Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 10 updates#391

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-663911aabd
Open

chore(deps): bump the production-dependencies group across 1 directory with 10 updates#391
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-663911aabd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 10 updates in the / directory:

Package From To
playwright 1.60.0 1.61.1
@ai-sdk/anthropic 2.0.82 2.0.88
@ai-sdk/openai 2.0.107 2.0.114
@langchain/core 1.1.48 1.2.3
@langchain/langgraph 1.3.6 1.4.8
ai 5.0.200 5.0.218
undici 6.26.0 6.27.0
@fontsource/chakra-petch 5.2.7 5.3.0
@fontsource/ibm-plex-mono 5.2.7 5.3.0
@fontsource/ibm-plex-sans 5.2.8 5.3.0

Updates playwright from 1.60.0 to 1.61.1

Release notes

Sourced from playwright's releases.

v1.61.1

Bug Fixes

  • #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
  • #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
  • #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
  • #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
  • #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

Browser and Screencast

... (truncated)

Commits
  • 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
  • 4328122 chore: mark v1.61.1 (#41404)
  • 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
  • 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
  • 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
  • b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
  • b5a3175 cherry-pick(#41319): fix(loader): support other node versions
  • d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
  • 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
  • a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
  • Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 2.0.82 to 2.0.88

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

2.0.88

Patch Changes

  • 30c69e6: fix(provider/anthropic): warn when parallel tool use is requested with JSON tool structured output

2.0.87

Patch Changes

  • 5082ee8: fix(provider/anthropic): preserve web search citations when replaying assistant messages
  • Updated dependencies [2fd6076]
    • @​ai-sdk/provider-utils@​3.0.30

2.0.86

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29

2.0.85

Patch Changes

  • f236836: feat (provider/anthropic): add claude-sonnet-5 model id

2.0.84

Patch Changes

  • Updated dependencies [b85c4fb]
    • @​ai-sdk/provider-utils@​3.0.28

2.0.83

Patch Changes

  • Updated dependencies [9169261]
    • @​ai-sdk/provider-utils@​3.0.27
Commits

Updates @ai-sdk/openai from 2.0.107 to 2.0.114

Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.114

Patch Changes

  • Updated dependencies [2fd6076]
    • @​ai-sdk/provider-utils@​3.0.30

2.0.113

Patch Changes

  • 21eef03: Send null content for tool-call-only assistant messages.

2.0.112

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29

2.0.111

Patch Changes

  • b4f8362: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls
  • 8549807: feat(provider/openai,provider/gateway): add gpt-5.6 model ids

2.0.110

Patch Changes

  • Updated dependencies [b85c4fb]
    • @​ai-sdk/provider-utils@​3.0.28

2.0.109

Patch Changes

  • f8e6a5c: feat(openai): add orchestration token usage details to Responses API usage

2.0.108

Patch Changes

  • Updated dependencies [9169261]
    • @​ai-sdk/provider-utils@​3.0.27
Commits

Updates @langchain/core from 1.1.48 to 1.2.3

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.3

Patch Changes

  • #11200 08e5888 Thanks @​hntrl! - fix(aws): normalize and safely replay Bedrock reasoning blocks

    Emit standard reasoning blocks with preserved signatures, omit incomplete signature-only reasoning during replay, and retain compatibility with legacy and redacted Bedrock reasoning.

@​langchain/core@​1.2.2

Patch Changes

  • #11171 82bef01 Thanks @​christian-bromann! - fix(core): coerce string v1 AIMessage content to text blocks

    Prevent contentBlocks.push is not a function when constructing an AIMessage with response_metadata.output_version === "v1" and string content (common in serialized LangGraph stream payloads).

@​langchain/core@​1.2.1

Patch Changes

  • #10674 f017708 Thanks @​christian-bromann! - fix: classify provider 429s before retrying

  • #11092 7918bbd Thanks @​aolsenjazz! - fix(core): only treat arrays of content blocks as ToolMessage content

    Fix tool outputs that are arrays of plain objects being forwarded as malformed message content. An array is now only treated as message content blocks when every element is an object with a type; otherwise it is JSON-stringified.

@​langchain/core@​1.2.0

Minor Changes

Patch Changes

  • #11047 ac0f71d Thanks @​christian-bromann! - fix(core): preserve AIMessage content blocks

    Keep existing v1 contentBlocks when constructing AIMessage instances so serialized messages do not lose block content during deserialization.

Commits
  • 82a6b8e chore: version packages (#11202)
  • 08e5888 fix(aws): normalize Bedrock reasoning blocks (#11200)
  • 21aaeb0 fix: patch 13 high/critical Dependabot alerts (#11199)
  • 782c7f2 chore(dev): bump @​types/node from 25.9.1 to 26.1.0 in the types group across ...
  • f51f338 chore: version packages (#11176)
  • 09e7f6d fix(openai): drop tool_call content blocks from chat completions input (#11...
  • a9f123a fix(openai): filter out content blocks the chat completions api rejects as in...
  • cc39f56 chore: version packages (#11172)
  • 82bef01 fix(core): coerce string v1 AIMessage content to text blocks (#11171)
  • 8a7c5f8 chore: version packages (#11170)
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.3.6 to 1.4.8

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.8

Patch Changes

@​langchain/langgraph@​1.4.7

Patch Changes

  • #2571 85ba859 Thanks @​christian-bromann! - fix(langgraph): drop unused zod-to-json-schema peer dependency

    Remove the vestigial zod-to-json-schema (and its peerDependenciesMeta/dev) declarations. JSON Schema generation now flows through @langchain/core's Zod v3/v4 interop (toJsonSchema), so the old zod-to-json-schema@^3.x peer (which pins zod@^3.24.1) is no longer needed and was the last source of install-time peer conflicts with Zod v4. Closes #1706.

@​langchain/langgraph@​1.4.6

Patch Changes

  • 03a0d8b Thanks @​christian-bromann! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

    Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165.

  • Updated dependencies [0558e47, 091a46f]:

    • @​langchain/langgraph-sdk@​1.9.25
    • @​langchain/langgraph-checkpoint@​1.1.3

@​langchain/langgraph@​1.4.5

Patch Changes

  • #2557 b1e856d Thanks @​christian-bromann! - fix(sdk): apply state update and goto alongside interrupt resume

    respond(decision, { update, goto }) now maps to LangGraph's Command(resume, update, goto), so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the same superstep as the resume — one checkpoint, no separate updateState write, no flicker. @langchain/langgraph-api forwards update/goto through input.respond, and @langchain/core message instances in update are serialized to dicts before transport, exactly like submit(). Bumps @langchain/protocol to ^0.0.18 for the Goto type.

    respond/respondAll also apply update optimistically (mirroring submit()): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant respond() dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo).

    User-initiated optimistic writes (submit() / respond() / respondAll()) now commit to the store synchronously, in the same tick as the triggering event,

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.8

Patch Changes

1.4.7

Patch Changes

  • #2571 85ba859 Thanks @​christian-bromann! - fix(langgraph): drop unused zod-to-json-schema peer dependency

    Remove the vestigial zod-to-json-schema (and its peerDependenciesMeta/dev) declarations. JSON Schema generation now flows through @langchain/core's Zod v3/v4 interop (toJsonSchema), so the old zod-to-json-schema@^3.x peer (which pins zod@^3.24.1) is no longer needed and was the last source of install-time peer conflicts with Zod v4. Closes #1706.

1.4.6

Patch Changes

  • 03a0d8b Thanks @​christian-bromann! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

    Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165.

  • Updated dependencies [0558e47, 091a46f]:

    • @​langchain/langgraph-sdk@​1.9.25
    • @​langchain/langgraph-checkpoint@​1.1.3

1.4.5

Patch Changes

  • #2557 b1e856d Thanks @​christian-bromann! - fix(sdk): apply state update and goto alongside interrupt resume

    respond(decision, { update, goto }) now maps to LangGraph's Command(resume, update, goto), so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the same superstep as the resume — one checkpoint, no separate updateState write, no flicker. @langchain/langgraph-api forwards update/goto through input.respond, and @langchain/core message instances in update are serialized to dicts before transport, exactly like submit(). Bumps @langchain/protocol to ^0.0.18 for the Goto type.

    respond/respondAll also apply update optimistically (mirroring submit()): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant respond() dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or

... (truncated)

Commits

Updates ai from 5.0.200 to 5.0.218

Commits

Updates undici from 6.26.0 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

  • Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
  • Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

Updates @fontsource/chakra-petch from 5.2.7 to 5.3.0

Commits

Updates @fontsource/ibm-plex-mono from 5.2.7 to 5.3.0

Commits

Updates @fontsource/ibm-plex-sans from 5.2.8 to 5.3.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
5546bd1 
…y with 10 updates

Bumps the production-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.1` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `2.0.82` | `2.0.88` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `2.0.107` | `2.0.114` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.1.48` | `1.2.3` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.3.6` | `1.4.8` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.200` | `5.0.218` |
| [undici](https://github.com/nodejs/undici) | `6.26.0` | `6.27.0` |
| [@fontsource/chakra-petch](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/chakra-petch) | `5.2.7` | `5.3.0` |
| [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` |
| [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-sans) | `5.2.8` | `5.3.0` |



Updates `playwright` from 1.60.0 to 1.61.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.1)

Updates `@ai-sdk/anthropic` from 2.0.82 to 2.0.88
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@2.0.88/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@2.0.88/packages/anthropic)

Updates `@ai-sdk/openai` from 2.0.107 to 2.0.114
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@2.0.114/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@2.0.114/packages/openai)

Updates `@langchain/core` from 1.1.48 to 1.2.3
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.1.48...@langchain/core@1.2.3)

Updates `@langchain/langgraph` from 1.3.6 to 1.4.8
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.8/libs/langgraph-core)

Updates `ai` from 5.0.200 to 5.0.218
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/HEAD/packages/ai)

Updates `undici` from 6.26.0 to 6.27.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.26.0...v6.27.0)

Updates `@fontsource/chakra-petch` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/chakra-petch)

Updates `@fontsource/ibm-plex-mono` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono)

Updates `@fontsource/ibm-plex-sans` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-sans)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.61.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 2.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 2.0.114
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/core"
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.4.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 5.0.218
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource/chakra-petch"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource/ibm-plex-mono"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fontsource/ibm-plex-sans"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants