Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 12 updates - #395

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-12427f81d6
Open

chore(deps): bump the production-dependencies group across 1 directory with 12 updates#395
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-12427f81d6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 12 updates in the / directory:

Package From To
playwright 1.60.0 1.62.0
@ai-sdk/anthropic 2.0.82 2.0.92
@ai-sdk/openai 2.0.107 2.0.117
@langchain/core 1.1.48 1.2.3
@langchain/langgraph 1.3.6 1.4.8
@modelcontextprotocol/sdk 1.29.0 1.30.0
ai 5.0.200 5.0.223
undici 6.26.0 6.28.0
minimatch 10.2.5 10.2.6
@fontsource/chakra-petch 5.2.7 5.3.0
@fontsource/ibm-plex-mono 5.2.7 5.3.0
@fontsource/ibm-plex-sans 5.2.8 5.3.0

Updates playwright from 1.60.0 to 1.62.0

Release notes

Sourced from playwright's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table>

... (truncated)

Commits
  • e3950d9 chore: mark v1.62.0 (#41981)
  • f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
  • 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
  • 2934858 fix: correct pending navigation log spacing (#41949)
  • 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
  • bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
  • 15c4f55 fix(mcp): identify downloads explicitly (#41933)
  • f5fa967 fix(network): request.postData() returns null for empty string body override ...
  • 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
  • 244a1ff feat(firefox): roll to r1538 (#41938)
  • Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 2.0.82 to 2.0.92

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/xai@​2.0.84

Patch Changes

  • Updated dependencies [7a6bdbc]
    • @​ai-sdk/provider-utils@​3.0.31
    • @​ai-sdk/openai-compatible@​1.0.47
Changelog

Sourced from @​ai-sdk/anthropic's changelog.

2.0.92

Patch Changes

  • Updated dependencies [7a6bdbc]
    • @​ai-sdk/provider-utils@​3.0.31

2.0.91

Patch Changes

  • 0ab9755: feat (provider/anthropic): support fallbacks 'default' mode, which routes safety classifier refusals to Anthropic's recommended fallback model (adds the server-side-fallback-2026-07-01 beta automatically)
  • 0ab9755: feat (provider/anthropic): support mid-conversation tool changes via the toolChanges system message provider option, emitting tool_addition/tool_removal content blocks and the mid-conversation-tool-changes-2026-07-01 beta
  • 0ab9755: feat (provider/anthropic): add claude-opus-5 model id with frontier-tier capabilities (128k output tokens, structured output, adaptive thinking, xhigh effort, sampling parameter rejection, thinking-disabled only at effort high or below)

2.0.90

Patch Changes

  • db28434: fix (provider/anthropic): use current-generation capability defaults for unrecognized Claude model IDs while retaining conservative defaults for legacy Claude and non-Claude models.

2.0.89

Patch Changes

  • 1b0e540: Use native structured output on supported Bedrock Anthropic models when thinking is enabled instead of forcing a JSON tool call.
  • 5bb3ae4: Warn when an unknown model uses the default 4096 max output token limit.

2.0.88

Patch Changes

  • 30c69e6: fix(provider/anthropic): warn when parallel tool use is requested with JSON tool structured output

2.0.87

Patch Changes

  • 5082ee8: fix(provider/anthropic): preserve web search citations when replaying assistant messages
  • Updated dependencies [2fd6076]
    • @​ai-sdk/provider-utils@​3.0.30

2.0.86

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29

2.0.85

... (truncated)

Commits

Updates @ai-sdk/openai from 2.0.107 to 2.0.117

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​2.0.117

Patch Changes

  • Updated dependencies [7a6bdbc]
    • @​ai-sdk/provider-utils@​3.0.31
Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.117

Patch Changes

  • Updated dependencies [7a6bdbc]
    • @​ai-sdk/provider-utils@​3.0.31

2.0.116

Patch Changes

  • 8591016: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.

2.0.115

Patch Changes

  • 11a02d9: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.

2.0.114

Patch Changes

  • Updated dependencies [2fd6076]
    • @​ai-sdk/provider-utils@​3.0.30

2.0.113

Patch Changes

  • 21eef03: Send null content for tool-call-only assistant messages.

2.0.112

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29

2.0.111

Patch Changes

  • b4f8362: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls
  • 8549807: feat(provider/openai,provider/gateway): add gpt-5.6 model ids

2.0.110

Patch Changes

... (truncated)

Commits

Updates @langchain/core from 1.1.48 to 1.2.3

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.3

Patch Changes

  • #11200 08e5888 Thanks @​hntrl! - fix(aws): normalize and safely replay Bedrock reasoning blocks

    Emit standard reasoning blocks with preserved signatures, omit incomplete signature-only reasoning during replay, and retain compatibility with legacy and redacted Bedrock reasoning.

@​langchain/core@​1.2.2

Patch Changes

  • #11171 82bef01 Thanks @​christian-bromann! - fix(core): coerce string v1 AIMessage content to text blocks

    Prevent contentBlocks.push is not a function when constructing an AIMessage with response_metadata.output_version === "v1" and string content (common in serialized LangGraph stream payloads).

@​langchain/core@​1.2.1

Patch Changes

  • #10674 f017708 Thanks @​christian-bromann! - fix: classify provider 429s before retrying

  • #11092 7918bbd Thanks @​aolsenjazz! - fix(core): only treat arrays of content blocks as ToolMessage content

    Fix tool outputs that are arrays of plain objects being forwarded as malformed message content. An array is now only treated as message content blocks when every element is an object with a type; otherwise it is JSON-stringified.

@​langchain/core@​1.2.0

Minor Changes

Patch Changes

  • #11047 ac0f71d Thanks @​christian-bromann! - fix(core): preserve AIMessage content blocks

    Keep existing v1 contentBlocks when constructing AIMessage instances so serialized messages do not lose block content during deserialization.

Commits
  • 82a6b8e chore: version packages (#11202)
  • 08e5888 fix(aws): normalize Bedrock reasoning blocks (#11200)
  • 21aaeb0 fix: patch 13 high/critical Dependabot alerts (#11199)
  • 782c7f2 chore(dev): bump @​types/node from 25.9.1 to 26.1.0 in the types group across ...
  • f51f338 chore: version packages (#11176)
  • 09e7f6d fix(openai): drop tool_call content blocks from chat completions input (#11...
  • a9f123a fix(openai): filter out content blocks the chat completions api rejects as in...
  • cc39f56 chore: version packages (#11172)
  • 82bef01 fix(core): coerce string v1 AIMessage content to text blocks (#11171)
  • 8a7c5f8 chore: version packages (#11170)
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.3.6 to 1.4.8

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.8

Patch Changes

@​langchain/langgraph@​1.4.7

Patch Changes

  • #2571 85ba859 Thanks @​christian-bromann! - fix(langgraph): drop unused zod-to-json-schema peer dependency

    Remove the vestigial zod-to-json-schema (and its peerDependenciesMeta/dev) declarations. JSON Schema generation now flows through @langchain/core's Zod v3/v4 interop (toJsonSchema), so the old zod-to-json-schema@^3.x peer (which pins zod@^3.24.1) is no longer needed and was the last source of install-time peer conflicts with Zod v4. Closes #1706.

@​langchain/langgraph@​1.4.6

Patch Changes

  • 03a0d8b Thanks @​christian-bromann! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

    Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165.

  • Updated dependencies [0558e47, 091a46f]:

    • @​langchain/langgraph-sdk@​1.9.25
    • @​langchain/langgraph-checkpoint@​1.1.3

@​langchain/langgraph@​1.4.5

Patch Changes

  • #2557 b1e856d Thanks @​christian-bromann! - fix(sdk): apply state update and goto alongside interrupt resume

    respond(decision, { update, goto }) now maps to LangGraph's Command(resume, update, goto), so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the same superstep as the resume — one checkpoint, no separate updateState write, no flicker. @langchain/langgraph-api forwards update/goto through input.respond, and @langchain/core message instances in update are serialized to dicts before transport, exactly like submit(). Bumps @langchain/protocol to ^0.0.18 for the Goto type.

    respond/respondAll also apply update optimistically (mirroring submit()): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant respond() dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo).

    User-initiated optimistic writes (submit() / respond() / respondAll()) now commit to the store synchronously, in the same tick as the triggering event,

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.8

Patch Changes

1.4.7

Patch Changes

  • #2571 85ba859 Thanks @​christian-bromann! - fix(langgraph): drop unused zod-to-json-schema peer dependency

    Remove the vestigial zod-to-json-schema (and its peerDependenciesMeta/dev) declarations. JSON Schema generation now flows through @langchain/core's Zod v3/v4 interop (toJsonSchema), so the old zod-to-json-schema@^3.x peer (which pins zod@^3.24.1) is no longer needed and was the last source of install-time peer conflicts with Zod v4. Closes #1706.

1.4.6

Patch Changes

  • 03a0d8b Thanks @​christian-bromann! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

    Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165.

  • Updated dependencies [0558e47, 091a46f]:

    • @​langchain/langgraph-sdk@​1.9.25
    • @​langchain/langgraph-checkpoint@​1.1.3

1.4.5

Patch Changes

  • #2557 b1e856d Thanks @​christian-bromann! - fix(sdk): apply state update and goto alongside interrupt resume

    respond(decision, { update, goto }) now maps to LangGraph's Command(resume, update, goto), so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the same superstep as the resume — one checkpoint, no separate updateState write, no flicker. @langchain/langgraph-api forwards update/goto through input.respond, and @langchain/core message instances in update are serialized to dicts before transport, exactly like submit(). Bumps @langchain/protocol to ^0.0.18 for the Goto type.

    respond/respondAll also apply update optimistically (mirroring submit()): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant respond() dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or

... (truncated)

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates ai from 5.0.200 to 5.0.223

Release notes

Sourced from ai's releases.

ai@5.0.223

Patch Changes

  • 7a6bdbc: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
  • c5e11c6: Preserve provider metadata from empty text deltas in streamText.
  • Updated dependencies [7a6bdbc]
  • Updated dependencies [5bd6d2c]
    • @​ai-sdk/provider-utils@​3.0.31
    • @​ai-sdk/gateway@​2.0.122
Changelog

Sourced from ai's changelog.

5.0.223

Patch Changes

  • 7a6bdbc: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
  • c5e11c6: Preserve provider metadata from empty text deltas in streamText.
  • Updated dependencies [7a6bdbc]
  • Updated dependencies [5bd6d2c]
    • @​ai-sdk/provider-utils@​3.0.31
    • @​ai-sdk/gateway@​2.0.122

5.0.222

Patch Changes

  • d38a1d5: Route the warning system information banner to stderr so it does not corrupt application output written to stdout.
  • Updated dependencies [b408f1d]
    • @​ai-sdk/gateway@​2.0.121

5.0.221

Patch Changes

  • Updated dependencies [191423e]
    • @​ai-sdk/gateway@​2.0.120

5.0.220

Patch Changes

  • Updated dependencies [a45e563]
    • @​ai-sdk/gateway@​2.0.119

5.0.219

Patch Changes

  • 649bd0f: fix(ai): bound media-type sniffing decode for ID3-prefixed input

    Media-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on both image and audio paths.

  • 965545b: Return response piping promises so callers can catch stream read and write errors.

  • Updated dependencies [fb4c0d7]

    • @​ai-sdk/gateway@​2.0.118

5.0.218

Patch Changes

  • a322c62: fix: detect MP4 audio from its ftyp box during transcription

... (truncated)

Commits
  • b77a6d5 Version Packages (#18088)
  • e13f7b1 v5.0: docs: clarify generateText text behavior when no text parts are returne...
  • c5e11c6 [v5.0] fix: preserve provider metadata from empty streamText text deltas (#18...
  • 95c3321 Version Packages (#18032)
  • d38a1d5 [v5.0] fix: prevent the warning system banner from corrupting stdout output (...
  • 7b3811b [v5.0] docs: clarify that textStream does not surface error parts (#18000)
  • b65c4fb Version Packages (#17982)
  • 96f8997 Version Packages (#17824)
  • de65b8d Version Packages (#17754)
  • 649bd0f [v5.0] fix(provider-utils): bound media-type sniffing decode for ID3-prefixed...
  • Additional commits viewable in compare view

Updates undici from 6.26.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view

Updates minimatch from 10.2.5 to 10.2.6

Commits

Updates @fontsource/chakra-petch from 5.2.7 to 5.3.0

Commits

Updates @fontsource/ibm-plex-mono from 5.2.7 to 5.3.0

Commits

Updates @fontsource/ibm-plex-sans from 5.2.8 to 5.3.0

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 29, 2026
@dependabot
dependabot Bot requested a review from ceilf6 as a code owner July 29, 2026 03:58
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 29, 2026
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
31116e4 
…y with 12 updates

Bumps the production-dependencies group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.62.0` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `2.0.82` | `2.0.92` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `2.0.107` | `2.0.117` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.1.48` | `1.2.3` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.3.6` | `1.4.8` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.200` | `5.0.223` |
| [undici](https://github.com/nodejs/undici) | `6.26.0` | `6.28.0` |
| [minimatch](https://github.com/isaacs/minimatch) | `10.2.5` | `10.2.6` |
| [@fontsource/chakra-petch](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/chakra-petch) | `5.2.7` | `5.3.0` |
| [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` |
| [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-sans) | `5.2.8` | `5.3.0` |



Updates `playwright` from 1.60.0 to 1.62.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.62.0)

Updates `@ai-sdk/anthropic` from 2.0.82 to 2.0.92
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@2.0.92/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@2.0.92/packages/anthropic)

Updates `@ai-sdk/openai` from 2.0.107 to 2.0.117
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@2.0.117/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@2.0.117/packages/openai)

Updates `@langchain/core` from 1.1.48 to 1.2.3
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.1.48...@langchain/core@1.2.3)

Updates `@langchain/langgraph` from 1.3.6 to 1.4.8
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.8/libs/langgraph-core)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `ai` from 5.0.200 to 5.0.223
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.223/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.223/packages/ai)

Updates `undici` from 6.26.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.26.0...v6.28.0)

Updates `minimatch` from 10.2.5 to 10.2.6
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.2.5...v10.2.6)

Updates `@fontsource/chakra-petch` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/chakra-petch)

Updates `@fontsource/ibm-plex-mono` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono)

Updates `@fontsource/ibm-plex-sans` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-sans)

---
updated-dependencies:
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 2.0.91
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 2.0.116
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@fontsource/chakra-petch"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource/ibm-plex-mono"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource/ibm-plex-sans"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@langchain/core"
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.4.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 5.0.222
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: minimatch
  dependency-version: 10.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: playwright
  dependency-version: 1.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-12427f81d6 branch from a71b373 to 31116e4 Compare July 30, 2026 14:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ceilf6 ceilf6 Awaiting requested review from ceilf6 ceilf6 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants