chore(deps)(deps): bump the minor-and-patch group across 1 directory with 39 updates

[dependabot]

Bumps the minor-and-patch group with 39 updates in the / directory:

Package	From	To
@vitest/coverage-v8	4.1.7	4.1.9
esbuild	0.28.0	0.28.1
turbo	2.9.14	2.9.18
vitest	4.1.7	4.1.9
@hono/node-server	2.0.4	2.0.5
@langchain/core	1.1.48	1.2.0
@langchain/openai	1.4.7	1.5.1
better-auth	1.6.11	1.6.20
deepagents	1.10.2	1.10.5
hono	4.12.23	4.12.26
mongodb	7.2.0	7.3.0
mongoose	9.6.2	9.7.1
tsx	4.22.3	4.22.4
@astrojs/starlight	0.39.2	0.40.0
astro	6.3.7	6.4.8
sharp	0.34.5	0.35.2
@playwright/test	1.60.0	1.61.0
@tanstack/react-query	5.100.14	5.101.0
@tanstack/react-router	1.170.8	1.170.16
@xyflow/react	12.10.2	12.11.0
lucide-react	1.16.0	1.21.0
react	19.2.6	19.2.7
@types/react	19.2.15	19.2.17
react-dom	19.2.6	19.2.7
@tailwindcss/postcss	4.3.0	4.3.1
@tanstack/router-plugin	1.168.11	1.168.18
tailwindcss	4.3.0	4.3.1
vite	8.0.14	8.0.16
bullmq	5.77.2	5.79.1
ioredis	5.10.1	5.11.1
@langchain/anthropic	1.4.0	1.5.0
isomorphic-git	1.38.1	1.38.5
langchain	1.4.0	1.5.0
@radix-ui/react-label	2.1.8	2.1.10
@radix-ui/react-separator	1.1.8	1.1.10
@radix-ui/react-slot	1.2.4	1.3.0
@radix-ui/react-tooltip	1.2.8	1.2.10
date-fns	4.3.0	4.4.0
radix-ui	1.4.3	1.6.0

Updates @vitest/coverage-v8 from 4.1.7 to 4.1.9

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

Commits

• a7a61e7 chore: release v4.1.9 (#10598)
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• See full diff in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates turbo from 2.9.14 to 2.9.18

Release notes

Sourced from turbo's releases.

Turborepo v2.9.18

What's Changed

Changelog

• release(turborepo): 2.9.17 by @​github-actions[bot] in vercel/turborepo#13047
• ci: Fetch version.txt via API in docs alias failure notification by @​anthonyshew in vercel/turborepo#13050
• fix: Harden cache archive symlink restore by @​anthonyshew in vercel/turborepo#13051
• chore: Remove web UI mode by @​anthonyshew in vercel/turborepo#13052
• fix: Harden query server file access by @​anthonyshew in vercel/turborepo#13053
• fix: Confine prune patch paths by @​anthonyshew in vercel/turborepo#13054
• fix: Prevent git argument injection in SCM refs by @​anthonyshew in vercel/turborepo#13055
• fix: Strip special mode bits from cache restore by @​anthonyshew in vercel/turborepo#13056
• fix: Contain incremental cache outputs by @​anthonyshew in vercel/turborepo#13057
• fix(turborepo): Normalize Windows daemon path hash by @​Balance8 in vercel/turborepo#13020
• fix: Preserve vt100 cell byte counts by @​anthonyshew in vercel/turborepo#13058
• fix: Separate artifact signature fields by @​anthonyshew in vercel/turborepo#13059
• fix: Validate OidHash hex buffers by @​anthonyshew in vercel/turborepo#13060
• fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @​anthonyshew in vercel/turborepo#13061

New Contributors

• @​Balance8 made their first contribution in vercel/turborepo#13020

Full Changelog: vercel/turborepo@v2.9.17...v2.9.18

Turborepo v2.9.17

What's Changed

Changelog

• fix: Keep non-PTY stdin alive for persistent tasks by @​anthonyshew in vercel/turborepo#12972
• release(turborepo): 2.9.16 by @​github-actions[bot] in vercel/turborepo#12970
• release(turborepo): 2.9.17-canary.1 by @​github-actions[bot] in vercel/turborepo#12973
• fix: Add auth HTTP timeouts by @​anthonyshew in vercel/turborepo#12976
• fix: Detect affected root tasks in query by @​anthonyshew in vercel/turborepo#12977
• fix: Wait for Windows graceful shutdown by @​anthonyshew in vercel/turborepo#12979
• release(turborepo): 2.9.17-canary.2 by @​github-actions[bot] in vercel/turborepo#12980
• test: Skip installs for JSON output fixtures by @​anthonyshew in vercel/turborepo#12981
• feat: Add Rsbuild examples by @​Nsttt in vercel/turborepo#12942
• test: Skip installs for single package dry runs by @​anthonyshew in vercel/turborepo#12982
• test: Skip Corepack setup without installs by @​anthonyshew in vercel/turborepo#12983
• test: Skip installs for metadata-only Rust tests by @​anthonyshew in vercel/turborepo#12985
• test: Skip remaining unnecessary fixture installs by @​anthonyshew in vercel/turborepo#12986
• test: Add final hash contract snapshots by @​anthonyshew in vercel/turborepo#12984
• test: Trim run logging integration matrix by @​anthonyshew in vercel/turborepo#12987
• test: Trim affected query integration matrix by @​anthonyshew in vercel/turborepo#12988
• test: Narrow Windows integration test group by @​anthonyshew in vercel/turborepo#12989
• test: Trim task dependency integration coverage by @​anthonyshew in vercel/turborepo#12990
• test: Trim affected integration coverage by @​anthonyshew in vercel/turborepo#12991
• test: Collapse integration test matrices by @​anthonyshew in vercel/turborepo#12992

... (truncated)

Commits

• 3bdce32 publish 2.9.18 to registry
• 2a76556 fix: Block self-hosted login URLs from attempting to use Vercel's SSO (#13061)
• da8e348 fix: Validate OidHash hex buffers (#13060)
• 3018717 fix: Separate artifact signature fields (#13059)
• 34514e2 fix: Preserve vt100 cell byte counts (#13058)
• 24e2d34 fix(turborepo): Normalize Windows daemon path hash (#13020)
• 16dc881 fix: Contain incremental cache outputs (#13057)
• 92e1f8e fix: Strip special mode bits from cache restore (#13056)
• f46f896 fix: Prevent git argument injection in SCM refs (#13055)
• 7f353ca fix: Confine prune patch paths (#13054)
• Additional commits viewable in compare view

Updates vitest from 4.1.7 to 4.1.9

Release notes

Sourced from vitest's releases.

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

Commits

• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• See full diff in compare view

Updates @hono/node-server from 2.0.4 to 2.0.5

Release notes

Sourced from @​hono/node-server's releases.

v2.0.5

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.

Commits

• 9d56900 2.0.5
• cd076e1 Merge commit from fork
• See full diff in compare view

Updates @langchain/core from 1.1.48 to 1.2.0

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.0

Minor Changes

• #10924 2e28115 Thanks @​christian-bromann! - feat(core): add OpenAI-compatible stream event conversion

Patch Changes

• #11047 ac0f71d Thanks @​christian-bromann! - fix(core): preserve AIMessage content blocks

  Keep existing v1 contentBlocks when constructing AIMessage instances so serialized messages do not lose block content during deserialization.

Commits

• c5e8962 chore: version packages (#11059)
• e51478a feat(aws): bedrock prompt caching middleware (#11080)
• 7d61f5f fix(groq): tighten @​langchain/core peer dependency to ^1.1.30 (#11069)
• 2e28115 feat(deps): native streamEvents ChatModelStreamEvent protocol (#10924)
• 6d212ef docs(tavily): fix "refering" typo in tool description (#11067)
• a001816 chore(deps): bump esbuild from 0.28.0 to 0.28.1 in /environment_tests/test-ex...
• 234c8bb ci(infra): pin GitHub Actions to full-length commit SHAs (#11061)
• 4aeaa76 feat(langchain): add when predicate to human-in-the-loop middleware (#11012)
• ac0f71d fix(core): preserve AIMessage content blocks (#11047)
• 39f338e chore: remove deprecated @​langchain/google-cloud-sql-pg package (#11060)
• Additional commits viewable in compare view

Updates @langchain/openai from 1.4.7 to 1.5.1

Release notes

Sourced from @​langchain/openai's releases.

@​langchain/openai@​1.5.1

Patch Changes

• #11001 80b43ec Thanks @​Herrtian! - Wrap Responses API stream iteration errors with existing OpenAI client error handling.

@​langchain/openai@​1.5.0

Minor Changes

• #10924 2e28115 Thanks @​christian-bromann! - feat(openai): add native streamEvents event converters

Commits

• 0066b88 chore: version packages (#11085)
• 80b43ec fix(openai): wrap responses stream errors (#11001)
• 3ebd10a feat(langchain): surface tool-dispatched subagents on run.subagents (#11062)
• c5e8962 chore: version packages (#11059)
• e51478a feat(aws): bedrock prompt caching middleware (#11080)
• 7d61f5f fix(groq): tighten @​langchain/core peer dependency to ^1.1.30 (#11069)
• 2e28115 feat(deps): native streamEvents ChatModelStreamEvent protocol (#10924)
• 6d212ef docs(tavily): fix "refering" typo in tool description (#11067)
• a001816 chore(deps): bump esbuild from 0.28.0 to 0.28.1 in /environment_tests/test-ex...
• 234c8bb ci(infra): pin GitHub Actions to full-length commit SHAs (#11061)
• Additional commits viewable in compare view

Updates better-auth from 1.6.11 to 1.6.20

Release notes

Sourced from better-auth's releases.

v1.6.20

better-auth

Bug Fixes

• Fixed account-linking logs to route through the configured logger (#10121)
• Fixed TypeScript inference errors by declaring inherited APIError properties (#8734)
• Fixed refresh cookie Max-Age to be capped at expiresIn (#9621)

For detailed changes, see CHANGELOG

@better-auth/i18n

Bug Fixes

• Fixed English language fallback behavior and improved i18n documentation (#9872)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​adityachaudhary99, @​dipan-ck, @​sleepe229, @​WilsonnnTan

Full changelog: v1.6.19...v1.6.20

v1.6.19

better-auth

Features

• Added support for pre-binding device codes to a specific user in the device authorization plugin (#9995)

Bug Fixes

• Fixed headerless session checks (#10053)
• Fixed cookie cache fallback lookup (#9348)
• Fixed sendVerificationEmail errors not being surfaced to the client (#8863)
• Fixed auth client return types not being emitted correctly in TypeScript declaration builds (#10071)
• Fixed session and account cache cookies being silently dropped when near the browser's per-cookie size limit by splitting them into chunks (#10088)
• Fixed single-use verification flows (such as magic-link) hanging on connection-limited database adapters by reusing active transactions (#10070)
• Fixed the domain not being included when clearing cross-subdomain cookies in the last-login-method plugin (#9319)
• Fixed the oauth-popup plugin leaking internal OAuth state keys into additionalData (#10067)
• Reverted the headerless session check fix (#10074)

For detailed changes, see CHANGELOG

auth

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.20

Patch Changes

• #10121 21448b1 Thanks @​adityachaudhary99! - OAuth account-linking and create-user error logs now respect a custom logger configured in betterAuth(), instead of always being written to the default console logger.

• #9621 8ecf238 Thanks @​dipan-ck! - Session refresh no longer emits a cookie Max-Age above the browser's 400-day ceiling when using a database without fractional-second precision.

• #8734 930f534 Thanks @​sleepe229! - declare inherited APIError properties to fix TypeScript inference errors

• Updated dependencies []:

  • @​better-auth/core@​1.6.20
  • @​better-auth/drizzle-adapter@​1.6.20
  • @​better-auth/kysely-adapter@​1.6.20
  • @​better-auth/memory-adapter@​1.6.20
  • @​better-auth/mongo-adapter@​1.6.20
  • @​better-auth/prisma-adapter@​1.6.20
  • @​better-auth/telemetry@​1.6.20

1.6.19

Patch Changes

• #10088 de4aa52 Thanks @​bytaesu! - Session and account cache cookies near the browser's per-cookie size limit (for example with a long cookiePrefix or many cached fields) are now split into chunks instead of being silently dropped by the browser. A cache too large to fit even when chunked is skipped with a warning rather than failing the request, so reads fall back to the database.

• #9995 b4b0266 Thanks @​ElGauchooooo! - The device authorization plugin now accepts an optional user_id when issuing a device code via /device/code, pre-binding the code to that user. Only the bound user can approve or deny the code, so a publicly visible user code can no longer be claimed by someone else.

• #10086 5bd5e1c Thanks @​gustavovalverde! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.

  On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.

  @better-auth/core: incrementOne now reports a clear error when called with no increment and no set.

• #9319 581f827 Thanks @​ping-maxwell! - fix(last-login-method): include domain when clearing cross-subdomain cookies

• #10067 8407885 Thanks @​bytaesu! - The oauth-popup plugin now ignores internal OAuth state fields passed through its additionalData parameter, so additionalData only ever carries your own custom values.

• #9555 c1a8a64 Thanks @​ChrisMGeo! - Fix invalid OpenAPI output for Better Auth callback, session, and passkey routes so client generators can consume the schema.

• #10071 635f190 Thanks @​gustavovalverde! - Auth clients exported from wrapper packages can now be emitted in TypeScript declaration builds without extra type annotations.

• #10070 a787e0b Thanks @​gustavovalverde! - Single-use verification flows no longer hang on database adapters that use a one-connection pool. This fixes magic-link verification and similar token checks in connection-limited serverless database setups.

• #9348 c2f718f Thanks @​ping-maxwell! - fix: cookie cache fallback lookup

• #8863 7d18175 Thanks @​ping-maxwell! - sendVerificationEmail was invoked via runInBackgroundOrAwait, which could defer work when advanced.backgroundTasks.handler is configured (so the handler could return 200 before the email callback finished) and, in the default path, caught and logged errors without rethrowing. User callbacks that throw APIError (e.g. 429 from a rate limiter) were therefore not reliably reflected in the HTTP response (better-auth/better-auth#8757).

  Now we await sendVerificationEmailFn so failures surface to the client with the correct status. The unauthenticated /send-verification-email path enforces a constant-time floor (500 ms) so that the response duration does not reveal whether the email belongs to a real unverified user.

• Updated dependencies [0895993, 5bd5e1c, a787e0b]:

... (truncated)

Commits

• c342f42 chore: release v1.6.20 (#10108)
• 21448b1 fix: route account-linking logs through the configured logger (#10121)
• 8ecf238 fix(session): cap refresh cookie Max-Age at expiresIn (#9621)
• ac4d81d chore: release v1.6.19 (#10034)
• 1e69725 docs: clarify stateless Cognito token refresh (#10092)
• de4aa52 fix(cookies): chunk session and account cookies near the browser size limit (...
• 5bd5e1c fix: make guarded state transitions portable on Prisma (#10086)
• 36f345b revert: fix: allow headerless get session checks (#10053) (#10074)
• 635f190 fix(client): name auth client return types (#10071)
• d009dae fix: allow headerless get session checks (#10053)
• Additional commits viewable in compare view

Updates deepagents from 1.10.2 to 1.10.5

Release notes

Sourced from deepagents's releases.

deepagents@1.10.5

Patch Changes

• #598 7c4a11e Thanks @​christian-bromann! - refactor(stream): use langchain run.subagents instead of bespoke transformer

  Remove deepagents' custom createSubagentTransformer and rely on the native subagent stream that createAgent registers (langchain#37739). Keep DeepAgentRunStream as a compile-time overlay that narrows run.subagents to declared subagent specs. Update streaming tests for cause and per-subagent message coverage.

deepagents@1.10.4

Patch Changes

• #551 18557db Thanks @​antonnak! - fix(deepagents): gate cache_control writes on per-call request.model

  createCacheBreakpointMiddleware and createMemoryMiddleware were gating the Anthropic-specific cache_control write at agent-creation time only. When modelFallbackMiddleware swapped request.model to a non-Anthropic provider mid-flight (e.g. on Anthropic 5xx), the marker leaked through and the fallback provider rejected the request with 400 Unknown parameter: 'cache_control'. Both middlewares now also check isAnthropicModel(request.model) inside wrapModelCall. Fixes #550.

• #591 773cac5 Thanks @​colifran! - chore(deepagents): expose createSubAgent

• #541 1ca6dc9 Thanks @​ixchio! - fix getMimeType to return application/octet-stream for unknown file extensions instead of text/plain

• #572 03df237 Thanks @​hntrl! - fix: scope CompositeBackend grep/glob route fanout by search path

  CompositeBackend now limits fallback route fanout to routes mounted under the requested search path, instead of querying all routed backends unconditionally.

  This avoids unrelated...

  Description has been truncated

  ---

  [!NOTE]
  Medium Risk
  Wide dependency refresh touches auth (better-auth), HTTP stack (hono/node-server), AI agents (langchain/deepagents), and DB drivers without accompanying code changes—regression risk is mostly integration and runtime behavior.

  Overview
  Bumps ~39 npm dependencies across the monorepo by updating version ranges only in workspace package.json files (root, api, frontend, worker, core, ui, docs, e2e). There are no application source changes in this diff.

  Notable version moves include better-auth on api/frontend, the LangChain stack (@langchain/core 1.2.x, langchain, deepagents) on api/core/worker, Hono / @hono/node-server on api/frontend, MongoDB drivers on api/core, Vitest / Turbo / esbuild at the root, and frontend UI/router packages (TanStack, React 19.2.7, Radix / radix-ui).

  Review should focus on lockfile resolution, CI (build, test, e2e), and any behavior changes from auth, static file serving, or agent streaming dependencies rather than reading app diffs.

  ^{Reviewed by Cursor Bugbot for commit e21c0c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

Security review completed for the changed files (package.json files and pnpm-lock.yaml). I found no concrete issues introduced by this PR.

Checked against the requested surfaces:

• MCP endpoint auth: no MCP route or handler code changed; dependency resolution keeps the existing MCP packages and updates Hono to 4.12.26.
• Query execution sandboxing: no execute_query, DuckDB, semantic model, timeout, or result-limit code changed.
• Admin auth (Better Auth): better-auth is bumped from 1.6.11 to 1.6.20; no session-secret, CSRF, or cookie-configuration code changed.
• API input validation: no Hono route handler or Zod schema code changed.
• Environment secrets: no .env.local, secret literals, logging, or response-shaping code changed.
• Dependency exposure: no new direct dependencies were added. I ran pnpm audit / pnpm audit --prod on the PR head and compared with the base commit; the PR reduces the full audit count from 29 to 15 and the production audit count from 28 to 15. Remaining advisories are pre-existing carryovers rather than new exposure from this diff.

  

_{Sent by Cursor Automation: archmax Security Review}

[github-actions]

Docker image ready

docker pull ghcr.io/archmaxai/archmax:pr-74