Skip to content

deps(deps): bump the npm-all-updates group with 10 updates - #66

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-all-updates-97bb2f29da
Closed

deps(deps): bump the npm-all-updates group with 10 updates#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-all-updates-97bb2f29da

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-all-updates group with 10 updates:

Package From To
@ai-sdk/openai 3.0.88 3.0.91
@ai-sdk/provider-utils 4.0.40 4.0.42
@ai-sdk/openai-compatible 2.0.62 2.0.64
@biomejs/biome 2.5.5 2.5.7
@rollup/rollup-darwin-arm64 4.62.3 4.62.4
ai 6.0.236 6.0.246
globals 17.8.0 17.9.0
tsx 4.23.1 4.23.11
ultracite 7.9.4 7.10.1
vite 8.1.5 8.2.1

Updates @ai-sdk/openai from 3.0.88 to 3.0.91

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​3.0.91

Patch Changes

  • Updated dependencies [ee2bf30]
    • @​ai-sdk/provider-utils@​4.0.42
Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.91

Patch Changes

  • Updated dependencies [ee2bf30]
    • @​ai-sdk/provider-utils@​4.0.42

3.0.90

Patch Changes

  • Updated dependencies [9ecdefe]
    • @​ai-sdk/provider-utils@​4.0.41

3.0.89

Patch Changes

  • 23632b1: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.
Commits

Updates @ai-sdk/provider-utils from 4.0.40 to 4.0.42

Release notes

Sourced from @​ai-sdk/provider-utils's releases.

@​ai-sdk/provider-utils@​4.0.42

Patch Changes

  • ee2bf30: fix(provider-utils): prevent Metro from parsing the Node 18 dynamic import fallback
Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

4.0.42

Patch Changes

  • ee2bf30: fix(provider-utils): prevent Metro from parsing the Node 18 dynamic import fallback

4.0.41

Patch Changes

  • 9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
Commits

Updates @ai-sdk/openai-compatible from 2.0.62 to 2.0.64

Release notes

Sourced from @​ai-sdk/openai-compatible's releases.

@​ai-sdk/openai-compatible@​2.0.64

Patch Changes

  • Updated dependencies [ee2bf30]
    • @​ai-sdk/provider-utils@​4.0.42
Changelog

Sourced from @​ai-sdk/openai-compatible's changelog.

2.0.64

Patch Changes

  • Updated dependencies [ee2bf30]
    • @​ai-sdk/provider-utils@​4.0.42

2.0.63

Patch Changes

  • Updated dependencies [9ecdefe]
    • @​ai-sdk/provider-utils@​4.0.41
Commits

Updates @biomejs/biome from 2.5.5 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

  • #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

  • #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

  • #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

  • #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

  • #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

    Now, the nested configuration is correctly picked up and applied.

    In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

  • #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";

    The following code is also now invalid, because map(() => 42) returns 42:

    

    • 






... (truncated)





Changelog

Sourced from @​biomejs/biome's changelog.




2.5.7


Patch Changes


    

  • 

    #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
    

    • 

  • 

    #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
    

    • 

  • 

    #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
    

    • 

  • 

    #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
    

    • 

  • 

    #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
    

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
    

    Now, the nested configuration is correctly picked up and applied.
    

    In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
    

    • 

  • 

    #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.
    

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
    

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
    

    The following code is also now invalid, because map(() => 42) returns 42:
    

    type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;
    

    • 






... (truncated)





Commits






Updates @rollup/rollup-darwin-arm64 from 4.62.3 to 4.62.4



Release notes

Sourced from @​rollup/rollup-darwin-arm64's releases.




v4.62.4


4.62.4


2026-08-01


Bug Fixes


    

  • Resolve a regression when using Rollup on older Linux distributions (#6467)
    • 



Pull Requests








Changelog

Sourced from @​rollup/rollup-darwin-arm64's changelog.




4.62.4


2026-08-01


Bug Fixes


    

  • Resolve a regression when using Rollup on older Linux distributions (#6467)
    • 



Pull Requests








Commits






Updates ai from 6.0.236 to 6.0.246



Release notes

Sourced from ai's releases.




ai@6.0.246


Patch Changes


    

  • Updated dependencies [ee2bf30]

      

    • @​ai-sdk/provider-utils@​4.0.42
      • 

    • @​ai-sdk/gateway@​3.0.166
      • 

    

    • 








Changelog

Sourced from ai's changelog.




6.0.246


Patch Changes


    

  • Updated dependencies [ee2bf30]

      

    • @​ai-sdk/provider-utils@​4.0.42
      • 

    • @​ai-sdk/gateway@​3.0.166
      • 

    

    • 



6.0.245


Patch Changes


    

  • 0de0715: Filter unresolved tool approval requests and tool parts without state when ignoring incomplete tool calls.
    • 



6.0.244


Patch Changes


    

  • 79e58aa: Preserve preceding assistant messages when regenerating a response.
    • 



6.0.243


Patch Changes


    

  • dd5d344: Skip re-validating tool input for terminal output-available UI message parts.
    • 

  • Updated dependencies [0cd92fa]

      

    • @​ai-sdk/gateway@​3.0.165
      • 

    

    • 



6.0.242


Patch Changes


    

  • Updated dependencies [f615718]
    • 

  • Updated dependencies [48d5dff]

      

    • @​ai-sdk/gateway@​3.0.164
      • 

    

    • 



6.0.241


Patch Changes


    

  • Updated dependencies [7e50c52]

      

    • @​ai-sdk/gateway@​3.0.163
      • 

    

    • 



6.0.240


Patch Changes


    

  • Updated dependencies [b28367e]

      

    • @​ai-sdk/gateway@​3.0.162
      • 

    

    • 






... (truncated)





Commits






Updates globals from 17.8.0 to 17.9.0



Release notes

Sourced from globals's releases.




v17.9.0


    

  • Update globals (2026-08-01) (#348)  5a958ed
    • 





sindresorhus/globals@v17.8.0...v17.9.0







Commits






Updates tsx from 4.23.1 to 4.23.11



Release notes

Sourced from tsx's releases.




v4.23.11


4.23.11 (2026-08-07)


Bug Fixes


    

  • preserve async ESM require fallback (55cbece)
    • 





This release is also available on:



v4.23.10


4.23.10 (2026-08-07)


Bug Fixes





This release is also available on:



v4.23.9


4.23.9 (2026-08-06)


Bug Fixes


    

  • map Node test locations (2f55884)
    • 

  • support data URLs in tsImport (b94f46f)
    • 





This release is also available on:



v4.23.8


4.23.8 (2026-08-05)


Bug Fixes


    

  • preserve package subpath resolution (be1315e)
    • 

  • preserve typeless ESM dependency exports (70dfc5e)
    • 





This release is also available on:






... (truncated)





Commits

    

  • bd3bc64 test: cover CommonJS loader source fallback
    • 

  • 55cbece fix: preserve async ESM require fallback
    • 

  • 6c5ba85 docs: document CommonJS default interop
    • 

  • ec1bcd5 fix: support nyc coverage discovery (#710)
    • 

  • b6e5b48 docs: clarify CommonJS default imports
    • 

  • 2f55884 fix: map Node test locations
    • 

  • de935d5 docs: document Node source-map stack formatting
    • 

  • b94f46f fix: support data URLs in tsImport
    • 

  • be1315e fix: preserve package subpath resolution
    • 

  • 5efba41 docs: organize transform backend research
    • 

  • Additional commits viewable in compare view
    • 







Updates ultracite from 7.9.4 to 7.10.1



Release notes

Sourced from ultracite's releases.




ultracite@7.10.1


Patch Changes


    

  • d018b7f: Fix several agent fix mode (fix --claude/--codex) issues: runs no longer abort with ENOBUFS when linter JSON output exceeds 1MB, user-supplied format/reporter flags can no longer override the JSON reporter and break parsing, a stuck agent process is force-killed 10 seconds after the timeout instead of hanging forever, and the progress renderer no longer garbles TTY output when file paths and rule names exceed the terminal width.
    • 

  • d018b7f: Fix Biome config migration leaving the legacy bare "extends": ["ultracite"] form in place, which breaks Biome's module resolution since the package has no root export. It's now mapped to ultracite/biome/core.
    • 

  • d018b7f: Fix ultracite doctor reporting spurious failures: config checks now walk up parent directories (matching check/fix and the linters themselves) so monorepo packages inheriting a root config pass, .oxlintrc.json is accepted as a valid oxlint config (with a migration suggestion), and Prettier/Stylelint configs declared via package.json keys are recognized.
    • 

  • d018b7f: Fix ultracite init corrupting existing Prettier/Stylelint/ESLint configs by writing an ESM module into JSON/YAML/TOML/CJS config files (e.g. .prettierrc, eslint.config.cjs). Updates now write the default .mjs config instead and remove the incompatible file so it can't shadow the new one.
    • 

  • d018b7f: Fix ultracite check/fix misrouting space-separated flag values (e.g. --max-warnings 10) into the file list, which scrambled the underlying linter invocation and made formatters fail on bogus targets. Positional files listed before a -- separator are also kept as lint targets instead of being reclassified as passthrough, which could silently widen formatter runs to the whole project.
    • 

  • d018b7f: Fix Lefthook and pre-commit YAML updates silently doing nothing on common config shapes: the Lefthook job is now inserted correctly when jobs: isn't the first key under pre-commit: (and no longer matches a jobs: key in a different hook), repos: [] in .pre-commit-config.yaml is handled, and shapes that can't be safely edited produce a warning instead of writing the file back unchanged.
    • 

  • d018b7f: Fix the Husky integration overwriting an existing .husky/pre-commit hook: ultracite init ran husky init, which unconditionally replaces the hook with npm test. It now runs plain husky to set up the hooks infrastructure without touching the hook file.
    • 

  • d018b7f: Fix ultracite init destroying user files it couldn't parse or merge: unparseable tsconfig.json files are no longer replaced with a minimal config, unparseable .vscode/.zed settings are no longer overwritten wholesale, and lint-staged configs with function-valued entries are left untouched — all now warn and skip instead.
    • 

  • d018b7f: Fix re-running ultracite init on an oxlint setup silently enabling the full js-plugins preset — the previously selected JS plugins are now preserved when no new selection is made. Init also no longer flips an explicit "type": "commonjs" in package.json to "module"; it warns instead.
    • 

  • d018b7f: Fix switching linters removing storybook from the project's dependencies. It was swept into the removal set as a peer of eslint-plugin-storybook, but it's a user-facing tool a project may use independently of linting.
    • 

  • d018b7f: Fix Stylelint target generation dropping directories with a dot in their name (e.g. app.web) and producing non-matching globs from Windows-style backslash paths. Framework detection also handles negated workspace patterns (!packages/legacy) again.
    • 

  • d018b7f: Fix the CLI becoming a silent no-op (exiting 0 without linting anything) when a generic TEST environment variable is set, as is common in CI matrices. The internal test guard now uses ULTRACITE_TEST.
    • 

  • 36c7b80: Move @​typescript-eslint/utils from dependencies to devDependencies. It was accidentally shipped as a runtime dependency in 7.9.0, pulling eslint and the typescript-eslint packages into every consumer's install (including oxlint-only setups) via npm's automatic peer dependency installation. Nothing in the published package imports it — it only exists to support the workspace-internal rule-parity script.
    • 



ultracite@7.10.0


Minor Changes


    

  • 

    cd0a36c: Add --claude and --codex flags to ultracite fix. After the normal autofix pass, remaining diagnostics are handed to the Claude Code or Codex CLI non-interactively, one agent run per affected file, with a live per-issue spinner that flips to ✓/✗ once the fix is verified by a re-lint. Fixes that don't survive verification are retried (up to 3 attempts per file) with the fresh diagnostics and feedback that the previous approach failed. Works with all three linter modes (Oxlint, Biome, ESLint); exits non-zero if any issues remain, matching the plain fix contract.
    

    • 

  • 

    e089510: Scope React Doctor's framework-specific rules to per-framework add-on presets (#752)
    

    The ultracite/oxlint/js-plugins preset no longer enables React Doctor's nextjs-* and TanStack (query-*, tanstack-start-*) rules for every consumer. Rules like nextjs-no-img-element and tanstack-start-no-anchor-element fire on plain <img>/<a> JSX and recommend framework replacements, which falsely errored in Vite + React and other non-Next/non-TanStack projects.
    

    Those rules now live in two new add-on presets:
    

      

    • ultracite/oxlint/next/js-plugins
      • 

    • ultracite/oxlint/tanstack/js-plugins
      • 

    

    ultracite init wires the matching add-on automatically when you select the framework together with oxlint-plugin-react-doctor. If you manage oxlint.config.ts by hand and use Next.js or TanStack, add the matching add-on preset to extends alongside js-plugins to keep those rules — or re-run npx ultracite init.
    

    Also fixes re-running init on a config that already extends js-plugins producing a duplicate import jsPlugins declaration.
    

    • 



Patch Changes


    

  • 

    3320cd8: Update Biome to 2.5.6. No stable (non-nursery) rules were added, removed, or promoted between 2.5.3 and 2.5.6, so the preset configs are unchanged.
    

    • 

  • 

    477cd6e: Update ESLint to 10.8.0 and all ESLint plugins to their latest versions. Highlights:
    

      

    • eslint-plugin-react-doctor 0.9.3: the react preset expands from 149 to 417 rules, adopting the upstream recommended set (react-router, three.js/r3f, ink, motion, remotion, zustand/valtio/mobx, and more) while excluding rules that duplicate already-enabled react, react-hooks, and jsx-a11y rules. The next preset gains nextjs-async-dynamic-api-not-awaited and nextjs-metadata-url-consistency; the tanstack preset gains tanstack-start-missing-scripts, query-floating-mutate-async, and query-no-mutation-in-effect-as-read.
      • 

    • eslint-plugin-unicorn 72: adds no-missing-local-resource, no-multiple-promise-resolver-calls, no-shorthand-property-overrides, no-transition-all, no-unnecessary-string-trim, no-useless-re-export, prefer-then-catch, and require-frontmatter-fields. CSS-only rules are excluded from the preset since they fail config validation for JS files.
      • 

    • eslint-plugin-sonarjs 4.2: adds 11 rules including no-fixed-wait-in-tests, parameterized-tests, assertions-in-test-cases, prefer-native-lodash-alternative, and explicit-test-skip.
      • 

    • typescript-eslint 8.65: @typescript-eslint/no-loop-func and @typescript-eslint/no-restricted-imports were deprecated upstream in favor of the base rules, which now apply to TypeScript files.
      • 

    • eslint-plugin-astro 3: removes astro/no-omitted-end-tags and astro/valid-compile.
      • 

    • eslint-plugin-svelte 3.22: adds no-bind-value-on-checkable-inputs and no-conflicting-module-names; no-restricted-html-elements is now off because its schema requires a user-supplied element list.
      • 

    • @angular-eslint/eslint-plugin 22.1: adds inject-at-top and prefer-service-decorator.
      • 

    

    • 

  • 

    b81578b: Fix the useSortedPackageJson action not being executed by turning on assist actions for package.json-like files.
    

    • 

  • 

    9ec454a: Update oxlint to 1.76.0 and oxfmt to 0.61.0. New stable rules added to the presets: oxc/bad-match-all-arg, id-denylist, node/exports-style (core), react/function-component-definition with arrow-function components (react), and vitest/padding-around-test-blocks (vitest). node/no-top-level-await is off — top-level await is idiomatic in ESM, Astro frontmatter, and build scripts — and the ESLint preset's n/no-top-level-await is now off to match. No rules were removed or promoted out of nursery.
    

    • 

  • 

    ba61c02: Fix generated oxlint.config.ts accessing plugin.name on ExternalPluginEntry without narrowing the string form, which caused a TypeScript error in projects that type-check the config (#753)
    

    • 








Commits

    

  • 832cb7c Version Packages (#761)
    • 

  • d018b7f Split the CLI bug-scan changeset into per-fix patch changesets
    • 

  • 0dce9f8 Fix CLI bugs found in code audit
    • 

  • 36c7b80 Move @​typescript-eslint/utils to devDependencies
    • 

  • f943483 Version Packages (#756)
    • 

  • 74e671d Add video package with the Ultracite 7.10 fix --codex release video
    • 

  • e089510 Scope framework-specific react-doctor rules to oxlint/next/js-plugins and oxl...
    • 

  • cd0a36c Add --claude and --codex flags to ultracite fix (#760)
    • 

  • 477cd6e Update ESLint and plugins to latest versions
    • 

  • 9ec454a Update oxlint to 1.76.0 and oxfmt to 0.61.0
    • 

  • Additional commits viewable in compare view
    • 







Updates vite from 8.1.5 to 8.2.1



Release notes

Sourced from vite's releases.




plugin-legacy@8.2.1


Please refer to CHANGELOG.md for details.


v8.2.1


Please refer to CHANGELOG.md for details.


create-vite@8.2.0


Please refer to CHANGELOG.md for details.


plugin-legacy@8.2.0


Please refer to CHANGELOG.md for details.


v8.2.0


Please refer to CHANGELOG.md for details.


v8.2.0-beta.0


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




8.2.1 (2026-08-06)


Bug Fixes


    

  • build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
    • 

  • bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
    • 

  • css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
    • 

  • deps: update all non-major dependencies (#23136) (14454fd)
    • 

  • deps: update rolldown-related dependencies (#23070) (7ac6f7f)
    • 

  • don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
    • 

  • handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
    • 

  • server: use a random port when port is 0 (#23158) (fddf4ea)
    • 



Performance Improvements



Documentation


    

  • build: fix incomplete @default for build.minify (#23177) (ef02435)
    • 



Miscellaneous Chores


    

  • deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
    • 

  • deps: update dependency strip-literal to v4 (#23140) (9db65ce)
    • 



Code Refactoring


    

  • bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
    • 

  • bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)
    • 



Tests



8.2.0 (2026-07-30)


Features


    

  • add input to server.fs.allow (#23035) (95a3cda)
    • 

  • bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
    • 

  • bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
    • 

  • config: include column in config incompatibility location (#23064) (8a24572)
    • 

  • dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)
    • 



Bug Fixes


    

  • bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
    • 

  • deps: update all non-major dependencies (#23069) (4c07b74)
    • 

  • hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
    • 

  • importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
    • 






... (truncated)





Commits

    

  • 4216158 release: v8.2.1
    • 

  • fddf4ea fix(server): use a random port when port is 0 (#23158)
    • 

  • de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
    • 

  • 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
    • 

  • c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
    • 

  • ef02435 docs(build): fix incomplete @default for build.minify (#23177)
    • 

  • eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
    • 

  • 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
    • 

  • e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
    • 

  • 14454fd fix(deps): update all non-major dependencies (#23136)
    • 

  • Additional commits viewable in compare view
    • 







Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          deps(deps): bump the npm-all-updates group with 10 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          2c598f0
        
      

    

  

    

      
Bumps the npm-all-updates group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.88` | `3.0.91` |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `4.0.40` | `4.0.42` |
| [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `2.0.62` | `2.0.64` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.5` | `2.5.7` |
| [@rollup/rollup-darwin-arm64](https://github.com/rollup/rollup) | `4.62.3` | `4.62.4` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.236` | `6.0.246` |
| [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.9.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.11` |
| [ultracite](https://github.com/haydenbleasel/ultracite) | `7.9.4` | `7.10.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.1` |


Updates `@ai-sdk/openai` from 3.0.88 to 3.0.91
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@3.0.91/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@3.0.91/packages/openai)

Updates `@ai-sdk/provider-utils` from 4.0.40 to 4.0.42
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/provider-utils@4.0.42/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@4.0.42/packages/provider-utils)

Updates `@ai-sdk/openai-compatible` from 2.0.62 to 2.0.64
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai-compatible@2.0.64/packages/openai-compatible/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@2.0.64/packages/openai-compatible)

Updates `@biomejs/biome` from 2.5.5 to 2.5.7
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome)

Updates `@rollup/rollup-darwin-arm64` from 4.62.3 to 4.62.4
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.3...v4.62.4)

Updates `ai` from 6.0.236 to 6.0.246
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.246/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.246/packages/ai)

Updates `globals` from 17.8.0 to 17.9.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.8.0...v17.9.0)

Updates `tsx` from 4.23.1 to 4.23.11
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.11)

Updates `ultracite` from 7.9.4 to 7.10.1
- [Release notes](https://github.com/haydenbleasel/ultracite/releases)
- [Commits](https://github.com/haydenbleasel/ultracite/compare/ultracite@7.9.4...ultracite@7.10.1)

Updates `vite` from 8.1.5 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

---
updated-dependencies:
- dependency-name: "@ai-sdk/openai"
  dependency-version: 3.0.91
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 4.0.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: "@ai-sdk/openai-compatible"
  dependency-version: 2.0.64
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: "@rollup/rollup-darwin-arm64"
  dependency-version: 4.62.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: ai
  dependency-version: 6.0.246
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: globals
  dependency-version: 17.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all-updates
- dependency-name: tsx
  dependency-version: 4.23.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all-updates
- dependency-name: ultracite
  dependency-version: 7.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all-updates
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
      



  

  @dependabot


    @github




  



    

      

  

    

      
          
      

      
            dependabot
    Bot

      

      

      commented

        on behalf of github

        Aug 10, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

  Author


    

  





      


        



  
    

      
          
Labels


The following labels could not be found: automated, dependencies, npm. Please create them before Dependabot can add them to a pull request.


