Skip to content

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 28 updates - #107

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-7220525b82
Closed

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 28 updates#107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-7220525b82

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 28 updates in the / directory:

Package From To
turbo 2.10.12 2.11.4
@langchain/core 1.2.9 1.2.12
@langchain/openai 1.5.11 1.5.13
@modelcontextprotocol/hono 2.0.0-alpha.2 2.0.1
@modelcontextprotocol/server 2.0.0-beta.5 2.1.0
better-auth 1.7.3 1.7.6
deepagents 1.13.3 1.14.1
hono 4.13.7 4.13.9
mongoose 9.9.5 9.10.2
zod 4.5.4 4.6.5
@types/node 26.5.0 26.6.2
tsx 4.23.13 4.23.15
@astrojs/starlight 0.42.0 0.42.4
astro 7.3.2 7.3.5
@tanstack/react-query 5.102.8 5.103.2
@tanstack/react-router 1.170.33 1.170.39
@xyflow/react 12.11.6 12.12.0
lucide-react 1.43.0 1.48.0
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.7 19.3.0
@tanstack/router-plugin 1.168.36 1.168.40
@types/react 19.2.18 19.3.0
@types/react-dom 19.2.7 19.3.0
vite 8.2.2 8.3.1
@langchain/anthropic 1.5.9 1.5.11
isomorphic-git 1.41.9 1.42.2
langchain 1.5.10 1.5.12
tailwind-merge 3.6.0 3.7.0

Updates turbo from 2.10.12 to 2.11.4

Release notes

Sourced from turbo's releases.

Turborepo v2.11.4

What's Changed

Changelog

... (truncated)

Commits
  • 40c2847 publish 2.11.4 to registry
  • f74650c fix: Put version in turbo query JSON output instead of a separate banner (#...
  • 4d72915 test: Move Cargo and Go discovery cases into contracts (#14227)
  • 8a9a10a test: Move Cargo prune layout checks into in-process plan contracts (#14226)
  • 4b72ac9 refactor: Group Run state into execution and services contexts (#14225)
  • 58a4889 refactor: Make repository context inputs injectable (#14224)
  • 813bed0 fix: Share concurrent remote-cache token recovery (#14223)
  • 7353b16 fix: Coordinate artifact requests after rate limiting (#14221)
  • ec329a0 test: Move affected run planning into RunBuilder contracts (#14212)
  • 935c9ea test: Move config precedence cases into funnel contracts (#14217)
  • Additional commits viewable in compare view

Updates @langchain/core from 1.2.9 to 1.2.12

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.12

Patch Changes

@​langchain/core@​1.2.11

Patch Changes

  • #11603 fec9cd8 Thanks @​thushanth-bengre-langchain! - fix(core): build streaming llmOutput.tokenUsage from the fully-accumulated chunk instead of whichever individual chunk's usage_metadata arrived last

    Affects both core streaming paths — .stream()/.streamEvents() (_streamIterator) and .invoke()/.generate() when a streaming-preferring callback is attached (_generateWithCache's hasStreamingHandler branch). Previously, llmOutput.tokenUsage was overwritten by each chunk in turn, so only the last chunk carrying usage_metadata won — correct for providers that emit one cumulative total on a final chunk, but wrong for providers (e.g. @langchain/google, @langchain/anthropic) that emit usage_metadata as a per-chunk delta across multiple chunks, where the values must be summed.

    Note for provider authors: this assumes each streamed chunk's usage_metadata is either a per-chunk delta or appears only on a single final chunk. A provider that instead repeats a cumulative total on every chunk will now see it summed (and inflated) in llmOutput.tokenUsage, matching the existing behavior of the correctly-working message.usage_metadata field.

    Also fixes @langchain/google's invoke({streaming: true}) path (no streaming-preferring callback attached), where llmOutput was never populated at all.

  • #11590 ffebdc2 Thanks @​thushanth-bengre-langchain! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses response_metadata.output directly, preserving every reasoning item's id/encrypted_content in original order. In v1, AIMessage.contentBlocks (outputVersion: "v1") is fixed the same way. additional_kwargs.reasoning is unchanged.

@​langchain/core@​1.2.10

Patch Changes

Commits
  • bd44054 chore: version packages (#11674)
  • 030a726 fix(core): preserve structured tool inputs in traces (#11675)
  • 8837c7a feat(typesafe): add model-router and auto-mode agent middleware (#11670)
  • 206d8b9 chore: version packages (#11668)
  • 70c42ac feat(typesafe): add TypeSafe System One classifier package (#11666)
  • 778566e chore: version packages (#11607)
  • 18b71af feat(google-genai): add outputDimensionality parameter to GoogleGenerativeAIE...
  • 35368db fix(google): surface groundingMetadata/citationMetadata on streaming path (#1...
  • 78b2923 fix(google): preserve tool call id and thoughtSignature in native streaming (...
  • ffebdc2 fix(openai): correctly handle multiple reasoning items in v1 content blocks (...
  • Additional commits viewable in compare view

Updates @langchain/openai from 1.5.11 to 1.5.13

Release notes

Sourced from @​langchain/openai's releases.

@​langchain/openai@​1.5.13

Patch Changes

  • #11590 ffebdc2 Thanks @​thushanth-bengre-langchain! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses response_metadata.output directly, preserving every reasoning item's id/encrypted_content in original order. In v1, AIMessage.contentBlocks (outputVersion: "v1") is fixed the same way. additional_kwargs.reasoning is unchanged.

@​langchain/openai@​1.5.12

Patch Changes

@​langchain/openai@​1.5.12-rc.0

Patch Changes

Commits
  • 778566e chore: version packages (#11607)
  • 18b71af feat(google-genai): add outputDimensionality parameter to GoogleGenerativeAIE...
  • 35368db fix(google): surface groundingMetadata/citationMetadata on streaming path (#1...
  • 78b2923 fix(google): preserve tool call id and thoughtSignature in native streaming (...
  • ffebdc2 fix(openai): correctly handle multiple reasoning items in v1 content blocks (...
  • c9ae847 fix(google): set includeServerSideToolInvocations when mixing tools (#11611)
  • bc88b75 fix(google): route Vertex multi-region endpoints (#11433)
  • fec9cd8 fix(core): build streaming llmOutput.tokenUsage from accumulated usage (#11603)
  • 194a063 fix(google): allowlist JSON Schema keywords for Gemini schemas (#11606)
  • b0a0d3f fix(deps): upgrade Vitest to address GHSA-82fw-gwwq-j7x9 (#11599)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/hono from 2.0.0-alpha.2 to 2.0.1

Release notes

Sourced from @​modelcontextprotocol/hono's releases.

@​modelcontextprotocol/hono@​2.0.1

Patch Changes

  • #2698 7b781ed Thanks @​maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport built on it), createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at 4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio bound their reads too) and answers 413 Payload Too Large before anything is parsed. toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy so the modern handler answers it. JSON-RPC batch arrays are limited to 100 messages; a longer batch is answered 400 / -32600 and none of it is dispatched.

    The limit is configurable with a new maxRequestBodySize option (bytes, default DEFAULT_MAX_REQUEST_BODY_SIZE = 4 MiB, exported from @modelcontextprotocol/server) on WebStandardStreamableHTTPServerTransportOptions, CreateMcpHandlerOptions (forwarded to its stateless legacy leg; isLegacyRequest and legacyStatelessFallback take the same option), CreateMcpHonoAppOptions, and ToNodeHandlerOptions / ToWebRequestOptions (the adapter's bound applies before the handler's, so raise both). The bounded reader is exported as readRequestBody for adapter authors. Hosts that pre-parse the body and pass it as parsedBody skip the SDK's read and its size limit entirely; the batch bound applies either way.

    createMcpHonoApp and createMcpExpressApp now run their Host/Origin validation before the JSON body parser, so a request from a disallowed Host or Origin with an invalid JSON body is answered 403 rather than 400, and its body is not read.

  • Updated dependencies [6fa4227, 03842cd, 3e90449, 7b781ed, 75dc7ea, 6032170, 6a05402, 70de0c8]:

    • @​modelcontextprotocol/server@​2.1.0

@​modelcontextprotocol/hono@​2.0.0

Patch Changes

  • #2402 a400259 Thanks @​felixweinberger! - First beta release of SDK v2 with support for the MCP 2026-07-28 specification revision. See the migration guides for upgrading from v1 (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision (docs/migration/support-2026-07-28.md).

  • #2405 f172626 Thanks @​mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map adds a require condition so require('@modelcontextprotocol/…') works from CommonJS consumers. Output extensions are normalized across all packages (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the public import paths are unchanged.

  • #2441 561c6d8 Thanks @​felixweinberger! - POSTs whose Content-Type media type is not application/json are now rejected with 415 Unsupported Media Type; the header is parsed instead of substring-matched. Previously any value merely containing the substring passed the check (for example text/plain; a=application/json), case

... (truncated)

Commits
  • 9517506 Version Packages (#2808)
  • 6a05402 fix(server): close StdioServerTransport when stdin ends or closes (#2494)
  • c4248a9 fix(client): add missing Windows env vars to DEFAULT_INHERITED_ENV_VARS (#2043)
  • 0b403f0 chore(changesets): only bump peer dependents when out of range (#2819)
  • 6032170 feat(server): add request-time OAuth scope challenges (#1624)
  • b654261 fix(client): let OAuth-derived Authorization override caller-supplied header ...
  • 5ecc791 fix(codemod): only count real module specifiers in project-type inference (#2...
  • 5119ee7 fix: preserve exact OAuth resource indicators (#2581)
  • 6fa4227 fix(client): surface underlying network error via Error.cause on probe failur...
  • dcc0102 feat(client): add DPoP (RFC 9449) sender-constrained token support (#2629)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0-beta.5 to 2.1.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.1.0

Patch Changes

  • Updated dependencies [dcc0102]:
    • @​modelcontextprotocol/core@​2.1.0

@​modelcontextprotocol/server@​2.1.0

Minor Changes

  • #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

    createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource_metadata parameter is derived from the verified AuthInfo: requireBearerAuth / verifyBearerToken now stamp their configured resourceMetadataUrl onto the AuthInfo they return (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the well-known location for an HTTP(S) RFC 8707 resource identifier; the parameter is omitted when neither is available.

Patch Changes

  • #2726 6fa4227 Thanks @​LuckTerence! - SdkError and SdkHttpError accept standard ErrorOptions as an optional fourth constructor argument and forward it to Error, so a wrapped error is reachable through the standard Error.cause chain. Version-negotiation probe failures (SdkErrorCode.EraNegotiationFailed) now use it: the underlying TypeError: fetch failed and the DNS or socket error beneath it surface via error.cause, so pino, Sentry, and util.inspect render ENOTFOUND / ECONNREFUSED / ETIMEDOUT instead of stopping at the SdkError (#2657). The previous error.data.cause slot is still populated for compatibility but is deprecated and slated for removal; read error.cause instead.

  • #2654 03842cd Thanks @​pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

    • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
    • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

    Absent is now the only value that means "no id".

  • #2668 3e90449 Thanks @​KKonstantinov! - Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

    The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

  • #2698 7b781ed Thanks @​maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport built on it), createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at 4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio bound their reads too) and answers 413 Payload Too Large before anything is parsed. toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy

... (truncated)

Commits
  • 9517506 Version Packages (#2808)
  • 6a05402 fix(server): close StdioServerTransport when stdin ends or closes (#2494)
  • c4248a9 fix(client): add missing Windows env vars to DEFAULT_INHERITED_ENV_VARS (#2043)
  • 0b403f0 chore(changesets): only bump peer dependents when out of range (#2819)
  • 6032170 feat(server): add request-time OAuth scope challenges (#1624)
  • b654261 fix(client): let OAuth-derived Authorization override caller-supplied header ...
  • 5ecc791 fix(codemod): only count real module specifiers in project-type inference (#2...
  • 5119ee7 fix: preserve exact OAuth resource indicators (#2581)
  • 6fa4227 fix(client): surface underlying network error via Error.cause on probe failur...
  • dcc0102 feat(client): add DPoP (RFC 9449) sender-constrained token support (#2629)
  • Additional commits viewable in compare view

Updates better-auth from 1.7.3 to 1.7.6

Release notes

Sourced from better-auth's releases.

v1.7.6

better-auth

Features

  • Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason. (#11325)
  • Added Vercel BotID as a captcha provider for protected authentication routes. (#11016)

Bug Fixes

  • Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification. (#11324)
  • Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate. (#11316)
  • Prevented older auth-query responses from overwriting newer results when requests overlap. (#11376)
  • Fixed model identity when a custom model name matches another schema key. (#11333)
  • Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)
  • Fixed social account linking through the OAuth Proxy plugin. (#11268)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed model identity when a custom model name matches another schema key. (#11333)
  • Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT. (#11374)
  • Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

  • Fixed model identity when a custom model name matches another schema key. (#11333)
  • Fixed schema validation for capitalized custom Prisma model names. (#11319)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.6

Patch Changes

  • #11325 af88385 Thanks @​Wadiou! - Admin plugin bannedUserMessage can now be a function that receives the banned user, so sign-in errors can include details such as the ban reason.

  • #11268 2fa501c Thanks @​bytaesu! - Support linking social accounts through the OAuth Proxy plugin.

  • #11366 d41e2ca Thanks @​bytaesu! - Use targeted PRAGMA queries when a Kysely dialect cannot introspect Cloudflare D1.

  • #11016 3d0efa3 Thanks @​davbrito! - Support Vercel BotID checks on protected authentication routes in Vercel-hosted applications.

  • #11333 631ac29 Thanks @​bytaesu! - Preserve logical model identity when a custom model name matches another schema key.

  • #11324 8853419 Thanks @​XXMOHAMED012! - Passwords longer than maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing on sign-in (email, username, phone number), verify-password, change-password (currentPassword), delete-user, the two-factor endpoints that take a password, and admin create-user, matching what sign-up and password reset already did.

  • #11316 2ee1545 Thanks @​Smidge! - Fix React hydration mismatches when a session or plugin auth query resolves before a streamed component hydrates. Preserve the server-rendered pending state during hydration, then update to the current client state without changing ordinary or computed plugin stores.

  • #11376 fc45d08 Thanks @​bytaesu! - Prevent older auth-query responses from replacing newer results when requests overlap.

  • Updated dependencies [41b7dc1, d41e2ca, 631ac29, 2b13e01]:

    • @​better-auth/prisma-adapter@​1.7.6
    • @​better-auth/kysely-adapter@​1.7.6
    • @​better-auth/core@​1.7.6
    • @​better-auth/drizzle-adapter@​1.7.6
    • @​better-auth/memory-adapter@​1.7.6
    • @​better-auth/mongo-adapter@​1.7.6
    • @​better-auth/telemetry@​1.7.6

1.7.5

Patch Changes

  • #11283 e56c45b Thanks @​bytaesu! - Log Cloudflare Turnstile error codes and binding mismatches on the server so CAPTCHA verification failures can be diagnosed.

  • #11209 8d37cc3 Thanks @​siam923! - Remove the unused optional better-sqlite3 peer dependency to prevent installation conflicts.

  • #11272 348fc26 Thanks @​bytaesu! - Use MySQL's reported byte lengths when validating indexes on existing string columns.

  • #11203 cb627eb Thanks @​dshukertjr! - Add a database.schemaName option for direct PostgreSQL connections. When set, the adapter and the CLI qualify every statement with that schema, so auth generate writes a schema-qualified migration that creates the schema before its tables instead of relying on the connection's search_path.

  • #11270 133f6a2 Thanks @​bytaesu! - Prevent PostgreSQL migrations from treating tables in other schemas or views in the active schema as Better Auth tables.

  • Updated dependencies [e18bc83, cb627eb, dae97ed]:

    • @​better-auth/drizzle-adapter@​1.7.5
    • @​better-auth/kysely-adapter@​1.7.5
    • @​better-auth/core@​1.7.5
    • @​better-auth/memory-adapter@​1.7.5
    • @​better-auth/mongo-adapter@​1.7.5
    • @​better-auth/prisma-adapter@​1.7.5

... (truncated)

Commits
  • 229a02a chore: release v1.7.6 (#11322)
  • dcaa5a7 feat(cli): add check command for schema validation (#11314)
  • fc45d08 fix(client): prevent stale query overwrites (#11376)
  • 8853419 fix: enforce maxPasswordLength before hashing on password verification endpoi...
  • 2fa501c fix(oauth-proxy): support social account linking (#11268)
  • 3d0efa3 feat(captcha): add Vercel BotID provider (#11016)
  • af88385 feat(admin): allow bannedUserMessage to be a function of the banned user (#11...
  • 2ee1545 fix(client): preserve auth query snapshots during hydration (#11316)
  • 0362d62 test(oauth): cover stateless implicit linking across instances (

@dependabot
chore(deps)(deps): bump the minor-and-patch group across 1 directory …
2cf1111 
…with 28 updates

Bumps the minor-and-patch group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo) | `2.10.12` | `2.11.4` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.9` | `1.2.12` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.11` | `1.5.13` |
| [@modelcontextprotocol/hono](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0-alpha.2` | `2.0.1` |
| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0-beta.5` | `2.1.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.3` | `1.7.6` |
| [deepagents](https://github.com/langchain-ai/deepagentsjs) | `1.13.3` | `1.14.1` |
| [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.9` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.9.5` | `9.10.2` |
| [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.2` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.42.0` | `0.42.4` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.2` | `7.3.5` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.8` | `5.103.2` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.33` | `1.170.39` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.6` | `12.12.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.43.0` | `1.48.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |
| [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.36` | `1.168.40` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.1` |
| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) | `1.5.9` | `1.5.11` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.41.9` | `1.42.2` |
| [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.10` | `1.5.12` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |



Updates `turbo` from 2.10.12 to 2.11.4
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.12...v2.11.4)

Updates `@langchain/core` from 1.2.9 to 1.2.12
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.9...@langchain/core@1.2.12)

Updates `@langchain/openai` from 1.5.11 to 1.5.13
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.11...@langchain/openai@1.5.13)

Updates `@modelcontextprotocol/hono` from 2.0.0-alpha.2 to 2.0.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/hono@2.0.0-alpha.2...@modelcontextprotocol/hono@2.0.1)

Updates `@modelcontextprotocol/server` from 2.0.0-beta.5 to 2.1.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.0.0-beta.5...@modelcontextprotocol/server@2.1.0)

Updates `better-auth` from 1.7.3 to 1.7.6
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.6/packages/better-auth)

Updates `deepagents` from 1.13.3 to 1.14.1
- [Release notes](https://github.com/langchain-ai/deepagentsjs/releases)
- [Commits](https://github.com/langchain-ai/deepagentsjs/compare/deepagents@1.13.3...deepagents@1.14.1)

Updates `hono` from 4.13.7 to 4.13.9
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.7...v4.13.9)

Updates `mongoose` from 9.9.5 to 9.10.2
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.9.5...9.10.2)

Updates `zod` from 4.5.4 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.4...v4.6.5)

Updates `@types/node` from 26.5.0 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

Updates `@astrojs/starlight` from 0.42.0 to 0.42.4
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.4/packages/starlight)

Updates `astro` from 7.3.2 to 7.3.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.5/packages/astro)

Updates `@tanstack/react-query` from 5.102.8 to 5.103.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.103.2/packages/react-query)

Updates `@tanstack/react-router` from 1.170.33 to 1.170.39
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.39/packages/react-router)

Updates `@xyflow/react` from 12.11.6 to 12.12.0
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.0/packages/react)

Updates `lucide-react` from 1.43.0 to 1.48.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.48.0/packages/lucide-react)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@tanstack/router-plugin` from 1.168.36 to 1.168.40
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.40/packages/router-plugin)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `vite` from 8.2.2 to 8.3.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.1/packages/vite)

Updates `@langchain/anthropic` from 1.5.9 to 1.5.11
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/anthropic@1.5.9...@langchain/anthropic@1.5.11)

Updates `isomorphic-git` from 1.41.9 to 1.42.2
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.41.9...v1.42.2)

Updates `langchain` from 1.5.10 to 1.5.12
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.10...langchain@1.5.12)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

---
updated-dependencies:
- dependency-name: turbo
  dependency-version: 2.11.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@langchain/core"
  dependency-version: 1.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@langchain/openai"
  dependency-version: 1.5.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/hono"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: deepagents
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mongoose
  dependency-version: 9.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.42.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: astro
  dependency-version: 7.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.103.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.39
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@xyflow/react"
  dependency-version: 12.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/router-plugin"
  dependency-version: 1.168.40
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@langchain/anthropic"
  dependency-version: 1.5.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: isomorphic-git
  dependency-version: 1.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: langchain
  dependency-version: 1.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This was referenced Sep 28, 2026
Closed
Closed
@github-actions

github-actions Bot commented Sep 28, 2026

Copy link
Copy Markdown

Docker image ready

docker pull ghcr.io/archmax-ai/semantics:pr-107

@dependabot @github

dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 5, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-7220525b82 branch October 5, 2026 04:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants