Skip to content

chore(deps): bump the production group across 1 directory with 16 updates - #44

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-8bc81f3156
Closed

chore(deps): bump the production group across 1 directory with 16 updates#44
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-8bc81f3156

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production group with 16 updates in the / directory:

Package From To
@modelcontextprotocol/server 2.0.0 2.3.1
@tanstack/react-router 1.170.32 1.170.41
@tanstack/react-start 1.168.49 1.168.60
cn 0.2.5 0.4.0
lucide-react 1.41.0 1.54.0
radix-ui 1.6.7 1.7.0
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
@ff-labs/fff-bun 0.10.6 0.11.0
@huggingface/transformers 4.2.0 4.3.1
@oxlint/plugins 1.81.0 1.87.0
@types/bun 1.4.0 1.4.2
@types/node 26.4.1 26.6.4
oxfmt 0.66.0 0.72.0
oxlint 1.81.0 1.87.0
zod 4.5.4 4.6.5

Updates @modelcontextprotocol/server from 2.0.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

  • #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

  • Updated dependencies []:

    • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

  • Updated dependencies []:
    • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • Updated dependencies [633dd3e]:

    • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

  • #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

  • #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

  • #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

    What keeps working without a change:

    • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
    • A handler that builds a new server and a new stateless transport for each request.
    • One server and one transport per session (a transport with a sessionIdGenerator).
    • Connecting a server again after close().
    • Client.

    What fails now, how it shows, and what to change:

    • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
    • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
    • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
    • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

    What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

    The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

  • #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits
  • fcef852 Version Packages (#2953)
  • e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
  • 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
  • 3ab61c6 docs: update the README banners (#2940)
  • 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
  • 33fecfb test(e2e): cover tools/call without arguments (#2933)
  • 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
  • a202a36 Version Packages (#2896)
  • 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
  • b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
  • Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.32 to 1.170.41

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.41

Patch Changes

  • #8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

  • #8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

  • #8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

  • #8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

  • Updated dependencies [d521abd]:

    • @​tanstack/router-core@​1.171.34

@​tanstack/react-router@​1.170.40

Patch Changes

  • #8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

  • Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

    • @​tanstack/router-core@​1.171.33

@​tanstack/react-router@​1.170.39

Patch Changes

  • #8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.41

Patch Changes

  • #8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

  • #8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

  • #8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

  • #8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

  • Updated dependencies [d521abd]:

    • @​tanstack/router-core@​1.171.34

1.170.40

Patch Changes

  • #8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

  • Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

    • @​tanstack/router-core@​1.171.33

1.170.39

Patch Changes

  • #8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

1.170.38

Patch Changes

1.170.37

Patch Changes

  • #8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

  • #8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

  • #8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

    Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

    Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

... (truncated)

Commits
  • 57e126e ci: Version Packages (#8531)
  • 614bc27 chore(deps): update TanStack Store to 0.11.2 (#8568)
  • 60b8ad1 perf(react-router): omit inactive route wrapper components (#8529)
  • 863c8a7 perf(react-router): reuse link selector results (#8522)
  • ff66a03 perf(react-router): consolidate root match provider (CodSpeed experiment) (#8...
  • f0e751d ci: Version Packages (#8497)
  • 763ac8b test(react-router): regression for #2072 router context invalidation (#8499)
  • f5ffd38 perf(router): skip unused link preload cleanup across adapters (#8436)
  • ddad69a ci: Version Packages (#8486)
  • 73bfc15 perf(react-router): avoid redundant link hydration updates (#8435)
  • Additional commits viewable in compare view

Updates @tanstack/react-start from 1.168.49 to 1.168.60

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.168.60

Patch Changes

@​tanstack/react-start@​1.168.59

Patch Changes

  • Updated dependencies [f5ffd38, 488d046, e81845f, 76a7c0b]:
    • @​tanstack/react-router@​1.170.40
    • @​tanstack/start-client-core@​1.170.33
    • @​tanstack/start-server-core@​1.169.38
    • @​tanstack/start-plugin-core@​1.171.48
    • @​tanstack/react-start-client@​1.168.38
    • @​tanstack/react-start-rsc@​0.1.58
    • @​tanstack/react-start-server@​1.167.45

@​tanstack/react-start@​1.168.58

Patch Changes

  • Updated dependencies [73bfc15]:
    • @​tanstack/react-router@​1.170.39
    • @​tanstack/react-start-client@​1.168.37
    • @​tanstack/react-start-rsc@​0.1.57
    • @​tanstack/react-start-server@​1.167.44

@​tanstack/react-start@​1.168.57

Patch Changes

  • Updated dependencies [222300b]:
    • @​tanstack/start-plugin-core@​1.171.47
    • @​tanstack/react-start-rsc@​0.1.56
Changelog

Sourced from @​tanstack/react-start's changelog.

1.168.60

Patch Changes

1.168.59

Patch Changes

  • Updated dependencies [f5ffd38, 488d046, e81845f, 76a7c0b]:
    • @​tanstack/react-router@​1.170.40
    • @​tanstack/start-client-core@​1.170.33
    • @​tanstack/start-server-core@​1.169.38
    • @​tanstack/start-plugin-core@​1.171.48
    • @​tanstack/react-start-client@​1.168.38
    • @​tanstack/react-start-rsc@​0.1.58
    • @​tanstack/react-start-server@​1.167.45

1.168.58

Patch Changes

  • Updated dependencies [73bfc15]:
    • @​tanstack/react-router@​1.170.39
    • @​tanstack/react-start-client@​1.168.37
    • @​tanstack/react-start-rsc@​0.1.57
    • @​tanstack/react-start-server@​1.167.44

1.168.57

Patch Changes

  • Updated dependencies [222300b]:
    • @​tanstack/start-plugin-core@​1.171.47
    • @​tanstack/react-start-rsc@​0.1.56

1.168.56

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-router@​1.170.38

... (truncated)

Commits

Updates cn from 0.2.5 to 0.4.0

Release notes

Sourced from cn's releases.

cn@0.4.0

Minor Changes

  • #153 2691a38 Thanks @​shadcn! - cn build and the plugins now register the theme scales declared in your Tailwind CSS.

cn@0.3.3

Patch Changes

  • #152 00daa7e Thanks @​shadcn! - Calls with an interpolated argument, such as cn(base, "translate-x-[" + x + "px]"), no longer thrash the argument cache. 2,213 → 80 ns per call on that shape; stable arguments are unchanged.

  • #150 6f5ccfa Thanks @​shadcn! - cn build -o *.ts output now typechecks under noUncheckedIndexedAccess and the rest of the @tsconfig/strictest flags. The .mjs output is unchanged.

cn@0.3.2

Patch Changes

  • #147 e703bfe Thanks @​shadcn! - Custom animate-* classes are no longer merged, matching tailwind-merge. Only the default theme animations (spin, ping, pulse, bounce), animate-none, and arbitrary values share the animate group, so plugin classes such as animate-in, animate-once, and animate-duration-500 are never dropped.

cn@0.3.1

Patch Changes

  • #144 19a9a66 Thanks @​shadcn! - Axis utilities now override the logical sides they cover, matching tailwind-merge 3.7.0. px-2 replaces ps-* and pe-*, py-2 replaces pbs-* and pbe-*, and the same applies to mx/my, inset-x/inset-y, border-x/border-y widths and colors, and scroll-mx/scroll-my/scroll-px/scroll-py.

cn@0.3.0

Minor Changes

  • #137 9a9c9b5 Thanks @​shadcn! - Add cn/build, the library behind cn build. The CLI now parses arguments and prints; scanning, subsetting, compiling, and writing run in build(options) so build scripts and bundler plugins can call it directly.

  • #139 829b6e1 Thanks @​shadcn! - Add cn/vite and cn/next.

cn@0.2.6

Patch Changes

  • #74 947e624 Thanks @​shadcn! - Fix merging for custom animations, containment, legacy gradients, and missing Tailwind v4 utilities.
Changelog

Sourced from cn's changelog.

0.4.0

Minor Changes

  • #153 2691a38 Thanks @​shadcn! - cn build and the plugins now register the theme scales declared in your Tailwind CSS.

0.3.3

Patch Changes

  • #152 00daa7e Thanks @​shadcn! - Calls with an interpolated argument, such as cn(base, "translate-x-[" + x + "px]"), no longer thrash the argument cache. 2,213 → 80 ns per call on that shape; stable arguments are unchanged.

  • #150 6f5ccfa Thanks @​shadcn! - cn build -o *.ts output now typechecks under noUncheckedIndexedAccess and the rest of the @tsconfig/strictest flags. The .mjs output is unchanged.

