Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#375

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-ed62b2930a
Open

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#375
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-ed62b2930a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
playwright 1.60.0 1.61.1
@ai-sdk/anthropic 2.0.82 2.0.86
@ai-sdk/openai 2.0.107 2.0.112
@langchain/core 1.1.48 1.2.3
@langchain/langgraph 1.3.6 1.4.7
ai 5.0.200 5.0.213
undici 6.26.0 6.27.0

Updates playwright from 1.60.0 to 1.61.1

Release notes

Sourced from playwright's releases.

v1.61.1

Bug Fixes

  • #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
  • #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
  • #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
  • #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
  • #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

Browser and Screencast

... (truncated)

Commits
  • 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
  • 4328122 chore: mark v1.61.1 (#41404)
  • 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
  • 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
  • 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
  • b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
  • b5a3175 cherry-pick(#41319): fix(loader): support other node versions
  • d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
  • 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
  • a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
  • Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 2.0.82 to 2.0.86

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

2.0.86

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29

2.0.85

Patch Changes

  • f236836: feat (provider/anthropic): add claude-sonnet-5 model id

2.0.84

Patch Changes

  • Updated dependencies [b85c4fb]
    • @​ai-sdk/provider-utils@​3.0.28

2.0.83

Patch Changes

  • Updated dependencies [9169261]
    • @​ai-sdk/provider-utils@​3.0.27
Commits

Updates @ai-sdk/openai from 2.0.107 to 2.0.112

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​2.0.112

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29
Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.112

Patch Changes

  • Updated dependencies [c6e1d1a]
    • @​ai-sdk/provider-utils@​3.0.29

2.0.111

Patch Changes

  • b4f8362: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls
  • 8549807: feat(provider/openai,provider/gateway): add gpt-5.6 model ids

2.0.110

Patch Changes

  • Updated dependencies [b85c4fb]
    • @​ai-sdk/provider-utils@​3.0.28

2.0.109

Patch Changes

  • f8e6a5c: feat(openai): add orchestration token usage details to Responses API usage

2.0.108

Patch Changes

  • Updated dependencies [9169261]
    • @​ai-sdk/provider-utils@​3.0.27
Commits

Updates @langchain/core from 1.1.48 to 1.2.3

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.3

Patch Changes

  • #11200 08e5888 Thanks @​hntrl! - fix(aws): normalize and safely replay Bedrock reasoning blocks

    Emit standard reasoning blocks with preserved signatures, omit incomplete signature-only reasoning during replay, and retain compatibility with legacy and redacted Bedrock reasoning.

@​langchain/core@​1.2.2

Patch Changes

  • #11171 82bef01 Thanks @​christian-bromann! - fix(core): coerce string v1 AIMessage content to text blocks

    Prevent contentBlocks.push is not a function when constructing an AIMessage with response_metadata.output_version === "v1" and string content (common in serialized LangGraph stream payloads).

@​langchain/core@​1.2.1

Patch Changes

  • #10674 f017708 Thanks @​christian-bromann! - fix: classify provider 429s before retrying

  • #11092 7918bbd Thanks @​aolsenjazz! - fix(core): only treat arrays of content blocks as ToolMessage content

    Fix tool outputs that are arrays of plain objects being forwarded as malformed message content. An array is now only treated as message content blocks when every element is an object with a type; otherwise it is JSON-stringified.

@​langchain/core@​1.2.0

Minor Changes

Patch Changes

  • #11047 ac0f71d Thanks @​christian-bromann! - fix(core): preserve AIMessage content blocks

    Keep existing v1 contentBlocks when constructing AIMessage instances so serialized messages do not lose block content during deserialization.

Commits
  • 82a6b8e chore: version packages (#11202)
  • 08e5888 fix(aws): normalize Bedrock reasoning blocks (#11200)
  • 21aaeb0 fix: patch 13 high/critical Dependabot alerts (#11199)
  • 782c7f2 chore(dev): bump @​types/node from 25.9.1 to 26.1.0 in the types group across ...
  • f51f338 chore: version packages (#11176)
  • 09e7f6d fix(openai): drop tool_call content blocks from chat completions input (#11...
  • a9f123a fix(openai): filter out content blocks the chat completions api rejects as in...
  • cc39f56 chore: version packages (#11172)
  • 82bef01 fix(core): coerce string v1 AIMessage content to text blocks (#11171)
  • 8a7c5f8 chore: version packages (#11170)
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.3.6 to 1.4.7

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.7

Patch Changes

  • #2571 85ba859 Thanks @​christian-bromann! - fix(langgraph): drop unused zod-to-json-schema peer dependency

    Remove the vestigial zod-to-json-schema (and its peerDependenciesMeta/dev) declarations. JSON Schema generation now flows through @langchain/core's Zod v3/v4 interop (toJsonSchema), so the old zod-to-json-schema@^3.x peer (which pins zod@^3.24.1) is no longer needed and was the last source of install-time peer conflicts with Zod v4. Closes #1706.

@​langchain/langgraph@​1.4.6

Patch Changes

  • 03a0d8b Thanks @​christian-bromann! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

    Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165.

  • Updated dependencies [0558e47, 091a46f]:

    • @​langchain/langgraph-sdk@​1.9.25
    • @​langchain/langgraph-checkpoint@​1.1.3

@​langchain/langgraph@​1.4.5

Patch Changes

  • #2557 b1e856d Thanks @​christian-bromann! - fix(sdk): apply state update and goto alongside interrupt resume

    respond(decision, { update, goto }) now maps to LangGraph's Command(resume, update, goto), so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the same superstep as the resume — one checkpoint, no separate updateState write, no flicker. @langchain/langgraph-api forwards update/goto through input.respond, and @langchain/core message instances in update are serialized to dicts before transport, exactly like submit(). Bumps @langchain/protocol to ^0.0.18 for the Goto type.

    respond/respondAll also apply update optimistically (mirroring submit()): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant respond() dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo).

    User-initiated optimistic writes (submit() / respond() / respondAll()) now commit to the store synchronously, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the same commit as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing.

  • Updated dependencies [b1e856d]:

    • @​langchain/langgraph-sdk@​1.9.24

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.7

Patch Changes

  • #2571 85ba859 Thanks @​christian-bromann! - fix(langgraph): drop unused zod-to-json-schema peer dependency

    Remove the vestigial zod-to-json-schema (and its peerDependenciesMeta/dev) declarations. JSON Schema generation now flows through @langchain/core's Zod v3/v4 interop (toJsonSchema), so the old zod-to-json-schema@^3.x peer (which pins zod@^3.24.1) is no longer needed and was the last source of install-time peer conflicts with Zod v4. Closes #1706.

1.4.6

Patch Changes

  • 03a0d8b Thanks @​christian-bromann! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

    Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165.

  • Updated dependencies [0558e47, 091a46f]:

    • @​langchain/langgraph-sdk@​1.9.25
    • @​langchain/langgraph-checkpoint@​1.1.3

1.4.5

Patch Changes

  • #2557 b1e856d Thanks @​christian-bromann! - fix(sdk): apply state update and goto alongside interrupt resume

    respond(decision, { update, goto }) now maps to LangGraph's Command(resume, update, goto), so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the same superstep as the resume — one checkpoint, no separate updateState write, no flicker. @langchain/langgraph-api forwards update/goto through input.respond, and @langchain/core message instances in update are serialized to dicts before transport, exactly like submit(). Bumps @langchain/protocol to ^0.0.18 for the Goto type.

    respond/respondAll also apply update optimistically (mirroring submit()): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant respond() dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo).

    User-initiated optimistic writes (submit() / respond() / respondAll()) now commit to the store synchronously, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the same commit as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing.

... (truncated)

Commits
  • 2174637 chore: version packages (#2572)
  • 85ba859 fix(langgraph): drop unused zod-to-json-schema dependency (#2571)
  • 86389fa chore: version packages (#2567)
  • 03a0d8b fix(langgraph): emit valid UUIDs for exit-mode delta task_ids
  • 31261c3 chore: version packages (#2558)
  • 5d279df chore(deps): bump langchain (#2564)
  • b1e856d feat(sdk): apply state update and goto alongside interrupt resume (#2557)
  • e6082e0 chore: version packages (#2554)
  • d662cbb fix(langgraph): isolate concurrent singleton-agent invocations by thread (#2552)
  • 1c2aa5b fix(langgraph): recognize JSON-erased Overwrite values across runtimes (#2553)
  • Additional commits viewable in compare view

Updates ai from 5.0.200 to 5.0.213

Release notes

Sourced from ai's releases.

ai@5.0.213

Patch Changes

  • 97e9b70: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
  • 59e34d9: Prevent pending tool executions from enqueueing results after a model stream error closes the result stream.
  • Updated dependencies [c6e1d1a]
  • Updated dependencies [7480df1]
    • @​ai-sdk/provider-utils@​3.0.29
    • @​ai-sdk/gateway@​2.0.112
Changelog

Sourced from ai's changelog.

5.0.213

Patch Changes

  • 97e9b70: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
  • 59e34d9: Prevent pending tool executions from enqueueing results after a model stream error closes the result stream.
  • Updated dependencies [c6e1d1a]
  • Updated dependencies [7480df1]
    • @​ai-sdk/provider-utils@​3.0.29
    • @​ai-sdk/gateway@​2.0.112

5.0.212

Patch Changes

  • Updated dependencies [2786e44]
    • @​ai-sdk/gateway@​2.0.111

5.0.211

Patch Changes

  • Updated dependencies [6a823a6]
  • Updated dependencies [ed8b811]
  • Updated dependencies [4f00314]
  • Updated dependencies [8549807]
  • Updated dependencies [3c89617]
    • @​ai-sdk/gateway@​2.0.110

5.0.210

Patch Changes

  • Updated dependencies [6d52ce8]
    • @​ai-sdk/gateway@​2.0.109

5.0.209

Patch Changes

  • Updated dependencies [f236836]
  • Updated dependencies [bd9365a]
    • @​ai-sdk/gateway@​2.0.108

5.0.208

Patch Changes

  • Updated dependencies [4a3b4c0]
    • @​ai-sdk/gateway@​2.0.107

... (truncated)

Commits

Updates undici from 6.26.0 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

  • Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
  • Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 17, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-ed62b2930a branch from b4ecb61 to 4409b17 Compare June 24, 2026 03:57
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-ed62b2930a branch from 4409b17 to 7ea0d1d Compare July 8, 2026 03:57
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
b1673d3 
…y with 7 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.1` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `2.0.82` | `2.0.86` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `2.0.107` | `2.0.112` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.1.48` | `1.2.3` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.3.6` | `1.4.7` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.200` | `5.0.213` |
| [undici](https://github.com/nodejs/undici) | `6.26.0` | `6.27.0` |



Updates `playwright` from 1.60.0 to 1.61.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.1)

Updates `@ai-sdk/anthropic` from 2.0.82 to 2.0.86
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@2.0.86/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@2.0.86/packages/anthropic)

Updates `@ai-sdk/openai` from 2.0.107 to 2.0.112
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@2.0.112/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@2.0.112/packages/openai)

Updates `@langchain/core` from 1.1.48 to 1.2.3
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.1.48...@langchain/core@1.2.3)

Updates `@langchain/langgraph` from 1.3.6 to 1.4.7
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.7/libs/langgraph-core)

Updates `ai` from 5.0.200 to 5.0.213
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.213/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.213/packages/ai)

Updates `undici` from 6.26.0 to 6.27.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.26.0...v6.27.0)

---
updated-dependencies:
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 2.0.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 2.0.108
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/core"
  dependency-version: 1.1.49
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 5.0.204
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: playwright
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-ed62b2930a branch from 7ea0d1d to b1673d3 Compare July 15, 2026 03:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants