Skip to content

chore(deps): bump the workspace group across 1 directory with 10 updates - #79

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/workspace-b87350f63a
Closed

chore(deps): bump the workspace group across 1 directory with 10 updates#79
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/workspace-b87350f63a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the workspace group with 10 updates in the / directory:

Package From To
@ai-sdk/anthropic 3.0.84 3.0.103
@ai-sdk/deepseek 2.0.39 2.0.50
@ai-sdk/google 3.0.82 3.0.101
@ai-sdk/openai 3.0.71 3.0.88
@ai-sdk/react 3.0.207 3.0.237
@biomejs/biome 2.5.2 2.5.5
@clerk/backend 3.11.6 3.13.1
@clerk/nextjs 7.5.19 7.6.1
@clerk/ui 1.25.4 1.26.0
@cloudflare/workers-types 5.20260716.1 5.20260727.1

Updates @ai-sdk/anthropic from 3.0.84 to 3.0.103

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/anthropic@​3.0.103

Patch Changes

  • 7865a71: fix(anthropic): report thinking tokens as reasoning token usage

@​ai-sdk/anthropic@​3.0.102

Patch Changes

  • b4c4426: feat (provider/anthropic): support fallbacks 'default' mode, which routes safety classifier refusals to Anthropic's recommended fallback model (adds the server-side-fallback-2026-07-01 beta automatically)
  • b4c4426: feat (provider/anthropic): support mid-conversation tool changes via the toolChanges system message provider option, emitting tool_addition/tool_removal content blocks and the mid-conversation-tool-changes-2026-07-01 beta
  • b4c4426: feat (provider/anthropic): add claude-opus-5 model id with frontier-tier capabilities (128k output tokens, structured output, adaptive thinking, xhigh effort, sampling parameter rejection, thinking-disabled only at effort high or below)
Changelog

Sourced from @​ai-sdk/anthropic's changelog.

3.0.103

Patch Changes

  • 7865a71: fix(anthropic): report thinking tokens as reasoning token usage

3.0.102

Patch Changes

  • b4c4426: feat (provider/anthropic): support fallbacks 'default' mode, which routes safety classifier refusals to Anthropic's recommended fallback model (adds the server-side-fallback-2026-07-01 beta automatically)
  • b4c4426: feat (provider/anthropic): support mid-conversation tool changes via the toolChanges system message provider option, emitting tool_addition/tool_removal content blocks and the mid-conversation-tool-changes-2026-07-01 beta
  • b4c4426: feat (provider/anthropic): add claude-opus-5 model id with frontier-tier capabilities (128k output tokens, structured output, adaptive thinking, xhigh effort, sampling parameter rejection, thinking-disabled only at effort high or below)

3.0.101

Patch Changes

  • 0608dca: fix (provider/anthropic): use current-generation capability defaults for unrecognized Claude model IDs while retaining conservative defaults for legacy Claude and non-Claude models.

3.0.100

Patch Changes

  • b7afc80: Warn when an unknown model uses the default 4096 max output token limit.

3.0.99

Patch Changes

  • db8cff6: fix(amazon-bedrock): sanitize unsupported JSON Schema constraints in native Anthropic structured output
  • 94d0f86: fix(provider/anthropic): warn when parallel tool use is requested with JSON tool structured output

3.0.98

Patch Changes

  • 10366a2: fix(provider/anthropic): preserve web search citations when replaying assistant messages
  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40

3.0.97

Patch Changes

  • Updated dependencies [06fb54c]
    • @​ai-sdk/provider-utils@​4.0.39

3.0.96

... (truncated)

Commits
  • 909df02 Version Packages (#17927)
  • 7865a71 backport: fix(anthropic): report thinking tokens as reasoning token usage (#1...
  • f6ac6a2 Version Packages (#17910)
  • b4c4426 feat(anthropic): opus 5 (#17905)
  • 07edaea Version Packages (#17825)
  • 0608dca [v6.0] fix: incorrect capability defaults for unrecognized Claude model IDs (...
  • f53b627 Version Packages (#17650)
  • b7afc80 [v6.0] fix: surface the implicit output token limit for unknown Anthropic mod...
  • 20e2395 Version Packages (#17552)
  • db8cff6 [v6.0] fix: prevent Bedrock native structured output from forwarding unsuppor...
  • Additional commits viewable in compare view

Updates @ai-sdk/deepseek from 2.0.39 to 2.0.50

Changelog

Sourced from @​ai-sdk/deepseek's changelog.

