chore(deps): bump the npm-minor-and-patch group across 1 directory with 38 updates

[dependabot]

Bumps the npm-minor-and-patch group with 38 updates in the / directory:

Package	From	To
@changesets/cli	3.0.1	3.0.2
@eslint-react/eslint-plugin	5.18.6	5.19.0
typescript-eslint	8.68.0	8.70.0
@assistant-ui/core	0.2.22	0.3.17
@assistant-ui/react	0.14.27	0.15.18
@assistant-ui/store	0.2.21	0.3.12
monaco-editor	0.52.2	0.56.0
react-router-dom	7.18.2	7.18.3
@types/react-dom	19.2.5	19.2.7
tsx	4.23.12	4.23.13
@anthropic-ai/sandbox-runtime	0.0.71	0.0.75
@daytona/sdk	0.204.1	0.211.2
@hono/swagger-ui	0.2.2	0.6.1
@hono/zod-openapi	1.6.1	1.6.3
hono	4.13.5	4.13.7
jose	6.2.10	6.2.12
openid-client	6.8.7	6.8.8
undici	7.29.0	7.29.1
zod	4.4.3	4.5.4
@swc/core	1.16.1	1.16.2
@ai-sdk/alibaba	2.0.37	2.0.41
@ai-sdk/anthropic	4.0.44	4.0.49
@ai-sdk/google	4.0.53	4.0.64
@ai-sdk/moonshotai	3.0.41	3.0.45
@ai-sdk/openai	4.0.49	4.0.60
@ai-sdk/openai-compatible	3.0.39	3.0.44
@ai-sdk/provider	4.0.8	4.0.10
@ai-sdk/provider-utils	5.0.32	5.0.36
@nats-io/nats-core	3.0.2	3.4.0
@opentelemetry/core	2.10.0	2.11.0
ai	7.0.82	7.0.93
openai	7.5.0	7.10.0
@openuidev/react-headless	0.9.4	0.9.13
@openuidev/react-lang	0.2.9	0.2.15
@openuidev/react-ui	0.13.3	0.13.10
lucide-react	0.562.0	0.577.0
react-resizable-panels	4.12.3	4.12.4
@testing-library/react	16.3.2	16.3.3

Updates @changesets/cli from 3.0.1 to 3.0.2

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.2

Patch Changes

• #2270 a0a4dc6 Thanks @​bluwy! - Add review message on pre exit
• Updated dependencies [1f4eb61, 059f70a]:
  • @​changesets/apply-release-plan@​8.1.0
  • @​changesets/git@​4.0.1
  • @​changesets/read@​1.0.1

Changelog

Sourced from @​changesets/cli's changelog.

3.0.2

Patch Changes

• #2270 a0a4dc6 Thanks @​bluwy! - Add review message on pre exit
• Updated dependencies [1f4eb61, 059f70a]:
  • @​changesets/apply-release-plan@​8.1.0
  • @​changesets/git@​4.0.1
  • @​changesets/read@​1.0.1

Commits

• d7e4a2d Version Packages (#2266)
• 68affee Upgrade to Vitest 5 (#2281)
• 5eeb012 Build(deps): Bump human-id in the production-dependencies group (#2279)
• a0a4dc6 Add review message on pre exit (#2270)
• 1f4eb61 Add default changelog message for empty release (#2265)
• 2eb65ba Add script to run unit and e2e tests separately (#2267)
• ff2b075 Build(deps-dev): Bump @​lydell/node-pty (#2254)
• 8eff462 Build(deps-dev): Bump the development-dependencies group across 1 directory w...
• See full diff in compare view

Updates @eslint-react/eslint-plugin from 5.18.6 to 5.19.0

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.19.0 (2026-09-07)

What's Changed

✨ New

• react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, a useState/useReducer state value, or a custom hook matching the additionalStateHooks setting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#1948, closes #1941)
• react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g. const copy = { ...state } / const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#1948)

Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0

Attestation

https://github.com/Rel1cx/eslint-react/attestations/45585492

v5.18.10 (2026-09-06)

What's Changed

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #1947, see #1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

Attestation

https://github.com/Rel1cx/eslint-react/attestations/45547760

v5.18.9 (2026-09-06)

What's Changed

🏗️ Internal

• Bumped eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0, nx to 23.2.0, dprint to 0.57.4, @types/react-dom to 19.2.7, @eslint/compat to 2.1.1, and @nubjs/nub to 0.8.3.

Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9

Attestation

https://github.com/Rel1cx/eslint-react/attestations/45544496

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.19.0 (2026-09-07)

✨ New

• react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, a useState/useReducer state value, or a custom hook matching the additionalStateHooks setting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#1948, closes #1941)
• react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g. const copy = { ...state } / const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#1948)

Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0

v5.18.10 (2026-09-06)

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #1947, see #1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

v5.18.9 (2026-09-06)

🏗️ Internal

• Bumped eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0, nx to 23.2.0, dprint to 0.57.4, @types/react-dom to 19.2.7, @eslint/compat to 2.1.1, and @nubjs/nub to 0.8.3.

Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9

v5.18.8 (2026-09-05)

🐞 Fixes

• Preset configs (recommended, strict, etc.) now register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when the plugin is registered manually and a preset is extended at the same time. (#1947, closes #1946)

🏗️ Internal

• Re-enabled the import-integrity-lint plugin and patched its path prefix check so sibling directories like examples/preact and examples/preact-compat no longer collide.
• Pinned fast-uri to ^3.1.5 to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7).
• Bumped @effect/language-service to 0.87.2, @effect/platform to 0.97.1, @effect/platform-node to 0.108.1, @nubjs/nub to 0.8.2, @types/node to 26.4.1, dprint to 0.57.0, and lucide-react to 1.39.0.

Full Changelog: Rel1cx/eslint-react@v5.18.7...v5.18.8

v5.18.7 (2026-09-02)

🐞 Fixes

• react-x/set-state-in-effect: no longer misattributes render-phase setState calls to effects when the state updater is passed through a prop function. (#1945)

🏗️ Internal

... (truncated)

Commits

• 6eee240 release: 5.19.0
• 3613135 release: 5.18.10
• 662e99a release: 5.18.9
• f9eeb3e chore(deps): update eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0 and ...
• 5a58608 release: 5.18.8
• 4eb8b48 fix: register the same plugin object in preset configs as the default… (#1947)
• 466ff59 chore(deps): pin fast-uri to ^3.1.5 to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7)
• 1943f39 chore(deps): update typescript to 7.0.2 and other deps
• e43350f release: 5.18.7
• 15a429a chore(deps): update typescript-eslint to 8.69.0 and other deps
• See full diff in compare view

Updates typescript-eslint from 8.68.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

• eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

• eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
• eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
• eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
• website: respect allowJs playground config (#12744)

❤️ Thank You

• Abdu Alim Arlikhozhaev @​Arlikhozhaev
• Evyatar Daud @​StyleShit

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• 9a6e546 chore(release): publish 8.69.0
• See full diff in compare view

Updates @assistant-ui/core from 0.2.22 to 0.3.17

Release notes

Sourced from @​assistant-ui/core's releases.

@​assistant-ui/core@​0.3.17

Patch Changes

• #6723 8cc962e - feat: let a tool approval request describe itself and report its outcome (@​okisdev)

  an approval carries prompt, display, and allowFreeform, so a renderer can tell a question from a permission gate without reading provider metadata, and ToolApprovalResponse gains a text answer that resolves the request as answered rather than approved. respondToToolApproval now returns a promise that rejects when the runtime could not record the response, instead of the external-store runtime logging the rejection away, so a refused response leaves the request retryable.

• #6539 2a31285 - fix: avoid duplicate external-store runtime publications (@​rupic-app)

• #6685 205acf5 - refactor: walk the nested tool-call tree through one shared traversal (@​okisdev)

• #6678 740a573 - fix: never execute a frontend tool on a tool call ADK resolves itself; a client-executed tool must be registered as a LongRunningFunctionTool on the agent (@​okisdev)

• #6498 65d449b - feat: background thread bodies and a plain cloud adapter factory (@​okisdev)

  RemoteThreadList gains a backgroundThreads mode that keeps every visited thread mounted: runs continue across switches, per-item isRunning is live, per-thread history and adapters mount once per body, and a freshly initialized thread generates its title. createCloudThreadListAdapter builds the assistant-cloud adapter without a hook call site so non-React hosts can construct it in plain code.

• #6671 79283c5 - fix: report lifecycle events from background thread runtimes (@​rupic-app)

• #6645 9ec29e1 - fix: report run start and end for threads a remote thread list keeps alive in the background (@​Kinfe123)

• #6702 14fc938 - fix: cancel AssistantFrame tool calls when their provider is removed (@​Kinfe123)

• #6562 3f7af8b - fix: preserve composer queue item component identity after removals (@​Kinfe123)

• #6597 5511057 - fix: preserve thread list item state when preceding threads are removed (@​Kinfe123)

• #6580 dc2cab3 - chore: stop hand-rolling the cloud adapter provider that the hosts synthesize (@​okisdev)

• #6587 d75944b - fix: keep Cloud thread adapter options scoped to committed renders (@​Kinfe123)

• #6547 6bd1570 - fix: drop zustand from core (@​okisdev)

  core declared zustand as an optional peer while importing create and useShallow unconditionally. pnpm keys a package instance on its resolved peers, so two dependency branches landing on different zustand patches (5.0.14 under one, 5.0.15 under the other) produced two physical copies of core. React context is per copy, so a RuntimeAdapterProvider rendered by one copy was invisible to a runtime hook imported from the other: unstable_Provider supplied a history adapter, useAISDKRuntime read undefined, withFormat() never fired, and every thread loaded with no messages and no error.

  core no longer uses zustand at all, so the peer is gone rather than reclassified. the four internal stores now use WritableSubscribable, a mutable cell built on the existing BaseSubscribable and read through useSubscribable. the two useShallow call sites wrapped selectors passed to useAuiState, aui's own store, so they now use useShallowSelector from @assistant-ui/store/internal, which memoizes a selector against the shallowEqual that already lived there.

  WritableSubscribable reports a server snapshot and useSubscribable forwards one when the subscribable offers it, so the components reading these stores render under SSR the way the zustand hook did. Subscribables without one, including every existing runtime client, keep their current behaviour.

  @assistant-ui/react-native and @assistant-ui/react-ink declared zustand only to satisfy core's optional peer and never imported it, so they no longer declare it. @assistant-ui/react and @assistant-ui/ui keep theirs because they import it directly, and @assistant-ui/react additionally exposes StoreApi through ReadonlyStore in its published types.

• #6758 60ae973 - fix: keep model context callbacks scoped to committed React renders (@​Kinfe123)

• #6719 0fb5390 - fix: never run a frontend tool on a call the provider is about to answer or gate (@​okisdev)

  a tool call whose name matched a registered tool closed its args stream, and therefore executed, as soon as argsText parsed. providers that answer or gate a call do so one or more snapshots later, so in that window a frontend execute fired on a call the provider was about to take: the AG-UI interrupt protocol carries the outcome only on RUN_FINISHED, so the gate landed on a call the client had already run.

  closing the args stream now waits until the provider can no longer speak about the call. unstable_isClientToolCall decides that per call: a call the adapter reports as client-owned closes as soon as its arguments parse, and a call whose ownership is unknown closes when the run ends. @assistant-ui/react-google-adk supplies the predicate and keeps its previous timing; every other runtime defers a frontend tool to the end of the run. streamCall still fires once and still streams partial arguments as they arrive, so rendering is unchanged, but a tool that pairs streamCall with execute (interactables) now commits its authoritative merge when the run settles.

• #6580 dc2cab3 - chore: remove an internal re-export shim and a duplicated type guard (@​okisdev)

... (truncated)

Changelog

Sourced from @​assistant-ui/core's changelog.

0.3.17

Patch Changes

• #6723 8cc962e - feat: let a tool approval request describe itself and report its outcome (@​okisdev)

  an approval carries prompt, display, and allowFreeform, so a renderer can tell a question from a permission gate without reading provider metadata, and ToolApprovalResponse gains a text answer that resolves the request as answered rather than approved. respondToToolApproval now returns a promise that rejects when the runtime could not record the response, instead of the external-store runtime logging the rejection away, so a refused response leaves the request retryable.

• #6539 2a31285 - fix: avoid duplicate external-store runtime publications (@​rupic-app)

• #6685 205acf5 - refactor: walk the nested tool-call tree through one shared traversal (@​okisdev)

• #6678 740a573 - fix: never execute a frontend tool on a tool call ADK resolves itself; a client-executed tool must be registered as a LongRunningFunctionTool on the agent (@​okisdev)

• #6498 65d449b - feat: background thread bodies and a plain cloud adapter factory (@​okisdev)

  RemoteThreadList gains a backgroundThreads mode that keeps every visited thread mounted: runs continue across switches, per-item isRunning is live, per-thread history and adapters mount once per body, and a freshly initialized thread generates its title. createCloudThreadListAdapter builds the assistant-cloud adapter without a hook call site so non-React hosts can construct it in plain code.

• #6671 79283c5 - fix: report lifecycle events from background thread runtimes (@​rupic-app)

• #6645 9ec29e1 - fix: report run start and end for threads a remote thread list keeps alive in the background (@​Kinfe123)

• #6702 14fc938 - fix: cancel AssistantFrame tool calls when their provider is removed (@​Kinfe123)

• #6562 3f7af8b - fix: preserve composer queue item component identity after removals (@​Kinfe123)

• #6597 5511057 - fix: preserve thread list item state when preceding threads are removed (@​Kinfe123)

• #6580 dc2cab3 - chore: stop hand-rolling the cloud adapter provider that the hosts synthesize (@​okisdev)

• #6587 d75944b - fix: keep Cloud thread adapter options scoped to committed renders (@​Kinfe123)

• #6547 6bd1570 - fix: drop zustand from core (@​okisdev)

  core declared zustand as an optional peer while importing create and useShallow unconditionally. pnpm keys a package instance on its resolved peers, so two dependency branches landing on different zustand patches (5.0.14 under one, 5.0.15 under the other) produced two physical copies of core. React context is per copy, so a RuntimeAdapterProvider rendered by one copy was invisible to a runtime hook imported from the other: unstable_Provider supplied a history adapter, useAISDKRuntime read undefined, withFormat() never fired, and every thread loaded with no messages and no error.

  core no longer uses zustand at all, so the peer is gone rather than reclassified. the four internal stores now use WritableSubscribable, a mutable cell built on the existing BaseSubscribable and read through useSubscribable. the two useShallow call sites wrapped selectors passed to useAuiState, aui's own store, so they now use useShallowSelector from @assistant-ui/store/internal, which memoizes a selector against the shallowEqual that already lived there.

  WritableSubscribable reports a server snapshot and useSubscribable forwards one when the subscribable offers it, so the components reading these stores render under SSR the way the zustand hook did. Subscribables without one, including every existing runtime client, keep their current behaviour.

  @assistant-ui/react-native and @assistant-ui/react-ink declared zustand only to satisfy core's optional peer and never imported it, so they no longer declare it. @assistant-ui/react and @assistant-ui/ui keep theirs because they import it directly, and @assistant-ui/react additionally exposes StoreApi through ReadonlyStore in its published types.

• #6758 60ae973 - fix: keep model context callbacks scoped to committed React renders (@​Kinfe123)

• #6719 0fb5390 - fix: never run a frontend tool on a call the provider is about to answer or gate (@​okisdev)

  a tool call whose name matched a registered tool closed its args stream, and therefore executed, as soon as argsText parsed. providers that answer or gate a call do so one or more snapshots later, so in that window a frontend execute fired on a call the provider was about to take: the AG-UI interrupt protocol carries the outcome only on RUN_FINISHED, so the gate landed on a call the client had already run.

  closing the args stream now waits until the provider can no longer speak about the call. unstable_isClientToolCall decides that per call: a call the adapter reports as client-owned closes as soon as its arguments parse, and a call whose ownership is unknown closes when the run ends. @assistant-ui/react-google-adk supplies the predicate and keeps its previous timing; every other runtime defers a frontend tool to the end of the run. streamCall still fires once and still streams partial arguments as they arrive, so rendering is unchanged, but a tool that pairs streamCall with execute (interactables) now commits its authoritative merge when the run settles.

... (truncated)

Commits

• d511ff4 chore: update versions (#6482)
• 0c68179 fix(core): isolate model context update listener errors (#6781)
• ddaac94 fix(core): isolate late initialize listener errors (#6728)
• 1fa3e09 fix(ai-sdk): mark stopped runs as cancelled (#6761)
• 0c5c574 fix(core): keep a pending human() interrupt when execution starts (#6764)
• 47a46db fix: keep remote thread clients commit-safe (#6760)
• 60ae973 fix(core): keep model context hooks commit-safe (#6758)
• 8cc962e feat: let a tool approval request describe itself and report its outcome (#6723)
• 0fb5390 fix(core): run a frontend tool only once the provider's run settles (#6719)
• 6fdfc23 fix(core): keep remote thread runtime hooks commit-safe (#6711)
• Additional commits viewable in compare view

Updates @assistant-ui/react from 0.14.27 to 0.15.18

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.18

Patch Changes

• #6723 8cc962e - feat: let a tool approval request describe itself and report its outcome (@​okisdev)

  an approval carries prompt, display, and allowFreeform, so a renderer can tell a question from a permission gate without reading provider metadata, and ToolApprovalResponse gains a text answer that resolves the request as answered rather than approved. respondToToolApproval now returns a promise that rejects when the runtime could not record the response, instead of the external-store runtime logging the rejection away, so a refused response leaves the request retryable.

• #6762 39c99b5 - fix(react): keep trigger callbacks commit-safe (@​Kinfe123)

• #6640 79c1465 - fix: load newly mounted MCP Apps through the committed host (@​Kinfe123)

• #6580 dc2cab3 - chore: drop a superseded internal hook and a dead plugin-registry variant (@​okisdev)

• #6710 a83be6b - fix(react): accept spec-shaped MCP App messages (@​rupic-app)

  the default sendMessage handler now reads the MCP Apps { role, content } params and appends each text block in order, alongside the existing string, { prompt }, { text }, and { message } forms. rejections now also carry the spec's isError: true, and the legacy ok and reason fields stay on the result so widgets already reading them keep working.

• #6706 6194f3e - fix(react): keep model-context mentions current and honor explicit tool categories without requiring custom categories (@​Kinfe123)

• #6528 152a35d - chore: update dependencies (@​okisdev)

• #6629 98b7213 - feat: resolve MCP App renderer options per part (@​okisdev)

  McpAppRenderer served every MCP app in a thread from one static options snapshot, so a host could not give one app its own displayMode and could not tell which app called requestDisplayMode. Renderer options now reach each part through the renderer store, and a new forPart resolver overrides hostContext, maxHeight, sandbox, hostInfo, and the fallbacks for a single part. handlers merges per key instead, so adding a per-part requestDisplayMode keeps the thread-wide handlers for that app. Host context changes are compared structurally before they are pushed over the bridge, so a resolver may rebuild its result on every render.

• #6586 9f08bdc - chore: reuse the shared viewport math and callback invoker (@​okisdev)

• #6639 05e3e6d - chore: update dependencies (@​Yonom)

• #6615 e7bcf83 - fix: report a sandboxed frame that never finishes loading through onError, and re-export the ShimLoadError and ShimLoadErrorCode types it is reported with (@​okisdev)

• #6714 0f3140d - refactor(react): extract a shared model-context snapshot hook for the mention adapter and the webmcp provider (@​okisdev)

• #6540 99db167 - feat: unstable_useWebMcpProvider, publishing frontend tools to a WebMCP-capable browser (@​samdickson22)

• #6703 21cbb78 - refactor: collapse the three trigger-item query predicates onto one shared helper (@​Kinfe123)

• #6614 1b25b22 - refactor: dispose WebMCP registrations through the abort signal alone (@​okisdev)

• Updated dependencies [8cc962e, 2a31285, 6083062, 205acf5, 740a573, 65d449b, 79283c5, 9ec29e1, 14fc938, 3f7af8b, 46fad14, 5511057, dc2cab3, d75944b, 99fd86e, 6bd1570, 7f7bd54, 60ae973, 9f08bdc, 0fb5390, dc2cab3, f0d0aa2, 1fa3e09, 5972a5e, 0f17ba5, 152a35d, 0c5c574, ddaac94, 0c68179, 250f69c, c22a3dc, aca6e30, 5bdd416, 6fdfc23, 136bbf5, e53299b, 69d8e1b, dabe8f2, 8d128af, 9f08bdc, e7bcf83, 47a46db, 8135d16, 07fed43, fa9c0dc, fa9c0dc, 4ca7de9, 65d449b, 49e727b, 49e727b, d9eae73, d56a66a, 96a2df8, 8206d8f]:

  • @​assistant-ui/core@​0.3.17
  • safe-content-frame@0.0.29
  • assistant-stream@0.3.41
  • assistant-cloud@0.1.43
  • @​assistant-ui/store@​0.3.12
  • @​assistant-ui/tap@​0Description has been truncated

    ---

    [!NOTE]
    Medium Risk
    No code changes, but assistant-ui 0.3.x and AI/auth/server dependency bumps can alter chat tool flows, validation, and OIDC/Swagger behavior at runtime; CI and manual smoke on chat plus API docs are the main guardrails.

    Overview
    This PR only updates version pins in root and package package.json files (no application source changes). It refreshes 38 dependencies via the automated npm-minor-and-patch group.

    Chat UI (frontend, trueforge-ui): @assistant-ui/core, @assistant-ui/react, and @assistant-ui/store move from the 0.2 / 0.14 line to 0.3.17 / 0.15.18 / 0.3.12, alongside monaco-editor 0.56, @openuidev/* patches, and react-router-dom tightened to ^7 in trueforge-ui.

    Agent runtime (trueforge-core): Vercel ai and @ai-sdk/* providers, openai, zod, @daytona/sdk, @nats-io/nats-core, and related tooling are bumped to newer patch/minor releases.

    Server (trueforge): hono, @hono/zod-openapi, @hono/swagger-ui (0.2 → 0.6), jose, openid-client, sandbox (@anthropic-ai/sandbox-runtime, @daytona/sdk), and zod are updated in step with core.

    Tooling: Root devDeps include typescript-eslint, @eslint-react/eslint-plugin, and @changesets/cli patch bumps.

    ^{Reviewed by} Cursor Bugbot for commit 9a068f381cd950e5082b26bc87485416d9568d22. Bugbot is set up for automated code reviews on this repo. Configure here.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9a068f3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Router range drops v6 support

Medium Severity

react-router-dom on the published @truefoundry/trueforge-ui package changed from ^6 || ^7 to ^7. Hosts still on React Router v6 will now resolve a second v7 copy or fail peer installation, which can break withRouter URL sync.

 

^{Reviewed by Cursor Bugbot for commit 7776308. Configure here.}

[cursor]

Published packages missing changeset

Low Severity

Runtime dependency ranges that ship in published packages changed, but this PR adds no .changeset/*.md. Run pnpm changeset and bump @truefoundry/trueforge-ui, @truefoundry/trueforge-core, and @truefoundry/trueforge.

Additional Locations (2)

• packages/trueforge-core/package.json#L101-L122
• packages/trueforge/package.json#L62-L85

 

^{Triggered by project rule: TrueForge review rules}

^{Reviewed by Cursor Bugbot for commit 7776308. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Published packages lack a changeset

Low Severity

Dependency versions that ship in published packages changed, but this PR adds no .changeset/*.md. Run pnpm changeset for @truefoundry/trueforge-core, @truefoundry/trueforge, and @truefoundry/trueforge-ui.

Additional Locations (2)

• packages/trueforge/package.json#L62-L84
• packages/trueforge-ui/package.json#L92-L113

 

^{Triggered by project rule: TrueForge review rules}

^{Reviewed by Cursor Bugbot for commit 8027e00. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Monaco 0.56 export break

Medium Severity

monaco-editor jumped from ^0.52.0 to ^0.56.0. 0.56 rewrote the package exports map so deep esm/vs/... worker specifiers no longer resolve. vite-plugin-monaco-editor-esm and the monacoeditorwork public-path rewrite can fail to load workers, breaking the editor or falling back to the main thread.

 

^{Reviewed by Cursor Bugbot for commit 5794f77. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Assistant-ui bump is inconsistent

High Severity

package.json now pins @assistant-ui/core 0.3.17, @assistant-ui/react 0.15.18, and @assistant-ui/store 0.3.12, but workspace overrides still force 0.2.22 / 0.14.27 / 0.2.21, the lockfile still records those old specifiers, and @truefoundry/trueforge-ui optional peers remain ^0.2.22 / ^0.14.24. Local installs never exercise the new 0.15 APIs, pnpm install can fail under trustLockfile, and published consumers would resolve breaking 0.3/0.15 releases that this repo did not test.

Additional Locations (2)

• packages/trueforge-ui/package.json#L92-L94
• packages/trueforge-ui/package.json#L74-L76

 

^{Reviewed by Cursor Bugbot for commit 2079f15. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 6 total unresolved issues (including 5 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7fb549d. Configure here.}