build(deps): bump the non-major group across 1 directory with 63 updates

[dependabot]

Bumps the non-major group with 63 updates in the / directory:

Package	From	To
@ai-sdk/anthropic	4.0.16	4.0.44
@ai-sdk/fal	3.0.12	3.0.33
@ai-sdk/gateway	4.0.23	4.0.67
@ai-sdk/google	4.0.18	4.0.56
@ai-sdk/mistral	4.0.13	4.0.35
@ai-sdk/openai	4.0.16	4.0.50
@ai-sdk/react	4.0.34	4.0.86
@composio/core	0.14.0	0.18.0
@composio/vercel	0.11.1	0.11.2
@convex-dev/auth	0.0.94	0.0.95
@convex-dev/resend	0.2.5	0.2.7
@polar-sh/checkout	0.4.0	0.4.1
@polar-sh/sdk	0.48.1	0.49.0
@radix-ui/react-alert-dialog	1.1.20	1.1.23
@radix-ui/react-avatar	1.2.3	1.2.6
@radix-ui/react-checkbox	1.3.8	1.3.11
@radix-ui/react-dialog	1.1.20	1.1.23
@radix-ui/react-dropdown-menu	2.1.21	2.1.24
@radix-ui/react-hover-card	1.1.20	1.1.23
@radix-ui/react-label	2.1.12	2.1.15
@radix-ui/react-popover	1.1.20	1.1.23
@radix-ui/react-progress	1.1.13	1.1.16
@radix-ui/react-radio-group	1.4.4	1.4.7
@radix-ui/react-scroll-area	1.2.15	1.2.18
@radix-ui/react-select	2.3.4	2.3.7
@radix-ui/react-separator	1.1.12	1.1.15
@radix-ui/react-slot	1.3.0	1.3.3
@radix-ui/react-switch	1.3.4	1.3.7
@radix-ui/react-tabs	1.1.18	1.1.21
@radix-ui/react-tooltip	1.2.13	1.2.16
@radix-ui/react-use-controllable-state	1.2.4	1.2.6
@tanstack/react-devtools	0.10.8	0.10.12
@tanstack/react-query	5.101.2	5.102.8
@tanstack/react-query-devtools	5.101.2	5.102.8
@tanstack/react-router	1.170.18	1.170.32
@tanstack/react-router-devtools	1.167.0	1.167.1
@tanstack/react-router-ssr-query	1.167.1	1.167.2
@tanstack/react-start	1.168.32	1.168.49
@upstash/redis	1.38.0	1.38.3
ai	7.0.31	7.0.83
convex	1.42.3	1.45.0
dayjs	1.11.21	1.11.23
exa-js	2.16.0	2.19.0
katex	0.18.1	0.18.4
lucide-react	1.25.0	1.35.0
marked	18.0.6	18.0.11
posthog-js	1.404.1	1.422.1
posthog-node	5.45.2	5.51.4
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.5
sonner	2.0.7	2.0.8
streamdown	2.5.0	2.6.0
zustand	5.0.14	5.0.15
@tanstack/devtools-vite	0.8.1	0.8.5
@testing-library/react	16.3.2	16.3.3
@vitejs/plugin-react	6.0.3	6.1.1
lint-staged	17.1.0	17.4.1
oxfmt	0.59.0	0.65.0
oxlint	1.74.0	1.80.0
vite	8.1.5	8.2.2
vitest	4.1.10	4.1.11

Updates @ai-sdk/anthropic from 4.0.16 to 4.0.44

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/mistral@​4.0.37

Patch Changes

• Updated dependencies [aa45741]
  • @​ai-sdk/provider@​4.0.9
  • @​ai-sdk/provider-utils@​5.0.34

@​ai-sdk/klingai@​4.0.36

Patch Changes

• Updated dependencies [aa45741]
  • @​ai-sdk/provider@​4.0.9
  • @​ai-sdk/provider-utils@​5.0.34

@​ai-sdk/perplexity@​4.0.36

Patch Changes

• Updated dependencies [aa45741]
  • @​ai-sdk/provider@​4.0.9
  • @​ai-sdk/provider-utils@​5.0.34

@​ai-sdk/groq@​4.0.35

Patch Changes

• Updated dependencies [aa45741]
  • @​ai-sdk/provider@​4.0.9
  • @​ai-sdk/provider-utils@​5.0.34

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.44

Patch Changes

• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

4.0.43

Patch Changes

• 7de3612: Encode provider-returned identifiers before using them in credentialed follow-up request paths.
• a9782e1: fix: align batch result parsing, request counts, and lifecycle behavior across providers
• 35841f5: feat: normalize mid-stream provider error events across supported providers into public StreamProviderError instances and preserve provider-owned type, code, status, retry, and raw payload metadata
• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

4.0.42

Patch Changes

• 591d25b: feat: add batch completion webhooks. experimental_startTextBatch accepts a webhookUrl, and the gateway provider registers it through the batch callbackUrl contract and exports typed async-job metadata. Direct Anthropic and OpenAI batch providers return an unsupported warning when the option is provided.
• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

4.0.41

Patch Changes

• Updated dependencies [b74971f]
  • @​ai-sdk/provider-utils@​5.0.29

4.0.40

Patch Changes

• Updated dependencies [e6087c9]
  • @​ai-sdk/provider-utils@​5.0.28

4.0.39

Patch Changes

• 4579b08: Preserve Anthropic server-tool caller metadata in multi-turn conversations.

4.0.38

... (truncated)

Commits

• c93fa8d Version Packages (#19748)
• a01c481 Version Packages (#19478)
• 35841f5 feat: normalize mid-stream provider error events into public typed errors wit...
• a9782e1 fix(batch): align result parsing, request counts, and behavior across provide...
• 7de3612 fix: provider-returned IDs escaping credentialed follow-up URL path segments ...
• 3d3afac Version Packages (#19362)
• 591d25b feat: batch completion webhooks via startTextBatch webhookUrl (#19305)
• ed857f5 Version Packages (#19296)
• 97a9489 Version Packages (#19085)
• 9ce09df Version Packages (#18869)
• Additional commits viewable in compare view

Updates @ai-sdk/fal from 3.0.12 to 3.0.33

Changelog

Sourced from @​ai-sdk/fal's changelog.

3.0.33

Patch Changes

• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

3.0.32

Patch Changes

• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

3.0.31

Patch Changes

• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

3.0.30

Patch Changes

• Updated dependencies [b74971f]
  • @​ai-sdk/provider-utils@​5.0.29

3.0.29

Patch Changes

• Updated dependencies [e6087c9]
  • @​ai-sdk/provider-utils@​5.0.28

3.0.28

Patch Changes

• Updated dependencies [7fbfc6d]
  • @​ai-sdk/provider-utils@​5.0.27

3.0.27

Patch Changes

• Updated dependencies [401a4ba]

... (truncated)

Commits

• c93fa8d Version Packages (#19748)
• a01c481 Version Packages (#19478)
• 3d3afac Version Packages (#19362)
• ed857f5 Version Packages (#19296)
• 97a9489 Version Packages (#19085)
• 52eff91 Version Packages (#18698)
• cbdbeee Version Packages (#18645)
• 63db193 Version Packages (#18587)
• ae26160 Version Packages (#18566)
• bb31e6b Version Packages (#18508)
• Additional commits viewable in compare view

Updates @ai-sdk/gateway from 4.0.23 to 4.0.67

Changelog

Sourced from @​ai-sdk/gateway's changelog.

4.0.67

Patch Changes

• 0e7994c: chore(provider/gateway): update gateway model settings files
• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

4.0.66

Patch Changes

• 81bebaf: Add GLM-5.3-Flash model support to the Z.AI provider and AI Gateway.

4.0.65

Patch Changes

• 80227cf: chore(provider/gateway): update gateway model settings files
• a9782e1: fix: align batch result parsing, request counts, and lifecycle behavior across providers
• 5533946: Remove the internal-only relevance_score and citation_number fields from published Tako Search response types and schemas. Code that reads either field must be updated; Gateway responses still pass the values through at runtime, but they are no longer typed. Also document data surcharge controls.
• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

4.0.64

Patch Changes

• 591d25b: feat: add batch completion webhooks. experimental_startTextBatch accepts a webhookUrl, and the gateway provider registers it through the batch callbackUrl contract and exports typed async-job metadata. Direct Anthropic and OpenAI batch providers return an unsupported warning when the option is provided.
• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

4.0.63

Patch Changes

• e12e068: chore(provider/gateway): update gateway model settings files

4.0.62

Patch Changes

• a371615: feat (provider/gateway): add Tako Search tool support
• Updated dependencies [b74971f]

... (truncated)

Commits

• c93fa8d Version Packages (#19748)
• 34c4710 Version Packages (#19716)
• 81bebaf feat(provider/zai,gateway): add GLM-5.3-Flash model support (#19701)
• a01c481 Version Packages (#19478)
• 35841f5 feat: normalize mid-stream provider error events into public typed errors wit...
• 80227cf chore(provider/gateway): update gateway model settings files (#19507)
• a9782e1 fix(batch): align result parsing, request counts, and behavior across provide...
• 5533946 address gateway tako search tool feedback (#19466)
• 3d3afac Version Packages (#19362)
• 591d25b feat: batch completion webhooks via startTextBatch webhookUrl (#19305)
• Additional commits viewable in compare view

Updates @ai-sdk/google from 4.0.18 to 4.0.56

Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.56

Patch Changes

• 3ad9da9: Preserve complete Google Generative Language usage metadata in raw usage results.
• e9bc618: Omit unsupported frequency and presence penalties from Gemini 2.5 requests and return warnings instead.

4.0.55

Patch Changes

• 56d492f: Surface prompt-level Google safety blocks without candidates as content-filter results with prompt feedback metadata.

4.0.54

Patch Changes

• 1f7835c: feat (provider/google, provider/google-vertex): Gemini 3.5 Transcribe support — unary transcription (gemini-3.5-transcribe) via generateContent with language detection, speaker diarization, word timestamps, and custom vocabulary, plus streaming transcription (gemini-3.5-transcribe-live) over the Live API WebSocket with mode: 'VERBATIM' | 'SMART' transcription formatting

4.0.53

Patch Changes

• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

4.0.52

Patch Changes

• 7de3612: Encode provider-returned identifiers before using them in credentialed follow-up request paths.
• a9782e1: fix: align batch result parsing, request counts, and lifecycle behavior across providers
• 92e08e6: Preserve recursive tool input schemas without aborting Google model calls.
• 35841f5: feat: normalize mid-stream provider error events across supported providers into public StreamProviderError instances and preserve provider-owned type, code, status, retry, and raw payload metadata
• 0246209: Fix Google file uploads failing to type-check with TypeScript 5.9 DOM types.
• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

4.0.51

Patch Changes

• e7fc90e: feat(google): support the Gemini Batch API with experimental_startTextBatch
• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

4.0.50

... (truncated)

Commits

• 3de1476 Version Packages (#19842)
• e9bc618 fix: Gemini 2.5 requests fail when frequency or presence penalties are config...
• 3ad9da9 fix: preserve complete Google Generative Language raw usage metadata (#19827)
• 2fc3389 Version Packages (#19816)
• 56d492f fix: surface Google prompt-level safety blocks without candidates as content-...
• 0379422 Version Packages (#19778)
• 1f7835c feat: support Gemini 3.5 Transcribe on Google and Google Vertex providers (#1...
• c93fa8d Version Packages (#19748)
• a01c481 Version Packages (#19478)
• 35841f5 feat: normalize mid-stream provider error events into public typed errors wit...
• Additional commits viewable in compare view

Updates @ai-sdk/mistral from 4.0.13 to 4.0.35

Changelog

Sourced from @​ai-sdk/mistral's changelog.

4.0.35

Patch Changes

• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

4.0.34

Patch Changes

• ff35434: Add the promptCacheKey chat provider option for Mistral prompt cache affinity.
• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

4.0.33

Patch Changes

• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

4.0.32

Patch Changes

• Updated dependencies [b74971f]
  • @​ai-sdk/provider-utils@​5.0.29

4.0.31

Patch Changes

• b8100f3: fix(mistral): support incremental streaming tool calls

4.0.30

Patch Changes

• Updated dependencies [e6087c9]
  • @​ai-sdk/provider-utils@​5.0.28

4.0.29

Patch Changes

• Updated dependencies [7fbfc6d]

... (truncated)

Commits

• c93fa8d Version Packages (#19748)
• a01c481 Version Packages (#19478)
• ff35434 feat: expose Mistral prompt cache keys for chat completions (#19499)
• 3d3afac Version Packages (#19362)
• ed857f5 Version Packages (#19296)
• e2aa796 Version Packages (#19186)
• b8100f3 fix: @​ai-sdk/mistral rejects incremental streaming tool-call arguments (#19181)
• 97a9489 Version Packages (#19085)
• 52eff91 Version Packages (#18698)
• cbdbeee Version Packages (#18645)
• Additional commits viewable in compare view

Updates @ai-sdk/openai from 4.0.16 to 4.0.50

Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.50

Patch Changes

• e6a2992: Fix Responses history serialization for regular functions named tool_search.

4.0.49

Patch Changes

• 2523403: Normalize non-object replayed Chat Completions tool arguments to empty objects.
• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

4.0.48

Patch Changes

• a9782e1: fix: align batch result parsing, request counts, and lifecycle behavior across providers
• eee6200: Signal schema-invalid known Responses stream events and preserve the error finish reason.
• 35841f5: feat: normalize mid-stream provider error events across supported providers into public StreamProviderError instances and preserve provider-owned type, code, status, retry, and raw payload metadata
• d2f3353: Split OpenAI and Azure OpenAI embedding requests by a conservative UTF-8 byte budget derived from their aggregate token limit, in addition to input count limits.
• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

4.0.47

Patch Changes

• 591d25b: feat: add batch completion webhooks. experimental_startTextBatch accepts a webhookUrl, and the gateway provider registers it through the batch callbackUrl contract and exports typed async-job metadata. Direct Anthropic and OpenAI batch providers return an unsupported warning when the option is provided.
• 2214258: Prevent negative text output token counts when providers report reasoning tokens. Perplexity reasoning tokens are now treated as separate from completion tokens.
• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

4.0.46

Patch Changes

• Updated dependencies [b74971f]
  • @​ai-sdk/provider-utils@​5.0.29

4.0.45

Patch Changes

• 6be0f51: fix(openai): expand internal parallel tool call wrappers from the Responses API while preserving stateful continuation and streaming fallbacks

... (truncated)

Commits

• 0379422 Version Packages (#19778)
• e6a2992 fix: replay regular functions named tool_search correctly in OpenAI Responses...
• c93fa8d Version Packages (#19748)
• 2523403 fix: prevent strict Chat Completions backends from rejecting malformed persis...
• a01c481 Version Packages (#19478)
• 35841f5 feat: normalize mid-stream provider error events into public typed errors wit...
• d2f3353 fix: split large embedding batches that exceed provider aggregate token limit...
• a9782e1 fix(batch): align result parsing, request counts, and behavior across provide...
• eee6200 fix: OpenAI Responses streams silently dropping schema-invalid known events a...
• 3d3afac Version Packages (#19362)
• Additional commits viewable in compare view

Updates @ai-sdk/react from 4.0.34 to 4.0.86

Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.86

Patch Changes

• Updated dependencies [8dd86a9]
• Updated dependencies [fda13b3]
• Updated dependencies [957146c]
• Updated dependencies [ce6849a]
  • ai@7.0.83

4.0.85

Patch Changes

• Updated dependencies [3e125ba]
  • ai@7.0.82
  • @​ai-sdk/provider-utils@​5.0.32
  • @​ai-sdk/mcp@​2.0.39

4.0.84

Patch Changes

• ai@7.0.81

4.0.83

Patch Changes

• Updated dependencies [a9782e1]
• Updated dependencies [bf591f0]
• Updated dependencies [35841f5]
• Updated dependencies [fe69342]
• Updated dependencies [d2f3353]
• Updated dependencies [eed7950]
  • @​ai-sdk/provider-utils@​5.0.31
  • @​ai-sdk/mcp@​2.0.38
  • ai@7.0.80

4.0.82

Patch Changes

• Updated dependencies [b251584]
• Updated dependencies [1175434]
• Updated dependencies [591d25b]
• Updated dependencies [9de0baf]
  • ai@7.0.79
  • @​ai-sdk/mcp@​2.0.37
  • @​ai-sdk/provider@​4.0.8

... (truncated)

Commits

• 0379422 Version Packages (#19778)
• c93fa8d Version Packages (#19748)
• 34c4710 Version Packages (#19716)
• a01c481 Version Packages (#19478)
• 3d3afac Version Packages (#19362)
• 5b64c39 Version Packages (#19341)
• ed857f5 Version Packages (#19296)
• ab58156 Version Packages (#19266)
• 7c5162f Version Packages (#19262)
• c0fa76a Version Packages (#19235)
• Additional commits viewable in compare view

Updates @composio/core from 0.14.0 to 0.18.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.18.0

Minor Changes

• 04817cb: Fix strict-mode tool schemas for OpenAI structured outputs. Strict normalization now applies OpenAI's contract at every depth (nested objects, anyOf branches, array items, inlined $ref/$defs): every object lists all of its properties in required and sets additionalProperties: false, so tools with nested or optional parameters no longer produce schemas the API rejects with a 400. Optional parameters are no longer dropped: they stay available and are widened to accept null, the emulation of optional fields OpenAI documents, and the strict providers drop a null argument the tool's own schema does not accept before executing the tool. Tools whose schema strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs) are sent without strict mode with a warning naming the tool and path, instead of being narrowed. @composio/core exports the new toStrictJsonSchema() and omitNullToolArguments() utilities; removeNonRequiredProperties is unchanged for other callers. The Python OpenAIResponsesProvider gains a matching opt-in strict=True constructor flag that also emits strict: true on the wrapped tool.

Patch Changes

• 449f4e1: Block automatic uploads when a sensitive directory or file name is hidden by symlink resolution.
• 9545806: Bound the best-effort telemetry requests with a timeout so a stalled telemetry endpoint cannot leave an SDK call pending indefinitely.
• db7b576: Declare Node.js 22.22.3 as the minimum supported runtime for every published TypeScript package so package managers surface incompatible runtimes before users encounter ESM loading failures.
• fe66cbe: Omit empty-string file-uploadable arguments from tool execution requests instead of forwarding them to the backend, which rejected them with "Input should be a valid dictionary or instance of FileUploadable". This now also applies when dangerouslyAllowAutoUploadDownloadFiles is off, and with it on an empty value is no longer attempted as an upload.
• c0f1609: Fix three ComposioError subclasses (ComposioToolVersionRequiredError, JsonSchemaToZodError, JsonSchemaRefResolutionError) that omitted their this.name assignment and therefore reported name as 'ComposioError' instead of their own class name, mis-grouping distinct error types in error telemetry.
• d544006: Close a DNS-rebinding window in the SSRF guard: the address validated by assertSafeFetchTarget is now the address ssrfSafeFetch connects to, so a hostname is no longer resolved a second time between the check and the connection. Each redirect hop is re-validated and re-pinned. The request still carries the original hostname in Host and TLS SNI, so certificate verification is unchanged. Hops whose effective dispatcher is a configured route — a caller-supplied dispatcher, a global ProxyAgent/EnvHttpProxyAgent, or NODE_USE_ENV_PROXY env-proxy mode — keep the pre-flight check only, mirroring the Python guard's documented proxy residual.
• Updated dependencies [db7b576]
  • @​composio/json-schema-to-zod@​0.3.1

Changelog

Sourced from @​composio/core's changelog.

0.18.0

Minor Changes

• 04817cb: Fix strict-mode tool schemas for OpenAI structured outputs. Strict normalization now applies OpenAI's contract at every depth (nested objects, anyOf branches, array items, inlined $ref/$defs): every object lists all of its properties in required and sets additionalProperties: false, so tools with nested or optional parameters no longer produce schemas the API rejects with a 400. Optional parameters are no longer dropped: they stay available and are widened to accept null, the emulation of optional fields OpenAI documents, and the strict providers drop a null argument the tool's own schema does not accept before executing the tool. Tools whose schema strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs) are sent without strict mode with a warning naming the tool and path, instead of being narrowed. @composio/core exports the new toStrictJsonSchema() and omitNullToolArguments() utilities; removeNonRequiredProperties is unchanged for other callers. The Python OpenAIResponsesProvider gains a matching opt-in strict=True constructor flag that also emits strict: true on the wrapped tool.

Patch Changes

• 449f4e1: Block automatic uploads when a sensitive directory or file name is hidden by symlink resolution.
• 9545806: Bound the best-effort telemetry requests with a timeout so a stalled telemetry endpoint cannot leave an SDK call pending indefinitely.
• db7b576: Declare Node.js 22.22.3 as the minimum supported runtime for every published TypeScript package so package managers surface incompatible runtimes before users encounter ESM loading failures.
• fe66cbe: Omit empty-string file-uploadable arguments from tool execution requests instead of forwarding them to the backend, which rejected them with "Input should be a valid dictionary or instance of FileUploadable". This now also applies when dangerouslyAllowAutoUploadDownloadFiles is off, and with it on an empty value is no longer attempted as an upload.
• c0f1609: Fix three ComposioError subclasses (ComposioToolVersionRequiredError, JsonSchemaToZodError, JsonSchemaRefResolutionError) that omitted their this.name assignment and therefore reported name as 'ComposioError' instead of their own class name, mis-grouping distinct error types in error telemetry.
• d544006: Close a DNS-rebinding window in the SSRF guard: the address validated by assertSafeFetchTarget is now the address ssrfSafeFetch connects to, so a hostname is no longer resolved a second time between the check and the connection. Each redirect hop is re-validated and re-pinned. The request still carries the original hostname in Host and TLS SNI, so certificate verification is unchanged. Hops whose effective dispatcher is a configured route — a caller-supplied dispatcher, a global ProxyAgent/EnvHttpProxyAgent, or NODE_USE_ENV_PROXY env-proxy mode — keep the pre-flight check only, mirroring the Python guard's documented proxy residual.
• Updated dependencies [db7b576]
  • @​composio/json-schema-to-zod@​0.3.1

0.17.0

Minor Changes

• 760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session. Session meta-tools now retain their session context while provider argument normalization remains intact; existing user-ID calls continue to use direct execution. Anthropic helper failures now preserve their error text in { error } results without changing successful payloads. Custom provider subclasses overriding executeToolCall or handleToolCalls may require updates because these methods now accept session targets.

Patch Changes

• 6ba9179: Validate the URLs that come from API responses before fetching them. Tool-execution downloads (s3Url), S3 presigned uploads (new_presigned_url), Tool Router session file downloads (RemoteFile.buffer() / blob() / text() / save()) and session file uploads (upload_url) now go through the same SSRF guard that already covered user-supplied URLs, so a response naming a private, loopback, or link-local address is refused instead of fetched. Redirect hops are re-validated. Edge runtimes keep their current behavior: session file transfers are not blocked there, since a Worker cannot resolve DNS to check and its fetch does not originate inside the caller's network.

0.16.0

Minor Changes

• 5e57815: Keep free-form object roots, patternProperties, and additionalProperties when parsing a tool schema.

  ToolSchema.parse used to reject a bare { "type": "object" } root, drop root patternProperties as an unknown key, and reject a root additionalProperties written as a schema instead of a boolean. Free-form roots now parse successfully, and both constraints survive parsing exactly as written. The public ToolSchema type now makes properties optional to reflect those valid property-less object schemas.

  This matters downstream. Every provider reads inputParameters after parsing, so a tool that declares dynamic keys had those rules stripped before the model ever saw them.

  An omitted additionalProperties still stays omitted. The parser does not invent a value, because each converter decides its own default.

  What no longer works

  Parsing no longer fails on a schema-valued root additionalProperties.

  const tool = ToolSchema.parse({
    slug: 'MY_TOOL',
    inputParameters: {
      type: 'object',
      properties: { name: { type: 'string' } },
      additionalProperties: { type: 'number' },

... (truncated)

Commits

• dbe5a63 Release: update version
• 08306f8 Merge branch 'next' into fix/error-subclass-names
• 3c7b938 Merge branch 'next' into fix/telemetry-request-timeout
• cf42328 fix(telemetry): clear timeout on serialization errors
• 9feca8f fix(json-schema): accept document-root references in strict mode
• 81631f8 Merge branch 'next' into fix/strict-mode-keep-optional-parameters
• c088076 fix(docs): escape pipes in generated text
• 8fe03ef test(json-schema): add strict-mode edge cases enumerated with a second model
• b47d513 fix(core): report every construct strict mode cannot rewrite
• 678ac72 fix(docs): complete generated string escaping
• Additional commits viewable in compare view

Updates @composio/vercel from 0.11.1 to 0.11.2

Release notes

Sourced from @​composio/vercel's releases.

@​composio/vercel@​0.11.2

Patch Changes

• db7b576: Declare Node.js 22.22.3 as the minimum supported runtime for every published TypeScript package so package managers surface incompatible runtimes before users encounter ESM loading failures.
• 04817cb: Fix strict-mode tool schemas for OpenAI structured outputs. Strict normalization now applies OpenAI's contract at every depth (nested objects, anyOf branches, array items, inlined $ref/$defs): every object lists all of its properties in required and sets additionalProperties: false, so tools with nested or optional parameters no longer produce schemas the API rejects with a 400. Optional parameters are no longer dropped: they stay available and are widened to accept null, the emulation of optional fields OpenAI documents, and the strict providers drop a null argument the tool's own schema does not accept before executing the tool. Tools whose schema strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs) are sent without strict mode with a warning naming the tool and path, instead of being narrowed. @composio/core exports the new toStrictJsonSchema() and omitNullToolArguments() utilities; removeNonRequiredProperties is unchanged for other callers. The Python OpenAIResponsesProvider gains a matching opt-in strict=True constructor flag that also emits strict: true on the wrapped tool.

Changelog

Sourced from @​composio/vercel's changelog.

0.11.2

Patch Changes

• db7b576: Declare Node.js 22.22.3 as the minimum supported runtime for every published TypeScript package so package managers surface incompatible runtimes before users encounter ESM loading failures.
• 04817cb: Fix strict-mode tool schemas for OpenAI structured outputs. Strict normalization now applies OpenAI's contract at every depth (nested objects, anyOf branches, array items, inlined $ref/$defs): every object lists all of its properties in required and sets additionalProperties: false, so tools with nested or optional parameters no longer produce schemas the API rejects with a 400. Optional parameters are no longer dropped: they stay available and are widened to accept null, the emulation of optional fields OpenAI documents, and the strict providers drop a null argument the tool's own schema does not accept before executing the tool. Tools whose schema strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs) are sent without strict mode with a warning naming the tool and path, instead of being narrowed. @composio/core exports the new toStrictJsonSchema() and omitNullToolArguments() utilities; removeNonRequiredProperties is unchanged for other callers. The Python OpenAIResponsesProvider gains a matching opt-in strict=True constructor flag that also emits strict: true on the wrapped tool.

Commits

• dbe5a63 Release: update version
• a93e8df docs(providers): clarify strict schema behavior
• 81631f8 Merge branch 'next' into fix/strict-mode-keep-optional-parameters
• e6fb9f9 feat(core): keep $defs recursion under strict mode
• fb30e8f fix(vercel): keep optional parameters available under strict mode
• db7b576 fix(ts): declare the supported Node.js engine floor (#4219)
• 04817cb fix(openai): recursive strict-mode schema normalization for structured output...
• 1503786 refactor(core): forbid explicit any and type JSON Schema recursively (#3968)
• See full diff in compare view

Updates @convex-dev/auth from 0.0.94 to 0.0.95

Changelog

Sourced from @​convex-dev/auth's changelog.

0.0.95

• fix: a failed OTP/magic-link sign-in no longer consumes the verification code it rejected
• fix: signIn called with only a code now resolves with { tokens: null } for every failure instead of rejecting for some

Commits

• b58a384 0.0.95
• 84688a7 return null on pre-verification code errors (#439)
• 7f04bc5 Use api.convex.dev, not provision.convex.dev (#444)
• bd68f9b docs: use named imports in provider JSDoc and docs examples (#353)
• 5ad1339 Update dependency valibot to v1 (#348)
• See full diff in compare view

Updates @convex-dev/resend from 0.2.5 to 0.2.7

Changelog

Sourced from @​convex-dev/resend's changelog.

0.2.7

• Bumps Workpool dependency and convex peer dependency

0.2.6

• forward message_id from Resend webhook payloads to onEmailEvent (#101)

Commits

• becef56 0.2.7
• e24e5dc bump peer dep
• 26d17f9 0.2.6
• 1823275 audit fix
• 2f6a91d Update Routine updates (#104)
• 95a91e1 Update actions/checkout action to v7 (#99)
• c09b7d5 drop renovate schedule
• 2412b9b Update Routine updates (#96)
• 249fa72 forward message_id from Resend webhook payloads to onEmailEvent (#101)
• See full diff in compare view

Updates @polar-sh/checkout from 0.4.0 to 0.4.1

Release notes

Sourced from @​polar-sh/checkout's releases.

@​polar-sh/checkout@​0.4.1

Pat...

Description has been truncated

---

Summary by cubic

Updates 63 non-major dependencies to their latest versions, picking up upstream bug fixes and improvements. No manual code changes are expected; the diff updates version ranges in package.json and regenerates bun.lock.

Dependencies

• Spans AI provider SDKs, Radix UI primitives, TanStack query/router, and build/test tooling.

^{Written for commit ab781d1. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
open-chat	Ignored		Aug 31, 2026 8:21am