deps-dev(deps-dev): bump the patch-and-minor group with 3 updates

[dependabot]

Bumps the patch-and-minor group with 3 updates: @langchain/langgraph, darwin-agents and tsx.

Updates @langchain/langgraph from 1.4.8 to 1.4.9

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.9

Patch Changes

• #2653 7880055 Thanks @​christian-bromann! - fix(langgraph): checkpoint Topic as a flat values list

  Match Python Topic checkpoints so Host JS graphs no longer put __pregel_tasks: [[], []] through the Python checkpointer. Keep reading legacy [seen, values] checkpoints for restore compatibility.

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.9

Patch Changes

• #2653 7880055 Thanks @​christian-bromann! - fix(langgraph): checkpoint Topic as a flat values list

  Match Python Topic checkpoints so Host JS graphs no longer put __pregel_tasks: [[], []] through the Python checkpointer. Keep reading legacy [seen, values] checkpoints for restore compatibility.

Commits

• 5f99152 chore: version packages (#2655)
• 7880055 fix(langgraph): checkpoint Topic as a flat values list (#2653)
• cac6d31 chore(deps): bump the vite-vitest group across 1 directory with 6 updates (#2...
• fa98921 chore(deps-dev): bump @​vitest/browser from 4.1.9 to 4.1.10 (#2624)
• cdffd18 chore(deps): bump the langchain group across 1 directory with 6 updates (#2616)
• See full diff in compare view

Updates darwin-agents from 0.12.2 to 0.13.2

Release notes

Sourced from darwin-agents's releases.

v0.13.2 — unconditional collision-freedom, single-dash flag guard

Round two of the cross-model review (GPT-5.6 attacking, after four Claude Fable rounds) upheld two of its findings against 0.13.1 — including a counterexample to 0.13.1's own "provably collision-free" claim. Both closed:

• Collision-freedom now holds unconditionally. nextVersion self-maps once parseInt saturates at 2^53; with such a label in history the probe walk pinned on one taken candidate and would have handed the upsert a colliding label (worst case: an A/B test with versionA === versionB). The walk now falls back to the append strategy on any non-progressing step — every step strictly progresses, so the history-size bound is a real proof with no carve-out. Mutation-proven test with the exact 2^53 label.
• --max-test-days -v / --max-merge -v no longer swallow -v. The missing-value guard only recognised ---prefixed tokens; the CLI defines single-dash -v, which was consumed as an invalid value. Both value-taking flags fixed, mutation-proven.

643 tests, tsc/build clean, adapter-compat guard OK.

v0.13.1 — provably collision-free labels, budget snapshotted on the test

Same-day patch on 0.13.0, from an adversarial cross-model review (Claude Opus built, Claude Fable refuted over four rounds, GPT-5.6 reviewed — these two survived all of it):

• nextFreeVersion is now provably collision-free: the probe walk's bound is the history size instead of a fixed 100 — the candidate sequence never revisits a label, so after |history| collisions the next candidate must be free. An all-non-numeric history with 101 chained rejected challengers defeated the old cap; mutation-proven regression test included.
• ABTest.maxTestDays: the wall-clock budget is snapshotted onto the test at start. Previously expiry read the current invocation's config, so a test started via a one-off darwin run … --max-test-days 7 silently lost its deadline on the next plain invocation. Snapshot preferred, config fallback keeps pre-0.13.1 tests and late-added budgets working.

Also documents (unchanged, pre-existing): the CLI short-output path returns before the loop and therefore cannot trip the budget; the evidence-based unreliability rule is evaluated before expiry by design; multi-writer concurrent evolution remains outside the engine's guarantees.

642 tests, tsc/build clean, adapter-compat guard OK.

v0.13.0 — rejected challengers survive, plus a wall-clock budget for A/B tests

Fixed

A rejected challenger is no longer overwritten by the next one. The challenger's version label was derived from the active version. That is only unique while the active version is also the newest: when an A/B test concludes in favour of the incumbent, the loser keeps its label and the incumbent stays active — so the next evolution cycle produced the same label again, and savePromptVersion upserted over the previous challenger's row. Its prompt text was destroyed; createdAt/parentVersion were left describing a prompt that no longer existed (the sqlite provider's INSERT OR REPLACE dropped the row outright).

This was not just bookkeeping: merge-parent selection, Pareto candidate selection and darwin status all read the version archive, so GEPA-style features were choosing parents from a history silently collapsed to two entries. Numbering now continues above the highest version in history; where the active version already is the highest — the healthy case — labels are unchanged. tests/version-collision.test.ts pins the contract: generating a challenger must never rewrite an existing version.

Added

evolution.maxTestDays (opt-in, CLI --max-test-days <n>, 0 = no budget): a wall-clock budget per A/B test. minRuns is a sample budget with no notion of throughput — a low-frequency agent can face months per arm and cannot evolve at all while its test is open; a statistically tied test can stay open forever. When the budget runs out before both arms reach minRuns, the test closes as inconclusive: the incumbent keeps the slot, the slot is freed for a different challenger, and a dedicated notifyABTestTimeout alert fires. A timeout never promotes the challenger — lowering minRuns instead would trade the deadlock for promotions on noise, and measured judge variance (±1 on a 10-point scale) dwarfs the real evolution lift (~+0.1–0.2, benchmark/results/). Unset leaves the untimed path byte-identical.

639 tests (all six new tests verified red against the pre-fix source), tsc/build clean, adapter-compat guard OK against the published darwin-langgraph peer.

Changelog

Sourced from darwin-agents's changelog.

[0.13.2] — 2026-08-01

Round two of the cross-model review upheld two of its round-one findings against 0.13.1 — including a counterexample to 0.13.1's own "provably collision-free" claim. Both closed:

Fixed

• The collision-freedom proof now holds unconditionally. 0.13.1 documented the parseInt-saturation corner (nextVersion("v9007199254740992") self-maps at 2^53) as theoretical — but a documented counterexample refutes a claimed proof: with that label in history the probe walk produced the same taken candidate forever, returned it, and the upsert would have overwritten the incumbent and started an A/B test with versionA === versionB. The walk now steps through progressStep, which falls back to the append strategy on any non-progressing step — every step strictly progresses, so the history-size bound is a real proof with no carve-out.
• --max-test-days -v / --max-merge -v no longer swallow the verbose flag. The missing-value guard only recognised ---prefixed tokens; the CLI defines single-dash -v, which was consumed as an invalid value and silently dropped. Both value-taking flags now treat any --prefixed token as a missing value (negative numbers were never valid for either). The 0.13.1 rebuttal of this finding claimed the CLI had no single-dash flags — that was wrong, and this entry is the correction.

[0.13.1] — 2026-08-01

Patch on the day of 0.13.0, from an adversarial cross-model review (built by Claude Opus, refuted by Claude Fable over four rounds, then reviewed by GPT-5.6 — two findings survived all of that and are fixed here).

Fixed

• nextFreeVersion is now provably collision-free. The probe walk stopped after a fixed 100 iterations and returned a possibly-taken label — an all-non-numeric history with 101 chained rejected challengers would have been overwritten again. The bound is now the history size itself: the candidate sequence never revisits a label (numeric labels strictly increment, non-numeric strictly grow), so after |history| collisions the next candidate must be free. The documented 2^53 parseInt-saturation corner remains theoretical and pre-existing.
• The wall-clock budget is snapshotted onto the A/B test at start (ABTest.maxTestDays). Expiry previously read the current invocation's config, so a test started via a one-off darwin run … --max-test-days 7 silently lost its deadline on the next plain invocation. Evaluation prefers the snapshot and falls back to the agent's current config, which keeps both pre-snapshot

... (truncated)

Commits

• e1b6459 fix(v0.13.2): unconditional collision-freedom + single-dash flag guard
• 80678bb fix(v0.13.1): provably collision-free labels + budget snapshotted on the test
• caed237 ci(deps): bump actions/setup-node from 6 to 7 in the actions group (#21)
• 882e629 fix(v0.13.0): stop a rejected challenger being overwritten by the next one
• 6e9e323 chore: sync package-lock self-version to 0.12.2
• See full diff in compare view

Updates tsx from 4.23.1 to 4.23.10

Release notes

Sourced from tsx's releases.

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

4.23.8 (2026-08-05)

Bug Fixes

• preserve package subpath resolution (be1315e)
• preserve typeless ESM dependency exports (70dfc5e)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.7

4.23.7 (2026-08-05)

Bug Fixes

• prevent tsImport cache collisions (4e5a138)

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• be1315e fix: preserve package subpath resolution
• 5efba41 docs: organize transform backend research
• 70dfc5e fix: preserve typeless ESM dependency exports
• a74ee91 docs: document engineering principles
• 4e5a138 fix: prevent tsImport cache collisions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.