2.0.50

Patch Changes

  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40

2.0.49

Patch Changes

  • 55be323: fix: Azure DeepSeek structured output returns JSON in reasoning with empty text

2.0.48

Patch Changes

  • Updated dependencies [06fb54c]
    • @​ai-sdk/provider-utils@​4.0.39

2.0.47

Patch Changes

  • Updated dependencies [e1af05f]
    • @​ai-sdk/provider@​3.0.14
    • @​ai-sdk/provider-utils@​4.0.38

2.0.46

Patch Changes

  • bef93ae: fix(security): prevent streaming tool calls from finalizing on parsable partial JSON

    Streaming tool call arguments were finalized using isParsableJson() as a heuristic for completion. If partial accumulated JSON happened to be valid JSON before all chunks arrived, the tool call would be executed with incomplete arguments. Tool call finalization now only occurs in flush() after the stream is fully consumed.

  • 327642b: fix: more precise default message for tool execution denial

  • Updated dependencies [d559de9]

    • @​ai-sdk/provider-utils@​4.0.37

2.0.45

Patch Changes

  • Updated dependencies [0952964]
    • @​ai-sdk/provider-utils@​4.0.36

2.0.44

Patch Changes

... (truncated)

Commits

Updates @ai-sdk/google from 3.0.82 to 3.0.101

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​3.0.101

Patch Changes

  • 326887b: fix(google): omit unsupported function call IDs

@​ai-sdk/google@​3.0.100

Patch Changes

  • dae771a: feat(provider/google): default unknown Gemini model IDs to the newest supported capabilities
Changelog

Sourced from @​ai-sdk/google's changelog.

3.0.101

Patch Changes

  • 326887b: fix(google): omit unsupported function call IDs

3.0.100

Patch Changes

  • dae771a: feat(provider/google): default unknown Gemini model IDs to the newest supported capabilities

3.0.99

Patch Changes

  • 2886d22: Avoid missing thought-signature warnings and skip-validator injection for valid unsigned Gemini 3 parallel function calls in the same model response.

3.0.98

Patch Changes

  • a09f944: feat(google): add gemini-3.6-flash and gemini-3.5-flash-lite models

3.0.97

Patch Changes

  • a6cb3c1: fix(provider/google): surface Gemini responseId as response-metadata (stream) and response.id (generate)

3.0.96

Patch Changes

  • 0d51472: fix(provider/google): associate multiple code execution results with their tool call

3.0.95

Patch Changes

  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40

3.0.94

Patch Changes

  • 020836c: fix(provider/google): forward Vertex-only imageConfig options (personGeneration, prominentPeople, imageOutputOptions)

3.0.93

... (truncated)

Commits
  • ac40b4e Version Packages (#17918)
  • 326887b Backport: fix(google): omit unsupported function call IDs (#17911)
  • 07edaea Version Packages (#17825)
  • dae771a [v6.0] feat: use forward-compatible capability defaults for unknown Google Ge...
  • f53b627 Version Packages (#17650)
  • 2886d22 [v6.0] fix: prevent warnings and skip-validator injection for valid Gemini 3 ...
  • 95c9e8d Version Packages (#17604)
  • a09f944 backport (v6): feat(google): add gemini-3.6-flash and `gemini-3.5-flash-lit...
  • 20e2395 Version Packages (#17552)
  • a6cb3c1 Backport: fix(provider/google): surface Gemini responseId on stream and gener...
  • Additional commits viewable in compare view

Updates @ai-sdk/openai from 3.0.71 to 3.0.88

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​3.0.88

Patch Changes

  • 8100830: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.
Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.88

Patch Changes

  • 8100830: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.

3.0.87

Patch Changes

  • 2f11af1: Preserve stored tool search output item IDs from provider metadata.

3.0.86

Patch Changes

  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40

3.0.85

Patch Changes

  • Updated dependencies [06fb54c]
    • @​ai-sdk/provider-utils@​4.0.39

3.0.84

Patch Changes

  • 356918c: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls

3.0.83

Patch Changes

  • 34b5acc: feat(provider/openai,provider/gateway): add gpt-5.6 model ids
  • Updated dependencies [e1af05f]
    • @​ai-sdk/provider@​3.0.14
    • @​ai-sdk/provider-utils@​4.0.38

3.0.82

Patch Changes

  • bef93ae: fix(security): prevent streaming tool calls from finalizing on parsable partial JSON

    Streaming tool call arguments were finalized using isParsableJson() as a heuristic for completion. If partial accumulated JSON happened to be valid JSON before all chunks arrived, the tool call would be executed with incomplete arguments. Tool call finalization now only occurs in flush() after the stream is fully consumed.

  • 327642b: fix: more precise default message for tool execution denial

... (truncated)

Commits

Updates @ai-sdk/react from 3.0.207 to 3.0.237

Release notes

Sourced from @​ai-sdk/react's releases.

@​ai-sdk/react@​3.0.237

Patch Changes

  • ai@6.0.235
Changelog

Sourced from @​ai-sdk/react's changelog.

3.0.237

Patch Changes

  • ai@6.0.235

3.0.236

Patch Changes

  • Updated dependencies [1efdef8]
  • Updated dependencies [49414cf]
    • ai@6.0.234

3.0.235

Patch Changes

  • Updated dependencies [fe410e7]
  • Updated dependencies [af7188c]
    • ai@6.0.233

3.0.234

Patch Changes

  • Updated dependencies [7644a61]
    • ai@6.0.232

3.0.233

Patch Changes

  • Updated dependencies [926f5a0]
  • Updated dependencies [4c5a22f]
  • Updated dependencies [842a383]
    • ai@6.0.231

3.0.232

Patch Changes

  • Updated dependencies [19093fd]
    • ai@6.0.230
    • @​ai-sdk/provider-utils@​4.0.40

3.0.231

Patch Changes

... (truncated)

Commits

Updates @biomejs/biome from 2.5.2 to 2.5.5

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.5

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}

  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}

  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Commits

Updates @clerk/backend from 3.11.6 to 3.13.1

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.13.1

Patch Changes

  • Updated dependencies [01f2c12]:
    • @​clerk/shared@​4.25.8

@​clerk/backend@​3.13.0

Minor Changes

  • Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

  • Updated dependencies [097432d]:
    • @​clerk/shared@​4.25.7

@​clerk/backend@​3.12.0

Minor Changes

  • Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

  • Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

  • Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

  • Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

  • Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

  • Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

    • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
    • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
    • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

  • Updated dependencies [858a689, c904fb4]:

    • @​clerk/shared@​4.25.6

@​clerk/backend@​3.11.7

Patch Changes

  • Reject machine tokens (M2M and OAuth JWTs) presented in the __session cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as userId, defeating if (userId) authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens. (#9168) by @​dominic-clerk

  • Updated dependencies [bcbdda6]:

    • @​clerk/shared@​4.25.5
Changelog

Sourced from @​clerk/backend's changelog.

3.13.1

Patch Changes

  • Updated dependencies [01f2c12]:
    • @​clerk/shared@​4.25.8

3.13.0

Minor Changes

  • Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

  • Updated dependencies [097432d]:
    • @​clerk/shared@​4.25.7

3.12.0

Minor Changes

  • Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

  • Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

  • Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

  • Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

  • Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

  • Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

    • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
    • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
    • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

  • Updated dependencies [858a689, c904fb4]:

    • @​clerk/shared@​4.25.6

3.11.7

Patch Changes

  • Reject machine tokens (M2M and OAuth JWTs) presented in the __session cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as userId, defeating if (userId) authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens. (#9168) by @​dominic-clerk

  • Updated dependencies [bcbdda6]:

    • @​clerk/shared@​4.25.5
Commits
  • 9081534 ci(repo): Version packages (#9240)
  • acef8a1 ci(repo): Version packages (#9219)
  • 848eefe feat(backend): support configurable Frontend API proxy URLs (#9223)
  • 430ae23 ci(repo): Version packages (#9195)
  • 858a689 docs(repo): Add trailing comma after e.g. and i.e. in JSDoc (#9201)
  • a009d91 fix(backend): Align enterprise connection create and update params with the B...
  • ff5d991 fix(backend): Fix cross-origin handshake bypass (#9145)
  • 26530ce feat(backend): support organization-scoped sign-in tokens (#9192)
  • b37ba0d ci(repo): Version packages (#9175)
  • e657d99 fix(backend): reject machine JWTs presented as session tokens (#9168)
  • See full diff in compare view

Updates @clerk/nextjs from 7.5.19 to 7.6.1

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.6.1

Patch Changes

  • Updated dependencies [01f2c12]:
    • @​clerk/shared@​4.25.8
    • @​clerk/react@​6.12.8
    • @​clerk/backend@​3.13.1

@​clerk/nextjs@​7.6.0

Minor Changes

  • Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

@​clerk/nextjs@​7.5.21

Patch Changes

@​clerk/nextjs@​7.5.20

Patch Changes

Changelog

Sourced from @​clerk/nextjs's changelog.

7.6.1

Patch Changes

  • Updated dependencies [01f2c12]:
    • @​clerk/shared@​4.25.8
    • @​clerk/react@​6.12.8
    • @​clerk/backend@​3.13.1

7.6.0

Minor Changes

  • Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

7.5.22

Patch Changes

  • Remove the redundant https://*.client.protect.clerk.com source from CSP headers generated by clerkMiddleware(). (#9207) by @​mwickett

7.5.21

Patch Changes

7.5.20

Patch Changes

Commits

Up...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot
dependabot Bot requested a review from iamjr15 as a code owner July 27, 2026 11:12
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot
chore(deps): bump the workspace group across 1 directory with 10 updates
4a0bb47 
Bumps the workspace group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `3.0.84` | `3.0.103` |
| [@ai-sdk/deepseek](https://github.com/vercel/ai/tree/HEAD/packages/deepseek) | `2.0.39` | `2.0.50` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `3.0.82` | `3.0.101` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.71` | `3.0.88` |
| [@ai-sdk/react](https://github.com/vercel/ai/tree/HEAD/packages/react) | `3.0.207` | `3.0.237` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.2` | `2.5.5` |
| [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.11.6` | `3.13.1` |
| [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.5.19` | `7.6.1` |
| [@clerk/ui](https://github.com/clerk/javascript/tree/HEAD/packages/ui) | `1.25.4` | `1.26.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260716.1` | `5.20260727.1` |



Updates `@ai-sdk/anthropic` from 3.0.84 to 3.0.103
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@3.0.103/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@3.0.103/packages/anthropic)

Updates `@ai-sdk/deepseek` from 2.0.39 to 2.0.50
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/deepseek@2.0.50/packages/deepseek/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/deepseek@2.0.50/packages/deepseek)

Updates `@ai-sdk/google` from 3.0.82 to 3.0.101
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/google@3.0.101/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@3.0.101/packages/google)

Updates `@ai-sdk/openai` from 3.0.71 to 3.0.88
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@3.0.88/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@3.0.88/packages/openai)

Updates `@ai-sdk/react` from 3.0.207 to 3.0.237
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/react@3.0.237/packages/react/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/react@3.0.237/packages/react)

Updates `@biomejs/biome` from 2.5.2 to 2.5.5
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.5/packages/@biomejs/biome)

Updates `@clerk/backend` from 3.11.6 to 3.13.1
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.13.1/packages/backend)

Updates `@clerk/nextjs` from 7.5.19 to 7.6.1
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.6.1/packages/nextjs)

Updates `@clerk/ui` from 1.25.4 to 1.26.0
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/ui/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/ui@1.26.0/packages/ui)

Updates `@cloudflare/workers-types` from 5.20260716.1 to 5.20260727.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

---
updated-dependencies:
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 3.0.103
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workspace
- dependency-name: "@ai-sdk/deepseek"
  dependency-version: 2.0.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workspace
- dependency-name: "@ai-sdk/google"
  dependency-version: 3.0.101
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workspace
- dependency-name: "@ai-sdk/openai"
  dependency-version: 3.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workspace
- dependency-name: "@ai-sdk/react"
  dependency-version: 3.0.237
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workspace
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workspace
- dependency-name: "@clerk/backend"
  dependency-version: 3.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workspace
- dependency-name: "@clerk/nextjs"
  dependency-version: 7.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workspace
- dependency-name: "@clerk/ui"
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workspace
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260727.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workspace
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the workspace group with 10 updates chore(deps): bump the workspace group across 1 directory with 10 updates Jul 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/workspace-b87350f63a branch from b2e6718 to 4a0bb47 Compare July 27, 2026 12:55
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 28, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/workspace-b87350f63a branch July 28, 2026 07:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iamjr15 iamjr15 Awaiting requested review from iamjr15 iamjr15 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants