Skip to content

Bump the minor-and-patch group across 1 directory with 18 updates - #23

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-b16eaca910
Closed

Bump the minor-and-patch group across 1 directory with 18 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-b16eaca910

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 16 updates in the / directory:

Package From To
@anthropic-ai/claude-agent-sdk 0.3.163 0.3.226
@modelcontextprotocol/sdk 1.29.0 1.30.0
express-rate-limit 8.5.2 8.6.2
marked 18.0.4 18.0.9
tsx 4.22.4 4.23.12
@testing-library/user-event 14.6.1 14.6.3
@vitejs/plugin-react 6.0.2 6.0.5
@vitest/coverage-v8 4.1.8 4.1.10
autoprefixer 10.5.0 10.5.4
postcss 8.5.15 8.5.26
prettier 3.8.3 3.9.6
vite 8.0.16 8.2.1
@opentelemetry/exporter-trace-otlp-http 0.218.0 0.221.0
@opentelemetry/resources 2.7.1 2.10.0
@opentelemetry/sdk-node 0.218.0 0.221.0
@opentelemetry/semantic-conventions 1.41.1 1.43.0

Updates @anthropic-ai/claude-agent-sdk from 0.3.163 to 0.3.226

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.226

What's changed

  • Updated to parity with Claude Code v2.1.226

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.226
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.226
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.226
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.226

v0.3.225

What's changed

  • Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.225
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.225
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.225
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.225

v0.3.224

What's changed

  • Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
  • Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
  • Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
  • Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
  • Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.224
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.224
# or
</tr></table>

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.226

  • Updated to parity with Claude Code v2.1.226

0.3.225

  • Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

0.3.224

  • Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
  • Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
  • Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
  • Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
  • Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

0.3.223

  • Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
  • Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
  • Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
  • Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

0.3.222

  • Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

0.3.221

  • Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
  • Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

0.3.220

  • Updated to parity with Claude Code v2.1.220

0.3.219

  • Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
  • Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
  • Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
  • Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
  • Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
  • Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

0.3.218

  • SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent
  • Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529
  • Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

... (truncated)

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates express-rate-limit from 8.5.2 to 8.6.2

Commits
  • c416f78 8.6.2
  • defb334 v8.6.2 changelog
  • 7dd82cf fix: key IPv4-in-IPv6 addresses by range, not notation (#667)
  • 4e23dbb chore(deps): bump ip-address from 10.3.1 to 10.4.0 (#666)
  • 607ef1f chore(deps): bump ip-address from 10.2.0 to 10.3.1 (#664)
  • d2370f6 chore(deps-dev): bump the development-dependencies group with 5 updates (#663)
  • c7fced5 8.6.1
  • b21110e chore: deprecate millisecond-based time constants (#662)
  • fad3d85 chore(deps-dev): bump the development-dependencies group with 4 updates (#660)
  • fffb3c4 8.6.0
  • Additional commits viewable in compare view

Updates marked from 18.0.4 to 18.0.9

Commits
  • 8e858a4 chore(release): 18.0.9 [skip ci]
  • 641e5df docs: explain partial extensions in use (#4033)
  • 452f1ed fix: Fix spurious deeper nesting in a blockquote continuation (#4030)
  • e8544e6 fix: an unmatched strong run before emphasis stays literal (#4008)
  • 823093f fix: pedantic foo: and "word" emphasis parsing (#3999)
  • 12a84a8 chore(release): 18.0.8 [skip ci]
  • 3a1a706 chore(deps-dev): bump undici from 6.24.0 to 6.27.0 (#4042)
  • 58ed4af chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 (#4032)
  • 01539fb chore(deps-dev): bump @​semantic-release/git from 10.0.1 to 11.0.1 (#4031)
  • e1b6139 fix: fall back to default checkbox renderer when extension returns false (#4023)
  • Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.12

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • b94f46f fix: support data URLs in tsImport
  • Additional commits viewable in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.3

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.


Updates @vitejs/plugin-react from 6.0.2 to 6.0.5

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

6.0.3 (2026-06-23)

Improve the react compiler preset filter to reduce false-positives (#1138)

Improved the filter in the react compiler babel preset to reduce the false-positives so that less modules are processed by the react compiler.

Commits
  • 68c0cb8 release: plugin-react@6.0.5 (#1362)
  • 555cdbc fix(react): make the react compiler preset filter linear (#1353)
  • a00a9f8 fix(deps): update all non-major dependencies (#1327)
  • f4b5498 release: plugin-react@6.0.4
  • 7a40659 fix(react): $RefreshSig$ is not defined with NODE_ENV=production vite dev ...
  • 98b32d4 fix(deps): update react 19.2.8 (#1298)
  • 8ae5449 fix: babel-plugin-react-compiler cannot be imported when used in a framework ...
  • f09ea01 fix(deps): update all non-major dependencies (#1282)
  • 640fd35 release: plugin-react@6.0.3
  • 889efb0 fix(deps): update all non-major dependencies (#1249)
  • Additional commits viewable in compare view

Updates @vitest/coverage-v8 from 4.1.8 to 4.1.10

Commits

Updates autoprefixer from 10.5.0 to 10.5.4

Changelog

Sourced from autoprefixer's changelog.

10.5.4

10.5.3

10.5.2

  • Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.


Updates postcss from 8.5.15 to 8.5.26

Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates prettier from 3.8.3 to 3.9.6

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Updates vite from 8.0.16 to 8.2.1

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

  • build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
  • bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
  • css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
  • deps: update all non-major dependencies (#23136) (14454fd)
  • deps: update rolldown-related dependencies (#23070) (7ac6f7f)
  • don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
  • handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
  • server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

Documentation

  • build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

  • deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
  • deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

  • bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
  • bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

8.2.0 (2026-07-30)

Features

  • add input to server.fs.allow (#23035) (95a3cda)
  • bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
  • bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
  • config: include column in config incompatibility location (#23064) (8a24572)
  • dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

  • bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
  • deps: update all non-major dependencies (#23069) (4c07b74)
  • hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
  • importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

... (truncated)

Commits
  • 4216158 release: v8.2.1
  • fddf4ea fix(server): use a random port when port is 0 (#23158)
  • de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
  • 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
  • c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
  • ef02435 docs(build): fix incomplete @default for build.minify (#23177)
  • eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
  • 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
  • e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
  • 14454fd fix(deps): update all non-major dependencies (#23136)
  • Additional commits viewable in compare view

Updates vitest from 4.1.8 to 4.1.10

Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • See full diff in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.218.0 to 0.221.0

Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
  • a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
  • af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
  • b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
  • cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
  • Additional commits viewable in compare view

Updates @opentelemetry/resources from 2.7.1 to 2.10.0

Changelog

Sourced from @​opentelemetry/resources's changelog.

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

2.8.0

🚀 Features

... (truncated)

Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
    • Description has been truncated

@dependabot
Bump the minor-and-patch group across 1 directory with 18 updates
72f00fb 
Bumps the minor-and-patch group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.163` | `0.3.226` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.2` | `8.6.2` |
| [marked](https://github.com/markedjs/marked) | `18.0.4` | `18.0.9` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.12` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.3` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.5` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.10` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.0` | `10.5.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.26` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.6` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.2.1` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.221.0` |
| [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.7.1` | `2.10.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.221.0` |
| [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.41.1` | `1.43.0` |



Updates `@anthropic-ai/claude-agent-sdk` from 0.3.163 to 0.3.226
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.163...v0.3.226)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `express-rate-limit` from 8.5.2 to 8.6.2
- [Commits](express-rate-limit/express-rate-limit@v8.5.2...v8.6.2)

Updates `marked` from 18.0.4 to 18.0.9
- [Commits](markedjs/marked@v18.0.4...v18.0.9)

Updates `tsx` from 4.22.4 to 4.23.12
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.12)

Updates `@testing-library/user-event` from 14.6.1 to 14.6.3
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.1...v14.6.3)

Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.5
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.10
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `autoprefixer` from 10.5.0 to 10.5.4
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.0...10.5.4)

Updates `postcss` from 8.5.15 to 8.5.26
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.26)

Updates `prettier` from 3.8.3 to 3.9.6
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.9.6)

Updates `vite` from 8.0.16 to 8.2.1
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

Updates `vitest` from 4.1.8 to 4.1.10
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.218.0 to 0.221.0
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.221.0)

Updates `@opentelemetry/resources` from 2.7.1 to 2.10.0
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.7.1...v2.10.0)

Updates `@opentelemetry/sdk-node` from 0.218.0 to 0.221.0
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.221.0)

Updates `@opentelemetry/sdk-trace-node` from 2.7.1 to 2.10.0
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.7.1...v2.10.0)

Updates `@opentelemetry/semantic-conventions` from 1.41.1 to 1.43.0
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@semconv/v1.41.1...semconv/v1.43.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.226
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: express-rate-limit
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: marked
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.221.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/resources"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.221.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/sdk-trace-node"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/semantic-conventions"
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
jagalliers added a commit that referenced this pull request Sep 1, 2026
@jagalliers @claude
Routine dependency refresh at cooldown-seasoned versions (supersedes PR
628436f 
#23)

Adopts the minor/patch updates Dependabot's grouped PR has been unable to
merge since July (red audit gate, now fixed): Vite 8.0.16 -> 8.2.2, vitest +
coverage 4.1.11, @vitejs/plugin-react 6.1.0, tsx 4.23.12, marked 18.0.11,
express-rate-limit 8.6.2, prettier 3.9.6 (one formatting-only reflow in
server/pipeline.ts), autoprefixer 10.5.4, @testing-library/user-event 14.6.6,
@types/node 22.20.1, @types/react 18.3.31.

Cooldown discipline (7-day policy): every adopted version's publish date
verified >= 7 days old. rolldown held at 1.2.5 via a documented override pin
(vite's ~1.2.4 range would float to the 6-day-old 1.2.6). zod and
@testing-library/react deliberately not bumped — only days-old releases
available. The browserslist data packages (caniuse-lite, electron-to-chromium,
node-releases, baseline-browser-mapping, update-browserslist-db) float with
autoprefixer and release near-daily; accepted as a documented exception since
pinning them (attempted before in an unmerged branch) rots within days.

Verified: npm audit 0, typecheck, prettier, 470 tests, coverage, build,
check-splunk-viz clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014FfvzDa5feL83VrySkppDD
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 1, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-b16eaca910 branch September 1, 2026 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants