Skip to content

build(deps): bump the production-dependencies group across 1 directory with 8 updates - #30

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-99e3463a7e
Closed

build(deps): bump the production-dependencies group across 1 directory with 8 updates#30
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-99e3463a7e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
@anthropic-ai/sdk 0.110.0 0.123.0
inngest 4.12.1 4.18.1
next 16.2.10 16.3.4
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
zod 4.4.3 4.5.4
cron-parser 5.6.1 5.10.0
fast-xml-parser 5.10.0 5.11.1

Updates @anthropic-ai/sdk from 0.110.0 to 0.123.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.123.0

0.123.0 (2026-09-01)

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

  • api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
  • api: manual updates (c6f0bda)
  • api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

  • keep credential file access out of non-Node bundles (ab6a4b2)

Chores

  • internal: codegen related update (788ea8b)

Documentation

  • changelog: detail the beta files/skills GA-shape change (#1175) (4951de0)

sdk: v0.122.0

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

  • api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

Bug Fixes

  • client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
  • client: use configured logger for SSE parse errors (80eeaf7)
  • sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
  • tools: let read return a view_range of a file over the size cap (#427) (56b3260)
  • uploads: default bare Blob filename on skills endpoints (#422) (e111649)
  • webhooks: require headers to be passed to unwrap() (3230804)

Chores

  • internal: codegen related update (c2f327a)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.123.0 (2026-09-01)

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

  • api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
  • api: manual updates (c6f0bda)
  • api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

  • keep credential file access out of non-Node bundles (ab6a4b2)

Chores

  • internal: codegen related update (788ea8b)

Documentation

  • changelog: detail the beta files/skills GA-shape change (#1175) (4951de0)

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

  • api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

    The beta Files and Skills namespaces (client.beta.files, client.beta.skills) no longer send the files-api-2025-04-14 / skills-2025-10-02 headers and return the same shapes as client.files / client.skills (with Beta-prefixed type names). Requests that still send those headers on raw HTTP keep receiving the beta shapes.

    Changes in the beta namespaces:

    • client.beta.skills.delete() now deletes a Skill together with all of its versions (previously refused while any version existed). It returns BetaDeletedSkill (was SkillDeleteResponse).
    • Beta Messages type BetaSkill (the {type, skill_id, version} entry in BetaContainer.skills) is renamed BetaContainerSkill; the request-side BetaSkillParams keeps its name. BetaSkill now names the Skill object returned by client.beta.skills.create() / retrieve() / list() (replacing SkillCreateResponse / SkillRetrieveResponse / SkillListResponse), and skill versions are BetaSkillVersion / BetaDeletedSkillVersion (replacing Version*Response).
    • client.beta.files.list() returns a BetaFileMetadataPageCursor (PageCursor<BetaFileMetadata> with data / next_page) and FileListParams paginates with page / ids (was BetaFileMetadataPage, a Page<BetaFileMetadata> with data, has_more, first_id, last_id and before_id / after_id); for await auto-pagination is unchanged. BetaSkill uses display_name (was display_title, also in SkillCreateParams) and latest_version_id (was latest_version), and BetaSkillVersion is addressed by its skver_… id (the Unix-timestamp version field is gone).

    Migration guides: Migrate from files-api-2025-04-14 · Migrate from skills-2025-10-02

Bug Fixes

  • client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
  • client: use configured logger for SSE parse errors (80eeaf7)
  • sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
  • tools: let read return a view_range of a file over the size cap (#427) (56b3260)
  • uploads: default bare Blob filename on skills endpoints (#422) (e111649)

... (truncated)

Commits
  • 4140e0e chore: release main (#1172)
  • 4951de0 docs(changelog): detail the beta files/skills GA-shape change (#1175)
  • 7f3898c chore: release main
  • 956ccb5 docs(api): clarify pagination on the organization rate-limit list endpoints
  • 2131d80 fix(tools): let read return a view_range of a file over the size cap (#427)
  • f830c8f fix(aws,bedrock): prefer env credentials over AWS_PROFILE (#436)
  • 4d50ddf test(ecosystem): expect cross-realm timeout errors to classify correctly
  • acdd669 fix(client): classify cross-realm DOMException abort/timeout errors correctly
  • 0a14622 test(tools): pin that read, edit and the memory tool preserve CRLF and CR lin...
  • 17035de docs: document TypeScript 5.0 as the minimum supported version
  • Additional commits viewable in compare view

Updates inngest from 4.12.1 to 4.18.1

Release notes

Sourced from inngest's releases.

inngest@4.18.1

Patch Changes

  • #1686 ca7dff0e Thanks @​jakobevangelista! - Allow sandbox names up to 255 characters, including uppercase ULIDs and human-readable names.

  • #1704 e72b89c7 Thanks @​jacobheric! - Prevent AI metadata tracking from retaining executions after an SDK request ends, including when OpenTelemetry excludes the root span from sampling.

  • #1698 282106a5 Thanks @​Linell! - Fix function-level middleware silently skipped on adapters whose url() drops the query string (AWS Lambda, Redwood, DigitalOcean): resolve fnId the same way execution does

inngest@4.18.0

Minor Changes

Patch Changes

inngest@4.16.0

Minor Changes

Patch Changes

  • #1674 6b0ae370 Thanks @​Linell! - Fix TS2742 errors in projects that use declaration or composite true by exporting SendSignalResponse appropriately.

