Skip to content

build(deps): bump the npm-minor-patch group across 1 directory with 27 updates - #1107

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-21d2ca05af
Closed

build(deps): bump the npm-minor-patch group across 1 directory with 27 updates#1107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-21d2ca05af

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 27 updates in the / directory:

Package From To
@ai-sdk/gateway 4.0.23 4.0.32
@google/genai 2.12.0 2.14.0
@opentelemetry/core 2.9.0 2.10.0
@types/node 26.0.0 26.1.2
ai 7.0.31 7.0.42
@modelcontextprotocol/sdk 1.29.0 1.30.0
brace-expansion 5.0.8 5.0.9
turbo 2.10.5 2.10.7
@opentelemetry/api 1.9.0 1.9.1
@opentelemetry/exporter-trace-otlp-http 0.220.0 0.221.0
@opentelemetry/instrumentation 0.220.0 0.221.0
@opentelemetry/resources 2.9.0 2.10.0
@opentelemetry/sdk-trace-base 2.9.0 2.10.0
@sentry/nextjs 10.65.0 10.69.0
@stripe/stripe-js 9.9.0 9.12.1
@supabase/supabase-js 2.110.7 2.111.0
@vercel/functions 3.7.5 3.7.6
lucide-react 1.25.0 1.28.0
stripe 22.3.2 22.4.0
@tailwindcss/postcss 4.3.2 4.3.3
autoprefixer 10.5.2 10.5.4
eslint-config-next 16.2.10 16.2.12
playwright 1.61.1 1.62.0
@playwright/test 1.61.1 1.62.0
postcss 8.5.21 8.5.25
tailwindcss 4.3.2 4.3.3
vite 8.1.5 8.2.0

Updates @ai-sdk/gateway from 4.0.23 to 4.0.32

Release notes

Sourced from @​ai-sdk/gateway's releases.

@​ai-sdk/openai@​4.0.24

Patch Changes

  • Updated dependencies [1659cd5]
  • Updated dependencies [6a5bdff]
    • @​ai-sdk/provider-utils@​5.0.15
Changelog

Sourced from @​ai-sdk/gateway's changelog.

4.0.32

Patch Changes

  • 0012529: chore(provider/gateway): update gateway model settings files
  • Updated dependencies [1659cd5]
  • Updated dependencies [6a5bdff]
    • @​ai-sdk/provider-utils@​5.0.15

4.0.31

Patch Changes

  • bf216b3: chore(provider/gateway): update gateway model settings files

4.0.30

Patch Changes

  • Updated dependencies [0c464d9]
  • Updated dependencies [c49380c]
    • @​ai-sdk/provider-utils@​5.0.14

4.0.29

Patch Changes

  • d9d2a11: chore(provider/gateway): update gateway model settings files
  • Updated dependencies [1e2f324]
    • @​ai-sdk/provider@​4.0.4
    • @​ai-sdk/provider-utils@​5.0.13

4.0.28

Patch Changes

  • 0a7c7f4: chore(provider/gateway): update gateway model settings files

4.0.27

Patch Changes

  • 2112ff1: chore(provider/gateway): update gateway model settings files

4.0.26

Patch Changes

  • 7c16f21: feat(google): add gemini-3.6-flash and gemini-3.5-flash-lite models

... (truncated)

Commits

Updates @google/genai from 2.12.0 to 2.14.0

Release notes

Sourced from @​google/genai's releases.

v2.14.0

2.14.0 (2026-07-28)

Features

  • [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (4b2e67a)
  • Add flat language_codes field to AudioTranscriptionConfig. (cc808eb)
  • Allow api key + proj/location for enterprise mode (9c0540a)

Bug Fixes

  • add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (bb66101)

v2.13.0

2.13.0 (2026-07-21)

Features

  • A new field custom_vocabulary is added to Live API(f32ec0a)
  • add model selector (b5d70da)
  • interaction-api: add queued status to interaction proto (1b7dd39)
  • make ASR fields public in v1main and Interactions (08ef3eb)
Changelog

Sourced from @​google/genai's changelog.

2.14.0 (2026-07-28)

Features

  • [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (4b2e67a)
  • Add flat language_codes field to AudioTranscriptionConfig. (cc808eb)
  • Allow api key + proj/location for enterprise mode (9c0540a)

Bug Fixes

  • add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (bb66101)

2.13.0 (2026-07-21)

Features

  • A new field custom_vocabulary is added to message .google.cloud.aiplatform.v1beta1.BidiGenerateContentSetup (f32ec0a)
  • add model selector (b5d70da)
  • interaction-api: add queued status to interaction proto (1b7dd39)
  • make ASR fields public in v1main and Interactions (08ef3eb)
Commits
  • ebeba1c chore(main): release 2.14.0 (#1799)
  • cc808eb feat: Add flat language_codes field to AudioTranscriptionConfig.
  • 9c0540a feat: Allow api key + proj/location for enterprise mode
  • d221cf3 chore: internal update
  • 4b2e67a feat: [GenerateContentConfig] Add GenerationConfig.audio_transcription_config...
  • 86d4bfa chore: internal change
  • bb66101 fix: add deprecation warnings to Imagen generate_images, edit_images, generat...
  • 78ef7c5 chore: Internal change
  • ebf3eb4 chore(main): release 2.13.0 (#1783)
  • 1b7dd39 feat(interaction-api): add queued status to interaction proto
  • Additional commits viewable in compare view

Updates @opentelemetry/core from 2.9.0 to 2.10.0

Release notes

Sourced from @​opentelemetry/core's releases.

v2.10.0

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

Changelog

Sourced from @​opentelemetry/core's changelog.

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
  • a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
  • af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
  • b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
  • cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
  • Additional commits viewable in compare view

Updates @types/node from 26.0.0 to 26.1.2

Commits

Updates ai from 7.0.31 to 7.0.42

Release notes

Sourced from ai's releases.

ai@7.0.42

Patch Changes

  • 1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
  • 60f97f6: support overriding model call settings for individual prepareStep invocations
  • 6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.
  • 6de2ec1: Preserve provider metadata from empty text deltas in streamText.
  • Updated dependencies [1659cd5]
  • Updated dependencies [6a5bdff]
  • Updated dependencies [0012529]
    • @​ai-sdk/provider-utils@​5.0.15
    • @​ai-sdk/gateway@​4.0.32
Changelog

Sourced from ai's changelog.

7.0.42

Patch Changes

  • 1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
  • 60f97f6: support overriding model call settings for individual prepareStep invocations
  • 6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.
  • 6de2ec1: Preserve provider metadata from empty text deltas in streamText.
  • Updated dependencies [1659cd5]
  • Updated dependencies [6a5bdff]
  • Updated dependencies [0012529]
    • @​ai-sdk/provider-utils@​5.0.15
    • @​ai-sdk/gateway@​4.0.32

7.0.41

Patch Changes

  • 2e2224b: Route the warning system information banner to stderr so it does not corrupt application output written to stdout.
  • Updated dependencies [bf216b3]
    • @​ai-sdk/gateway@​4.0.31

7.0.40

Patch Changes

  • c3782a6: Deprecate Experimental_GeneratedImage in favor of GeneratedFile.

7.0.39

Patch Changes

  • 09a52cb: Promote the repairText option to stable on generateObject and streamObject, with a deprecated experimental_repairText alias for backwards compatibility.
  • Updated dependencies [0c464d9]
  • Updated dependencies [c49380c]
    • @​ai-sdk/provider-utils@​5.0.14
    • @​ai-sdk/gateway@​4.0.30

7.0.38

Patch Changes

  • 7bd6bdd: Avoid synthesizing client tool errors for invalid provider-executed tool calls.
  • 1e2f324: feat: add experimental speech translation model specification (Experimental_SpeechTranslationModelV4) and experimental_streamTranslate for streaming speech-to-speech translation
  • Updated dependencies [d9d2a11]
  • Updated dependencies [1e2f324]
    • @​ai-sdk/gateway@​4.0.29
    • @​ai-sdk/provider@​4.0.4
    • @​ai-sdk/provider-utils@​5.0.13

... (truncated)

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates brace-expansion from 5.0.8 to 5.0.9

Commits

Updates turbo from 2.10.5 to 2.10.7

Release notes

Sourced from turbo's releases.

Turborepo v2.10.7-canary.1

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.6-canary.5...v2.10.7-canary.1

Turborepo v2.10.6

What's Changed

Changelog

... (truncated)

Commits

Updates @opentelemetry/api from 1.9.0 to 1.9.1

Release notes

Sourced from @​opentelemetry/api's releases.

api/v1.9.1

1.9.1

🐛 (Bug Fix)

  • fix(api): prioritize esnext export condition as it is more specific #5458
  • fix(api): update diag consoleLogger to use original console methods to prevent infinite loop when a console instrumentation is present #6395
  • fix(api): use Attributes instead of deprecated SpanAttributes in SpanOptions #6478 @​overbalance
  • fix(diag): change types in DiagComponentLogger from any to unknown#5478 @​loganrosen
  • fix(api): re-introduce fallback chain for global utils #6523 @​pichlermarc

🏠 (Internal)

Changelog

Sourced from @​opentelemetry/api's changelog.

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

  • chore: fix cross project links and missing implicitly exported types #3533 @​legendecas
  • feat(sdk-metrics): add exponential histogram mapping functions #3504 @​mwear
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​opentelemetry/api since your current version.


Updates @opentelemetry/exporter-trace-otlp-http from 0.220.0 to 0.221.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

  • feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
    • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
  • feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
  • feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
  • feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
  • feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

  • feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
  • feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
  • feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi
Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
  • a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
  • af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
  • b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
  • cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
  • Additional commits viewable in compare view

Updates @opentelemetry/instrumentation from 0.220.0 to 0.221.0

Release notes

Sourced from @​opentelemetry/instrumentation's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

  • feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
    • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
  • feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
  • feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
  • feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
  • feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

  • feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
  • feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
  • feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi
Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: star...

    Description has been truncated

@dependabot
build(deps): bump the npm-minor-patch group across 1 directory with 2…
ee19434 
…7 updates

Bumps the npm-minor-patch group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/gateway](https://github.com/vercel/ai/tree/HEAD/packages/gateway) | `4.0.23` | `4.0.32` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.12.0` | `2.14.0` |
| [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.0.0` | `26.1.2` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.31` | `7.0.42` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.8` | `5.0.9` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.7` |
| [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` |
| [@opentelemetry/instrumentation](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` |
| [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` |
| [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.65.0` | `10.69.0` |
| [@stripe/stripe-js](https://github.com/stripe/stripe-js) | `9.9.0` | `9.12.1` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.110.7` | `2.111.0` |
| [@vercel/functions](https://github.com/vercel/vercel/tree/HEAD/packages/functions) | `3.7.5` | `3.7.6` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.28.0` |
| [stripe](https://github.com/stripe/stripe-node) | `22.3.2` | `22.4.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.2` | `4.3.3` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.2` | `10.5.4` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.10` | `16.2.12` |
| [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.21` | `8.5.25` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.2` | `4.3.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.0` |



Updates `@ai-sdk/gateway` from 4.0.23 to 4.0.32
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/gateway/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/gateway@4.0.32/packages/gateway)

Updates `@google/genai` from 2.12.0 to 2.14.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v2.12.0...v2.14.0)

Updates `@opentelemetry/core` from 2.9.0 to 2.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0)

Updates `@types/node` from 26.0.0 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `ai` from 7.0.31 to 7.0.42
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.42/packages/ai)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `brace-expansion` from 5.0.8 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.8...v5.0.9)

Updates `turbo` from 2.10.5 to 2.10.7
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](https://github.com/vercel/turborepo/commits)

Updates `@opentelemetry/api` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.220.0 to 0.221.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0)

Updates `@opentelemetry/instrumentation` from 0.220.0 to 0.221.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0)

Updates `@opentelemetry/resources` from 2.9.0 to 2.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0)

Updates `@opentelemetry/sdk-trace-base` from 2.9.0 to 2.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0)

Updates `@sentry/nextjs` from 10.65.0 to 10.69.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.65.0...10.69.0)

Updates `@stripe/stripe-js` from 9.9.0 to 9.12.1
- [Release notes](https://github.com/stripe/stripe-js/releases)
- [Commits](stripe/stripe-js@v9.9.0...v9.12.1)

Updates `@supabase/supabase-js` from 2.110.7 to 2.111.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.111.0/packages/core/supabase-js)

Updates `@vercel/functions` from 3.7.5 to 3.7.6
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/functions/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/functions@3.7.6/packages/functions)

Updates `lucide-react` from 1.25.0 to 1.28.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react)

Updates `stripe` from 22.3.2 to 22.4.0
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v22.3.2...v22.4.0)

Updates `@tailwindcss/postcss` from 4.3.2 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss)

Updates `autoprefixer` from 10.5.2 to 10.5.4
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.2...10.5.4)

Updates `eslint-config-next` from 16.2.10 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next)

Updates `playwright` from 1.61.1 to 1.62.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.0)

Updates `@playwright/test` from 1.61.1 to 1.62.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.0)

Updates `postcss` from 8.5.21 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.21...8.5.25)

Updates `tailwindcss` from 4.3.2 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

Updates `vite` from 8.1.5 to 8.2.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@ai-sdk/gateway"
  dependency-version: 4.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@google/genai"
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: ai
  dependency-version: 7.0.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: turbo
  dependency-version: 2.10.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/api"
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.221.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/instrumentation"
  dependency-version: 0.221.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/resources"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/sdk-trace-base"
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@stripe/stripe-js"
  dependency-version: 9.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.111.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@vercel/functions"
  dependency-version: 3.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: stripe
  dependency-version: 22.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: eslint-config-next
  dependency-version: 16.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vite
  dependency-version: 8.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@dependabot
dependabot Bot requested a review from groupthinking as a code owner July 30, 2026 12:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@vercel

vercel Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
v0-uvai Ready Ready Preview, v0 Jul 30, 2026 12:17pm

@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown

🔍 PR Validation

⚠️ Large PR detected (2756 lines changed)

@github-actions

github-actions Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

Machine-readable verdict
{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

This grouped npm bump is currently in a dirty merge state (conflicts in package.json / package-lock.json, likely from other dependency updates landing on main). Rebasing regenerates the branch and lockfile against the latest main so the conflict clears and CI/Vercel can re-run cleanly. Holding at the merge gate for human sign-off afterward — this touches 27 packages on protected main and is not labeled automerge.

Generated by Claude Code

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

Conflict gate: this PR is mergeable_state=dirty (lockfile conflict against main). Triggering a native rebase to regenerate the lockfile and clear the conflict. The merge itself still requires a maintainer's sign-off — this PR targets the protected main branch and has no automerge label, so it is held at the publish gate awaiting human approval.

Generated by Claude Code

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

This PR is mergeable_state: dirty — it branched from a main that predates the dependency PRs #1094, #1098, and #1103. Rebasing onto current main will re-resolve the lockfile and clear the conflict.

Note for maintainers: even once the conflict is cleared, the Canonical issue and evidence governance gate will still fail on this PR because a bare Dependabot bump has no Closes #<issue> reference or Outcome / Risk / Verification / Production evidence body sections. Landing this bump will require either a maintainer merge that overrides that gate, or re-homing the change onto a PR that carries the governance body. The merge itself targets protected main and is left for a human decision.

Generated by Claude Code

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

Automated remediation scan — CONFLICT GATE. This grouped PR is mergeable_state: dirty because #1098 (fix/deps-npm-transitives) and #1103 (fix/deps-hono-via-mcp-sdk) both merged package.json / package-lock.json changes into main just after this PR was opened against the older base. Rebasing regenerates the lockfile against current main and clears the conflict; leaving it to Dependabot rather than hand-resolving a 27-package lockfile. Not merging — base is protected main and CI (incl. dependency-review) still needs to settle post-rebase.

Generated by Claude Code

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

This PR is currently conflicted against main (the branch was cut before #1094 / #1098 / #1103 landed the next and transitive-override security floors). Rebasing regenerates the lockfile against the current base so the diff is reviewable without conflicts.

Note for a human maintainer: even once rebased, this cannot auto-merge — the required governance checks (PR Governance, Agent completion enforcement, Canonical issue and evidence) fail on Dependabot PRs by design, and main is a protected branch. Final merge is a maintainer decision.

Generated by Claude Code

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

Automated review (review requested; dependency-bump PR).

Diff scope — package.json, apps/web/package.json, package-lock.json only. The npm-minor-patch group (27 updates): @ai-sdk/gateway 4.0.23→4.0.32, @google/genai 2.12→2.14, OpenTelemetry 2.9→2.10 / 0.220→0.221, @sentry/nextjs, stripe 22.3→22.4, @supabase/supabase-js, ai 7.0.31→7.0.42, eslint-config-next, playwright 1.61→1.62, vite 8.1→8.2, turbo, @modelcontextprotocol/sdk 1.26→1.30, etc. All minor/patch — no majors, no removed/yanked packages, sources look normal. The code diff is not a concern.

Blockers (why this cannot merge yet):

  1. Merge conflict — mergeable_state: dirty; package-lock.json conflicts with main (this group PR overlaps the superseded individual OTel bumps build(deps): bump @opentelemetry/exporter-trace-otlp-http from 0.220.0 to 0.221.0 in /apps/web #1004–build(deps): bump @opentelemetry/sdk-trace-base from 2.9.0 to 2.10.0 in /apps/web #1008). I've triggered a rebase (command above) to regenerate the lockfile against current main.

  2. Governance gates fail structurally — Canonical issue and evidence, Agent completion enforcement, and PR Governance all fail. They require the PR body to contain ## Canonical issue / ## Outcome / ## Risk / ## Verification / ## Production evidence plus exactly one Closes #<issue> reference to a real open issue. A dependabot[bot] PR cannot produce that contract. This is a maintainer policy decision, not a branch fix: either exempt bot-authored PRs from the agent-completion workflow, or override-merge. The same wall will block every dependabot PR (build(deps): bump github/gh-aw-actions/setup from 0.82.14 to 0.83.4 #999–build(deps): bump @opentelemetry/sdk-trace-base from 2.9.0 to 2.10.0 in /apps/web #1008 are queued behind it). I have deliberately not edited the PR body to fabricate these sections — that would defeat the governance control.

State: HALTED(awaiting_maintainer) — after the rebase clears the conflict and CI re-runs, merge is gated on (a) your governance-gate exemption decision and (b) merge approval on protected main. No code change to this branch is warranted.

Generated by Claude Code

@groupthinking Claude

groupthinking commented Jul 30, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

This PR is currently mergeable_state: dirty (conflicts against main, likely the package-lock.json). Rebasing will regenerate the group update against the current base so it can be reviewed and merged cleanly. Merge itself is intentionally left for human sign-off — this branch has no automerge label and targets protected main.

Generated by Claude Code

@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 30, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-21d2ca05af branch July 30, 2026 12:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@groupthinking groupthinking Awaiting requested review from groupthinking groupthinking is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@groupthinking