[dependabot]

Bumps the minor-and-patch group with 42 updates in the / directory:

Package	From	To
@contentauth/c2pa-node	0.9.7	0.9.11
@google-cloud/kms	6.2.0	6.3.0
@google-cloud/storage	8.2.0	8.4.0
@google/genai	2.23.0	2.32.0
@modelcontextprotocol/sdk	1.32.1	1.32.2
@opentelemetry/api-logs	0.222.0	0.223.0
@opentelemetry/exporter-logs-otlp-http	0.222.0	0.300.0
@opentelemetry/semantic-conventions	1.43.0	1.44.0
@slack/web-api	8.1.1	8.2.0
@workos-inc/widgets	1.18.0	1.20.2
axios	1.20.0	1.21.0
csv-parse	7.0.2	7.0.3
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.1
file-type	22.1.1	22.3.0
google-auth-library	11.1.0	11.3.2
isomorphic-dompurify	4.3.0	4.6.0
jose	6.2.12	6.2.14
linkedom	0.18.13	0.18.14
mammoth	1.12.3	1.13.0
marked	18.0.13	18.1.2
openai	7.20.0	7.45.1
pg	8.23.0	8.23.1
pino	10.3.1	10.4.0
pino-pretty	13.1.3	13.2.0
posthog-node	5.52.4	5.60.0
resend	6.28.1	6.35.0
svix	2.5.0	2.9.1
tldts	7.4.13	7.4.19
uuid	14.0.2	14.0.3
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2
@types/multer	2.2.0	2.3.0
@types/node	24.13.6	24.19.2
@types/ws	8.18.1	8.18.2
concurrently	10.0.5	10.0.6
jsdom	30.1.0	30.1.3
mint	4.2.909	4.2.1166
puppeteer	25.11.0	25.16.0
supertest	7.2.2	7.3.1
tsx	4.23.13	4.23.15
unist-util-visit-parents	6.0.2	6.1.0
vitest	5.0.1	5.0.5

Updates @contentauth/c2pa-node from 0.9.7 to 0.9.11

Changelog

Sourced from @​contentauth/c2pa-node's changelog.

0.9.11

Patch Changes

• f0ceda3: Update to c2pa-rs 0.91.7, including patched native TLS certificate verification and roots for the eMudhra incident. JavaScript HTTPS paths still require a patched Node.js runtime or browser independently of the Rust SDK.
• Updated dependencies [f0ceda3]
  • @​contentauth/c2pa-types@​0.7.7
  • @​contentauth/c2pa-utilities@​0.3.3

0.9.10

Patch Changes

• 29520c7: Update to c2pa-rs v0.91.3.
• Updated dependencies [29520c7]
  • @​contentauth/c2pa-utilities@​0.3.2
  • @​contentauth/c2pa-types@​0.7.6

0.9.9

Patch Changes

• e29811b: Add ability to modify assertions
• a0057f8: Update to Trustmark version 0.4.0.
• b862120: Bump Trustmark crate dependency to v0.3.0 for c2pa-node.

0.9.8

Patch Changes

• e454a78: Update to c2pa-rs v0.91.0.
• abe6b75: Support optional (empty) mime types for Readers. Prefer supplying the mime type explicitly whenever it's known — omitting it falls back to slower, less reliable byte-based format detection in the native library.
• f5141d9: Fix typings errors and avoid potential udnerflow
• Updated dependencies [e454a78]
  • @​contentauth/c2pa-utilities@​0.3.1
  • @​contentauth/c2pa-types@​0.7.5

Commits

• 23718c0 chore: version packages (#248)
• f0ceda3 chore: bump c2pa crate to 0.91.7 (#246)
• 7036c20 docs: version Node.js and web API documentation (#242)
• 20531aa chore: version packages (#241)
• edb68d8 chore: version packages (#232)
• a0057f8 fix: Switch to Trustmark v0.4.0 (#233)
• e29811b feat: Add assertion updates to Node and Web (#229)
• b862120 chore(c2pa-node): Bump Trustmark dependency to v0.3.0 (#231)
• 598bd8c chore: version packages (#226)
• e454a78 Bump c2pa-rs to 0.91.0 (#217)
• Additional commits viewable in compare view

Updates @google-cloud/kms from 6.2.0 to 6.3.0

Release notes

Sourced from @​google-cloud/kms's releases.

bigquery-storage: v6.3.0

6.3.0 (2026-10-14)

Features

• deps: Bump bigquery-storage-api to ^0.5.0 (#9595) (fca6160)

cloudbuild: v6.3.0

6.3.0 (2026-10-19)

