deps-dev(deps-dev): bump the patch-and-minor group with 2 updates

[dependabot]

Bumps the patch-and-minor group with 2 updates: darwin-agents and tsx.

Updates darwin-agents from 0.9.0 to 0.10.0

Release notes

Sourced from darwin-agents's releases.

v0.10.0 — Demo injection + parent-selection strategies

Two research-driven, opt-in evolution surfaces — a new challenger source (demo injection) and a new parent-selection strategy for the existing reflective challenger — both validated against the current state of the field (GEPA upstream docs, DSPy SIMBA) before a line was written. Default behaviour is byte-for-byte unchanged with the flags off.

SIMBA-style demo injection (useDemos)

DSPy's SIMBA improves programs two ways: appending self-reflective rules (Darwin's reflector already covers that) and appending successful past examples as demonstrations. This release adapts the second strategy to the online loop: on every demoEveryK-th cycle (default 4) the loop harvests the agent's own highest-scoring past runs (score ≥ 8, one per task type, maxDemos cap) and appends them as a marker-delimited "Demonstrations" section. The demo-augmented prompt is a normal challenger — same alignment guard, same A/B test, same rollback. Zero LLM cost (pure selection + rendering on data Darwin already persists), works with or without useGepa, idempotent refresh. CLI: --demos / --no-demos.

Parent-selection strategies (candidateSelection)

GEPA candidate_selection_strategy parity: instead of always mutating the currently-active prompt (a hill-climb), reflect from 'best' (highest composite in the version history), 'pareto' (uniform sample from the history's Pareto front), or 'epsilon-greedy' (explore with probability explorationEpsilon). Injectable RNG for deterministic tests; useCoverage keeps precedence. CLI: --candidate-selection <active|best|pareto|epsilon-greedy>.

Hardening (2-agent review, all fixed in-place)

• CLI override resolution: the new flags are wired through OVERRIDE_KEYS + typed resolve branch (persisted and applied), with regression tests through the real resolver path.
• applyDemoSection uses a function replacer — $& / $` / $$ in harvested demo content can never be interpreted as replacement patterns.
• Marker literals are stripped from quoted demo text so a past output writing about Darwin can't corrupt the section span.
• NaN-safe RNG index pick, matching sampleByCoverage's defensive posture.

Credits

package.json now lists Claude (currently Claude Fable 5, Anthropic) as a contributor, and the README's new Credits section says plainly how this project is built: directed and reviewed by a human, largely written by Claude, gated by multi-agent review and this repo's test suite.

586 tests (585 pass / 1 pre-existing skip) · tsc strict + build clean · zero hard deps

Changelog

Sourced from darwin-agents's changelog.

[0.10.0] — 2026-07-03

Two research-driven, opt-in evolution surfaces — a new challenger source (demo injection) and a new parent-selection strategy for the existing reflective challenger — both validated against the current state of the field (GEPA upstream docs, DSPy SIMBA) before a line was written. Default behaviour is byte-for-byte unchanged with the flags off.

Added

• SIMBA-style demo injection (src/evolution/demos.ts + evolution.useDemos). DSPy's SIMBA optimizer improves programs two ways: appending self-reflective rules (Darwin's reflector already covers that ground) and appending successful past examples as demonstrations. This release adapts the second strategy to the online loop: on every demoEveryK-th evolution cycle (default 4) the loop harvests the agent's own highest-scoring past runs (score ≥ demoScoreThreshold, default 8; at most one demo per task type for diversity; maxDemos cap, default 2) and appends them as a marker-delimited "Demonstrations" section. The demo-augmented prompt is a normal challenger — same alignment guard, same A/B test, same safety gate; if demos don't help this agent, the incumbent wins. Zero LLM cost (pure selection + rendering on data Darwin already persists), works with or without useGepa, idempotent via <!-- darwin:demos:start/end --> markers (a later cycle refreshes the section, never stacks a second one). Pure helpers (selectDemoCandidates / buildDemoSection / applyDemoSection / stripDemoSection) are exported from the package root. CLI: --demos / --no-demos.

• Parent-selection strategies (src/evolution/selection.ts + evolution.candidateSelection) — GEPA candidate_selection_strategy parity for the online loop. Historically the loop always reflected from the currently-active prompt (a hill-climb that can sit on a local optimum). Opt-in strategies pick the reflection parent from the agent's scored version history instead: 'best' (GEPA current_best — highest scalarised composite), 'pareto' (GEPA default — uniform sample from the non-dominated front, keeping lineages alive that win on different objectives), 'epsilon-greedy' (explore with probability explorationEpsilon, default 0.1, exploit otherwise). The RNG is injectable via the new DarwinLoopDeps.rng for deterministic tests. Precedence: useCoverage (GEPA Algorithm 2, the more specific selector) wins when it finds a coverage parent. Only consulted when useGepa is on. CLI: --candidate-selection <active|best|pareto|epsilon-greedy>.

Internal

• tryMergeVariant's version-history scoring extracted into a shared buildScoredHistory (used by merge and parent selection) — behaviour unchanged.
• package.json now lists Claude (Anthropic) as a contributor — see the README's new Credits section for how this project is actually built.

Commits

• 7a7b6b5 feat(v0.10.0): SIMBA-style demo injection + GEPA parent-selection strategies
• be2b364 ci(deps): bump actions/checkout from 6 to 7 in the actions group (#15)
• 901124a deps-dev(deps-dev): bump the patch-and-minor group with 2 updates (#14)
• 76bb842 fix(config): remove 3 non-existent MCP packages from the example config (#13)
• See full diff in compare view

Updates tsx from 4.22.4 to 4.23.0

Release notes

Sourced from tsx's releases.

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 1dfad37 docs: cite esbuild's extension-resolution model in node notes
• 257bbbb fix: avoid redundant filesystem probes during module resolution
• c178197 feat: add multi-scenario startup benchmark suite
• 51800ac docs: add Node internals knowledge base (notes/node)
• a305f36 fix: isolate hook state per async module.register() registration
• ca501a9 chore: upgrade skills-npm to v1.2.0
• 596cd1f test: cover __dirname, __filename, & require.cache in CJS TS file
• 75d9bf0 test: lock in lenient ESM for ambiguous and CJS-typed packages
• 1472f3e test: cover ESM-syntax dependency with omitted "type" field
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.