Skip to content

chore(deps): bump the production-minor-patch group across 1 directory with 12 updates - #986

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-9b1c729cde
Open

chore(deps): bump the production-minor-patch group across 1 directory with 12 updates#986
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-9b1c729cde

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 12 updates in the / directory:

Package From To
@types/node 22.20.1 22.20.2
@clack/prompts 1.7.0 1.8.1
posthog-node 5.49.1 5.52.1
jose 6.2.9 6.2.12
@rollup/rollup-linux-x64-gnu 4.62.4 4.63.2
uuid 14.0.1 14.0.2
@anthropic-ai/claude-agent-sdk 0.3.234 0.3.270
@anthropic-ai/sdk 0.117.1 0.125.0
@clerk/nextjs 7.7.7 7.9.2
next 15.5.24 15.5.25
tsx 4.23.12 4.23.13
vite 8.2.1 8.3.0

Updates @types/node from 22.20.1 to 22.20.2

Commits

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.8.1

Patch Changes

  • 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

  • Updated dependencies [8bd9129]:

    • @​clack/core@​1.5.1

@​clack/prompts@​1.8.0

Minor Changes

  • #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

Changelog

Sourced from @​clack/prompts's changelog.

1.8.1

Patch Changes

  • 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

  • Updated dependencies [8bd9129]:

    • @​clack/core@​1.5.1

1.8.0

Minor Changes

  • #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

Commits

Updates posthog-node from 5.49.1 to 5.52.1

Release notes

Sourced from posthog-node's releases.

posthog-node@5.52.1

5.52.1

Patch Changes

  • #4908 4a3c74b Thanks @​turnipdabeets! - Child spans now share their parent's clock, so a child no longer appears to start before or end after its parent by up to a millisecond, or by more when the system clock is adjusted mid-trace. (2026-09-11)
  • Updated dependencies [4a3c74b]:
    • @​posthog/core@​1.53.1

posthog-node@5.52.0

5.52.0

Minor Changes

  • #4579 19e78cc Thanks @​turnipdabeets! - Add experimental distributed tracing to posthog-node: startSpan, withSpan and getActiveSpan record spans against a new traces client option. A service with tracing off still forwards an inbound traceparent, including from spans nested inside the one that received it, so a distributed trace is not severed. A traceparent may be passed as the one-element array req.headersDistinct gives. A beforeSpanSend hook sees every span before it is exported and may edit or drop it, and maxAttributesPerSpan, maxEventsPerSpan, maxAttributeValueLength, maxLiveSpans and maxSpanAgeMs bound what a single span and a single process may hold. (2026-09-10)

Patch Changes

  • #4579 19e78cc Thanks @​turnipdabeets! - Stop a throwing getter in metrics.resourceAttributes from breaking every metrics export — the key is recorded as [Unserializable] instead. (2026-09-10)

  • #4579 19e78cc Thanks @​turnipdabeets! - Honor Retry-After when the ingestion endpoint refuses a logs or metrics batch, instead of retrying on the SDK's own schedule alone. A refusal naming a longer wait extends the one being served, up to five minutes from when it started. Retry delays now carry jitter so clients refused together do not return together, and metrics backs off exponentially across consecutive failures rather than retrying on a fixed interval. (2026-09-10)

  • #4579 19e78cc Thanks @​turnipdabeets! - Logs and metrics now always send service.name and telemetry.sdk.*, even when a resourceAttributes value is too large to encode in full. Previously that value could crowd them out, and the records reached PostHog with no service attribution. (2026-09-10)

  • #4579 19e78cc Thanks @​turnipdabeets! - Stop sending logs and metrics batches over 10 MiB, or too large to serialize at all, instead of spending a request to discover the endpoint refuses them. (2026-09-10)

  • Updated dependencies [19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc]:

    • @​posthog/core@​1.53.0
Changelog

Sourced from posthog-node's changelog.

5.52.1

Patch Changes

  • #4908 4a3c74b Thanks @​turnipdabeets! - Child spans now share their parent's clock, so a child no longer appears to start before or end after its parent by up to a millisecond, or by more when the system clock is adjusted mid-trace. (2026-09-11)
  • Updated dependencies [4a3c74b]:
    • @​posthog/core@​1.53.1

5.52.0

Minor Changes

  • #4579 19e78cc Thanks @​turnipdabeets! - Add experimental distributed tracing to posthog-node: startSpan, withSpan and getActiveSpan record spans against a new traces client option. A service with tracing off still forwards an inbound traceparent, including from spans nested inside the one that received it, so a distributed trace is not severed. A traceparent may be passed as the one-element array req.headersDistinct gives. A beforeSpanSend hook sees every span before it is exported and may edit or drop it, and maxAttributesPerSpan, maxEventsPerSpan, maxAttributeValueLength, maxLiveSpans and maxSpanAgeMs bound what a single span and a single process may hold. (2026-09-10)

Patch Changes

  • #4579 19e78cc Thanks @​turnipdabeets! - Stop a throwing getter in metrics.resourceAttributes from breaking every metrics export — the key is recorded as [Unserializable] instead. (2026-09-10)

  • #4579 19e78cc Thanks @​turnipdabeets! - Honor Retry-After when the ingestion endpoint refuses a logs or metrics batch, instead of retrying on the SDK's own schedule alone. A refusal naming a longer wait extends the one being served, up to five minutes from when it started. Retry delays now carry jitter so clients refused together do not return together, and metrics backs off exponentially across consecutive failures rather than retrying on a fixed interval. (2026-09-10)

  • #4579 19e78cc Thanks @​turnipdabeets! - Logs and metrics now always send service.name and telemetry.sdk.*, even when a resourceAttributes value is too large to encode in full. Previously that value could crowd them out, and the records reached PostHog with no service attribution. (2026-09-10)

  • #4579 19e78cc Thanks @​turnipdabeets! - Stop sending logs and metrics batches over 10 MiB, or too large to serialize at all, instead of spending a request to discover the endpoint refuses them. (2026-09-10)

  • Updated dependencies [19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc]:

    • @​posthog/core@​1.53.0

5.51.8

Patch Changes

  • #4798 4358915 Thanks @​posthog! - fix(error-tracking): collapse repeated frame cycles in parsed stack traces to reduce grouping differences caused by recursion depth, while preserving distinct throw locations (2026-09-09)
  • Updated dependencies [4358915]:
    • @​posthog/core@​1.51.1

5.51.7

Patch Changes

  • #4785 74ca945 Thanks @​marandaneto! - Clarify feature flag return-value terminology across SDK APIs. A false value is a conclusive off evaluation, while undefined means no evaluation is available. Remote evaluation omits globally inactive flags, whereas backend local evaluation can resolve cached inactive definitions to false. (2026-09-07)
  • Updated dependencies [74ca945]:
    • @​posthog/core@​1.50.6

... (truncated)

Commits
  • bc1cc15 chore: update versions and lockfile [version bump]
  • 1bef871 chore: update versions and lockfile [version bump]
  • 19e78cc feat(node): distributed tracing spans (#4579)
  • 902cd32 chore: update versions and lockfile [version bump]
  • 4951873 build: remove nested builds and duplicate test runs (#4848)
  • 575e078 chore: update versions and lockfile [version bump]
  • 74ca945 docs(flags): clarify feature flag result semantics (#4785)
  • 135b7c7 chore: replace ESLint directives with Oxlint annotations (#4784)
  • e9a47d5 chore: migrate unit tests from Jest to Vitest (#4739)
  • 285a2cb chore: migrate remaining lint rules to Oxlint (#4738)
  • Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.62.4 to 4.63.2

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.63.2

4.63.2

2026-09-12

Bug Fixes

  • Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

v4.63.1

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

v4.63.0

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.63.2

2026-09-12

Bug Fixes

  • Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

... (truncated)

Commits

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.234 to 0.3.270

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.270

What's changed

  • Updated to parity with Claude Code v2.1.270

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.270
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.270
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.270
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.270

v0.3.269

What's changed

  • Changed user_message_uuid, user_message_uuids and resume_reason to be stamped on a turn's first complete assistant message as well as its first stream event when partial messages are on
  • Fixed result.permission_denials omitting Read, Edit and Write calls blocked by a path-scoped deny rule
  • Fixed interrupts and permission responses being delayed while a host-started MCP server OAuth sign-in waited on a slow authorization server
  • Fixed missing tool_use_id on task_started / task_notification when the CLI resumes a background subagent on its own; they now carry the agent's last call id
  • Changed plan mode to route writes through canUseTool even when allowDangerouslySkipPermissions is set; the flag now only enables switching to bypassPermissions later
  • Updated to parity with Claude Code v2.1.269

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.269
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.269
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.269
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.269

v0.3.268

What's changed

  • Added result_index to result messages: the result's position in delivery order within the run, from 0
  • Added local_command to the result message of a turn that ran a slash command without entering the model loop, carrying the command's name
  • Added hold_on_cache_impact to the reload_plugins control request (Query.reloadPlugins({ holdOnCacheImpact: true })): holds a reload that would invalidate the session's prompt cache
  • Added resume_reason to assistant, stream-event and result messages, set only on the automatic re-run of a turn a host restart interrupted
  • Added kind (used, free, buffer, deferred) to each category in the get_context_usage control response, matching the /context result's context_usage rows
  • Added optional defaultToNo and suppressAlwaysAllowRule hints to canUseTool options: the prompt should open on its decline option, or offer no persistent "always allow" choice
  • Changed setModel() to confirm a model id the CLI doesn't know locally with the API the first time a session uses it, instead of refusing it as unrecognized
  • Changed user_message_uuid on the automatic re-run of an interrupted turn to name that turn's last user prompt

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.270

  • Updated to parity with Claude Code v2.1.270

0.3.269

  • Changed user_message_uuid, user_message_uuids and resume_reason to be stamped on a turn's first complete assistant message as well as its first stream event when partial messages are on
  • Fixed result.permission_denials omitting Read, Edit and Write calls blocked by a path-scoped deny rule
  • Fixed interrupts and permission responses being delayed while a host-started MCP server OAuth sign-in waited on a slow authorization server
  • Fixed missing tool_use_id on task_started / task_notification when the CLI resumes a background subagent on its own; they now carry the agent's last call id
  • Changed plan mode to route writes through canUseTool even when allowDangerouslySkipPermissions is set; the flag now only enables switching to bypassPermissions later
  • Updated to parity with Claude Code v2.1.269

0.3.268

  • Added result_index to result messages: the result's position in delivery order within the run, from 0
  • Added local_command to the result message of a turn that ran a slash command without entering the model loop, carrying the command's name
  • Added hold_on_cache_impact to the reload_plugins control request (Query.reloadPlugins({ holdOnCacheImpact: true })): holds a reload that would invalidate the session's prompt cache
  • Added resume_reason to assistant, stream-event and result messages, set only on the automatic re-run of a turn a host restart interrupted
  • Added kind (used, free, buffer, deferred) to each category in the get_context_usage control response, matching the /context result's context_usage rows
  • Added optional defaultToNo and suppressAlwaysAllowRule hints to canUseTool options: the prompt should open on its decline option, or offer no persistent "always allow" choice
  • Changed setModel() to confirm a model id the CLI doesn't know locally with the API the first time a session uses it, instead of refusing it as unrecognized
  • Changed user_message_uuid on the automatic re-run of an interrupted turn to name that turn's last user prompt
  • Changed the initialize success response to always include pending_permission_requests (empty when nothing is pending), so clients can tell that apart from an older CLI
  • Changed the task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) to be default tools only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6 and Haiku 4.5; elsewhere list them in tools/allowedTools
  • Updated to parity with Claude Code v2.1.268

0.3.267

  • Added getCcrEvent(query, message) and getSseLastSequenceNum(query) to the browser SDK's SSE transport, plus fromSequenceNum, onCatchUpTruncated and onDeliveryUpdate SSE options
  • Changed systemPrompt recording to default on for custom prompts and appends (a mid-session prompt change takes effect at the next compaction); pass snapshot: false to keep per-request rendering
  • Updated to parity with Claude Code v2.1.267

0.3.266

  • Updated to parity with Claude Code v2.1.266

0.3.265

  • Added user_message_uuid and user_message_uuids to a synthetic turn's first reply and result for a message sent with isSynthetic: true and a uuid, naming the message that started it
  • Added user_message_uuid and user_message_uuids to the first reply and the result of a turn Claude Code started itself, such as a resume, naming the messages you sent that it picked up mid-turn
  • Fixed user_message_uuid missing from the success result of a turn that sent no API request, such as a slash command
  • Fixed multi-turn sessions resetting the shell working directory to the cwd option at each new user message; a cd made by the agent now persists across turns, as in the interactive app
  • Changed user_message_uuid to be set on the first reply after each change of the message a turn is answering, instead of on one reply frame per turn
  • Updated to parity with Claude Code v2.1.265

0.3.264

  • Updated to parity with Claude Code v2.1.264

... (truncated)

CommitsDescription has been truncated

@dependabot @github

dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 20, 2026 22:09
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 20, 2026
@changeset-bot

changeset-bot Bot commented Sep 20, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: c485179

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-minor-patch-9b1c729cde branch from 7bb770e to 22d9b21 Compare September 20, 2026 23:38
@dependabot
chore(deps): bump the production-minor-patch group across 1 directory…
c485179 
… with 12 updates

Bumps the production-minor-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.1` | `22.20.2` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.1` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.52.1` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.62.4` | `4.63.2` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.234` | `0.3.270` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.125.0` |
| [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.7.7` | `7.9.2` |
| [next](https://github.com/vercel/next.js) | `15.5.24` | `15.5.25` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.3.0` |



Updates `@types/node` from 22.20.1 to 22.20.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@clack/prompts` from 1.7.0 to 1.8.1
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.1/packages/prompts)

Updates `posthog-node` from 5.49.1 to 5.52.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.52.1/packages/node)

Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.9...v6.2.12)

Updates `@rollup/rollup-linux-x64-gnu` from 4.62.4 to 4.63.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.4...v4.63.2)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.234 to 0.3.270
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.234...v0.3.270)

Updates `@anthropic-ai/sdk` from 0.117.1 to 0.125.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.125.0)

Updates `@clerk/nextjs` from 7.7.7 to 7.9.2
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.2/packages/nextjs)

Updates `next` from 15.5.24 to 15.5.25
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.24...v15.5.25)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

Updates `vite` from 8.2.1 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.270
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@clack/prompts"
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@clerk/nextjs"
  dependency-version: 7.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@rollup/rollup-linux-x64-gnu"
  dependency-version: 4.63.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@types/node"
  dependency-version: 22.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: next
  dependency-version: 15.5.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: posthog-node
  dependency-version: 5.52.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-minor-patch-9b1c729cde branch from 22d9b21 to c485179 Compare September 20, 2026 23:55
freshtonic
freshtonic approved these changes Sep 21, 2026
View reviewed changes

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving. Twelve minor/patch bumps in the production-minor-patch group; lockfile-only apart from the version pins and catalog entries; CI green except the two Drizzle cells, which fail for a reason that is not this PR's (below).

What I checked

  • Release notes for the bumps with real surface area:
    • jose 6.2.9 → 6.2.12: refactors, an AES-GCM perf change, and the 6.2.10 header/serialization validation fixes. No API shape change on the verify path @cipherstash/nextjs uses.
    • @clack/prompts 1.7.0 → 1.8.1: exports CANCEL_SYMBOL; prompt return types narrow from symbol to CANCEL_SYMBOL. The CLI and wizard pin it exactly, and typecheck passed.
    • @anthropic-ai/sdk 0.117.1 → 0.125.0 and @anthropic-ai/claude-agent-sdk 0.3.234 → 0.3.270: no release in either range mentions a breaking change; wizard unit tests and the e2e job passed.
  • @rollup/rollup-linux-x64-gnu 4.62.4 → 4.63.2: after this PR the pin matches the rollup that vite resolves in the lockfile. Before it, it matched nothing (the lockfile had no rollup@4.62.4), so the bump is a net fix.
  • pnpm-workspace.yaml changes are catalog version moves only. No onlyBuiltDependencies change. Frozen-lockfile install, OSV scan and the supply-chain e2e all passed. The newest release I looked at (@clack/prompts 1.8.1, 13 Sep) clears the 7-day cooldown.

The Drizzle failures are a secrets-scope gap, not a regression

Both Drizzle v3 integration cells fail in lock-context.integration.test.ts with missing CLERK_MACHINE_TOKEN. Dependabot PRs only see Dependabot secrets. CLERK_MACHINE_TOKEN and CLERK_MACHINE_TOKEN_B exist as Actions secrets but not as Dependabot secrets (gh api repos/cipherstash/stack/dependabot/secrets lists only the CS_*, DATABASE_URL and Supabase ones). #985 failed identically before #983 merged, and main is green.

Fix is repo settings, not code: add the two Clerk secrets to Dependabot secrets, then @dependabot rebase. Until then every Dependabot PR shows these two cells red, and any @clerk/* bump lands without the identity suites having run.

Non-blocking, exposed by the touched line

The rollup platform pin lives in optionalDependencies of the published @cipherstash/nextjs, so every Linux x64 consumer of that package installs a rollup binary the package does not use at runtime. It belongs in devDependencies. Follow-up, not this PR.

@freshtonic freshtonic mentioned this pull request Sep 21, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freshtonic freshtonic freshtonic approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@freshtonic