.6.1` (LOW, GHSA-848j-6mx2-7j84) — `first_patched_version` is `null`; upstream has not released a fix. Defer until a patched version ships. ### CVE Details - CVE-2025-62718 / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname Normalization Bypass Leads to SSRF — https://github.com/advisories/GHSA-3p68-rc4w-qgx5 - CVE-2026-40175 / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud Metadata Exfiltration via Header Injection Chain — https://github.com/advisories/GHSA-fvcv-3m26-pcqx - GHSA-39q2-94rc-95cp — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS` via short-circuit evaluation — https://github.com/advisories/GHSA-39q2-94rc-95cp - GHSA-r4q5-vmmm-2653 — follow-redirects leaks custom authentication headers to cross-domain redirect targets — https://github.com/advisories/GHSA-r4q5-vmmm-2653 - CVE-2026-40190 / GHSA-fw9q-39r9-c252 — LangSmith prototype pollution via incomplete `__proto__` guard in internal lodash `set()` — https://github.com/advisories/GHSA-fw9q-39r9-c252 - GHSA-rr7j-v2q5-chgv — LangSmith streaming token events bypass output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv ### Linear Tickets Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No ticket IDs included in the title. ### Verification - [x] Lockfile regenerated via `pnpm install --lockfile-only` - [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors - [x] `pnpm format:check` (oxfmt) — clean - [x] `pnpm audit --prod` — No known vulnerabilities found - [x] `pnpm typecheck` on `libs/langgraph-api` — clean - [x] No staged secrets (`gitleaks git --staged`) 🤖 Submitted by langster-patch Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>	2026-04-22 09:26:44 -07:00
John Kennedy	076f7f81f0	fix: patch 7 security alerts (critical + high severity) (#2329 ) ## Security Alert Patch Resolves 7 Dependabot security alerts in the critical + high severity tier via `pnpm.overrides` in the root `package.json`. All fixes are patch/minor bumps within the current major — no breaking changes. ### Packages Updated \| Package \| Old Constraint \| New Constraint \| Strategy \| Scope \| CVEs Resolved \| \|---------\|---------------\|----------------\|----------\|-------\|---------------\| \| `protobufjs` \| (transitive, resolved 7.5.4) \| `>=7.5.5 <8` \| C (override) \| dev-only (testcontainers chain + `@xenova/transformers` devDeps) \| CVE-2026-41242 \| \| `basic-ftp` \| (transitive, resolved 5.2.0) \| `>=5.3.0 <6` \| C (override) \| effectively dev-only (reached only via `@vitest/browser` — an optional peerDep of vitest — through webdriverio→proxy-agent) \| GHSA-rp42-5vxx-qpwr, GHSA-6v7q-wjvx-w8wg, CVE-2026-39983 \| \| `vite` (7.x only) \| (transitive via vitest peer, resolved 7.3.1) \| `>=7.3.2` \| C (override, scoped to vite@7) \| effectively dev-only (vite is a peerDependency of vitest — end users supply their own vite) \| CVE-2026-39363, CVE-2026-39364 \| \| `defu` \| (transitive, resolved 6.1.4) \| `>=6.1.5 <7` \| C (override) \| dev-only (`internal/build` via tsdown) \| CVE-2026-35209 \| Strategy C (pnpm.overrides) follows the existing pattern in this repo — axios, qs, undici, minimatch, brace-expansion, etc. are already overridden the same way. ### Side-effect Fixes Bumping `vite@7` to 7.3.2 also resolves one medium alert that wasn't in the primary batch: - CVE-2026-39365 / GHSA-4w7w-66w2-5vf9 — vite Path Traversal in Optimized Deps `.map` Handling ### Upstream / Design Issues (NOT fixed in this PR) - `protobufjs@6.11.x` persists in the dependency graph via `@xenova/transformers@2.17.2` (`libs/langgraph-core` devDep + 9 example apps). `@xenova/transformers` is abandoned and rebranded as `@huggingface/transformers@3`; a migration would be a separate manual dev-only upgrade. The 6.x line is in devDependencies only and does not ship to published package consumers. Dependabot may continue to flag the 6.x range because the advisory's `vulnerable_range` is `< 7.5.5`. - Published-path caveat for `basic-ftp` and `vite`: Both transit through `@langchain/langgraph-checkpoint-validation`'s `dependencies.vitest`. However, `vite` is declared as a peerDependency of vitest (end users supply their own), and `basic-ftp` reaches end users only through `@vitest/browser` — an optional peerDependency that users must explicitly opt into. Overrides in this PR protect local dev and CI; end users of `@langchain/langgraph-checkpoint-validation` are not exposed unless they independently install and configure the browser-testing chain. ### Deferred (medium + low tier) Per security-alert-patch policy, only the highest active severity tier was patched in this PR. The following remain open and would be addressed in a follow-up batch: - 6 medium: axios ×2 (SSRF + cloud-metadata exfil — existing `axios: >=1.13.5` override doesn't cover 1.15.0), dompurify, langsmith ×2, follow-redirects - 1 low: elliptic (no `first_patched_version` published — upstream has not released a fix) ### Verification - [x] Lockfile regenerated via `pnpm install --lockfile-only` - [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors - [x] `pnpm format:check` (oxfmt) — clean - [x] `pnpm audit --prod` — 0 critical, 0 high remaining (3 moderates = the deferred medium alerts) - [x] No staged secrets (gitleaks) ### Linear Tickets Linear ticket lookup skipped — CLI not authenticated in this environment. No ticket IDs included in title. 🤖 Submitted by langster-patch Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>	2026-04-20 21:47:08 -07:00