Features

• Update API sources and regenerate (#9620) (c812bc3)

precise-date: v6.2.1

6.2.1 (2026-10-19)

Bug Fixes

• tools: Export test-utils types and exempt cloud-profiler on Bun (#9611) (ec74599)

projectify: v6.2.1

6.2.1 (2026-10-19)

Bug Fixes

• tools: Export test-utils types and exempt cloud-profiler on Bun (#9611) (ec74599)

promisify: v6.2.1

6.2.1 (2026-10-19)

Bug Fixes

• tools: Export test-utils types and exempt cloud-profiler on Bun (#9611) (ec74599)

Changelog

Sourced from @​google-cloud/kms's changelog.

6.3.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

6.2.1 (2026-09-28)

Bug Fixes

• Update package.json and .gitignore across packages (#9378) (9c54cec)

Commits

• See full diff in compare view

Updates @google-cloud/storage from 8.2.0 to 8.4.0

Release notes

Sourced from @​google-cloud/storage's releases.

storage: v8.4.0

8.4.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

dialogflow: v8.4.0

8.4.0 (2026-10-21)

Features

• Update API sources and regenerate (#9683) (b5aabd8)

gaxios: v8.3.2

8.3.2 (2026-10-23)

Bug Fixes

• gaxios: Narrow fetch types to call signature for @​types/bun (#9699) (2a34528)

gaxios: v8.3.1

8.3.1 (2026-10-14)

Bug Fixes

• gaxios: Exclude compiled tests and .tsbuildinfo from published tarball (#9612) (7394a38)
• gaxios: Normalize TimeoutError in _request and propagate retry timeout (#9582) (1b10df0)
• gaxios: Remove --abort-signal-timeout-shim (#9555) (29d8a5e)
• gaxios: Remove --bun-plugin-shim and support Bun fetch natively (#9561) (93b426d)

common: v8.2.2

8.2.2 (2026-10-23)

Bug Fixes

• common: Preserve {{projectId}} token during URI path encoding (#9668) (14b0cc6)

cloud-profiler: v8.2.1

8.2.1 (2026-10-09)

Bug Fixes

• Use npm in prepare/compile lifecycle scripts (#9587) (64c3a2b)

... (truncated)

Changelog

Sourced from @​google-cloud/storage's changelog.

8.4.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

8.3.0 (2026-10-07)

Features

• tools: Add individual CLI flags for Bun monkey patches (#9533) (a5eec89)

8.2.1 (2026-10-06)

Bug Fixes

• storage: Re-enable docs check and update linkinator (#9257) (6f9d967)
• storage: Upgrade google-auth-library to v11, gaxios to v7 and align auth client types (#9289) (c6c946d)

Commits

• 27d6be6 chore(main): release storage 8.4.0 (#9576)
• 5250db6 chore(main): release storage 8.3.0 (#9552)
• a5eec89 feat(tools): add individual CLI flags for Bun monkey patches (#9533)
• c0239c8 chore(main): release storage 8.2.1 (#9527)
• c6c946d fix(storage): upgrade google-auth-library to v11, gaxios to v7 and align auth...
• 6f9d967 fix(storage): re-enable docs check and update linkinator (#9257)
• f11413c test(storage): adopt run-test runner and fix Bun shim caching and mocking for...
• fd32884 chore(main): release storage 8.2.0 (#9297)
• b880f66 refactor(storage): dynamically import mime and p-limit with module caching (#...
• 3ff5ae9 chore: update .nycrc, Contributing.md, and .gitignore across packages (#9144)
• Additional commits viewable in compare view

Updates @google/genai from 2.23.0 to 2.32.0

Release notes

Sourced from @​google/genai's releases.

v2.32.0

2.32.0 (2026-10-29)

Features

• Add support for continuation_token and requires_continuation status (c7b2fd2)
• add video upscale task parameter (54b9b19)
• interactions: add automatic_continuation to interactions.create in the TypeScript SDK (99f1892)
• interactions: declare continuation_ids on Interaction (9cf3280)
• support video understanding in Gemini Developer API (7c82322)

Bug Fixes

• interactions: align SDK User-Agent and x-goog-api-client headers (dda511e)

v2.31.0

2.31.0 (2026-10-22)

