deps(deps): bump the npm-all-updates group across 1 directory with 6 updates

[dependabot]

Bumps the npm-all-updates group with 6 updates in the / directory:

Package	From	To
@ai-sdk/openai	3.0.88	3.0.90
@ai-sdk/provider-utils	4.0.40	4.0.41
@ai-sdk/openai-compatible	2.0.62	2.0.63
@biomejs/biome	2.5.5	2.5.6
ai	6.0.236	6.0.239
vite	8.1.5	8.2.0

Updates @ai-sdk/openai from 3.0.88 to 3.0.90

Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.90

Patch Changes

• Updated dependencies [9ecdefe]
  • @​ai-sdk/provider-utils@​4.0.41

3.0.89

Patch Changes

• 23632b1: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.

Commits

• 006a2f8 Version Packages (#18089)
• 98d8c43 Version Packages (#18028)
• 23632b1 [v6.0] feat: support blocked domains in OpenAI web search (#18035)
• See full diff in compare view

Updates @ai-sdk/provider-utils from 4.0.40 to 4.0.41

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

4.0.41

Patch Changes

• 9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.

Commits

• 006a2f8 Version Packages (#18089)
• 9ecdefe [v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads (#18095)
• See full diff in compare view

Updates @ai-sdk/openai-compatible from 2.0.62 to 2.0.63

Changelog

Sourced from @​ai-sdk/openai-compatible's changelog.

2.0.63

Patch Changes

• Updated dependencies [9ecdefe]
  • @​ai-sdk/provider-utils@​4.0.41

Commits

• 006a2f8 Version Packages (#18089)
• See full diff in compare view

Updates @biomejs/biome from 2.5.5 to 2.5.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

• #10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• See full diff in compare view

Updates ai from 6.0.236 to 6.0.239

Changelog

Sourced from ai's changelog.

6.0.239

Patch Changes

• Updated dependencies [d3d9e0b]
  • @​ai-sdk/gateway@​3.0.161

6.0.238

Patch Changes

• 9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
• 26d10c0: support overriding model call settings for individual prepareStep invocations
• 7767170: Preserve provider metadata from empty text deltas in streamText.
• Updated dependencies [9ecdefe]
• Updated dependencies [87fb433]
  • @​ai-sdk/provider-utils@​4.0.41
  • @​ai-sdk/gateway@​3.0.160

6.0.237

Patch Changes

• f6020d7: Avoid synthesizing client tool errors for invalid provider-executed tool calls.
• Updated dependencies [de438f5]
  • @​ai-sdk/gateway@​3.0.159

Commits

• fbb507a Version Packages (#18280)
• 6e37b23 v6.0: docs: document GenerateTextResult.output getter errors (#18252)
• 006a2f8 Version Packages (#18089)
• 2deee5b v6.0: docs: clarify generateText text aggregation and empty-string behavior (...
• 26d10c0 [v6.0] feat: support per-step model call setting overrides in prepareStep (#1...
• 9ecdefe [v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads (#18095)
• 7767170 [v6.0] fix: preserve provider metadata from empty streamText text deltas (#18...
• 98d8c43 Version Packages (#18028)
• f6020d7 [v6.0] fix: prevent orphaned Anthropic tool results after invalid provider-ex...
• 8e4c560 [v6.0] docs: clarify that textStream does not surface error parts (#18001)
• See full diff in compare view

Updates vite from 8.1.5 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

• add input to server.fs.allow (#23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
• config: include column in config incompatibility location (#23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
• deps: update all non-major dependencies (#23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#22932) (fa005d1)
• support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

• config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

• config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

• add input option (#22642) (9beae37)
• config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)
• css: export PostCSS config type for type-safe configs (#22792) (302c755)
• dev: label network URLs with their interface name (#22830) (78accc4)
• optimizer: support aube lockfile (#22813) (6319827)
• optimizer: support nub lockfile (#22891) (65d3604)
• update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)
• wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

• build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)
• config: exclude virtual modules from native config compat check (#22979) (2ced1fe)
• css: rewrite urls in OnceExit-injected content (#22983) (abb793e)
• deps: update all non-major dependencies (#22985) (04f345b)
• deps: update dependency magic-string to v1 (#22998) (c60b4d7)
• hmr: remove hot data after prune (#23002) (be96316)
• resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

• 24a611f release: v7.2.4
• 2d66b7b fix: revert "perf(deps): replace debug with obug (#21107)"
• a668014 release: v7.2.3
• acfe939 perf(deps): replace debug with obug (#21107)
• 4f8171e fix(deps): update all non-major dependencies (#21128)
• 5029720 chore(deps): update rolldown-related dependencies (#21127)
• 5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
• 39a0a15 chore(deps): update rolldown-related dependencies (#21095)
• 6a34ac3 fix(deps): update all non-major dependencies (#21096)
• 02ceaec chore(deps): update dependency @​rollup/plugin-commonjs to v29 (#21099)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: automated, dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.