0.3.2

Patch Changes

  • #147 e703bfe Thanks @​shadcn! - Custom animate-* classes are no longer merged, matching tailwind-merge. Only the default theme animations (spin, ping, pulse, bounce), animate-none, and arbitrary values share the animate group, so plugin classes such as animate-in, animate-once, and animate-duration-500 are never dropped.

0.3.1

Patch Changes

  • #144 19a9a66 Thanks @​shadcn! - Axis utilities now override the logical sides they cover, matching tailwind-merge 3.7.0. px-2 replaces ps-* and pe-*, py-2 replaces pbs-* and pbe-*, and the same applies to mx/my, inset-x/inset-y, border-x/border-y widths and colors, and scroll-mx/scroll-my/scroll-px/scroll-py.

0.3.0

Minor Changes

  • #137 9a9c9b5 Thanks @​shadcn! - Add cn/build, the library behind cn build. The CLI now parses arguments and prints; scanning, subsetting, compiling, and writing run in build(options) so build scripts and bundler plugins can call it directly.

  • #139 829b6e1 Thanks @​shadcn! - Add cn/vite and cn/next.

0.2.6

Patch Changes

  • #74 947e624 Thanks @​shadcn! - Fix merging for custom animations, containment, legacy gradients, and missing Tailwind v4 utilities.
Commits
  • 84db832 chore(release): version packages (#154)
  • 2691a38 feat(build): register theme scales from the Tailwind CSS entry (#153)
  • acfba70 chore(release): version packages (#151)
  • 00daa7e fix(engine): stop the arg cache thrashing on interpolated arguments (#152)
  • 6f5ccfa fix(build): typecheck .ts output under noUncheckedIndexedAccess (#150)
  • 210353b chore(release): version packages (#148)
  • e703bfe fix(config): stop merging custom animate classes (#147)
  • 8f12110 chore(release): version packages (#145)
  • 19a9a66 fix(config): override logical sides with axis utilities (#144)
  • 398d55a chore(release): version packages (#138)
  • Additional commits viewable in compare view

Updates lucide-react from 1.41.0 to 1.54.0

Release notes

Sourced from lucide-react's releases.

Version 1.54.0

What's Changed

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

Version 1.52.0

What's Changed

Full Changelog: lucide-icons/lucide@1.51.0...1.52.0

Version 1.51.0

What's Changed

... (truncated)

Commits
  • 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
  • 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
  • e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
  • f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
  • 94e4cb9 chore(dependencies): Update dependencies (#4806)
  • 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
  • See full diff in compare view

Updates radix-ui from 1.6.7 to 1.7.0

Changelog

Sourced from radix-ui's changelog.

1.7.0

Dialog

  • Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.

Navigation Menu

  • Added a disableToggle prop to NavigationMenu.Sub.
    • true: Clicking the trigger of an already-open submenu item keeps it open. This is the default and matches existing behavior.
    • false: Clicking the trigger of a submenu item toggles it open or closed.
  • Added an activationMode prop to NavigationMenu.Root and NavigationMenu.Sub.
    • "automatic": Hovering or focusing a trigger opens its item, and moving away from the trigger closes it after a short delay. This is the default and matches existing behavior.
    • "manual": Pointer entry and focus never open an item. The item opens when its trigger is clicked.
    • When activationMode is omitted on NavigationMenu.Sub, it inherits the value from the parent NavigationMenu.Root, so setting "manual" on the root also applies to submenus unless a submenu opts back in to "automatic".
  • Fixed a bug where a submenu's defaultValue was reset when an external element was focused before the menu opened.
  • Fixed a bug where NavigationMenu.Viewport discarded its children and rendered the active content in their place. The active content is now rendered inside the consumer's element alongside any children it already had.

Popover

  • Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.

Scroll Area

  • Added a ScrollArea.Content part so consumers can own the wrapper element implicitly rendered by ScrollArea.Viewport. Pass disableImplicitContentElement to the viewport and render ScrollArea.Content as its child.

    <ScrollArea.Root>
  <ScrollArea.Viewport disableImplicitContentElement>
    <ScrollArea.Content>{children}</ScrollArea.Content>
  </ScrollArea.Viewport>
  <ScrollArea.Scrollbar>
    <ScrollArea.Thumb />
  </ScrollArea.Scrollbar>
</ScrollArea.Root>

    In the next major release, the viewport will no longer render this element implicitly. We recomme...

    Description has been truncated

@dependabot
chore(deps): bump the production group across 1 directory with 16 upd…
5185229 
…ates

Bumps the production group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0` | `2.3.1` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.32` | `1.170.41` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.49` | `1.168.60` |
| [cn](https://github.com/shadcn-ui/cn/tree/HEAD/packages/cn) | `0.2.5` | `0.4.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.41.0` | `1.54.0` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.7.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@ff-labs/fff-bun](https://github.com/dmtrKovalenko/fff/tree/HEAD/packages/fff) | `0.10.6` | `0.11.0` |
| [@huggingface/transformers](https://github.com/huggingface/transformers.js) | `4.2.0` | `4.3.1` |
| [@oxlint/plugins](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugins) | `1.81.0` | `1.87.0` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.0` | `1.4.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.4` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.66.0` | `0.72.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.81.0` | `1.87.0` |
| [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` |



Updates `@modelcontextprotocol/server` from 2.0.0 to 2.3.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.0.0...@modelcontextprotocol/server@2.3.1)

Updates `@tanstack/react-router` from 1.170.32 to 1.170.41
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.41/packages/react-router)

Updates `@tanstack/react-start` from 1.168.49 to 1.168.60
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.60/packages/react-start)

Updates `cn` from 0.2.5 to 0.4.0
- [Release notes](https://github.com/shadcn-ui/cn/releases)
- [Changelog](https://github.com/shadcn-ui/cn/blob/main/packages/cn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/cn/commits/cn@0.4.0/packages/cn)

Updates `lucide-react` from 1.41.0 to 1.54.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.54.0/packages/lucide-react)

Updates `radix-ui` from 1.6.7 to 1.7.0
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@ff-labs/fff-bun` from 0.10.6 to 0.11.0
- [Release notes](https://github.com/dmtrKovalenko/fff/releases)
- [Commits](https://github.com/dmtrKovalenko/fff/commits/v0.11.0/packages/fff)

Updates `@huggingface/transformers` from 4.2.0 to 4.3.1
- [Release notes](https://github.com/huggingface/transformers.js/releases)
- [Commits](huggingface/transformers.js@4.2.0...4.3.1)

Updates `@oxlint/plugins` from 1.81.0 to 1.87.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.87.0/npm/oxlint-plugins)

Updates `@types/bun` from 1.4.0 to 1.4.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `@types/node` from 26.4.1 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `oxfmt` from 0.66.0 to 0.72.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.72.0/npm/oxfmt)

Updates `oxlint` from 1.81.0 to 1.87.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.87.0/npm/oxlint)

Updates `zod` from 4.5.4 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.4...v4.6.5)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.168.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: cn
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: lucide-react
  dependency-version: 1.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: radix-ui
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@ff-labs/fff-bun"
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@huggingface/transformers"
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@oxlint/plugins"
  dependency-version: 1.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@types/bun"
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: oxfmt
  dependency-version: 0.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: oxlint
  dependency-version: 1.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026
@coderabbitai

coderabbitai Bot commented Oct 12, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: f68c81f7-0161-45ba-a7ff-8faafe5bfc97

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

Benchmark comparison

main 294ff73 → PR 5185229.

7 measured rounds per revision; one discarded warm-up round. Medians ± median absolute deviation; lower is better.

