chore(deps): bump the npm-v1-version group across 6 directories with 54 updates

[dependabot]

Bumps the npm-v1-version group with 13 updates in the /runtime/promptyjs directory:

Package	From	To
glob	11.1.0	13.0.6
js-yaml	4.3.1	5.3.0
openai	4.55.1	7.5.0
@changesets/cli	2.29.6	3.0.1
@types/glob	8.1.0	9.0.0
@types/mustache	4.2.5	4.2.6
@types/node	20.14.14	26.2.0
jest	29.7.0	30.4.2
@types/jest	29.5.14	30.0.0
puppeteer	22.15.0	25.8.0
ts-jest	29.2.6	29.4.12
tsup	8.4.0	8.5.1
typescript	5.7.3	7.0.2

Bumps the npm-v1-version group with 9 updates in the /vscode/prompty directory:

Package	From	To
js-yaml	4.1.0	5.3.0
@types/node	20.16.10	26.2.0
typescript	5.8.2	7.0.2
@eslint/js	9.13.0	10.0.1
@stylistic/eslint-plugin	2.9.0	5.10.0
@vscode/vsce	3.3.2	3.9.2
eslint	9.13.0	10.9.0
mocha	10.8.2	11.8.0
typescript-eslint	8.26.0	8.67.0

Bumps the npm-v1-version group with 7 updates in the /vscode/prompty/packages/core directory:

Package	From	To
glob	11.0.0	13.0.6
typescript	5.8.2	7.0.2
vscode-languageclient	9.0.1	10.1.0
@types/vscode	1.75.1	1.134.0
@vscode/test-electron	2.3.9	3.1.0
prettier	3.5.3	3.9.6
rimraf	6.0.1	6.1.3

Bumps the npm-v1-version group with 6 updates in the /vscode/prompty/packages/server directory:

Package	From	To
vscode-json-languageservice	5.5.0	5.7.2
vscode-languageserver	9.0.1	10.1.0
yaml-language-server	1.18.0	1.24.0
ts-loader	9.5.2	9.6.2
webpack	5.99.8	5.109.2
webpack-cli	6.0.1	7.2.2

Bumps the npm-v1-version group with 20 updates in the /vscode/prompty/packages/trace directory:

Package	From	To
typescript	5.8.2	7.0.2
@eslint/js	9.23.0	10.0.1
eslint	9.23.0	10.9.0
typescript-eslint	8.28.0	8.67.0
react	18.3.1	19.2.8
@types/react	18.3.20	19.2.18
react-dom	18.3.1	19.2.8
@types/react-dom	18.3.5	19.2.4
react-icons	5.5.0	5.7.0
react-markdown	9.1.0	10.1.0
styled-components	6.1.16	6.5.3
uuid	9.0.1	14.0.2
zustand	4.5.6	5.0.15
@types/uuid	9.0.8	11.0.0
@vitejs/plugin-react	4.3.4	6.1.0
babel-plugin-styled-components	2.1.4	2.3.0
eslint-plugin-react-hooks	5.2.0	7.1.1
eslint-plugin-react-refresh	0.4.19	0.5.4
globals	15.15.0	17.11.0
vite	5.4.15	8.2.2

Bumps the npm-v1-version group with 8 updates in the /web directory:

Package	From	To
@astrojs/starlight	0.34.4	0.41.7
astro	5.16.1	7.2.4
sass	1.89.2	1.103.1
sharp	0.32.6	0.35.3
starlight-auto-sidebar	0.1.2	0.4.0
starlight-contributor-list	0.3.0	0.4.0
starlight-links-validator	0.17.1	0.25.3
vite-plugin-devtools-json	0.2.1	1.1.0

Updates glob from 11.1.0 to 13.0.6

Changelog

Sourced from glob's changelog.

changeglob

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

• Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
• Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
• Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

• Drop support for node before v20

10.4

• Add includeChildMatches: false option
• Export the Ignore class

10.3

• Add --default -p flag to provide a default pattern
• exclude symbolic links to directories when follow and nodir are both set

10.2

• Add glob cli

10.1

• Return '.' instead of the empty string '' when the current working directory is returned as a match.
• Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

• e80cb38 13.0.6
• 9cdbbff revert tsgo, not ready for test coverage correctness yet
• 89c99ba use tsgo compiler
• b7275d5 update deps, expand engines to include node 18
• 942e360 update workflows, pull taprc out of package.json
• 4a0d53c update tap for mockImport bugfix
• ef94ad2 update tap
• 180c2d4 update docs
• 37993c8 remove stray console.error in test
• 03ae4c2 13.0.5
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.3.1 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

... (truncated)

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

Updates openai from 4.55.1 to 7.5.0

Release notes

Sourced from openai's releases.

v7.5.0

7.5.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#2364) (602d481)
• api: add WebSocket stream IDs (#2314) (156a8db)
• api: add workload identity access token issued event (#2307) (322a5b1)
• api: deprecate Sora video APIs (#2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
• audio: reject ffplay spawn errors (#2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
• await webhook verification in README examples (#2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
• azure: prevent deployment path traversal (#2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
• client: handle empty JSON response body without content-length (#1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
• embedding: response type for base64 encoding format (#1554) (ef69801)
• export AzureClientOptions (#1760) (511bf6d), closes #1735
• export workload identity helpers from openai/auth (#2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
• format: restore formatting for generated SDK files (#2089) (6d69d4b)
• harden runTools against inherited function names (#2333) (f4496d1)
• honor defaultHeaders null for helper method header (#1857) (8eab09a)
• include items for strict Zod v3 any arrays (#2357) (4c32089)
• isolate Vercel ecosystem tests per request (#2359) (2831290)
• keep streamed Responses output text linear and canonical (#2354) (6827a40)
• lint: recognize Castiron-generated headers (#2124) (cf6237f)
• lint: restore generated SDK lint rules (#2126) (6b8162c)
• parse empty chat content when present (#2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
• pass file batch helper options through (#1855) (05ce028)
• preserve File-like metadata in toFile (#1883) (ba1a781)

... (truncated)

Changelog

Sourced from openai's changelog.

7.5.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#2348) (4a199af)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (9a38e63)
• api: add new Daybreak and gpt-5.6-cyber model identifiers (#2278) (9a38e63)
• api: Add ServiceTier and ImageDetail types (#2364) (602d481)
• api: add WebSocket stream IDs (#2314) (156a8db)
• api: add workload identity access token issued event (#2307) (322a5b1)
• api: deprecate Sora video APIs (#2313) (4424b40)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#2332) (a3deafb)

Bug Fixes

• api: clarify audio upload metadata requirements (#2279) (34ecf3f)
• audio: prevent microphone leaks and playback pipe deadlocks (#2339) (1c692fe)
• audio: reject ffplay spawn errors (#2012) (6d42d4d)
• auth: reject redirects during workload identity token exchange (#2321) (240385e)
• auth: reject unsafe workload-identity token expirations (#2345) (1f0349d)
• avoid TypeError in toFile for Responses without a URL (#2311) (3313f54)
• await webhook verification in README examples (#2302) (0fe7ad0)
• azure: honor explicit browser denial for Entra token providers (#2328) (9d47510)
• azure: preserve model-to-deployment mapping for images.edit (#1918) (6c207c6)
• azure: prevent API-key disclosure across HTTP redirects (#2320) (f36c418)
• azure: prevent deployment path traversal (#2337) (a9d9d41)
• bedrock: safely sign inherited query parameter names (#2375) (3f8d5cc)
• chat: support custom tool calls in parser and ChatCompletionStream (#2023) (6fa9152)
• client: handle empty JSON response body without content-length (#1998) (b6447e9)
• configure Bash for pnpm scripts on Windows (#2330) (f5a0ad1)
• deps: remediate Dependabot and fixture vulnerabilities (#2282) (783da8f)
• embedding: response type for base64 encoding format (#1554) (ef69801)
• export AzureClientOptions (#1760) (511bf6d), closes #1735
• export workload identity helpers from openai/auth (#2344) (af8f14f)
• fail ecosystem CI when live credentials are missing (#2349) (a47dc75)
• format: restore formatting for generated SDK files (#2089) (6d69d4b)
• harden runTools against inherited function names (#2333) (f4496d1)
• honor defaultHeaders null for helper method header (#1857) (8eab09a)
• include items for strict Zod v3 any arrays (#2357) (4c32089)
• isolate Vercel ecosystem tests per request (#2359) (2831290)
• keep streamed Responses output text linear and canonical (#2354) (6827a40)
• lint: recognize Castiron-generated headers (#2124) (cf6237f)
• lint: restore generated SDK lint rules (#2126) (6b8162c)
• parse empty chat content when present (#2331) (53dd723)
• parser: recognize raw json_schema response format in auto-parsing checks (#2015) (fbd2541)
• pass file batch helper options through (#1855) (05ce028)
• preserve File-like metadata in toFile (#1883) (ba1a781)
• preserve skill upload paths without buffering native files (#2303) (30b9c41)

... (truncated)

Commits

• 5b96016 release: 7.5.0 (#2087)
• bfcccad fix(security): prevent Bedrock bearer credential disclosure across redirects ...
• 3f8d5cc fix(bedrock): safely sign inherited query parameter names (#2375)
• 16172a4 chore(deps-dev): bump oxfmt from 0.61.0 to 0.62.0 (#2373)
• 6320b64 chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 (#2374)
• b49b227 chore(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /ecosystem-tests/ts-...
• 2cc57c3 chore(deps-dev): bump @​aws-sdk/credential-provider-node from 3.972.77 to 3.97...
• 6983363 chore(deps-dev): bump @​cloudflare/workers-types from 5.20260804.1 to 5.202608...
• 50db5db chore(deps-dev): bump @​types/node from 24.12.4 to 26.2.0 (#2370)
• 7259f9f chore(deps-dev): bump html-webpack-plugin from 5.6.7 to 5.6.8 in /ecosystem-t...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openai since your current version.

Updates @changesets/cli from 2.29.6 to 3.0.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.1

Patch Changes

• #2239 fdfdc93 Thanks @​bluwy! - Update links in default generated .changeset/README.md file
• Updated dependencies [d0386b6]:
  • @​changesets/write@​1.0.1

@​changesets/cli@​3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

• #1652 a0b5326 Thanks @​bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

• #2186 3910adf Thanks @​Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

• #1879 c76b232 Thanks @​beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

  This means the CLI flows will have minor changes, but they are largely the same.

... (truncated)

Changelog

Sourced from @​changesets/cli's changelog.

3.0.1

Patch Changes

• #2239 fdfdc93 Thanks @​bluwy! - Update links in default generated .changeset/README.md file
• Updated dependencies [d0386b6]:
  • @​changesets/write@​1.0.1

3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

• #1652 a0b5326 Thanks @​bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

• #2186 3910adf Thanks @​Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

• #1879 c76b232 Thanks @​beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

... (truncated)

Commits

• bed4581 Version Packages (#2242)
• fdfdc93 Update default generated readme (#2239)
• d5f5ae8 Fix Windows PTY snapshot normalization (#2233)
• f442221 Version Packages (#2235)
• e3facad Version Packages (next) (#2228)
• c98af4c Do not bump ignored independent packages when exiting pre mode (#2092)
• 496ca21 Build(deps-dev): Bump the development-dependencies group with 6 updates (#2225)
• d1053ac Build(deps): Bump the production-dependencies group across 1 directory with 2...
• 68ea6ec Fix linked and fixed glob patterns expansion (#2222)
• c1b6f8c fix missing coloring of name (#2218)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​changesets/cli since your current version.

Updates @types/glob from 8.1.0 to 9.0.0

Commits

• See full diff in compare view

Updates @types/mustache from 4.2.5 to 4.2.6

Commits

• See full diff in compare view

Updates @types/node from 20.14.14 to 26.2.0

Commits

• See full diff in compare view

Updates jest from 29.7.0 to 30.4.2

Release notes

Sourced from jest's releases.

v30.4.2

Fixes

• [jest-runtime] Fix named imports from CJS modules whose module.exports is a function with own-property exports (#16150)

Full Changelog: jestjs/jest@v30.4.1...v30.4.2

v30.4.1

Features

• [jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#16141)

Fixes

• [jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#16143)

Full Changelog: jestjs/jest@v30.4.0...v30.4.1

v30.4.0

Big release! 😀

Main feature is a rewrite of our custom runtime in preparation for stabilisation of native support of ESM. As part of that work require(esm) module is now supported on Node 24.9+ (still requires --experimental-vm-modules like before).

In addition we now support fake timers for the recently released Description has been truncated