Bump the npm-minor-patch group with 2 updates

[dependabot]

Bumps the npm-minor-patch group with 2 updates: @vercel/connect and eve.

Updates @vercel/connect from 0.3.3 to 0.4.2

Release notes

Sourced from @​vercel/connect's releases.

@​vercel/connect@​0.4.2

Patch Changes

• 0be0e28: Adding support for authorization mode override via env var.

@​vercel/connect@​0.4.1

Patch Changes

• dad41da: Test Connect against a recent stable Eve and AI SDK 7 release.

@​vercel/connect@​0.4.0

Minor Changes

• c636d67: Add optional claims field to ConnectTokenResponse for allow-listed upstream OAuth token claims

Changelog

Sourced from @​vercel/connect's changelog.

0.4.2

Patch Changes

• 0be0e28: Adding support for authorization mode override via env var.

0.4.1

Patch Changes

• dad41da: Test Connect against a recent stable Eve and AI SDK 7 release.

0.4.0

Minor Changes

• c636d67: Add optional claims field to ConnectTokenResponse for allow-listed upstream OAuth token claims

Commits

• c1125ef Version Packages (#17172)
• 0be0e28 [@​vercel/connect] adding authorization mode override env var (#17166)
• 917f31e Version Packages (#17147)
• dad41da [connect] Update Eve test dependency (#17145)
• dc224ce Version Packages (#17126)
• c636d67 feat(connect): add claims field to ConnectTokenResponse (#17133)
• See full diff in compare view

Updates eve from 0.24.4 to 0.27.1

Release notes

Sourced from eve's releases.

eve@0.27.1

Patch Changes

• eaaf6d6: Enable Workflow's optimistic concurrency precondition guard in every generated Vercel workflow function so stale replays reload concurrent events before committing.
• 6ded22e: Preserve every queued delivery's message, context, and input responses when eve batches payloads before routing.
• 3ffaf12: Added a Slack onMessage hook with isBotMentioned() and isSubscribed() helpers for custom message routing.
• 49f2f13: Report connection_search as failed when every targeted connection fails to load, including authorization startup failures, so tool-call observability preserves the underlying error. Requests for unregistered connections now fail instead of returning an empty result.
• 9679abc: Added an isSubscribed() helper to the Microsoft Teams onMessage hook for custom routing that can continue conversations without repeated mentions.
• 1a618ba: Add a generic Slack onEvent fallback for subscribed Events API callbacks. Handlers can use a Slack-bound receive function to start zero, one, or many agent turns while authored mention and direct-message handlers retain precedence.
• 0df8ab9: Update the bundled AI SDK and provider integrations to their latest compatible releases.
• 394b467: Update the bundled Vercel integrations and core execution utilities to their latest compatible releases.
• f2724fb: Update the Vite integration and Vitest test tooling to their latest compatible releases.
• 01552fc: Update the bundled Workflow runtime dependencies to their latest 5.0 beta releases.
• dd1ba23: Declining a session token-budget prompt now cancels the in-flight turn cleanly (turn.cancelled → session.waiting) instead of completing the session or surfacing an error to the delegating parent. Declining a delegated child's prompt cancels the whole turn tree from the root, so the parent can no longer retry the child against a fresh quota share, and stale answers to budget prompts are dropped instead of being shown to the model. The prompt copy is reworded ("This session has hit the input-token limit (2M) per session…") with Approve/Stop buttons.
• a70d4ce: Restart native progress feedback across built-in chat channels when a completed connection authorization resumes the agent session. Slack also shows an explicit connected and resuming status.
• d3cd770: Generated Web Chat apps now retain completed sessions for follow-up messages and cancel the active durable turn when Stop is clicked instead of only disconnecting the browser stream.

eve@0.27.0

Minor Changes

• 1db41fd: eve/nuxt now deploys the agent through Vercel's stable services model: on Vercel builds the module generates an eve Build Output service and a /eve/v1/* service route instead of writing legacy experimentalServices to vercel.json, which Vercel no longer routes (every agent request returned a platform NOT_FOUND). The configureVercelJson and servicePrefix module options and the EVE_NUXT_SERVICE_PREFIX export were removed. Delete any generated experimentalServices block from vercel.json — the module warns when it sees one — or declare the eve service and its rewrite yourself under the stable services field to keep managing routing manually.

  A generated eve service build now also skips host middleware preservation when the host's Build Output config is not yet present, instead of failing the build. Unlike the Next.js integration, which writes that config early, the Nuxt web service emits it only at the end of its own build, so an isolated eve service build could crash reading a file that had no middleware to preserve.

Patch Changes

• 707de7f: Anthropic models served through the standard @ai-sdk/amazon-bedrock Converse provider are now detected as cacheable. Prompt-cache breakpoints previously only matched on the provider name, so Bedrock (which reports provider amazon-bedrock and carries the Anthropic identity in the model id) fell through to no caching. The cache marker now also carries the Bedrock cachePoint namespace that the Converse provider reads.
• 7df0bf1: Compaction now reserves room for its checkpoint prompt before reaching the configured threshold. The prompt asks the compaction model to distinguish completed work from remaining work, and later compactions receive the previous checkpoint intact instead of truncating it with ordinary transcript text.
• 7df0bf1: Compaction now feeds the summarizer full-fidelity conversation text (tool payloads stay compact) and first tries evicting older tool results before summarizing; the kept recent window retains tool results verbatim. Agents lose less context per compaction and stop re-running completed tools.
• c0e368a: Routes protected by httpBasic() now advertise a standards-compliant WWW-Authenticate: Basic challenge on 401, using an optional realm that defaults to "eve"; HTTP Basic credentials are normalized to Unicode NFC to match the advertised UTF-8 encoding. routeAuth collects challenges from the configured auth strategies instead of always emitting Bearer.

eve@0.26.2

Patch Changes

• dbca15c: Bump the vendored chat SDK (chat, @chat-adapter/*) from 4.31.0 to 4.34.0. Slack card tables now render as native data table blocks — paginated and sortable — instead of plain table blocks, and Table() supports optional caption and pageSize fields.
• 938ef92: Identify Eve and its version on AI Gateway, Sandbox, and Workflow service requests.
• d034e01: Fixed the default chat message reducer dropping assistant text when a single turn produced more than one message — for example, text shown before an OAuth authorization prompt was overwritten by the text that followed it once authorization completed. Each message now renders in the order it arrived.
• dad9472: eve info now reports discovered subagents and schedules in both the human table and the --json output, matching what the CLI reference already documented. Previously both surfaces silently omitted them even though discovery resolved them correctly.
• f1253c5: Listing or loading static skills no longer requires opening a sandbox. Dynamic skills and access to supporting skill package files, such as references, assets, and scripts, remain sandbox-backed.
• de917a6: Fix a crash when an agent is triggered by a bare mention with no text (e.g. sending just @bot in a Microsoft Teams channel). The agent now responds normally instead of failing.

eve@0.26.1

Patch Changes

• 1f04ff7: The dev TUI renders Markdown through a real GFM parser (width-fitted tables, code blocks, task lists, links), presents every builtin tool with semantic activity copy (Fetch <url>, Run <command>, Search <query> — including web_search across provider input shapes, todo, ask_question, agent, and connection_search), and shows rejected tool approvals as denied instead of successful. Tool activity now accumulates in place: an in-flight batch renders as one counted header with its newest calls listed first behind a │ rail and a … (N more) elision, then collapses to a single past-tense line (▪ Fetched 30 URLs) once every call settles — failures keep their itemized per-call error rail — and each write_file keeps its own block rendering a real line diff (+/- rows with context, computed from content the session has already seen — prior writes and full-file reads; new files show all additions). ask_question prompts open as a numbered overlay panel above the input (number keys select directly, the "Type your own answer" row focuses its inline editor on reach, Esc dismisses to plain text input), committing as ? question ⎿ answer in the transcript. The todo tool no longer emits transcript blocks; it drives a pinned panel above the input showing per-task state, which commits as a completed block once every task settles. An empty prompt now shows a quiet › mark with a rotating placeholder of things to try, switching to the active ❯ once typing starts. Reasoning defaults to a fixed one-line thinking indicator that updates in place (persisting as ○ Thought for 12s only for long thoughts; --reasoning full restores the streaming trace), the prompt stays anchored during a turn with Enter inert (the draft carries into the next prompt), and completed turns close with a └ Done in <duration> stats coda (per-turn token flow, context fill) when the turn was long or expensive. Subagent calls render as individual ※ subagent(<name>) #N sections in the tool column whose child rows window to the three most recently active (failures stay itemized while settled work condenses to one counted row) and close on a corner that reports Done once the call's final message arrives; captured server output renders as one open-railed ○ stderr / ○ stdout stream section per source (streams are continuous — no closing corner, and interleaved activity never fragments them): the section sits at its newest write's position — everything that happened after the last error displays after it — and shows only that newest write, with earlier ones behind an … (N more) count (the stored-diagnostics pointer carries the history); the status bar names the model's actual routing and credential (via ai-gateway(oidc:<project>), via ai-gateway(api-key), or via <provider>⌝ for a directly-authored endpoint); an empty prompt no longer submits; and a mid-conversation session replacement marks the context cut with a ┌── Session restarted, clear context. boundary line.

eve@0.26.0

Minor Changes

• 26504e9: The client now reconnects durable event streams from their last cursor, so long turns continue across transient connection cuts without replaying events. Stream retries are now managed internally, interrupted sessions remain resumable, and maxReconnectAttempts has been removed from ClientOptions, EveAgentStoreInit, and the React, Svelte, and Vue UseEveAgentOptions APIs.

... (truncated)

Changelog

Sourced from eve's changelog.

0.27.1

Patch Changes

• eaaf6d6: Enable Workflow's optimistic concurrency precondition guard in every generated Vercel workflow function so stale replays reload concurrent events before committing.
• 6ded22e: Preserve every queued delivery's message, context, and input responses when eve batches payloads before routing.
• 3ffaf12: Added a Slack onMessage hook with isBotMentioned() and isSubscribed() helpers for custom message routing.
• 49f2f13: Report connection_search as failed when every targeted connection fails to load, including authorization startup failures, so tool-call observability preserves the underlying error. Requests for unregistered connections now fail instead of returning an empty result.
• 9679abc: Added an isSubscribed() helper to the Microsoft Teams onMessage hook for custom routing that can continue conversations without repeated mentions.
• 1a618ba: Add a generic Slack onEvent fallback for subscribed Events API callbacks. Handlers can use a Slack-bound receive function to start zero, one, or many agent turns while authored mention and direct-message handlers retain precedence.
• 0df8ab9: Update the bundled AI SDK and provider integrations to their latest compatible releases.
• 394b467: Update the bundled Vercel integrations and core execution utilities to their latest compatible releases.
• f2724fb: Update the Vite integration and Vitest test tooling to their latest compatible releases.
• 01552fc: Update the bundled Workflow runtime dependencies to their latest 5.0 beta releases.
• dd1ba23: Declining a session token-budget prompt now cancels the in-flight turn cleanly (turn.cancelled → session.waiting) instead of completing the session or surfacing an error to the delegating parent. Declining a delegated child's prompt cancels the whole turn tree from the root, so the parent can no longer retry the child against a fresh quota share, and stale answers to budget prompts are dropped instead of being shown to the model. The prompt copy is reworded ("This session has hit the input-token limit (2M) per session…") with Approve/Stop buttons.
• a70d4ce: Restart native progress feedback across built-in chat channels when a completed connection authorization resumes the agent session. Slack also shows an explicit connected and resuming status.
• d3cd770: Generated Web Chat apps now retain completed sessions for follow-up messages and cancel the active durable turn when Stop is clicked instead of only disconnecting the browser stream.

0.27.0

Minor Changes

• 1db41fd: eve/nuxt now deploys the agent through Vercel's stable services model: on Vercel builds the module generates an eve Build Output service and a /eve/v1/* service route instead of writing legacy experimentalServices to vercel.json, which Vercel no longer routes (every agent request returned a platform NOT_FOUND). The configureVercelJson and servicePrefix module options and the EVE_NUXT_SERVICE_PREFIX export were removed. Delete any generated experimentalServices block from vercel.json — the module warns when it sees one — or declare the eve service and its rewrite yourself under the stable services field to keep managing routing manually.

  A generated eve service build now also skips host middleware preservation when the host's Build Output config is not yet present, instead of failing the build. Unlike the Next.js integration, which writes that config early, the Nuxt web service emits it only at the end of its own build, so an isolated eve service build could crash reading a file that had no middleware to preserve.

Patch Changes

• 707de7f: Anthropic models served through the standard @ai-sdk/amazon-bedrock Converse provider are now detected as cacheable. Prompt-cache breakpoints previously only matched on the provider name, so Bedrock (which reports provider amazon-bedrock and carries the Anthropic identity in the model id) fell through to no caching. The cache marker now also carries the Bedrock cachePoint namespace that the Converse provider reads.
• 7df0bf1: Compaction now reserves room for its checkpoint prompt before reaching the configured threshold. The prompt asks the compaction model to distinguish completed work from remaining work, and later compactions receive the previous checkpoint intact instead of truncating it with ordinary transcript text.
• 7df0bf1: Compaction now feeds the summarizer full-fidelity conversation text (tool payloads stay compact) and first tries evicting older tool results before summarizing; the kept recent window retains tool results verbatim. Agents lose less context per compaction and stop re-running completed tools.
• c0e368a: Routes protected by httpBasic() now advertise a standards-compliant WWW-Authenticate: Basic challenge on 401, using an optional realm that defaults to "eve"; HTTP Basic credentials are normalized to Unicode NFC to match the advertised UTF-8 encoding. routeAuth collects challenges from the configured auth strategies instead of always emitting Bearer.

0.26.2

Patch Changes

• dbca15c: Bump the vendored chat SDK (chat, @chat-adapter/*) from 4.31.0 to 4.34.0. Slack card tables now render as native data table blocks — paginated and sortable — instead of plain table blocks, and Table() supports optional caption and pageSize fields.
• 938ef92: Identify Eve and its version on AI Gateway, Sandbox, and Workflow service requests.
• d034e01: Fixed the default chat message reducer dropping assistant text when a single turn produced more than one message — for example, text shown before an OAuth authorization prompt was overwritten by the text that followed it once authorization completed. Each message now renders in the order it arrived.
• dad9472: eve info now reports discovered subagents and schedules in both the human table and the --json output, matching what the CLI reference already documented. Previously both surfaces silently omitted them even though discovery resolved them correctly.
• f1253c5: Listing or loading static skills no longer requires opening a sandbox. Dynamic skills and access to supporting skill package files, such as references, assets, and scripts, remain sandbox-backed.
• de917a6: Fix a crash when an agent is triggered by a bare mention with no text (e.g. sending just @bot in a Microsoft Teams channel). The agent now responds normally instead of failing.

0.26.1

Patch Changes

• 1f04ff7: The dev TUI renders Markdown through a real GFM parser (width-fitted tables, code blocks, task lists, links), presents every builtin tool with semantic activity copy (Fetch <url>, Run <command>, Search <query> — including web_search across provider input shapes, todo, ask_question, agent, and connection_search), and shows rejected tool approvals as denied instead of successful. Tool activity now accumulates in place: an in-flight batch renders as one counted header with its newest calls listed first behind a │ rail and a … (N more) elision, then collapses to a single past-tense line (▪ Fetched 30 URLs) once every call settles — failures keep their itemized per-call error rail — and each write_file keeps its own block rendering a real line diff (+/- rows with context, computed from content the session has already seen — prior writes and full-file reads; new files show all additions). ask_question prompts open as a numbered overlay panel above the input (number keys select directly, the "Type your own answer" row focuses its inline editor on reach, Esc dismisses to plain text input), committing as ? question ⎿ answer in the transcript. The todo tool no longer emits transcript blocks; it drives a pinned panel above the input showing per-task state, which commits as a completed block once every task settles. An empty prompt now shows a quiet › mark with a rotating placeholder of things to try, switching to the active ❯ once typing starts. Reasoning defaults to a fixed one-line thinking indicator that updates in place (persisting as ○ Thought for 12s only for long thoughts; --reasoning full restores the streaming trace), the prompt stays anchored during a turn with Enter inert (the draft carries into the next prompt), and completed turns close with a └ Done in <duration> stats coda (per-turn token flow, context fill) when the turn was long or expensive. Subagent calls render as individual ※ subagent(<name>) #N sections in the tool column whose child rows window to the three most recently active (failures stay itemized while settled work condenses to one counted row) and close on a corner that reports Done once the call's final message arrives; captured server output renders as one open-railed ○ stderr / ○ stdout stream section per source (streams are continuous — no closing corner, and interleaved activity never fragments them): the section sits at its newest write's position — everything that happened after the last error displays after it — and shows only that newest write, with earlier ones behind an … (N more) count (the stored-diagnostics pointer carries the history); the status bar names the model's actual routing and credential (via ai-gateway(oidc:<project>), via ai-gateway(api-key), or via <provider>⌝ for a directly-authored endpoint); an empty prompt no longer submits; and a mid-conversation session replacement marks the context cut with a ┌── Session restarted, clear context. boundary line.

... (truncated)

Commits

• 4373c25 Version Packages (#1028)
• 9679abc feat(eve): Update teams to add isSubscribed, isBotMentioned utility (#1068)
• 01552fc chore(eve): dependencies - update Workflow beta packages (#1073)
• 3ffaf12 feat(eve): Add onMessage hook w/ isSubscribed utility (#1046)
• 49f2f13 Fail connection search when connections cannot load (#1066)
• dd1ba23 fix(eve): cancel the turn tree when a session token-budget prompt is declined...
• 1a618ba feat(eve): slack - add generic event handler (#1044)
• e7e773a fix(eve): use native elicitations for the Linear channel (#1053)
• 6ded22e fix(eve): preserve coalesced delivery inputs (#1049)
• d3cd770 fix(eve): cancel durable turns from generated Web Chat (#950)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
evolve	Ready	Preview, Comment	Jul 23, 2026 5:25am