Operation main PR Change Assessment
Full index (4,096 messages) 153.709 ± 0.506 ms 154.425 ± 1.796 ms 0.5% Within noise
Index unchanged files 24.310 ± 0.142 ms 24.166 ± 0.789 ms -0.6% Within noise
Index one appended session 30.015 ± 0.079 ms 31.794 ± 0.735 ms 5.9% Within noise
Index unchanged (8 sessions) 5.284 ± 0.035 ms 5.217 ± 0.111 ms -1.3% Within noise
Index unchanged (128 sessions) 62.343 ± 0.986 ms 61.398 ± 0.943 ms -1.5% Within noise
Index unchanged (2,048 sessions) 918.380 ± 8.915 ms 914.370 ± 7.753 ms -0.4% Within noise
Native grep: initialization + first query 71.965 ± 0.215 ms 71.999 ± 0.417 ms 0.0% Within noise
Native grep: warm query 11.676 ± 0.239 ms 11.696 ± 0.221 ms 0.2% Within noise
Native grep: no match 0.197 ± 0.011 ms 0.184 ± 0.010 ms -6.6% Within noise
Streaming grep: plain 11.064 ± 0.250 ms 10.915 ± 0.357 ms -1.4% Within noise
Streaming grep: regex 10.838 ± 0.308 ms 10.338 ± 0.320 ms -4.6% Within noise
Streaming grep: fuzzy 10.611 ± 0.067 ms 10.759 ± 0.340 ms 1.4% Within noise
Streaming grep: no match 19.947 ± 0.368 ms 19.514 ± 0.246 ms -2.2% Within noise
FTS: open index 7.399 ± 0.076 ms 7.344 ± 0.041 ms -0.7% Within noise
FTS: reopen index per query 8.821 ± 0.149 ms 8.753 ± 0.080 ms -0.8% Within noise
Semantic build: fake engine (4,097 messages) 333.793 ± 1.961 ms 340.515 ± 4.231 ms 2.0% Within noise
Vector search: SQLite 8.853 ± 0.334 ms 7.946 ± 0.155 ms -10.2% Within noise
Vector search: SQLite, selective filter 2.503 ± 0.005 ms 3.263 ± 0.049 ms 30.3% Slower
Vector search: SQLite, selective filter (16,384 vectors) 2.270 ± 0.054 ms 2.961 ± 0.024 ms 30.5% Slower
Vector search: cosine, selective filter 0.956 ± 0.029 ms 0.677 ± 0.032 ms -29.2% Faster
Rank fusion (2 × 100 hits) 0.042 ± 0.001 ms 0.038 ± 0.001 ms -9.4% Within noise

A change is flagged only when it exceeds 10% and three times the larger median absolute deviation. This is a noise heuristic, not a statistical significance test. Timing changes are informational. New correctness failures and execution errors fail the job; identical assertion failures in every main and PR round remain visible without blocking the PR.

Runtime: Bun 1.4.0, linux x64, AMD EPYC 7763 64-Core Processor. Same runner, serial execution, alternating revision order. Suite: f7f0a0530c34.

Fixtures: 32 sessions × 128 messages (~2 MiB), unchanged incremental-index proxies at 8/128/2,048 one-message sessions, 4,096 vectors × 384 dimensions, and a 16,384-vector selective-filter case. Native cold includes finder initialization; filesystem caches are not flushed. Vector retrieval excludes model loading and embedding generation.
Vector retrieval remains exact: SQL predicates reduce the distance input set and LIMIT bounds materialized results, but scalar distance still scans every filtered vector. Approximate vec0/ANN retrieval is deferred pending separate maintainer approval.

Tail latency (p95 of round averages)
Operation main p95 PR p95
Full index (4,096 messages) 159.160 ms 160.342 ms
Index unchanged files 25.136 ms 25.081 ms
Index one appended session 31.001 ms 33.540 ms
Index unchanged (8 sessions) 5.569 ms 5.607 ms
Index unchanged (128 sessions) 63.764 ms 63.395 ms
Index unchanged (2,048 sessions) 928.475 ms 931.512 ms
Native grep: initialization + first query 72.543 ms 72.568 ms
Native grep: warm query 11.956 ms 12.046 ms
Native grep: no match 0.208 ms 0.223 ms
Streaming grep: plain 11.410 ms 11.437 ms
Streaming grep: regex 11.461 ms 11.076 ms
Streaming grep: fuzzy 11.274 ms 11.833 ms
Streaming grep: no match 21.431 ms 20.183 ms
FTS: open index 8.966 ms 7.406 ms
FTS: reopen index per query 9.044 ms 9.185 ms
Semantic build: fake engine (4,097 messages) 344.216 ms 348.311 ms
Vector search: SQLite 9.215 ms 8.658 ms
Vector search: SQLite, selective filter 2.635 ms 3.703 ms
Vector search: SQLite, selective filter (16,384 vectors) 2.342 ms 3.090 ms
Vector search: cosine, selective filter 1.005 ms 0.785 ms
Rank fusion (2 × 100 hits) 0.050 ms 0.044 ms

Raw samples and per-case failures are available in the workflow artifact.

Workflow run and raw results

@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 19, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-8bc81f3156 branch October 19, 2026 04:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants