build(deps): bump the npm-minor-patch group across 1 directory with 13 updates - #881
Merged
groupthinking merged 1 commit intoJul 19, 2026
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuespackage-lock.json
apps/web/package.json
OpenSSF ScorecardScorecard details
Scanned Files
|
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Automated review — dependency bump is clean; the 3 red checks are dependabot CI plumbing, not code defects
The change: 13 minor/patch bumps to package.json + package-lock.json only, no source touched (@ai-sdk/gateway, @google/genai, @opentelemetry/*, @sentry/nextjs, @stripe/stripe-js, ai, lucide-react, openai, @tailwindcss/postcss, autoprefixer, tailwindcss, vite). All within-range, low risk.
Substantive checks are green: test, CodeQL, Security Scan (javascript/python), gitleaks, python-safety, coverage all passed.
Why the three ❌ are false negatives (infra, not this diff):
| Check | Root cause |
|---|---|
validate |
Throws HttpError: Resource not accessible by integration (403) when it POSTs its "GITHUB_TOKEN, so issues:write comment creation 403s and the job crashes. Not related to the dependencies. |
agent-completion/truth-gate |
Structurally fails on non-agent PRs — no agent lease / intent snapshot exists (snapshot-agent-task-intent was skipped), so the gate finalizes failure. Designed for agent-authored PRs. |
dependency-review |
Output shows no vulnerabilities and no denied licenses — only OpenSSF scorecard scores + the change list. The failure carries no policy violation and is consistent with the same read-only-token comment step. |
mergeable_state is unstable (not blocked), so these failing checks are not required by branch protection — the PR is otherwise mergeable pending the human sign-off on protected main.
Recommendation: safe to merge on owner approval. The validate / dependency-review comment steps should be guarded for dependabot runs (e.g. if: github.actor != 'dependabot[bot]' or continue-on-error on the comment step, or grant the workflow write via a pull_request_target pattern) — the same read-only-token crash blocks the CI signal on all four open dependabot PRs (#879, #880, #881, #882). No code change is warranted on this PR itself.
Posted by an automated PR-triage routine. No approval implied — merge decision remains with the maintainer.
Generated by Claude Code
…3 updates Bumps the npm-minor-patch group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@ai-sdk/gateway](https://github.com/vercel/ai/tree/HEAD/packages/gateway) | `4.0.19` | `4.0.23` | | [@google/genai](https://github.com/googleapis/js-genai) | `2.11.0` | `2.12.0` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.26` | `7.0.31` | | [openai](https://github.com/openai/openai-node) | `6.46.0` | `6.48.0` | | [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.65.0` | `10.66.0` | | [@stripe/stripe-js](https://github.com/stripe/stripe-js) | `9.9.0` | `9.10.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.24.0` | `1.25.0` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.2` | `4.3.3` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.2` | `10.5.4` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.2` | `4.3.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.4` | `8.1.5` | Updates `@ai-sdk/gateway` from 4.0.19 to 4.0.23 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/gateway/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/gateway@4.0.23/packages/gateway) Updates `@google/genai` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/googleapis/js-genai/releases) - [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md) - [Commits](googleapis/js-genai@v2.11.0...v2.12.0) Updates `ai` from 7.0.26 to 7.0.31 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/ai@7.0.31/packages/ai) Updates `openai` from 6.46.0 to 6.48.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v6.46.0...v6.48.0) Updates `@opentelemetry/api` from 1.9.0 to 1.9.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.219.0 to 0.220.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.220.0) Updates `@sentry/nextjs` from 10.65.0 to 10.66.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.65.0...10.66.0) Updates `@stripe/stripe-js` from 9.9.0 to 9.10.0 - [Release notes](https://github.com/stripe/stripe-js/releases) - [Commits](stripe/stripe-js@v9.9.0...v9.10.0) Updates `lucide-react` from 1.24.0 to 1.25.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.25.0/packages/lucide-react) Updates `@tailwindcss/postcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss) Updates `autoprefixer` from 10.5.2 to 10.5.4 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.5.2...10.5.4) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) Updates `vite` from 8.1.4 to 8.1.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite) --- updated-dependencies: - dependency-name: "@ai-sdk/gateway" dependency-version: 4.0.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@google/genai" dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/api" dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@sentry/nextjs" dependency-version: 10.66.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@stripe/stripe-js" dependency-version: 9.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: ai dependency-version: 7.0.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: autoprefixer dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: lucide-react dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: openai dependency-version: 6.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: vite dependency-version: 8.1.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/npm-minor-patch-94d1f35770
branch
from
July 19, 2026 04:56
216cfc2 to
147cb07
Compare
groupthinking
deleted the
dependabot/npm_and_yarn/npm-minor-patch-94d1f35770
branch
July 19, 2026 05:05
🔍 PR Validation |
Agent Completion Truth Gate: NOT_APPLICABLEEvidence agrees. Machine-readable verdict{
"details": {},
"reasons": [],
"verdict": "not_applicable"
} |
This was referenced Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm-minor-patch group with 12 updates in the / directory:
4.0.194.0.232.11.02.12.07.0.267.0.316.46.06.48.01.9.01.9.110.65.010.66.09.9.09.10.01.24.01.25.04.3.24.3.310.5.210.5.44.3.24.3.38.1.48.1.5Updates
@ai-sdk/gatewayfrom 4.0.19 to 4.0.23Changelog
Sourced from @ai-sdk/gateway's changelog.
Commits
9352ac1Version Packages (#17417)2667d27Version Packages (#17351)70fc45cchore(provider/gateway): update gateway model settings files (#17385)6427ca9Version Packages (#17324)4bf9ac2feat (provider/gateway): transcription client-secret minting via gateway.expe...7069785chore(provider/gateway): update gateway model settings files (#17320)b13b5faRevert "fix: AI Gateway usage token counts are undefined in AI SDK results" (...880622bfix: AI Gateway usage token counts are undefined in AI SDK results (#17227)6976682Version Packages (#17196)4d096f6chore(provider/gateway): update gateway model settings files (#17236)Updates
@google/genaifrom 2.11.0 to 2.12.0Release notes
Sourced from @google/genai's releases.
Changelog
Sourced from @google/genai's changelog.
Commits
4106e89chore(main): release 2.12.0 (#1761)aa2fd80chore: internal changec0b64fefeat: Add max_total_tokens for Interaction.3b40b82chore: Add basic trigger life cycle samples8666bc2feat: Add history config.872aa26feat: Add AntigravityAgentConfig to OpenAPI schema overlays and regenerate SDKs.8d520cdfeat: Add Triggers resource to GoogleGenAI client.7b5a133chore: refresh model listc10c048chore: Use trigger_id instead of id for run and list_execution method7ff69c8No public descriptionUpdates
aifrom 7.0.26 to 7.0.31Release notes
Sourced from ai's releases.
Changelog
Sourced from ai's changelog.
Commits
9352ac1Version Packages (#17417)70f18c3fix: transition client-denied tool approvals to output-denied (#17438)cd06458fix: ensure tool input lifecycle callbacks start before input becomes availab...2667d27Version Packages (#17351)6427ca9Version Packages (#17324)3649694Version Packages (#17251)0bc8d4ffix: prevent Chat resume-stream onFinish errors when requests overlap (#16620)6976682Version Packages (#17196)2696562fix(ai): streamTranscribe result promises resolve without consuming fullStrea...ac01b79fix: UI message validation rejects persisted assistant responses with empty p...Updates
openaifrom 6.46.0 to 6.48.0Release notes
Sourced from openai's releases.
Changelog
Sourced from openai's changelog.
Commits
ee5bce8release: 6.48.0 (#2000)8009491chore: refresh ecosystem test dependencies (#2002)18e8c29fix: normalize header names before appending (#1941)6255405release: 6.47.0 (#1989)1cdc019fix(assistants): preserve readable stream deltas (#1994)ec2f57fPreserve snapshots when resuming response streams (#1984)2df10fcfix(zod): support zod v4 mini schemas (#1985)ebb6498Fix runTools readable stream round trip tool results (#1986)5984f44feat: add fromReadableStream to ResponseStream (#1987)373b08adocs: clarify strict Zod function schemas (#1988)Updates
@opentelemetry/apifrom 1.9.0 to 1.9.1Release notes
Sourced from @opentelemetry/api's releases.
Changelog
Sourced from @opentelemetry/api's changelog.
Commits
279458eRelease 1.9.1 / 0.35.1 (#3573)4978743fix(http): remove outgoing headers normalization (#3557)d1f9594chore(deps): update dependency rimraf to v4 (#3532)e0abcc0fix: remove JSON syntax error and regenerate tsconfig files (#3566)a90c558fix(sdk-node): register instrumentations early (#3502)5b070b8fix: include TraceState in trace exports (#3569)dcb09b7chore(deps): update dependency gh-pages to v5 (#3571)3bc93a9feat: exponential histogram - part 1 - mapping functions (#3504)3670071fix: avoid grpc types dependency (#3551)b5ef0e4chore: fix proto generation (#3567)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@opentelemetry/apisince your current version.Updates
@opentelemetry/exporter-trace-otlp-httpfrom 0.219.0 to 0.220.0Release notes
Sourced from @opentelemetry/exporter-trace-otlp-http's releases.
Commits
40d67b7chore: prepare next release (#6869)b1c196dMerge commit from forkd375c08fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)d61ab5fperf(sdk-metrics): optionally capture active context for sync instruments (#6...9e6475efix(core): guard timeInputToHrTime against clock-skew misclassification (#677...c989308feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)dddbc0efeat(sdk-trace): add AlwaysRecordSampler (#6168)991434cchore(deps): update dependency@bufbuild/bufto v1.71.0 (#6863)69303d0chore(deps): update all patch versions (#6862)6690b03chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...Updates
@sentry/nextjsfrom 10.65.0 to 10.66.0Release notes
Sourced from @sentry/nextjs's releases.
... (truncated)
Changelog
Sourced from @sentry/nextjs's changelog.
... (truncated)
Commits
323cbf6release: 10.66.085d0619Merge pull request #22315 from getsentry/prepare-release/10.66.0bddcb83meta(changelog): Update changelog for 10.66.0595e940feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)667cb71fix(browser): Propagate trace data from active span ifhttp.clientspan is ...e8d7bd4fix(core): Preserve propagation across ignored spans (#22277)bd69bd9chore(node-core): Deprecate@sentry/node-corepackage (#22285)c04ebdafix(react): Preserve parent path prefix for descendant route names in `react-...2cbacb5feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22...c9716ebfeat(server-utils): Capture and log orchestrion stats (