Please fix the above issues or remove invalid values from dependabot.yml.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

              requested a review
  from KIM3310
    as a code owner


        August 10, 2026 15:37        
        
      

    





  

  

    
  


  

      


    @KIM3310
KIM3310



    mentioned this pull request
    
      Aug 10, 2026
    





  


  

      
   Merged

  







  









      

  
      



  

  @KIM3310






  



    

      

  

    

      
          
      

      
            KIM3310
    

      

      

      commented


        Aug 10, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Owner


        

    

  





      


        



  
    

      
          
Superseded by #67. This grouped update cannot be merged as generated: Dependency Review found three high-severity advisories from the introduced undici@5.29.0, and Biome 2.5.7 correctly required new formatting. The replacement keeps the same current updates, uses tested undici@6.28.0 and esbuild@0.28.1 overrides, reaches zero audit findings, applies formatting, adds an audit gate, and removes unused PR-write permission.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @KIM3310
KIM3310




          closed this


      Aug 10, 2026

    

  


    







      

  
      



  

  @dependabot


    @github




  



    

      

  

    

      
          
      

      
            dependabot
    Bot

      

      

      commented

        on behalf of github

        Aug 10, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

  Author


    

  





      


        



  
    

      
          
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.


To ignore these dependencies, configure ignore rules in dependabot.yml


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

        
    deleted the
    
      
        dependabot/npm_and_yarn/npm-all-updates-97bb2f29da
    
    branch

        August 10, 2026 15:51        
        
      

    





  



  
    
  
  

    

  KIM3310 

      added a commit
      that referenced
      this pull request

    
      Aug 10, 2026
    
    

      


  

    

      


  

        
          @KIM3310
        
          @dependabot
  





      

        
          deps: refresh toolchain without vulnerable transitives (#67)
        

          
            
          

      


      

          

    
    
    

  

    


      


      

          

    
    
    

  

  

    
  



      


      
      

        
          a215b47
        
      

    

  

    

      
## Summary
- carry forward the 10 current patch/minor toolchain and AI SDK updates
from Dependabot #66
- force `undici` 6.28.0 instead of the newly introduced vulnerable
5.29.0 tree
- force `esbuild` 0.28.1 instead of the vulnerable 0.27.7 transitive
copy
- apply Biome 2.5.7's deterministic formatting changes
- add a zero-tolerance `pnpm audit` CI job and remove an unused
`pull-requests: write` permission

## Security rationale
Dependency Review correctly blocked #66 because it introduced three
high-severity Undici advisories (`GHSA-v9p9-hfj2-hcw8`,
`GHSA-vrm6-8vpv-qv8q`, and `GHSA-vxpw-j846-p89q`). The override is safe
for this Node >=20 project and was exercised by the full runtime/test
suite. The esbuild override also removes `GHSA-g7r4-m6w7-qqqr` rather
than accepting a low-severity residual.

## Validation
- `pnpm install --frozen-lockfile`
- `pnpm audit`: **No known vulnerabilities found**
- `pnpm verify`: Biome, publication check, TypeScript, full tests, and
build passed
- `pnpm test -- --coverage`: passed
- `pnpm why undici`: only 6.28.0
- lockfile contains neither `undici@5.29.0` nor `esbuild@0.27.7`
- actionlint 1.7.12
- Gitleaks 8.30.1: no findings
- immutable action reference and diff checks

No audit, lint, test, or dependency-review gate is suppressed.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Doeon Kim <215626042+KIM3310@users.noreply.github.com>

    




    

  













  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    


      

          


  
      @KIM3310
  
    KIM3310


          Awaiting requested review from KIM3310


                    KIM3310 is a code owner
      



      







    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

    None yet







      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      1 participant
    

    

        
          @KIM3310