build(deps): bump the production-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
@astrojs/cloudflare	14.1.3	14.1.4
astro	7.1.1	7.1.3
agents	0.17.4	0.19.0
hono	4.12.31	4.12.32
jose	6.2.3	6.2.4
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8

Updates @astrojs/cloudflare from 14.1.3 to 14.1.4

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.1.4

Patch Changes

• #17457 d46ecd8 Thanks @​matthewp! - Fixes a dev server crash when using Astro Actions with the Cloudflare adapter

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.1.4

Patch Changes

• #17457 d46ecd8 Thanks @​matthewp! - Fixes a dev server crash when using Astro Actions with the Cloudflare adapter

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

Commits

• cf9ffc7 [ci] release (#17455)
• d46ecd8 Fix Cloudflare dev server crash when using Astro Actions (#17457)
• 092da56 Add more escaping for rendered content (#17393)
• See full diff in compare view

Updates astro from 7.1.1 to 7.1.3

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

• #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

• #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

• #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

• #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

• #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

• #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

Commits

• cf9ffc7 [ci] release (#17455)
• 630b382 Use os.availableParallelism() for image optimization queue to fix OOM in CP...
• 8a7f7e0 [ci] release (#17411)
• ebbd793 chore(deps): update astro-embed (#17436)
• 311e42c [ci] format
• 1d62202 chore(deps): update neotraverse to v1 (#17446)
• a5f7230 fix(astro): update cookie to v2 (#17445)
• 91992ef fix(prefetch): swallow fetch-fallback rejection to avoid unhandled 'Load fail...
• a89c137 fix(astro): propagate mutated locals to custom error pages (#17402)
• See full diff in compare view

Updates agents from 0.17.4 to 0.19.0

Release notes

Sourced from agents's releases.

agents@0.19.0

Minor Changes

• #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

  The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when bumping these packages.

  Only the current implementations are covered. New optimisations and APIs made available by AI SDK v7 (broader result-shape audits, stream helper migrations, etc.) are intentionally out of scope.

  How dual-version support works — @cloudflare/think calls the AI SDK through the option names present in both majors (v7 keeps the v6 names as aliases), and normalizes the genuine divergences at the boundary:

  • Uses stepCountIs, system, experimental_telemetry, onStepFinish, and experimental_onToolCallFinish (in v7 this alias resolves to onToolExecutionEnd and fires once).

  • The tool-execution-finished event is normalized across majors: v6's { success, output, error, durationMs, stepNumber } and v7's { toolOutput, toolExecutionMs } collapse to one ToolCallResultContext. stepNumber is undefined under v7 (the v7 event no longer provides it).

  • The UI message stream is built via the result's toUIMessageStream() method (present in both majors); the standalone toUIMessageStream({ stream }) helper and result.stream are v7-only.

  • The workspace read tool emits { type: "file-data", data, mediaType, filename } model output, accepted by both majors (v7's newer { type: "file", data: { type: "data", data } } shape does not exist in v6).

    Public API notes:

  • @cloudflare/think keeps system, onStepFinish, and experimental_telemetry where callers already use them, and also accepts TurnConfig.telemetry (forwarded ahead of experimental_telemetry when present).

  • @cloudflare/ai-chat updates the AIChatAgent.onChatMessage callback type from StreamTextOnFinishCallback to GenerateTextOnFinishCallback.

    Verified against both ai@6 and ai@7: @cloudflare/think type-checks with zero errors and its full workers test suite passes under each major.

    Known limitations:

  • workers-ai-provider (Think's default model provider) is fixed at v4 for AI

... (truncated)

Changelog

Sourced from agents's changelog.

0.19.0

Minor Changes

• #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

  The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when bumping these packages.

  Only the current implementations are covered. New optimisations and APIs made available by AI SDK v7 (broader result-shape audits, stream helper migrations, etc.) are intentionally out of scope.

  How dual-version support works — @cloudflare/think calls the AI SDK through the option names present in both majors (v7 keeps the v6 names as aliases), and normalizes the genuine divergences at the boundary:

  • Uses stepCountIs, system, experimental_telemetry, onStepFinish, and experimental_onToolCallFinish (in v7 this alias resolves to onToolExecutionEnd and fires once).
  • The tool-execution-finished event is normalized across majors: v6's { success, output, error, durationMs, stepNumber } and v7's { toolOutput, toolExecutionMs } collapse to one ToolCallResultContext. stepNumber is undefined under v7 (the v7 event no longer provides it).
  • The UI message stream is built via the result's toUIMessageStream() method (present in both majors); the standalone toUIMessageStream({ stream }) helper and result.stream are v7-only.
  • The workspace read tool emits { type: "file-data", data, mediaType, filename } model output, accepted by both majors (v7's newer { type: "file", data: { type: "data", data } } shape does not exist in v6).

  Public API notes:

  • @cloudflare/think keeps system, onStepFinish, and experimental_telemetry where callers already use them, and also accepts TurnConfig.telemetry (forwarded ahead of experimental_telemetry when present).
  • @cloudflare/ai-chat updates the AIChatAgent.onChatMessage callback type from StreamTextOnFinishCallback to GenerateTextOnFinishCallback.

  Verified against both ai@6 and ai@7: @cloudflare/think type-checks with zero errors and its full workers test suite passes under each major.

  Known limitations:

  • workers-ai-provider (Think's default model provider) is fixed at v4 for AI SDK v7. Consumers on ai@6 who rely on Think's built-in default model may hit a provider-version mismatch; passing their own LanguageModel avoids this.
  • chat@4.31.0 currently declares an ai@^6 peer and does not yet advertise

... (truncated)

Commits

• 4a3ee29 Version Packages (#1976)
• cb4c1c7 feat: update AI SDK to v7 (#1922)
• 83e093b Version Packages (#1943)
• 33e59c4 fix(mcp): recover expired HTTP sessions (#1923)
• c19d58a fix(mcp): harden connection recovery (#1924)
• 6861933 fix(mcp): harden OAuth callback recovery (#1926)
• 8ad5f39 docs(agents): document current ctx.id.name availability and pin it with a col...
• 3ce98ff fix(chat): reconcile errored reconnect streams (#1963)
• f5b1dd8 feat: Cloudflare-native AI tracing (agents/observability/ai) (#1860)
• a3cbed1 fix(mcp): avoid repeated tool schema materialization (#1959)
• Additional commits viewable in compare view

Updates hono from 4.12.31 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

• ci: enable reports for type & bundle size check in honojs/hono#5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
• fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
• fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
• fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

• 26d8e42 4.12.32
• 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
• c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
• a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
• 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
• e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
• bf8608c ci: enable reports for type & bundle size check (#5148)
• See full diff in compare view

Updates jose from 6.2.3 to 6.2.4

Release notes

Sourced from jose's releases.

v6.2.4

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

Changelog

Sourced from jose's changelog.

6.2.4 (2026-07-21)

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

Commits

• 3ced677 chore(release): 6.2.4
• 9725456 chore: bump packages
• 386a3eb refactor: normalize JWK export members from runtime quirks
• f86dbef chore: bump packages
• 990c670 test: update electron expectations
• 0bbe2d0 chore: fix broken links for undici
• 294c40c test: update electron expectations
• a378068 chore(deps): bump the actions group with 2 updates
• b299ce2 chore(deps-dev): bump undici
• f261d84 chore(deps-dev): bump tar in the npm_and_yarn group across 1 directory
• Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.