Features

• Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (0b52aa5)
• add base_voice to PromptedVoice in GAOS SDK (d62820b)
• Add generation_output_config to GenerateContentConfig (e82a75a)
• Add Live API in-session context updates (send_context_update) and types across GenAI SDKs. (177ee68)
• include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (aeaed4e)
• sdks: enable fixes.openSingleValueEnumsOct2026 across all SDKs (0059474)
• update discovery doc (40d6e98)

Bug Fixes

• genai: raise mid-stream SSE errors and dropped connections consistently across SDKs; add continuation conformance tests (38f6ebc)
• interactions: sync InteractionSseEventInteractionStatus enum with InteractionStatus (be6aa9f)
• triggers: fix agent triggers OpenAPI overlays, numeric fields, and SDK patches (0e9031d)

v2.30.0

2.30.0 (2026-10-14)

Features

• interactions: add gemini-4-argon to Model enum (8a3c307)

Bug Fixes

• clear continuation state and preserve prompt feedback when continuation hop returns no candidates (e63d1f1)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

2.32.0 (2026-10-29)

Features

• Add support for continuation_token and requires_continuation status (c7b2fd2)
• add video upscale task parameter (54b9b19)
• interactions: add automatic_continuation to interactions.create in the TypeScript SDK (99f1892)
• interactions: declare continuation_ids on Interaction (9cf3280)
• support video understanding in Gemini Developer API (7c82322)

Bug Fixes

• interactions: align SDK User-Agent and x-goog-api-client headers (dda511e)

2.31.0 (2026-10-22)

Features

• Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (0b52aa5)
• add base_voice to PromptedVoice in GAOS SDK (d62820b)
• Add generation_output_config to GenerateContentConfig (e82a75a)
• Add Live API in-session context updates (send_context_update) and types across GenAI SDKs. (177ee68)
• include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (aeaed4e)
• sdks: enable fixes.openSingleValueEnumsOct2026 across all SDKs (0059474)
• update discovery doc (40d6e98)

Bug Fixes

• genai: raise mid-stream SSE errors and dropped connections consistently across SDKs; add continuation conformance tests (38f6ebc)
• interactions: sync InteractionSseEventInteractionStatus enum with InteractionStatus (be6aa9f)
• triggers: fix agent triggers OpenAPI overlays, numeric fields, and SDK patches (0e9031d)

2.30.0 (2026-10-14)

Features

• interactions: add gemini-4-argon to Model enum (8a3c307)

Bug Fixes

• clear continuation state and preserve prompt feedback when continuation hop returns no candidates (e63d1f1)
• fix the grounding metadata merging for automatic continuation in generate content and generate content stream (6bfba87)
• make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (6bdc0d9)
• type GeminiNextGen signatures with public, importable names (ad3fb89)

... (truncated)

Commits

• 70501db chore(main): release 2.32.0 (#2099)
• 54b9b19 feat: add video upscale task parameter
• 99f1892 feat(interactions): add automatic_continuation to interactions.create in the ...
• dda511e fix(interactions): align SDK User-Agent and x-goog-api-client headers
• 7c82322 feat: support video understanding in Gemini Developer API
• 9cf3280 feat(interactions): declare continuation_ids on Interaction
• 00cfd86 chore(cli): update Speakeasy OpenAPI generator to v2.952.4
• c7b2fd2 feat: Add support for continuation_token and requires_continuation status
• fc5ad30 chore(genai): pass platform WebSocketFactory to GeminiNextGenInteractions
• 0dd787c chore: update Speakeasy OpenAPI generator to v2.950.11 and bump CLI to v0.4.4
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.32.1 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @​kishormorol in modelcontextprotocol/typescript-sdk#2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in modelcontextprotocol/typescript-sdk#2958
• chore: bump version to 1.32.2 by @​claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

• @​kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Commits

• 3b73021 chore: bump version to 1.32.2 (#3089)
• fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
• 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
• See full diff in compare view

Updates @opentelemetry/api-logs from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/api-logs's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

• refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @opentelemetry/exporter-logs-otlp-http from 0.222.0 to 0.300.0

Release notes

Sourced from @​opentelemetry/exporter-logs-otlp-http's releases.

experimental/v0.300.0

0.300.0

Summary

• The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.
• The public interface has changed
  • for notes on migrating to 3.x / 0.300.x see the upgrade guide
• Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

• chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package
  • In the OpenTelemetry Specification v1.58.0 the OpenCensus compatibility requirements were deprecated. The JavaScript OpenCensus shim package will not receive any more releases after the current 0.222.0 release (source code for last release).
• feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081
  • The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.
• feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing
  • NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.
  • NodeSDKConfiguration.metricReader — use metricReaders instead.
  • NodeSDKConfiguration.spanProcessor — use spanProcessors instead.
  • export * as node from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-node instead.
  • export * as tracing from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-base instead.
• feat(sdk-logs)!: remove deprecated SdkLogRecord type alias and LoggerProviderConfig type alias #7062
  • SdkLogRecord — use ReadWriteLogRecord instead.
  • LoggerProviderConfig — use LoggerProviderOptions instead.
• feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #6293 @​overbalance
  • Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.
  • Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/sdk-logs/build/src/... or @opentelemetry/sdk-logs/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.
  • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.
  • <package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.
  • The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).
  • Packages that ship separate Node.js and browser implementations export them under explicit subpaths, for example @opentelemetry/sdk-logs/platform. If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.
• feat(sdk-node)!: remove "jaeger" propagator from @opentelemetry/sdk-node #7077
  • OTEL_PROPAGATORS=jaeger and { jaeger: null } in the configuration object are no longer recognised. Replace with "tracecontext".
  • See the 3.x migration guide for full instructions.
• fix(opentelemetry-exporter-prometheus)!: default exporter host to localhost #6599 @​cjihrig
• chore!: bump minimum node.js version to >=22.15.0
• feat(api-logs)!: move the Logs API to @opentelemetry/api and remove the standalone @opentelemetry/api-logs package #4862 @​hectorhdzg
• fix(exporter-prometheus)!: stop reading Prometheus exporter host and port environment variables in the exporter constructor #6966 @​LarryHu0217
• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().
• feat(sdk-node)!: drop SDK package re-exports (api, contextBase, core, logs, metrics, resources) #7111 @​pichlermarc
  • api / contextBase → import from @opentelemetry/api
  • core → import from @opentelemetry/core
  • logs → import from @opentelemetry/sdk-logs
  • metrics → import from @opentelemetry/sdk-metrics
  • resources → import from @opentelemetry/resources
• feat(sdk-logs): mark @opentelemetry/sdk-logs as stable #7143 @​trentm
  • See the stable CHANGELOG for future changes to the sdk-logs package.

... (truncated)

Commits

• 12a5817 chore: prepare next release (#7213)
• 2a97587 docs: 3.x migration doc edits (#7216)
• ebefa76 chore(deps): update dependency eslint to v10.13.0 (#7129)
• 83b6922 chore(deps): update dependency superagent to v10.4.1 (#7184)
• 68e9e6e fix(otlp-exporter-base): pick fetch mode from the document origin, not locati...
• 7d2455e build: lint for unused dependencies with knip (#7200)
• 5e65e0e fix(core): no longer drop an attribute value that is an object that has `un...
• 2fbb404 chore(deps): dedupe nx to 23.3.0 (#7205)
• c971f52 docs(changelog): trim unreleased entries (#7203)
• 2516215 feat(instrumentation)!: make InstrumentationBase#_enabled protected on both p...
• Additional commits viewable in compare view

Updates @opentelemetry/semantic-conventions from 1.43.0 to 1.44.0

Release notes

Sourced from @​opentelemetry/semantic-conventions's releases.

semconv/v1.44.0

1.44.0

🚀 Features

• feat: update semantic conventions to v1.44.0 #7239
  • Semantic Conventions v1.44.0: changelog | latest docs
  • @opentelemetry/semantic-conventions (stable) changes: none
  • @opentelemetry/semantic-conventions/incubating (unstable) changes: 3 newly deprecated exports, 33 added exports

Unstable changes in v1.44.0

METRIC_CONTAINER_MEMORY_PAGING_FAULTS // container.memory.paging.faults: Replaced by `container.paging.faults`.
METRIC_K8S_NODE_MEMORY_PAGING_FAULTS  // k8s.node.memory.paging.faults: Replaced by `k8s.node.paging.faults`.
METRIC_K8S_POD_MEMORY_PAGING_FAULTS   // k8s.pod.memory.paging.faults: Replaced by `k8s.pod.paging.faults`.

ATTR_BROWSER_WEB_VITAL_DELTA                               // browser.web_vital.delta
ATTR_BROWSER_WEB_VITAL_ID                                  // browser.web_vital.id
ATTR_BROWSER_WEB_VITAL_NAME                                // browser.web_vital.name
  BROWSER_WEB_VITAL_NAME_VALUE_CLS                           // "cls"
  BROWSER_WEB_VITAL_NAME_VALUE_FCP                           // "fcp"
  BROWSER_WEB_VITAL_NAME_VALUE_FID                           // "fid"
  BROWSER_WEB_VITAL_NAME_VALUE_INP                           // "inp"
  BROWSER_WEB_VITAL_NAME_VALUE_LCP                           // "lcp"
  BROWSER_WEB_VITAL_NAME_VALUE_TTFB                          // "ttfb"
ATTR_BROWSER_WEB_VITAL_NAVIGATION_TYPE                     // browser.web_vital.navigation_type
  BROWSER_WEB_VITAL_NAVIGATION_TYPE_VALUE_BACK_FORWARD       // "back-forward"
  BROWSER_WEB_VITAL_NAVIGATION_TYPE_VALUE_BACK_FORWARD_CACHE // "back-forward-cache"
  BROWSER_WEB_VITAL_NAVIGATION_TYPE_VALUE_NAVIGATE           // "navigate"
  BROWSER_WEB_VITAL_NAVIGATION_TYPE_VALUE_PRERENDER          // "prerender"
  BROWSER_WEB_VITAL_NAVIGATION_TYPE_VALUE_RELOAD             // "reload"
  BROWSER_WEB_VITAL_NAVIGATION_TYPE_VALUE_RESTORE            // "restore"
ATTR_BROWSER_WEB_VITAL_RATING                              // browser.web_vital.rating
  BROWSER_WEB_VITAL_RATING_VALUE_GOOD                        // "good"
  BROWSER_WEB_VITAL_RATING_VALUE_NEEDS_IMPROVEMENT           // "needs-improvement"
  BROWSER_WEB_VITAL_RATING_VALUE_POOR                        // "poor"
ATTR_BROWSER_WEB_VITAL_VALUE                               // browser.web_vital.value
ATTR_MESSAGING_KAFKA_CLUSTER_ID                            // messaging.kafka.cluster.id
</tr></table>

... (truncated)

Commits

• 70253d9 chore: prepare next release (#7246)
• 4c7796c chore(deps): update all patch versions (#7128)
• f2a26a8 chore(deps): update dependency @​bufbuild/buf to v1.75.0 (#7215)
• 0f27cf1 fix(deps): update dependency body-parser to v2.4.0 [security] (#7240)
• d49d4d0 feat(semantic-conventions): update semantic conventions to v1.44.0 (#7239)
• e3ea181 docs: note that CJS apps can need the ESM hook when a dependency is ESM (#7212)
• d7d2d1b chore(deps): update actions/create-github-app-token action to v3.3.0 (#7214)
• cd1e328 chore(deps): update dependency eslint-plugin-n to v18.5.0 (#7233)
• 85ac9d3 chore(deps): update dependency knip to v6.43.0 (#7234)
• 55f3df3 ci: update W3C harness for Python 3.14 (#7236)
• Additional commits viewable in compare view

Updates @slack/web-api from 8.1.1 to 8.2.0

Release notes

Sourced from @​slack/web-api's releases.

@​slack/web-api@​8.2.0

Minor Changes

• c523063: feat: add the agents.conversations.* methods for Slack Code (create, archive, setProperties, setView, setCommands, listViews, removeView, getCanvas, setCanvasContent).

Patch Changes

• Updated dependencies [ca6f416]
• Updated dependencies [abf184e]
• Updated dependencies [d420d00]
• Updated dependencies [52eeb05]
  • @​slack/types@​3.2.0

Commits

• a98047a chore: release (#2726)
• c523063 feat(web-api): add agents.conversations.* methods (#2748)
• e22facd fix(socket-mode): route ping/pong diagnostics by identity, not instanceof (#2...
• 4dfe5eb chore(deps-dev): bump @​biomejs/biome from 2.5.13 to 2.5.14 (#2750)
• 6d9bad8 chore(deps-dev): bump typedoc-plugin-markdown from 4.13.0 to 4.13.1 (#2749)
• 334e6a6 feat(socket-mode): support undici v8 as a peer dependency (#2694)
• 7d415e4 chore(deps-dev): bump @​changesets/cli from 3.0.2 to 3.0.3 (#2746)
• 600fca5 chore(deps-dev): bump @​biomejs/biome from 2.5.12 to 2.5.13 (#2745)
• f4c3e7e chore(deps-dev): bump tsx from 4.23.12 to 4.23.13 (#2741)
• d420d00 feat(types): allow raw_number cells in TableBlock rows (#2737)
• Additional commits viewable in compare view

Updates @workos-inc/widgets from 1.18.0 to 1.20.2

Commits

• See full diff in compare view

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

• Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

• Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
• UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

• Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (