chore(deps): bump the production-minor-patch group across 1 directory with 13 updates by dependabot[bot] · Pull Request #993 · cipherstash/stack

dependabot · 2026-10-01T01:20:14Z

Bumps the production-minor-patch group with 13 updates in the / directory:

Package	From	To
@types/node	`22.20.1`	`22.20.4`
drizzle-orm	`0.45.2`	`0.45.3`
@clack/prompts	`1.7.0`	`1.8.1`
posthog-node	`5.49.1`	`5.53.0`
jose	`6.2.9`	`6.2.12`
@rollup/rollup-linux-x64-gnu	`4.62.4`	`4.63.4`
uuid	`14.0.1`	`14.0.2`
@anthropic-ai/claude-agent-sdk	`0.3.234`	`0.3.281`
@anthropic-ai/sdk	`0.117.1`	`0.128.0`
@clerk/nextjs	`7.7.7`	`7.9.5`
next	`15.5.24`	`15.5.26`
tsx	`4.23.12`	`4.23.15`
vite	`8.2.1`	`8.3.0`

Updates @types/node from 22.20.1 to 22.20.4

Commits

See full diff in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @clack/prompts's releases.

@clack/prompts@1.8.1

Patch Changes

8bd9129 Thanks @gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

Updated dependencies [8bd9129]:

@clack/core@1.5.1

@clack/prompts@1.8.0

Minor Changes

#592 caa32e8 Thanks @gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

#594 37fca4e Thanks @dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

#583 ae636dd Thanks @43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

#588 6506135 Thanks @danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

#599 0547d6f Thanks @43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

@clack/core@1.5.0

Changelog

Sourced from @clack/prompts's changelog.

1.8.1

Patch Changes

8bd9129 Thanks @gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

Updated dependencies [8bd9129]:

@clack/core@1.5.1

1.8.0

Minor Changes

#592 caa32e8 Thanks @gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

#594 37fca4e Thanks @dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

#583 ae636dd Thanks @43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

#588 6506135 Thanks @danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

#599 0547d6f Thanks @43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

@clack/core@1.5.0

Commits

da44e23 [ci] release (#605)
8bd9129 fix: correctly specify return type of CANCEL_SYMBOL (#601)
de1ef16 [ci] release (#589)
0547d6f fix: output submit gap only when guide enabled (#599)
ae636dd feat: add async validation (#583)
37fca4e feat(prompts): add tab-completion to path prompt (#594)
caa32e8 feat: export CANCEL_SYMBOL (#592)
8d81248 chore: stop publishing CHANGELOG.md to npm (#591)
e238070 test(box): remove redundant test (#590)
6506135 fix(prompts): style box guide bar to match other gutters (#588)
See full diff in compare view

Updates posthog-node from 5.49.1 to 5.53.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.53.0

5.53.0

Minor Changes

#5050 31dd1ad Thanks @posthog! - Read a feature flag's evaluation runtime with getFeatureFlagEvaluationRuntime(key) and getFeatureFlagKeysByEvaluationRuntime(runtime) (2026-09-23)

posthog-node@5.52.6

5.52.6

Patch Changes

#5078 f4704ac Thanks @rubychilds! - Honor filters.holdout during local feature flag evaluation. A user in an experiment holdout now receives the holdout-<id> variant instead of being bucketed into a regular variant, matching how the server evaluates the same flag. The holdout is resolved before the release conditions, so a held-out user never reaches the flag's targeting — including when those conditions would have excluded them, so isFeatureEnabled can return true where it previously returned false. Experiments with an active holdout will see variant assignment change for the held-out share of traffic on upgrade, bringing locally evaluated assignments in line with server-evaluated ones. (2026-09-23)

Updated dependencies [f4704ac]:

@posthog/core@1.55.2

posthog-node@5.52.5

5.52.5

Patch Changes

#5018 9cd8ebd Thanks @turnipdabeets! - Stop dropping long spans that end: maxSpanAgeMs now evicts spans only once maxLiveSpans is reached, so a span that runs past the age limit and then ends is exported, and its children are no longer orphaned. (2026-09-21)

#4800 aad7464 Thanks @marandaneto! - Respect the definitions response's property_matching_version during local feature flag evaluation. Version 2 uses explicit boolean/string equality and per-member array matching, while missing or other versions retain service legacy matching (including empty-array truthiness). Preserve the version in Node definition caches and Convex persisted definitions, and propagate it through person, group, cohort and dependency evaluation without mixing snapshots during reloads. Existing numeric ambiguity fallback and SemVer parsing policies are unchanged. (2026-09-21)

Updated dependencies [9cd8ebd, aad7464]:

@posthog/core@1.55.1

posthog-node@5.52.4

5.52.4

Patch Changes

#4885 39a8980 Thanks @decknamec! - Server-side feature flags now resolve in posthog-node and posthog-edge even when a proxy rewrites the request's User-Agent. Flags restricted to the client runtime now resolve to undefined in these SDKs, where a rewritten User-Agent previously let them through. (2026-09-15)

Updated dependencies [39a8980]:

@posthog/core@1.54.2

posthog-node@5.52.3

5.52.3

Patch Changes

#4941 07c1045 Thanks @marandaneto! - Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections. (2026-09-15)

Updated dependencies [07c1045]:

@posthog/core@1.54.1

Changelog

Sourced from posthog-node's changelog.

5.53.0

Minor Changes

#5050 31dd1ad Thanks @posthog! - Read a feature flag's evaluation runtime with getFeatureFlagEvaluationRuntime(key) and getFeatureFlagKeysByEvaluationRuntime(runtime) (2026-09-23)

5.52.6

Patch Changes

#5078 f4704ac Thanks @rubychilds! - Honor filters.holdout during local feature flag evaluation. A user in an experiment holdout now receives the holdout-<id> variant instead of being bucketed into a regular variant, matching how the server evaluates the same flag. The holdout is resolved before the release conditions, so a held-out user never reaches the flag's targeting — including when those conditions would have excluded them, so isFeatureEnabled can return true where it previously returned false. Experiments with an active holdout will see variant assignment change for the held-out share of traffic on upgrade, bringing locally evaluated assignments in line with server-evaluated ones. (2026-09-23)

Updated dependencies [f4704ac]:

@posthog/core@1.55.2

5.52.5

Patch Changes

#5018 9cd8ebd Thanks @turnipdabeets! - Stop dropping long spans that end: maxSpanAgeMs now evicts spans only once maxLiveSpans is reached, so a span that runs past the age limit and then ends is exported, and its children are no longer orphaned. (2026-09-21)

#4800 aad7464 Thanks @marandaneto! - Respect the definitions response's property_matching_version during local feature flag evaluation. Version 2 uses explicit boolean/string equality and per-member array matching, while missing or other versions retain service legacy matching (including empty-array truthiness). Preserve the version in Node definition caches and Convex persisted definitions, and propagate it through person, group, cohort and dependency evaluation without mixing snapshots during reloads. Existing numeric ambiguity fallback and SemVer parsing policies are unchanged. (2026-09-21)

Updated dependencies [9cd8ebd, aad7464]:

@posthog/core@1.55.1

5.52.4

Patch Changes

#4885 39a8980 Thanks @decknamec! - Server-side feature flags now resolve in posthog-node and posthog-edge even when a proxy rewrites the request's User-Agent. Flags restricted to the client runtime now resolve to undefined in these SDKs, where a rewritten User-Agent previously let them through. (2026-09-15)

Updated dependencies [39a8980]:

@posthog/core@1.54.2

5.52.3

Patch Changes

#4941 07c1045 Thanks @marandaneto! - Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections. (2026-09-15)

Updated dependencies [07c1045]:

@posthog/core@1.54.1

5.52.2

Patch Changes

... (truncated)

Commits

7b3121f chore: update versions and lockfile [version bump]
31dd1ad feat(node): expose a flag's evaluation runtime through the SDK (#5050)
0c5557a chore: update versions and lockfile [version bump]
f4704ac fix: honor filters.holdout in local flag evaluation (#5078)
3e72e7b chore: update versions and lockfile [version bump]
aad7464 fix(flags): honor versioned local property matching (#4800)
dea3a53 chore: update versions and lockfile [version bump]
5cfec8b feat(react-native): support partial survey responses and persistent resume (#...
e65d81f build: adopt stable native TypeScript with targeted legacy fallbacks (#4984)
d14b608 chore: add semantic type checks for every SDK (#4985)
Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

505a55b chore(release): 6.2.12
7bc9a33 perf: encode single-signature JWS input once
78637bd perf: normalize General JWE shared headers once
bf5138b perf: deduplicate pending jwks key imports
b23a6f3 perf: use native encoding for larger ASCII strings
fd3ae3f perf: normalize jwks selection metadata once
6925d43 perf: avoid copying AES-GCM output
be62530 docs: clarify and shorten public API guidance
1b41312 build: preserve README when generation fails
0b51829 build: check tree-shaking for every public binding
Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.62.4 to 4.63.4

Release notes

Sourced from @rollup/rollup-linux-x64-gnu's releases.

v4.63.4

4.63.4

2026-09-19

Bug Fixes

Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)

Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

#6429: ci: collect Rust coverage from JS tests in dedicated job (@lukastaegert)

#6442: fix: expose cached module meta during cache checks (@ychampion, @lukastaegert)

#6496: docs: name the parameter runHook actually takes (@darkdi, @lukastaegert)

#6502: Escape quotes and backslashes in import attribute values (@dylanpulver, @lukastaegert)

#6517: Improve agent instructions (@lukastaegert)

#6518: fix(deps): update minor/patch updates (@renovate[bot])

#6519: Request Copilot code review via workflow (@lukastaegert)

v4.63.3

4.63.3

2026-09-14

Bug Fixes

Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)

Always report and recover from failures on invalidation in watch mode (#6506)

Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

#6473: fix(browser): match node's basename and extname (@luantaraschi, @lukastaegert)

#6506: fix(watch): await the rerun so listener failures surface as ERROR events (@yoominho91, @irontaek, @lukastaegert)

#6514: Remove the whole CRLF pair when suppressing ASI (@NgoQuocViet2001)

#6515: chore(deps): lock file maintenance (@renovate[bot])

v4.63.2

4.63.2

2026-09-12

Bug Fixes

Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

#6498: chore(deps): lock file maintenance (@renovate[bot])

... (truncated)

Changelog

Sourced from @rollup/rollup-linux-x64-gnu's changelog.

4.63.4

2026-09-19

Bug Fixes

Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)

Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

#6429: ci: collect Rust coverage from JS tests in dedicated job (@lukastaegert)

#6442: fix: expose cached module meta during cache checks (@ychampion, @lukastaegert)

#6496: docs: name the parameter runHook actually takes (@darkdi, @lukastaegert)

#6502: Escape quotes and backslashes in import attribute values (@dylanpulver, @lukastaegert)

#6517: Improve agent instructions (@lukastaegert)

#6518: fix(deps): update minor/patch updates (@renovate[bot])

#6519: Request Copilot code review via workflow (@lukastaegert)

4.63.3

2026-09-14

Bug Fixes

Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)

Always report and recover from failures on invalidation in watch mode (#6506)

Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

#6473: fix(browser): match node's basename and extname (@luantaraschi, @lukastaegert)

#6506: fix(watch): await the rerun so listener failures surface as ERROR events (@yoominho91, @irontaek, @lukastaegert)

#6514: Remove the whole CRLF pair when suppressing ASI (@NgoQuocViet2001)

#6515: chore(deps): lock file maintenance (@renovate[bot])

4.63.2

2026-09-12

Bug Fixes

Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

#6498: chore(deps): lock file maintenance (@renovate[bot])

#6503: fix(deps): update minor/patch updates (@renovate[bot])

#6504: chore(deps): update dependency eslint-plugin-unicorn to v74 (@renovate[bot])

#6505: pin mocha to v11 (@renovate[bot], @lukastaegert)

... (truncated)

Commits

ba78d57 4.63.4
67c3379 Escape quotes and backslashes in import attribute values (#6502)
35f6053 fix: expose cached module meta during cache checks (#6442)
b7ae5e2 Request Copilot code review via workflow (#6519)
504824c fix(deps): update minor/patch updates (#6518)
05980cf Improve agent instructions (#6517)
942a0a8 ci: collect Rust coverage from JS tests in dedicated job (#6429)
e8c8dd6 docs: name the parameter runHook actually takes (#6496)
250deca 4.63.3
01ab3f8 fix(watch): await the rerun so listener failures surface as ERROR events (#6506)
Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)

v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)

v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)

v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)

v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

fd59f02 chore(main): release 14.0.2 (#967)
f3c564e docs: point the Node support permalink at the CI version matrix (#974)
b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
ea83515 docs: cleanup API summary (#968)
ac36860 chore: pin publint version in CI (#966)
a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.234 to 0.3.281

Release notes

Sourced from @anthropic-ai/claude-agent-sdk's releases.

v0.3.281

What's changed

Added optional trigger, user_message_uuid and timestamp fields to the conversation_reset message so clients can tell what reset the conversation, match a /clear to its message, and show when the reset happened

Fixed permission and dialog callbacks still being invoked for requests that arrived after close()

Fixed control requests issued after a query closed hanging or leaking, and permission prompts that could not be cancelled after a cancelled request was redelivered

Fixed session_state_changed staying at requires_action after an overlapping permission prompt and sandbox network-access prompt were both answered

Improved SDK package size and load time: sdk.mjs no longer bundles unused dependencies (1.47 MB → 0.97 MB)

Improved startup time for query() sessions with in-process MCP servers (createSdkMcpServer) by running their handshake inside the SDK; initialize may now wait up to 250 ms for them

Improved SDK session start-up: the CLI now answers the host's initialize request before starting its background start-up work

Changed the Settings type's attribution field to boolean | {...}; TypeScript code that reads attribution.commit from returned settings needs a type narrow

Updated to parity with Claude Code v2.1.281

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.281
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.281
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.281
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.281
v0.3.280

What's changed

Added optional fireReason to the task-notification SDKMessageOrigin; a local host's declared scheduled-task fire is honored only in a process it started with CLAUDE_CODE_HOST_SCHEDULED_RUN=1

Added verbatimPrompts option: prompts are delivered as written — no @path expansion, no slash-command dispatch and, on current CLIs, no ambient attachments with the prompt (Claude Code 2.1.248+)

Added _meta to mcpServerStatus() tool entries, carrying a tool's MCP Apps ui metadata so a host can find its ui:// resource

Added readMcpResource() (alpha) to read an MCP Apps ui:// resource from an MCP server that Claude Code connected

Improved askSideQuestion(): asked while a turn is running, it now sees that turn (its prompt, replies and finished tool results so far) instead of only the last completed turn

Improved unattended retry (CLAUDE_CODE_RETRY_WATCHDOG): a usage-limit wait emits rate_limit_event (rejected, resetsAt) as it begins; api_retry heartbeats continue while sub-agent work waits

Changed session_state_changed events (CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS=1) to report requires_action while an MCP elicitation waits on the user, as for permission prompts

Changed headless sessions to cancel an MCP server's pending form question when the tool call that drew it ends

Updated to parity with Claude Code v2.1.280

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.280
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.280
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.280
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.280

... (truncated)

Changelog

Sourced from @anthropic-ai/claude-agent-sdk's changelog.

0.3.281

Added optional trigger, user_message_uuid and timestamp fields to the conversation_reset message so clients can tell what reset the conversation, match a /clear to its message, and show when the reset happened

Fixed permission and dialog callbacks still being invoked for requests that arrived after close()

Fixed control requests issued after a query closed hanging or leaking, and permission prompts that could not be cancelled after a cancelled request was redelivered

Fixed session_state_changed staying at requires_action after an overlapping permission prompt and sandbox network-access prompt were both answered

Improved SDK package size and load time: sdk.mjs no longer bundles unused dependencies (1.47 MB → 0.97 MB)

Improved startup time for query() sessions with in-process MCP servers (createSdkMcpServer) by running their handshake inside the SDK; initialize may now wait up to 250 ms for them

Improved SDK session start-up: the CLI now answers the host's initialize request before starting its background start-up work

Changed the Settings type's attribution field to boolean | {...}; TypeScript code that reads attribution.commit from returned settings needs a type narrow

Updated to parity with Claude Code v2.1.281

0.3.280

Added optional fireReason to the task-notification SDKMessageOrigin; a local host's declared scheduled-task fire is honored only in a process it started with CLAUDE_CODE_HOST_SCHEDULED_RUN=1

Added verbatimPrompts option: prompts are delivered as written — no @path expansion, no slash-command dispatch and, on current CLIs, no ambient attachments with the prompt (Claude Code 2.1.248+)

Added _meta to mcpServerStatus() tool entries, carrying a tool's MCP Apps ui metadata so a host can find its ui:// resource

Added readMcpResource() (alpha) to read an MCP Apps ui:// resource from an MCP server that Claude Code connected

Improved askSideQuestion(): asked while a ...
Description has been truncated

… with 13 updates Bumps the production-minor-patch group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.1` | `22.20.4` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` | | [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.1` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.53.0` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` | | [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.62.4` | `4.63.4` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.234` | `0.3.281` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.128.0` | | [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.7.7` | `7.9.5` | | [next](https://github.com/vercel/next.js) | `15.5.24` | `15.5.26` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.15` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.3.0` | Updates `@types/node` from 22.20.1 to 22.20.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `drizzle-orm` from 0.45.2 to 0.45.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3) Updates `@clack/prompts` from 1.7.0 to 1.8.1 - [Release notes](https://github.com/bombshell-dev/clack/releases) - [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md) - [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.1/packages/prompts) Updates `posthog-node` from 5.49.1 to 5.53.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.53.0/packages/node) Updates `jose` from 6.2.9 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.9...v6.2.12) Updates `@rollup/rollup-linux-x64-gnu` from 4.62.4 to 4.63.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.62.4...v4.63.4) Updates `uuid` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.1...v14.0.2) Updates `@anthropic-ai/claude-agent-sdk` from 0.3.234 to 0.3.281 - [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-typescript@v0.3.234...v0.3.281) Updates `@anthropic-ai/sdk` from 0.117.1 to 0.128.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.128.0) Updates `@clerk/nextjs` from 7.7.7 to 7.9.5 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.5/packages/nextjs) Updates `next` from 15.5.24 to 15.5.26 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.24...v15.5.26) Updates `tsx` from 4.23.12 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.12...v4.23.15) Updates `vite` from 8.2.1 to 8.3.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 22.20.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: drizzle-orm dependency-version: 0.45.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@clack/prompts" dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: posthog-node dependency-version: 5.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.63.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@anthropic-ai/claude-agent-sdk" dependency-version: 0.3.281 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.128.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@clerk/nextjs" dependency-version: 7.9.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: next dependency-version: 15.5.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: vite dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-01T01:20:15Z

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

changeset-bot · 2026-10-01T01:20:18Z

⚠️ No Changeset found

Latest commit: ab4fad7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 1, 2026

dependabot Bot requested a review from a team as a code owner October 1, 2026 01:20

Navigation Menu

chore(deps): bump the production-minor-patch group across 1 directory with 13 updates - #993

chore(deps): bump the production-minor-patch group across 1 directory with 13 updates#993
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-e2e8d9a719

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

changeset-bot Bot commented Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026

0.45.3

New Netlify DB Driver

@​clack/prompts@​1.8.1

Patch Changes

@​clack/prompts@​1.8.0

Minor Changes

Patch Changes

1.8.1

Patch Changes

1.8.0

Minor Changes

Patch Changes

posthog-node@5.53.0

5.53.0

Minor Changes

posthog-node@5.52.6

5.52.6

Patch Changes

posthog-node@5.52.5

5.52.5

Patch Changes

posthog-node@5.52.4

5.52.4

Patch Changes

posthog-node@5.52.3

5.52.3

Patch Changes

5.53.0

Minor Changes

5.52.6

Patch Changes

5.52.5

Patch Changes

5.52.4

Patch Changes

5.52.3

Patch Changes

5.52.2

Patch Changes

v6.2.12

Documentation

Refactor

Performance

v6.2.11

Documentation

Refactor

v6.2.10

Fixes

6.2.12 (2026-09-05)

Documentation

Refactor

Performance

6.2.11 (2026-09-04)

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

v4.63.4

4.63.4

Bug Fixes

Pull Requests

v4.63.3

4.63.3

Bug Fixes

Pull Requests

v4.63.2

4.63.2

Bug Fixes

Pull Requests

4.63.4

Bug Fixes

Pull Requests

4.63.3

Bug Fixes

Pull Requests

4.63.2

Bug Fixes

Pull Requests

`@clack/prompts@1`.8.1

`@clack/prompts@1`.8.0