chore(crx-deps)(deps): bump the crx-prod-minor group across 1 directory with 3 updates - #175
Conversation
dependabot
Bot
added
area: chrome-crx
dependabot
Bot
added
the
area: chrome-crx
dependabot
Bot
added
the
dependencies
|
Not merged during dependency PR cleanup. Local verification against current main failed for this group: |
dependabot
Bot
changed the title
3db7ea8 to
efb38b5
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efb38b59f1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| }, | ||
| "dependencies": { | ||
| "@anthropic-ai/sdk": "^0.95.1", | ||
| "@anthropic-ai/sdk": "^0.104.1", |
There was a problem hiding this comment.
When installing after this change, Bun can resolve ^0.104.1 to the newer 0.104.2 patch (published June 15, 2026) instead of the reviewed 0.104.1 release. Because this repo does not commit a JS lockfile (.gitignore:6-9) and the min-release-age check strips ranges and only checks the lower bound (scripts/check-min-release-age.mjs:91-93), CI/developers can pull an unreviewed <3-day-old SDK despite the cooldown policy; pin this dependency exactly or commit the lockfile resolution.
Useful? React with 👍 / 👎.
|
@duckpr |
![duckpr[bot]](https://avatars.githubusercontent.com/in/4166808?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — Dependabot crx-prod-minor bump touching three runtime deps in chrome-crx/package.json.
@anthropic-ai/sdk^0.95.1→^0.104.1— additive SDK release (new models, Managed Agents, middlewarectx.logger, refusal categories). Verified zero new type errors vsmain.katex^0.16.33→^0.17.0— the 0.17 BREAKING CHANGE is scoped to the internal__defineFunctionAPI; this repo only consumes the public CSS (katex/dist/katex.min.css) and goes throughrehype-katex, so unaffected.openai6.38.0→6.42.0— additive features (moderation endpoints, Bedrock Responses, audit-log workload identity).OpenAIis used as a constructor/type only.
Verification this run: tsc --noEmit produces the same 3 errors on both main (SDK 0.95.2) and the PR branch (SDK 0.104.2) — the bump adds none. vite build passes and KaTeX assets bundle correctly. rehype-katex@7.0.1 retains its nested katex@0.16.47 and resolves cleanly.
anthropic/glm-5.2 ｜ 𝕏
|
@duckpr review |
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes — Dependabot bumps three production deps in chrome-crx/package.json (no other files touched). I traced each bumped package to its in-repo usage to confirm the bumps are non-breaking.
@anthropic-ai/sdk^0.95.1→^0.104.1— spans 9 minor versions; release notes are all additive (Managed Agents deployments,claude-mythos-5/claude-fable-5models with refusal fallbacks,frontier_llmrefusal category,ctx.loggermiddleware). Repo usage is a thin re-export of the default export asMessages_clientinchrome-crx/src/mcpServersStore.ts, which remains stable.katex^0.16.33→^0.17.0— 0.17 ships a documented breaking change for the internal__defineFunctionAPI, but this repo only imports the stylesheet (katex/dist/katex.min.css); math rendering flows throughrehype-katex(separate package, not in scope). No internal API usage to break.openai6.38.0→6.42.0— 4 minor versions (Bedrock Responses, audit-log workload identity,responses.moderation/chat_completions.moderation). Repo constructs clients via the standardnew OpenAI({...})shape, which is unchanged.
No lockfile is committed for chrome-crx/ (builds run via bun scripts/build.mjs), so this package.json-only diff is the complete change.
anthropic/glm-5.2 ｜ 𝕏
There was a problem hiding this comment.
Important
The @anthropic-ai/sdk bump (^0.95.1 → ^0.104.1) breaks bun run typecheck — 3 type errors in code that consumes BetaToolResultBlockParam. The other two bumps (katex, openai) are clean. Needs a follow-up commit adjusting the affected types before merge.
Reviewed changes — Dependabot minor bump PR touching chrome-crx/package.json only; 3 prod deps updated in the crx-prod-minor group.
@anthropic-ai/sdk^0.95.1→^0.104.1— additive SDK features (Managed Agents,claude-mythos-5/claude-fable-5, client-side fallbacks middleware), but theBetaToolResultBlockParam.contentandBetaContentBlockParamunions were widened withBetaSearchResultBlockParam,BetaToolReferenceBlockParam, and an expandedBetaRequestDocumentBlock.source(PDF / plain-text / file-document). That widening breaks 3 existing call sites.katex^0.16.33→^0.17.0— 0.17.0 ships a BREAKING change to the internal__defineFunctionAPI, but this repo only consumeskatexviakatex/dist/katex.min.css(CSS import inchrome-crx/src/sidepanel/index.tsx) and throughrehype-katex. No use ofdefineFunctioninchrome-crx/src. Safe.openai6.38.0→6.42.0— additive (responses.moderation, Bedrock Responses support, audit-log workload identity). Usage inchrome-crx/src/utils/providerStore.tsandproviderRuntime.tsis just the default-export client; no typecheck errors attributable to openai.