  • #1658 edcb6536 Thanks @​amh4r! - Fix wrapStep middleware hook sometimes skipped for parallel steps

inngest@4.15.0

Minor Changes

  • #1667 961d2807 Thanks @​jakobevangelista! - Allow sandbox Create to configure environment variables inherited by commands and managed processes.

  • #1654 23ddbc2e Thanks @​jakobevangelista! - Add experimental sandbox APIs, including the direct inngest.sandboxes client and the opt-in durable step.sandbox surface enabled by sandboxMiddleware().

Patch Changes

  • #1663 0bec14ee Thanks @​mar-inngest! - Prevent Connect lease renewals from using a draining or replaced connection.

  • #1665 3f25b191 Thanks @​Linell! - Sub-second durations no longer get dropped. step.sleep("id", 500) used to resolve immediately; it now rounds up and sleeps a full second, the minimum resolution of a durable wait. The same rounding applies to waitForEvent, invoke, waitForSignal, and cancelOn timeouts.

inngest@4.14.0

Minor Changes

Patch Changes

... (truncated)

Changelog

Sourced from inngest's changelog.

4.18.1

Patch Changes

  • #1686 ca7dff0e Thanks @​jakobevangelista! - Allow sandbox names up to 255 characters, including uppercase ULIDs and human-readable names.

  • #1704 e72b89c7 Thanks @​jacobheric! - Prevent AI metadata tracking from retaining executions after an SDK request ends, including when OpenTelemetry excludes the root span from sampling.

  • #1698 282106a5 Thanks @​Linell! - Fix function-level middleware silently skipped on adapters whose url() drops the query string (AWS Lambda, Redwood, DigitalOcean): resolve fnId the same way execution does

4.18.0

Minor Changes

Patch Changes

4.17.0

Minor Changes

4.16.0

Minor Changes

Patch Changes

  • #1674 6b0ae370 Thanks @​Linell! - Fix TS2742 errors in projects that use declaration or composite true by exporting SendSignalResponse appropriately.

  • #1658 edcb6536 Thanks @​amh4r! - Fix wrapStep middleware hook sometimes skipped for parallel steps

4.15.0

Minor Changes

  • #1667 961d2807 Thanks @​jakobevangelista! - Allow sandbox Create to configure environment variables inherited by commands and managed processes.

  • #1654 23ddbc2e Thanks @​jakobevangelista! - Add experimental sandbox APIs, including the direct inngest.sandboxes client and the opt-in durable step.sandbox surface enabled by sandboxMiddleware().

... (truncated)

Commits

Updates next from 16.2.10 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

... (truncated)

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
  • e3a695b docs(v4): record the email regex and container output-shape findings under Open
  • 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
  • 87d6464 fix(docs): drop the OG description when the title wraps past two lines
  • e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
  • 9a193aa 4.5.2
  • Additional commits viewable in compare view

Updates cron-parser from 5.6.1 to 5.10.0

Release notes

Sourced from cron-parser's releases.

v5.10.0

What's Changed

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0

What's Changed

New Contributors

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1

What's Changed

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0

What's Changed

Full Changelog: harrisiirak/cron-parser@v5.7.0...v5.8.0

v5.7.0

What's Changed

  • fix: enforce iteration loop limit so unsatisfiable expressions throw instead of returning a bogus date by @​spokodev in harrisiirak/cron-parser#415
  • fix: do not drop a matching day of month when the day of week uses an nth (#) occurrence by @​spokodev in Description has been truncated

@dependabot
build(deps): bump the production-dependencies group across 1 director…
28e5e6b 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.110.0` | `0.123.0` |
| [inngest](https://github.com/inngest/inngest-js/tree/HEAD/packages/inngest) | `4.12.1` | `4.18.1` |
| [next](https://github.com/vercel/next.js) | `16.2.10` | `16.3.4` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [cron-parser](https://github.com/harrisiirak/cron-parser) | `5.6.1` | `5.10.0` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.10.0` | `5.11.1` |



Updates `@anthropic-ai/sdk` from 0.110.0 to 0.123.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.110.0...sdk-v0.123.0)

Updates `inngest` from 4.12.1 to 4.18.1
- [Release notes](https://github.com/inngest/inngest-js/releases)
- [Changelog](https://github.com/inngest/inngest-js/blob/main/packages/inngest/CHANGELOG.md)
- [Commits](https://github.com/inngest/inngest-js/commits/inngest@4.18.1/packages/inngest)

Updates `next` from 16.2.10 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.10...v16.3.4)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `cron-parser` from 5.6.1 to 5.10.0
- [Release notes](https://github.com/harrisiirak/cron-parser/releases)
- [Changelog](https://github.com/harrisiirak/cron-parser/blob/master/CHANGELOG.md)
- [Commits](harrisiirak/cron-parser@v5.6.1...v5.10.0)

Updates `fast-xml-parser` from 5.10.0 to 5.11.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.10.0...v5.11.1)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.123.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: inngest
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: cron-parser
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fast-xml-parser
  dependency-version: 5.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 26, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-99e3463a7e branch September 26, 2026 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants