Skip to content

chore(deps): bump the production-minor-patch group with 7 updates - #1376

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-08587fc680
Open

chore(deps): bump the production-minor-patch group with 7 updates#1376
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-08587fc680

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 7 updates:

Package From To
posthog-node 5.55.2 5.56.2
@rollup/rollup-linux-x64-gnu 4.64.5 4.64.10
@anthropic-ai/claude-agent-sdk 0.3.296 0.3.302
@anthropic-ai/sdk 0.133.0 0.135.0
@clerk/nextjs 7.9.14 7.9.17
@vitest/coverage-v8 4.1.11 4.1.12
vitest 4.1.11 4.1.12

Updates posthog-node from 5.55.2 to 5.56.2

Release notes

Sourced from posthog-node's releases.

posthog-node@5.56.2

5.56.2

Patch Changes

  • #5263 cd31356 Thanks @​dustinbyrne! - Allow local feature flag evaluation from a shared definition cache without a secret or personal API key. (2026-10-16)

posthog-node@5.56.1

5.56.1

Patch Changes

  • #5289 e6598be Thanks @​pauldambra! - Link captured exceptions to active OpenTelemetry traces when the API is available. (2026-10-14)

posthog-node@5.56.0

5.56.0

Minor Changes

Patch Changes

  • Updated dependencies [7c10169]:
    • @​posthog/core@​1.59.0

posthog-node@5.55.3

5.55.3

Patch Changes

  • #5281 8f2d581 Thanks @​marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)
  • Updated dependencies [8f2d581]:
    • @​posthog/core@​1.58.1
Changelog

Sourced from posthog-node's changelog.

5.56.2

Patch Changes

  • #5263 cd31356 Thanks @​dustinbyrne! - Allow local feature flag evaluation from a shared definition cache without a secret or personal API key. (2026-10-16)

5.56.1

Patch Changes

  • #5289 e6598be Thanks @​pauldambra! - Link captured exceptions to active OpenTelemetry traces when the API is available. (2026-10-14)

5.56.0

Minor Changes

Patch Changes

  • Updated dependencies [7c10169]:
    • @​posthog/core@​1.59.0

5.55.3

Patch Changes

  • #5281 8f2d581 Thanks @​marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)
  • Updated dependencies [8f2d581]:
    • @​posthog/core@​1.58.1
Commits
  • 3ddaa65 chore: update versions and lockfile [version bump]
  • cd31356 fix(flags): load shared definitions without a secret key (#5263)
  • 9a196f9 chore: update versions and lockfile [version bump]
  • e6598be feat(node): link captured exceptions to active OpenTelemetry spans (#5289)
  • ab585bc chore: update versions and lockfile [version bump]
  • 7c10169 feat(metrics): attach trace exemplars to flushed metric series (#5291)
  • 635149f chore: update versions and lockfile [version bump]
  • 8f2d581 fix: make before_send callback inputs non-null (#5281)
  • d1b00d0 test(node): wait for local evaluation instead of a fixed delay (#5274)
  • See full diff in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.64.5 to 4.64.10

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.64.10

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

v4.64.9

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

v4.64.8

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change when sourcemap comments change (#6509)
  • Resolve some relative import resolution edge cases (#6522)

Pull Requests

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change when sourcemap comments change (#6509)
  • Resolve some relative import resolution edge cases (#6522)

Pull Requests

4.64.7

2026-10-15

... (truncated)

Commits

Updates @anthropic-ai/claude-agent-sdk from 0.3.296 to 0.3.302

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.302

What's changed

  • Fixed structured output results delivering a response's output as structured_output when the API refused that response; the result is now an error with no payload
  • Changed an omitted permissionMode to start in default mode on third-party providers, with telemetry off or on a fresh install; pass permissionMode: 'auto' to keep auto mode
  • Changed fork subagents (subagent_type: "fork") to be on by default in SDK sessions, as in the terminal; run_in_background is still offered, and CLAUDE_CODE_FORK_SUBAGENT=0 turns them off
  • Updated to parity with Claude Code v2.1.302

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.302
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.302
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.302
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.302

v0.3.301

What's changed

  • Added per-tool permission policies to sdk-type MCP server configs: tools entries with permission_policy always_ask or always_deny, applied on initialize and setMcpServers()
  • Added BUILTIN_TOOL_NAMES and LEGACY_TOOL_NAME_ALIASES exports: the public built-in tool names and their earlier names, for checking permission rules and tool settings
  • Added addPlugins to Query.reloadPlugins() so a host can load more plugin folders into a running session
  • Fixed setModel() with a model ID failing while the account is at its five-hour or weekly usage limit; the model now applies and the next message reports the limit
  • Changed the error when a full disk keeps the login from being refreshed: error is now invalid_request, not authentication_failed, and api_error_status is null, not 401
  • Changed mcpServerStatus() to still report a tool's _meta.ui.visibility when the rest of its _meta.ui fails validation
  • Updated to parity with Claude Code v2.1.301

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.301
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.301
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.301
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.301

v0.3.300

What's changed

  • Fixed importSessionToStore skipping transcript rows that contain a Unicode line or paragraph separator (U+2028, U+2029) on Node 24 and Bun
  • Fixed a background subagent's final report in auto mode being joined into one turn with another message from the same subagent; the report now always runs as its own turn
  • Fixed rewind_conversation with interrupt_if_running stopping the running turn before refusing with "unseen later turn"
  • Reverted canUseTool options carrying suppressAlwaysAllowRule: true for connector tools that an organization set to require approval (added in 0.3.292)

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.302

  • Fixed structured output results delivering a response's output as structured_output when the API refused that response; the result is now an error with no payload
  • Changed an omitted permissionMode to start in default mode on third-party providers, with telemetry off or on a fresh install; pass permissionMode: 'auto' to keep auto mode
  • Changed fork subagents (subagent_type: "fork") to be on by default in SDK sessions, as in the terminal; run_in_background is still offered, and CLAUDE_CODE_FORK_SUBAGENT=0 turns them off
  • Updated to parity with Claude Code v2.1.302

0.3.301

  • Added per-tool permission policies to sdk-type MCP server configs: tools entries with permission_policy always_ask or always_deny, applied on initialize and setMcpServers()
  • Added BUILTIN_TOOL_NAMES and LEGACY_TOOL_NAME_ALIASES exports: the public built-in tool names and their earlier names, for checking permission rules and tool settings
  • Added addPlugins to Query.reloadPlugins() so a host can load more plugin folders into a running session
  • Fixed setModel() with a model ID failing while the account is at its five-hour or weekly usage limit; the model now applies and the next message reports the limit
  • Changed the error when a full disk keeps the login from being refreshed: error is now invalid_request, not authentication_failed, and api_error_status is null, not 401
  • Changed mcpServerStatus() to still report a tool's _meta.ui.visibility when the rest of its _meta.ui fails validation
  • Updated to parity with Claude Code v2.1.301

0.3.300

  • Fixed importSessionToStore skipping transcript rows that contain a Unicode line or paragraph separator (U+2028, U+2029) on Node 24 and Bun
  • Fixed a background subagent's final report in auto mode being joined into one turn with another message from the same subagent; the report now always runs as its own turn
  • Fixed rewind_conversation with interrupt_if_running stopping the running turn before refusing with "unseen later turn"
  • Reverted canUseTool options carrying suppressAlwaysAllowRule: true for connector tools that an organization set to require approval (added in 0.3.292)
  • Improved the browser SDK bundle (@anthropic-ai/claude-agent-sdk/browser): 40% smaller to download, by no longer bundling a Node crypto polyfill
  • Changed thinking: { type: 'disabled' } and maxThinkingTokens: 0 to run as adaptive thinking on models that can't turn thinking off
  • Changed updatedInput from PreToolUse and PermissionRequest hook callbacks: it is now validated like Claude's own input and unknown keys are dropped; canUseTool is unchanged
  • Updated to parity with Claude Code v2.1.300

0.3.299

  • Added an optional nextFireAt (epoch ms of the next run) to the CronCreate and CronList tool outputs
  • Added property_order to the elicitation control request: a form's field names in the order the MCP server listed them, for hosts whose transport keeps no JSON object key order
  • Fixed rewind_conversation answering "target not found" for a message stopped during its prompt hooks or plugins: until a reply or input follows, it answers rewound: true with a null prefillText
  • Fixed in-process SDK MCP servers named constructor or toString being silently dropped when a prewarm() process is claimed with SpareProcess.claim()
  • Fixed queued user messages with content-block arrays running together without a line break when merged into one turn
  • Fixed origin.body on a user message that merges several queued peer messages (from other sessions or agents) carrying only the first message's text; it is now omitted
  • Changed initialize, mcp_set_servers and claim_session to refuse the reserved MCP server names __proto__, __defineGetter__, __defineSetter__, __lookupGetter__, __lookupSetter__
  • Updated to parity with Claude Code v2.1.299

0.3.298

  • Updated to parity with Claude Code v2.1.298

0.3.297

  • Updated to parity with Claude Code v2.1.297
Commits

Updates @anthropic-ai/sdk from 0.133.0 to 0.135.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.135.0

Features

  • api: add between_tools to thinking types in model capabilities
  • api: add the speed parameter and usage.speed to Messages
  • api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

  • client: close streams dropped without being read to the end
  • client: keep an unread JSONL response open while it is held

Chores

  • ci: speed up breaking change detection
  • docs: describe headers on Managed Agents and telemetry endpoints

Documentation

  • api: note that some models need a beta header to use speed

sdk-v0.134.0

Features

  • api: add execution_identity to Managed Agents agents

  • api: add organization_type_not_supported error to spend limit lists

  • api: add telemetry destination test endpoint

  • api: add telemetry destinations to the Admin API

  • client: add native support for OpenTelemetry tracing

    If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

  • api: rename telemetry destination test response model
  • client: close an unread stream that was dropped while tracing is on
  • client: don't follow redirects on token requests
  • client: treat proxy-authorization as a sensitive header

Bug Fixes

  • streaming: tolerate unknown event types in MessageStream and BetaMessageStream
  • streaming: stop throwing "Unexpected event order" for an event before message_start
  • streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.135.0 (2026-10-15)

Features

  • api: add between_tools to thinking types in model capabilities
  • api: add the speed parameter and usage.speed to Messages
  • api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

  • client: close streams dropped without being read to the end
  • client: keep an unread JSONL response open while it is held

Chores

  • ci: speed up breaking change detection
  • docs: describe headers on Managed Agents and telemetry endpoints

Documentation

  • api: note that some models need a beta header to use speed

0.134.0 (2026-10-14)

Features

  • api: add execution_identity to Managed Agents agents

  • api: add organization_type_not_supported error to spend limit lists

  • api: add telemetry destination test endpoint

  • api: add telemetry destinations to the Admin API

  • client: add native support for OpenTelemetry tracing

    If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

  • api: rename telemetry destination test response model
  • client: close an unread stream that was dropped while tracing is on
  • client: don't follow redirects on token requests
  • client: treat proxy-authorization as a sensitive header

Bug Fixes

  • streaming: tolerate unknown event types in MessageStream and BetaMessageStream
  • streaming: stop throwing "Unexpected event order" for an event before message_start

... (truncated)

Commits
  • 04a4c28 release: 0.135.0
  • 69dbe62 Merge pull request #935 from anthropics/synced/published
  • b61a531 feat(helpers): retry a rate-limited fast fallback at standard speed (#943)
  • 38d0ab4 feat(api): add between_tools to thinking types in model capabilities
  • 366b53b chore(docs): describe headers on Managed Agents and telemetry endpoints
  • ca50812 docs(api): note that some models need a beta header to use speed
  • 03f6012 fix(helpers): honor speed overrides from fallback entries when streaming (#942)
  • 88bf034 docs(changelog): shorten the OpenTelemetry tracing note (#941)
  • 7c807a0 fix(client): close streams dropped without being read to the end
  • 64758f6 feat(api): add the speed parameter and usage.speed to Messages
  • Additional commits viewable in compare view

Updates @clerk/nextjs from 7.9.14 to 7.9.17

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.9.17

Patch Changes

  • Updated dependencies [57aeba8]:
    • @​clerk/backend@​3.25.0
Changelog

Sourced from @​clerk/nextjs's changelog.

7.9.17

Patch Changes

  • Updated dependencies [57aeba8]:
    • @​clerk/backend@​3.25.0

7.9.16

Patch Changes

  • Updated dependencies [9159465]:
    • @​clerk/backend@​3.24.0

7.9.15

Patch Changes

  • Fix auth.protect() skipping authorization checks for machine tokens. The role, permission, feature, plan, and reverification params and the predicate callback are now evaluated for API key, OAuth token, and M2M token requests. Param-based checks respond with a 401 for those requests. (#10198) by @​wobsoriano

  • Fix getAuth() and auth() returning OAuth and M2M tokens as signed-in user sessions. They now return a signed-out state for machine tokens. To authenticate OAuth or M2M tokens on a route, use auth({ acceptsToken }). (#10213) by @​wobsoriano

Commits

Updates @vitest/coverage-v8 from 4.1.11 to 4.1.12

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.12

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates vitest from 4.1.11 to 4.1.12

Release notes

Sourced from vitest's releases.

v4.1.12

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-minor-patch group with 7 updates
ccd045c 
Bumps the production-minor-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.55.2` | `5.56.2` |
| [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.64.5` | `4.64.10` |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.296` | `0.3.302` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.133.0` | `0.135.0` |
| [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.9.14` | `7.9.17` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.11` | `4.1.12` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `4.1.12` |


Updates `posthog-node` from 5.55.2 to 5.56.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.56.2/packages/node)

Updates `@rollup/rollup-linux-x64-gnu` from 4.64.5 to 4.64.10
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.5...v4.64.10)

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.296 to 0.3.302
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.296...v0.3.302)

Updates `@anthropic-ai/sdk` from 0.133.0 to 0.135.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.133.0...sdk-v0.135.0)

Updates `@clerk/nextjs` from 7.9.14 to 7.9.17
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.17/packages/nextjs)

Updates `@vitest/coverage-v8` from 4.1.11 to 4.1.12
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/coverage-v8)

Updates `vitest` from 4.1.11 to 4.1.12
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/vitest)

---
updated-dependencies:
- dependency-name: posthog-node
  dependency-version: 5.56.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@rollup/rollup-linux-x64-gnu"
  dependency-version: 4.64.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.302
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@clerk/nextjs"
  dependency-version: 7.9.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 25, 2026 21:11
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@changeset-bot

changeset-bot Bot commented Oct 25, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: ccd045c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI; Enforced overrides: Organization
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: f29d956d-d310-4282-ad19-b797ab433a45

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@freshtonic freshtonic mentioned this pull request Oct 25, 2026
Open
freshtonic
freshtonic approved these changes Oct 25, 2026
View reviewed changes

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

  • posthog-node goes to ^5.56.2 in stash and @cipherstash/wizard. @anthropic-ai/sdk goes to ^0.135.0 and @anthropic-ai/claude-agent-sdk to ^0.3.302 in the wizard. @rollup/rollup-linux-x64-gnu goes to 4.64.10 in nextjs. The catalog moves vitest and @vitest/coverage-v8 to 4.1.12 and @clerk/nextjs to 7.9.17.
  • One new package: @opentelemetry/api@1.9.1. @anthropic-ai/sdk 0.135.0 now lists it as a regular dependency. So the published wizard gets it as a runtime transitive dependency. It has no dependencies and no install scripts, and it was published on 2026-03-25, so it is well past the 7-day minimumReleaseAge. posthog-node, vitest, drizzle-orm, next and supabase-js list it as an optional peer, so pnpm now links it to them too. That is why so many snapshot keys change.
  • @anthropic-ai/sdk is a 0.x minor bump, which semver allows to break the API. The wizard's tests and typecheck pass with it.
  • The lockfile resolves one @anthropic-ai/sdk version and has no non-registry sources. None of the bumped packages has an install script.
  • All 23 checks pass.

This PR and #1375 both change pnpm-lock.yaml, so the second one to merge needs a rebase.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freshtonic freshtonic freshtonic approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@freshtonic