⚠️ @anthropic-ai/sdk 0.104.x widens BetaToolResultBlockParam.content and breaks tsc
Verified locally by installing the bumped deps and running npx tsc --noEmit in chrome-crx/ — 3 errors, all rooted in the SDK's widened union types. bun run typecheck is part of the CI gate and the husky pre-commit hook, so merging this as-is will break both.
The newly-added union members are BetaSearchResultBlockParam and BetaToolReferenceBlockParam (added to BetaContentBlockParam), plus an expanded BetaRequestDocumentBlock.source that now accepts PDF / plain-text / file-document sources in addition to images. Existing code hands BetaToolResultBlockParam straight through to narrower local types, which reject the new members.
Technical details
# `@anthropic-ai/sdk` 0.104.x type regressions
## Affected sites
- `chrome-crx/src/mcpRuntime/core.ts:1341` — `[toolResult] = await executor.processToolResults(...)`. The returned `BetaToolResultBlockParam` is no longer assignable to the local `ExecuteToolResponse` type because `content` now includes `BetaToolReferenceBlockParam` (missing the `content` property required by `BetaMidConversationSystemBlockParam`).
- `chrome-crx/src/sidepanel/MessageComponents/ContentBlocksRenderer.tsx:1129` — `<WebSearchToolCell toolResult={toolResult} />`. `toolResult` is `BetaToolResultBlockParam | undefined`, but `WebSearchToolCell`'s `ToolResultLike` expects a narrower `content` union; `BetaRequestDocumentBlock.source` is now a wider document-source union (PDF / plain-text / file) that doesn't satisfy the image-only source type.
- `chrome-crx/src/sidepanel/MessageComponents/ContentBlocksRenderer.tsx:1146` — same shape, `<WebFetchToolCell toolResult={toolResult} />`.
## Required outcome
- `bun run typecheck` passes against `@anthropic-ai/sdk@^0.104.1` without weakening type safety elsewhere.
## Suggested approach
- Preferred: widen the local `ToolResultLike` and `ExecuteToolResponse` `content` field types to accept the new SDK union members (mirror the SDK's own `BetaContentBlockParam` union). This preserves end-to-end typing and is the lowest-risk path.
- Alternative: introduce a narrowing type guard that filters out the new block kinds at the boundary before passing the value to `WebSearchToolCell` / `WebFetchToolCell` / the executor. Preserves the narrow component contract but adds runtime branching.
## Open questions for the human
- `BetaSearchResultBlockParam` and `BetaToolReferenceBlockParam` are new first-class content blocks. Should the rendering layer actually display them (e.g. render a search-result chip), or is it fine to filter them out for now? That decision drives which fix path is correct.anthropic/glm-5.2 ｜ 𝕏
| }, | ||
| "dependencies": { | ||
| "@anthropic-ai/sdk": "^0.95.1", | ||
| "@anthropic-ai/sdk": "^0.104.1", |
There was a problem hiding this comment.
@anthropic-ai/sdk bump breaks bun run typecheck — 3 errors in chrome-crx/src/mcpRuntime/core.ts:1341 and chrome-crx/src/sidepanel/MessageComponents/ContentBlocksRenderer.tsx:1129,1146, all caused by the 0.104.x SDK widening BetaToolResultBlockParam.content and BetaContentBlockParam with new block types. Needs a follow-up commit adjusting the affected local types before this can merge. Details in the review body.
efb38b5 to
b62b039
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b62b0396ea
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| }, | ||
| "dependencies": { | ||
| "@anthropic-ai/sdk": "^0.95.1", | ||
| "@anthropic-ai/sdk": "^0.106.0", |
There was a problem hiding this comment.
This package.json bump is not accompanied by the shared bun.lock update: the lockfile still records the chrome-crx workspace constraints/resolutions for @anthropic-ai/sdk ^0.95.1/0.95.2, katex ^0.16.33/0.16.47, and openai 6.38.0 (bun.lock lines 16, 44, 48, 108, 1084, 1304). The CI workflows I checked (.github/workflows/lint-ts.yml:28, .github/workflows/test-coverage.yml:38, .github/workflows/docs.yml:57) run bun install --frozen-lockfile, and bun install --help says that flag disallows lockfile changes, so a fresh CI install for this PR has to rewrite the lockfile to satisfy these new versions and will fail before lint/tests/docs run.
Useful? React with 👍 / 👎.
…ry with 3 updates Bumps the crx-prod-minor group with 3 updates in the /chrome-crx directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [katex](https://github.com/KaTeX/KaTeX) and [openai](https://github.com/openai/openai-node). Updates `@anthropic-ai/sdk` from 0.95.2 to 0.115.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.95.2...sdk-v0.115.0) Updates `katex` from 0.16.47 to 0.18.1 - [Release notes](https://github.com/KaTeX/KaTeX/releases) - [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md) - [Commits](KaTeX/KaTeX@v0.16.47...v0.18.1) Updates `openai` from 6.38.0 to 6.49.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v6.38.0...v6.49.0) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.100.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: crx-prod-minor - dependency-name: katex dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: crx-prod-minor - dependency-name: openai dependency-version: 6.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: crx-prod-minor ... Signed-off-by: dependabot[bot] <support@github.com>
b62b039 to
d51dedb
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d51dedb031
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "diff": "^9.0.0", | ||
| "framer-motion": "^12.38.0", | ||
| "katex": "^0.16.33", | ||
| "katex": "^0.18.1", |
There was a problem hiding this comment.
When the lockfile is regenerated for this bump, sidepanel math will likely be rendered by rehype-katex's own katex@^0.16.0 dependency (bun.lock:1502, loaded from chrome-crx/src/sidepanel/components/markdownComponents/mathPlugins.ts:24) while the sidepanel imports the direct katex/dist/katex.min.css (chrome-crx/src/sidepanel/index.tsx:5). KaTeX 0.18 prefixes internal CSS classes, so 0.18 CSS no longer reliably styles 0.16-generated markup; inline/block math in rendered markdown can appear unstyled unless rehype-katex is bumped to a version that renders with 0.18 or the direct katex dependency stays on the 0.16 line.
Useful? React with 👍 / 👎.
2 participants
Bumps the crx-prod-minor group with 3 updates in the /chrome-crx directory: @anthropic-ai/sdk, katex and openai.
Updates
@anthropic-ai/sdkfrom 0.95.2 to 0.115.0Release notes
Sourced from @anthropic-ai/sdk's releases.
... (truncated)
Changelog
Sourced from @anthropic-ai/sdk's changelog.
... (truncated)
Commits
3b45cd3chore: release mainf298e9afeat(api): add claude-opus-5 modelce8e54bfix(client): release abort listeners when requests settle (#1129)2d314b4chore: release main3d051dffeat(api): add new stop reason 'model_context_window_exceeded'4414d47chore: release main1ec5566feat(api): add support for Managed Agents model effort, initial session event...c58a55bchore: release main2fb7da5chore(api): add support for new refusal categoryd6ffc3cchore(internal): codegen related updateMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@anthropic-ai/sdksince your current version.Updates
katexfrom 0.16.47 to 0.18.1Release notes
Sourced from katex's releases.
Changelog
Sourced from katex's changelog.
Commits
cdf479fchore(release): 0.18.1 [ci skip]87a2b30fix(htmlData): allow escaped commas in \htmlData (#4236)2318066chore(deps): bump codecov/codecov-action from 6 to 7 (#4227)3b5b6a0chore(deps): bump actions/checkout from 6 to 7 (#4232)4e9d31achore(deps): update dependency js-yaml to v4.2.0 [security] (#4244)b7ca8f0chore(deps): update dependency webpack-dev-server to v5.2.5 [security] (#4242)bf1a59fchore: use pixel diff as fallback for byte-to-byte (#4245)4d9d0aechore(release): 0.18.0 [ci skip]6f5c44ffeat: prefix css classes (#4229)2c6143arefactor: remove direct hasOwnProperty call (#4230)Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
openaifrom 6.38.0 to 6.49.0Release notes
Sourced from openai's releases.
... (truncated)
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
04671d2release: 6.49.0 (#2004)4ced1a8feat(helpers): add standard schema support (#1997)eb04567feat(zod): support schema definitions (#1993)83cdb79fix(zod): infer parsed tool callback arguments (#1992)a60cc25fix(runTools): sanitize replayed messages (#1990)bd86817fix(stream): handle audio completion markers (#1991)ee59911feat(helpers): add zod realtime function helper (#1996)39a15b4fix(azure): normalize endpoint trailing slashes (#1995)2706888fix: address code scanning findings (#2007)9bec333chore: exclude Brewfile from language detection (#2006)