dependabot[bot]	786fe03646	chore(deps): bump vite from 7.3.2 to 8.0.5 (#2322 )	2026-04-20 20:07:04 -07:00
dependabot[bot]	ac9947f64d	chore(deps): bump langsmith from 0.5.19 to 0.5.20 (#2323 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.5.19 to 0.5.20. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langsmith-sdk/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.19&new-version=0.5.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-16 03:45:01 +00:00
dependabot[bot]	a9db0172df	chore(deps): bump hono from 4.12.12 to 4.12.14 (#2321 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.12 to 4.12.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.14</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>Improper handling of JSX attribute names in hono/jsx SSR</h3> <p>Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375</p> <h2>Other changes</h2> <ul> <li>fix(aws-lambda): handle invalid header names in request processing (<a href="https://redirect.github.com/honojs/hono/issues/4883">#4883</a>) fa2c74fe</li> </ul> <h2>v4.12.13</h2> <h2>What's Changed</h2> <ul> <li>fix(types): infer response type from last handler in app.on 9-/10-handler overloads by <a href="https://github.com/T4ko0522"><code>@T4ko0522</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4865">honojs/hono#4865</a></li> <li>feat(trailing-slash): add <code>skip</code> option by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4862">honojs/hono#4862</a></li> <li>feat(cache): add <code>onCacheNotAvailable</code> option by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4876">honojs/hono#4876</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/T4ko0522"><code>@T4ko0522</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/4865">honojs/hono#4865</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.13">https://github.com/honojs/hono/compare/v4.12.12...v4.12.13</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/cf2d2b7edcf07adef2db7614557f4d7f9e2be7ba"><code>cf2d2b7</code></a> 4.12.14</li> <li><a href="https://github.com/honojs/hono/commit/66daa2edef8965544c04fcad82c596ab2acdb5ee"><code>66daa2e</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/fa2c74fe5c3ce996d025d9d97bf5670c207bb82e"><code>fa2c74f</code></a> fix(aws-lambda): handle invalid header names in request processing (<a href="https://redirect.github.com/honojs/hono/issues/4883">#4883</a>)</li> <li><a href="https://github.com/honojs/hono/commit/3779927c17201dc6bfd20697f0e1ec65407da779"><code>3779927</code></a> 4.12.13</li> <li><a href="https://github.com/honojs/hono/commit/faa6c46a1aa3a8b792b29e20fc93bcd6d2a4d720"><code>faa6c46</code></a> feat(cache): add <code>onCacheNotAvailable</code> option (<a href="https://redirect.github.com/honojs/hono/issues/4876">#4876</a>)</li> <li><a href="https://github.com/honojs/hono/commit/f23e97b7f300bcb8571ae864010b8f7cdb5d0d5d"><code>f23e97b</code></a> feat(trailing-slash): add <code>skip</code> option (<a href="https://redirect.github.com/honojs/hono/issues/4862">#4862</a>)</li> <li><a href="https://github.com/honojs/hono/commit/1aa32fb91e7bc1366811d80ebcce61ec0d0c68cb"><code>1aa32fb</code></a> fix(types): infer response type from last handler in app.on 9- and 10-handler...</li> <li>See full diff in <a href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.14">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.12&new-version=4.12.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-15 19:45:00 -07:00
Hunter Lovell	9102d526c8	fix(langgraph): propagate tracer metadata defaults from configurable (#2315 ) ## Summary This updates Pregel callback manager initialization to pass `tracerInheritableMetadata` defaults derived from `config.configurable`, and narrows `ensureLangGraphConfig` metadata mirroring to the allowlisted LangGraph identifiers used in stream/runtime metadata. ## Changes ### `@langchain/langgraph` (`libs/langgraph-core`) - Updated Pregel callback manager setup to configure core callbacks with `tracerInheritableMetadata` based on configurable primitive values, excluding internal and secret-like keys. - Hoisted tracing default logic into `_getTracingMetadataDefaults` and `_excludeAsMetadata` for parity with the Python implementation shape. - Restricted `ensureLangGraphConfig` configurable-to-metadata propagation to the identifier allowlist: - `thread_id` - `checkpoint_id` - `checkpoint_ns` - `task_id` - `run_id` - `assistant_id` - `graph_id` - Updated config tests to assert the narrowed metadata propagation behavior.	2026-04-15 18:48:41 -07:00
dependabot[bot]	7da383a8e6	chore(deps-dev): bump vite from 7.3.1 to 7.3.2 (#2297 ) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.1 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6">f8103cc</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/cc383e07b66d4c5a9768fcb570e0af812cb8d999"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-16 01:43:26 +00:00
dependabot[bot]	5a0d0d0155	chore(deps): bump langsmith from 0.5.18 to 0.5.19 (#2319 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.5.18 to 0.5.19. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langsmith-sdk/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.18&new-version=0.5.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-14 16:51:50 -07:00
dependabot[bot]	aa2cfc8bf7	chore(deps): bump langsmith from 0.5.16 to 0.5.18 (#2307 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.5.16 to 0.5.18. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langsmith-sdk/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.16&new-version=0.5.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-10 13:58:27 -07:00
dependabot[bot]	9c1e3278fe	chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 (#2300 ) Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.11 to 1.19.13. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/node-server/releases"><code>@hono/node-server</code>'s releases</a>.</em></p> <blockquote> <h2>v1.19.13</h2> <h2>Security Fix</h2> <p>Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (<code>//</code>) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.</p> <p>See GHSA-92pp-h63x-v22m for details.</p> <h2>v1.19.12</h2> <h2>What's Changed</h2> <ul> <li>chore: ignore claude setting by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/314">honojs/node-server#314</a></li> <li>fix: request draining for early 413 responses by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/329">honojs/node-server#329</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12">https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/node-server/commit/fd64e659a34ec661fd9ccda00d1b9dff88dfaf90"><code>fd64e65</code></a> 1.19.13</li> <li><a href="https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2"><code>025c30f</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/node-server/commit/6cdb5a724952f3df5748e435637792068ebea6d9"><code>6cdb5a7</code></a> 1.19.12</li> <li><a href="https://github.com/honojs/node-server/commit/70250f780ec99d2ddc0dd8275a42f8e091e06e94"><code>70250f7</code></a> fix: request draining for early 413 responses (<a href="https://redirect.github.com/honojs/node-server/issues/329">#329</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/cfc08b330a1f2e0a2d8cc7797cde389465b5f4fb"><code>cfc08b3</code></a> chore: ignore claude setting (<a href="https://redirect.github.com/honojs/node-server/issues/314">#314</a>)</li> <li>See full diff in <a href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.13">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-09 17:27:00 -07:00
dependabot[bot]	96a92c01a6	chore(deps): bump hono from 4.12.7 to 4.12.12 (#2301 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-08 14:34:47 -07:00
Christian Bromann	2b62610710	feat(sdk): support for headless tools (#2281 )	2026-04-03 22:07:54 -07:00
John Kennedy	90631859ba	fix: patch 7 security alerts (high+medium severity) (#2282 ) Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>	2026-04-04 03:43:41 +00:00
dependabot[bot]	e72c8e769e	chore(deps-dev): bump the svelte group across 1 directory with 3 updates (#2272 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christian Bromann <git@bromann.dev>	2026-04-03 09:59:39 -07:00
dependabot[bot]	2bb2ed4565	chore(deps): bump the vue group across 1 directory with 4 updates (#2273 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hunter Lovell <hunter@hntrl.io>	2026-04-02 00:37:15 -07:00
dependabot[bot]	271f9750f0	chore(deps): bump the langchain group across 1 directory with 7 updates (#2270 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-01 23:59:19 -07:00
dependabot[bot]	73ae630253	chore(deps): bump the angular group with 13 updates (#2271 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-01 21:30:32 -07:00
John Kennedy	4d2963c313	fix: patch 11 security alerts (critical+high severity) (#2258 ) Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>	2026-03-31 13:09:10 -07:00

1 2 3

110 Commits