Skip to content

chore(deps):(deps-dev): bump the development-dependencies group across 1 directory with 20 updates - #6391

Closed
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/development-dependencies-d80495fc1c
Closed

chore(deps):(deps-dev): bump the development-dependencies group across 1 directory with 20 updates#6391
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/development-dependencies-d80495fc1c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 20 updates in the / directory:

Package From To
@astrojs/markdoc 2.0.11 2.1.1
@astrojs/react 7.0.1 7.1.1
@axe-core/playwright 4.13.0 4.14.0
@composio/core 0.22.0 0.27.0
@composio/vercel 0.12.1 0.13.0
agents 0.28.1 0.30.0
astro 7.3.5 7.4.2
dependency-cruiser 18.6.0 18.7.0
eslint 10.12.0 10.13.0
eslint-plugin-n 18.4.1 18.5.0
headroom-ai 0.40.0 0.41.0
knip 6.41.0 6.42.1
markdownlint 0.41.1 0.42.0
mcp-remote 0.14.5 0.15.2
oxc-parser 0.151.0 0.155.0
oxfmt 0.72.0 0.74.0
oxlint 1.88.0 1.89.0
rollup 4.64.9 4.65.0
satori 0.47.1 0.63.2
wrangler 4.151.1 4.152.0

Updates @astrojs/markdoc from 2.0.11 to 2.1.1

Release notes

Sourced from @​astrojs/markdoc's releases.

@​astrojs/markdoc@​2.1.1

Patch Changes

@​astrojs/markdoc@​2.1.0

Minor Changes

Patch Changes

Changelog

Sourced from @​astrojs/markdoc's changelog.

2.1.1

Patch Changes

2.1.0

Minor Changes

Patch Changes

Commits

Updates @astrojs/react from 7.0.1 to 7.1.1

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​7.1.1

Patch Changes

@​astrojs/react@​7.1.0

Minor Changes

Patch Changes

  • Updated dependencies [b7a1bd9]:
    • @​astrojs/internal-helpers@​0.13.0
Changelog

Sourced from @​astrojs/react's changelog.

7.1.1

Patch Changes

7.1.0

Minor Changes

Patch Changes

  • Updated dependencies [b7a1bd9]:
    • @​astrojs/internal-helpers@​0.13.0
Commits

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.14.0

What's Changed

New Contributors

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

Features

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @composio/core from 0.22.0 to 0.27.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.27.0

Minor Changes

  • c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

    create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

    const session = await composio.create('user_123', {
  hooks: [
    {
      type: 'before_execute',
      id: 'no_external_email',
      name: 'No external email',
      appliesTo: { toolkits: ['gmail'] },
      handler: {
        type: 'condition_check',
        condition: 'Sending email to anyone outside example.org',
        action: 'block',
      },
    },
  ],
});

    A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

    session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

@​composio/core@​0.26.0

Minor Changes

  • e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

    Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

    On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

    The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

  • 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

  • 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

    toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

  • 3dd9a2c: Strip string format values that OpenAI structured outputs rejects from strict tool schemas

... (truncated)

Changelog

Sourced from @​composio/core's changelog.

0.27.0

Minor Changes

  • c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

    create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

    const session = await composio.create('user_123', {
  hooks: [
    {
      type: 'before_execute',
      id: 'no_external_email',
      name: 'No external email',
      appliesTo: { toolkits: ['gmail'] },
      handler: {
        type: 'condition_check',
        condition: 'Sending email to anyone outside example.org',
        action: 'block',
      },
    },
  ],
});

    A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

    session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

0.26.0

Minor Changes

  • e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

    Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

    On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

    The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

  • 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

  • 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

    toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

... (truncated)

Commits
  • 19a8404 Release: update version (#5057)
  • 9a4977f feat(core): add session hooks to TS and Python sessions (#4958)
  • a15956a Release: update version (#4928)
  • bff8c4a feat(core): rename hook handlers to condition_check and prompt_injection_check
  • 9d26fb8 fix(core): fold OpenAPI nullable into the type in strict tool schemas (#4997)
  • f1898b6 fix(sdk): enforce hooks/session-config parity and precise hook_results errors
  • f744fdf fix(core): match the hooks contract on staging
  • c2bbfa8 feat(core): add session hooks to TS and Python sessions
  • be12ce1 feat(core): warn once per deprecated toolkit version reported by the API (PLE...
  • 3dd9a2c fix(core): strip string formats strict mode rejects (#4936)
  • Additional commits viewable in compare view

Updates @composio/vercel from 0.12.1 to 0.13.0

Release notes

Sourced from @​composio/vercel's releases.

@​composio/vercel@​0.13.0

Minor Changes

  • adf6b02: Show the model each tool's JSON Schema as is. The provider now passes the schema to the AI SDK with jsonSchema(), so keywords a Zod schema cannot carry, such as format: "binary", contentEncoding, contentMediaType, title, default, and examples, reach the model. Internal $refs are still inlined first. Tool-call arguments are validated with the same Zod schema as before, so the values a tool accepts and rejects are unchanged.

    In strict mode the model now sees the output of the strict rewrite itself rather than a Zod rendering of it. Zod adds a pattern next to formats such as email, and strict structured outputs reject the one it adds for email, so a strict request with an email parameter would have failed once Zod forwarded more of the schema.

    tool.inputSchema is now an AI SDK Schema instead of a Zod schema. Code that called inputSchema.safeParse() directly can validate with asSchema(tool.inputSchema).validate(value) from ai.

Changelog

Sourced from @​composio/vercel's changelog.

0.13.0

Minor Changes

  • adf6b02: Show the model each tool's JSON Schema as is. The provider now passes the schema to the AI SDK with jsonSchema(), so keywords a Zod schema cannot carry, such as format: "binary", contentEncoding, contentMediaType, title, default, and examples, reach the model. Internal $refs are still inlined first. Tool-call arguments are validated with the same Zod schema as before, so the values a tool accepts and rejects are unchanged.

    In strict mode the model now sees the output of the strict rewrite itself rather than a Zod rendering of it. Zod adds a pattern next to formats such as email, and strict structured outputs reject the one it adds for email, so a strict request with an email parameter would have failed once Zod forwarded more of the schema.

    tool.inputSchema is now an AI SDK Schema instead of a Zod schema. Code that called inputSchema.safeParse() directly can validate with asSchema(tool.inputSchema).validate(value) from ai.

Commits
  • a15956a Release: update version (#4928)
  • cf6343b docs(vercel): state that strict mode does not turn on schema enforcement (#5028)
  • adf6b02 feat: show the model each tool's own JSON Schema in the Vercel, LlamaIndex, a...
  • 517725b test: remove low-value tests without reducing coverage (#4630)
  • See full diff in compare view

Updates agents from 0.28.1 to 0.30.0

Release notes

Sourced from agents's releases.

agents@0.30.0

This release adds support for Pi 1.4 and makes PiHarness recover more reliably from evictions, crashes and storage errors.

Highlights

  • Pi 1.4 support: agents/harness/pi now runs on Pi 1.4.
  • Hibernation while Pi's tasks sleep: PiHarness passes Pi's onWake through your harness factory, so a Durable Object sleeps until Pi's next task is due instead of staying in memory.
  • One wake job per object: PiHarness wakes from Pi's wake(), so a task stopped by Pi's restart limit no longer keeps the object awake.
  • Parked tasks: tasks stopped by Pi's restart limit show as parked in pending(), and retry() runs them again.
  • Recovery: Pi reopens after a storage error instead of failing every call until the object restarts, and the wake job survives failed steps with backoff.
  • Fixes: Lifecycle no longer keeps evicted Durable Objects in memory, and it arms a fallback alarm when startup fails. pi-ai now reports cut-off model streams with wording Pi treats as transient, so Pi retries them.

Upgrading

  1. Update Pi to ~1.4.0 (@earendil-works/pi-durable, pi-ai, pi-agent-core) and install @earendil-works/chord alongside them. Pi 1.4 migrates session storage to a schema Pi 1.3 cannot open, so a deployment cannot roll back past this release.

  2. Check pi-durable's 1.4.0 changelog for its breaking changes, such as the removal of TaskRuntime.sleep(), the new sleeping task status, and the restart limit that parks a crash-looping task after 5 restarts.

  3. Pass onWake to Harness.open, as in the diff below. Without it, the harness still works but logs a warning, and the object stays in memory while Pi's tasks sleep.

  4. If you create Pi's registry at module scope, move it into your class, as a field or in the factory. Our tool examples showed module scope before this release. Pi keeps every Harness subscribed to its registry until it closes, and an evicted object never closes it, so a module-level registry keeps every evicted object's harness in memory.

    - const registry = createRegistry();
  export class Assistant extends Agent<Env> {
+   registry = createRegistry();
    harness = new PiHarness({
      harness: ({ storage, context, onWake }) =>
-       Harness.open(storage, { models, registry }, context)
+       Harness.open(storage, { models, registry: this.registry, onWake }, context)
    });
  }

  5. Keep the harness factory safe to run more than once. It now runs again when Pi reopens after a storage error.

  6. Handle the new parked status if you switch on PiPendingOperation.status.

Existing objects need no migration step. Wake jobs left by earlier releases are handed over to the new wake job on first start.

Minor Changes

  • #2617 cfe9d0f Thanks @​ben-reitz! - Support Pi 1.4: the Pi peer range is now ~1.4.0. Pi 1.4 migrates SQLite session storage to a schema that Pi 1.3 cannot open, so a deployment cannot roll back past this release. See Pi harness.

  • #2619 4b535dc Thanks @​ben-reitz! - PiHarness hands its factory an onWake to pass to Harness.open, so the Durable Object can hibernate while Pi's tasks sleep. Add it to your factory: harness: ({ storage, context, onWake }) => Harness.open(storage, { ...options, onWake }, context). Without it the harness still works and logs a warning. See Pi harness.

  • #2624 3954859 Thanks @​ben-reitz! - PiHarness shows operations stopped by Pi's restart limit as parked in pending(), and retry() runs them again. See Pi harness.

Patch Changes

... (truncated)

Changelog

Sourced from agents's changelog.

0.30.0

This release adds support for Pi 1.4 and makes PiHarness recover more reliably from evictions, crashes and storage errors.

Highlights

  • Pi 1.4 support: agents/harness/pi now runs on Pi 1.4.
  • Hibernation while Pi's tasks sleep: PiHarness passes Pi's onWake through your harness factory, so a Durable Object sleeps until Pi's next task is due instead of staying in memory.
  • One wake job per object: PiHarness wakes from Pi's wake(), so a task stopped by Pi's restart limit no longer keeps the object awake.
  • Parked tasks: tasks stopped by Pi's restart limit show as parked in pending(), and retry() runs them again.
  • Recovery: Pi reopens after a storage error instead of failing every call until the object restarts, and the wake job survives failed steps with backoff.
  • Fixes: Lifecycle no longer keeps evicted Durable Objects in memory, and it arms a fallback alarm when startup fails. pi-ai now reports cut-off model streams with wording Pi treats as transient, so Pi retries them.

Upgrading

  1. Update Pi to ~1.4.0 (@earendil-works/pi-durable, pi-ai, pi-agent-core) and install @earendil-works/chord alongside them. Pi 1.4 migrates session storage to a schema Pi 1.3 cannot open, so a deployment cannot roll back past this release.

  2. Check pi-durable's 1.4.0 changelog for its breaking changes, such as the removal of TaskRuntime.sleep(), the new sleeping task status, and the restart limit that parks a crash-looping task after 5 restarts.

  3. Pass onWake to Harness.open, as in the diff below. Without it, the harness still works but logs a warning, and the object stays in memory while Pi's tasks sleep.

  4. If you create Pi's registry at module scope, move it into your class, as a field or in the factory. Our tool examples showed module scope before this release. Pi keeps every Harness subscribed to its registry until it closes, and an evicted object never closes it, so a module-level registry keeps every evicted object's harness in memory.

    - const registry = createRegistry();
  export class Assistant extends Agent<Env> {
+   registry = createRegistry();
    harness = new PiHarness({
      harness: ({ storage, context, onWake }) =>
-       Harness.open(storage, { models, registry }, context)
+       Harness.open(storage, { models, registry: this.registry, onWake }, context)
    });
  }

  5. Keep the harness factory safe to run more than once. It now runs again when Pi reopens after a storage error.

  6. Handle the new parked status if you switch on PiPendingOperation.status.

Existing objects need no migration step. Wake jobs left by earlier releases are handed over to the new wake job on first start.

Minor Changes

  • #2617 cfe9d0f Thanks @​ben-reitz! - Support Pi 1.4: the Pi peer range is now ~1.4.0. Pi 1.4 migrates SQLite session storage to a schema that Pi 1.3 cannot open, so a deployment cannot roll back past this release. See Pi harness.

  • #2619 4b535dc Thanks @​ben-reitz! - PiHarness hands its factory an onWake to pass to Harness.open, so the Durable Object can hibernate while Pi's tasks sleep. Add it to your factory: harness: ({ storage, context, onWake }) => Harness.open(storage, { ...options, onWake }, context). Without it the harness still works and logs a warning. See Pi harness.

  • #2624 3954859 Thanks @​ben-reitz! - PiHarness shows operations stopped by Pi's restart limit as parked in pending(), and retry() runs them again. See Pi harness.

Patch Changes

  • #2644 f404547 Thanks @​ben-reitz! - Lifecycle arms a fallback alarm while its job queue holds jobs, before startup runs in an alarm and after a startup that queued jobs throws, so a failed startup cannot leave queued jobs without a wake. See Lifecycle.

  • #2653 fc4cd24 Thanks @​ben-reitz! - Stop Lifecycle startup keeping an evicted Durable Object in memory when a capability's startup leaves a promise pending, as PiHarness does when it opens Pi. See Pi harness.

... (truncated)

Commits
  • e18c094 Version Packages (#2652)
  • fc4cd24 fix(agents): stop Lifecycle's startup scope keeping evicted objects alive (#2...
  • 8af09a0 docs(agents): document Pi's afterFailedRun setting for PiHarness (#2651)
  • 91a8f61 fix(agents): keep the Pi harness wake job through failed steps (#2649)
  • 000fcaf fix(agents): reopen pi after a storage error fails its session (#2648)
  • 3954859 feat(agents): show and retry tasks parked by pi's restart limit in PiHarness ...
  • 4b535dc feat(agents): pass pi's onWake through the PiHarness factory (#2619)
  • 3e91ded fix(agents): wake PiHarness from pi.wake(), one job per object (#2618)
  • cfe9d0f chore(agents): prepare for Pi 1.4 (#2617)
  • f404547 fix(agents): arm a Lifecycle fallback alarm before startup in an alarm (#2644)
  • Additional commits viewable in compare view

Updates astro from 7.3.5 to 7.4.2

Release notes

Sourced from astro's releases.

astro@7.4.2

Patch Changes

  • #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

  • #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

  • #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

@dependabot
dependabot Bot requested a review from daggerstuff as a code owner October 26, 2026 03:18
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
pixelated Ignored Ignored Preview Oct 26, 2026 7:54am UTC

Request Review

@dependabot dependabot Bot added the pnpm Pull requests that update pnpm dependencies label Oct 26, 2026
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • Report files not found (see artifacts)

Reports are also available as workflow artifacts

@daggerstuff

daggerstuff commented Oct 26, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-d80495fc1c branch from 443fd2f to 5bc192e Compare October 26, 2026 06:15
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • Report files not found (see artifacts)

Reports are also available as workflow artifacts

@daggerstuff

daggerstuff commented Oct 26, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

1 similar comment
@daggerstuff

daggerstuff commented Oct 26, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-d80495fc1c branch from 5bc192e to 1ef8bc6 Compare October 26, 2026 07:31
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • Report files not found (see artifacts)

Reports are also available as workflow artifacts

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@daggerstuff

daggerstuff commented Oct 26, 2026

Copy link
Copy Markdown
Owner

Holding this PR: the dev-dependencies group floats astro ^7.3.5 → ^7.4.2, and the repo's patches/astro.patch does not apply to 7.4.2 (ERR_PNPM_PATCH_FAILED in build-test setup). Same failure class as the 2026-10-15 astro.float incident — needs a rebuilt patch or an explicit astro override in pnpm-workspace.yaml before these 20 dev bumps can land. Not merging as-is.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-d80495fc1c branch from 1ef8bc6 to ca62823 Compare October 26, 2026 07:43
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • Report files not found (see artifacts)

Reports are also available as workflow artifacts

@dependabot
chore(deps):(deps-dev): bump the development-dependencies group acros…
3432291 
…s 1 directory with 20 updates

Bumps the development-dependencies group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/markdoc](https://github.com/withastro/astro/tree/HEAD/packages/integrations/markdoc) | `2.0.11` | `2.1.1` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `7.0.1` | `7.1.1` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [@composio/core](https://github.com/ComposioHQ/composio/tree/HEAD/ts/packages/core) | `0.22.0` | `0.27.0` |
| [@composio/vercel](https://github.com/ComposioHQ/composio/tree/HEAD/ts/packages/providers/vercel) | `0.12.1` | `0.13.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.28.1` | `0.30.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.5` | `7.4.2` |
| [dependency-cruiser](https://github.com/sverweij/dependency-cruiser) | `18.6.0` | `18.7.0` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [eslint-plugin-n](https://github.com/eslint-community/eslint-plugin-n) | `18.4.1` | `18.5.0` |
| headroom-ai | `0.40.0` | `0.41.0` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.41.0` | `6.42.1` |
| [markdownlint](https://github.com/DavidAnson/markdownlint) | `0.41.1` | `0.42.0` |
| [mcp-remote](https://github.com/punkpeye/mcp-remote) | `0.14.5` | `0.15.2` |
| [oxc-parser](https://github.com/oxc-project/oxc/tree/HEAD/napi/parser) | `0.151.0` | `0.155.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.72.0` | `0.74.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.88.0` | `1.89.0` |
| [rollup](https://github.com/rollup/rollup) | `4.64.9` | `4.65.0` |
| [satori](https://github.com/vercel/satori) | `0.47.1` | `0.63.2` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.151.1` | `4.152.0` |



Updates `@astrojs/markdoc` from 2.0.11 to 2.1.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/markdoc/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdoc@2.1.1/packages/integrations/markdoc)

Updates `@astrojs/react` from 7.0.1 to 7.1.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@7.1.1/packages/integrations/react)

Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `@composio/core` from 0.22.0 to 0.27.0
- [Release notes](https://github.com/ComposioHQ/composio/releases)
- [Changelog](https://github.com/ComposioHQ/composio/blob/next/ts/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ComposioHQ/composio/commits/@composio/core@0.27.0/ts/packages/core)

Updates `@composio/vercel` from 0.12.1 to 0.13.0
- [Release notes](https://github.com/ComposioHQ/composio/releases)
- [Changelog](https://github.com/ComposioHQ/composio/blob/next/ts/packages/providers/vercel/CHANGELOG.md)
- [Commits](https://github.com/ComposioHQ/composio/commits/@composio/vercel@0.13.0/ts/packages/providers/vercel)

Updates `agents` from 0.28.1 to 0.30.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.30.0/packages/agents)

Updates `astro` from 7.3.5 to 7.4.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.2/packages/astro)

Updates `dependency-cruiser` from 18.6.0 to 18.7.0
- [Release notes](https://github.com/sverweij/dependency-cruiser/releases)
- [Changelog](https://github.com/sverweij/dependency-cruiser/blob/main/CHANGELOG.md)
- [Commits](sverweij/dependency-cruiser@v18.6.0...v18.7.0)

Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `eslint-plugin-n` from 18.4.1 to 18.5.0
- [Release notes](https://github.com/eslint-community/eslint-plugin-n/releases)
- [Changelog](https://github.com/eslint-community/eslint-plugin-n/blob/master/CHANGELOG.md)
- [Commits](eslint-community/eslint-plugin-n@v18.4.1...v18.5.0)

Updates `headroom-ai` from 0.40.0 to 0.41.0

Updates `knip` from 6.41.0 to 6.42.1
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.42.1/packages/knip)

Updates `markdownlint` from 0.41.1 to 0.42.0
- [Changelog](https://github.com/DavidAnson/markdownlint/blob/main/CHANGELOG.md)
- [Commits](DavidAnson/markdownlint@v0.41.1...v0.42.0)

Updates `mcp-remote` from 0.14.5 to 0.15.2
- [Release notes](https://github.com/punkpeye/mcp-remote/releases)
- [Commits](punkpeye/mcp-remote@v0.14.5...v0.15.2)

Updates `oxc-parser` from 0.151.0 to 0.155.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/napi/parser/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/crates_v0.155.0/napi/parser)

Updates `oxfmt` from 0.72.0 to 0.74.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.74.0/npm/oxfmt)

Updates `oxlint` from 1.88.0 to 1.89.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint)

Updates `rollup` from 4.64.9 to 4.65.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.9...v4.65.0)

Updates `satori` from 0.47.1 to 0.63.2
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](vercel/satori@0.47.1...0.63.2)

Updates `wrangler` from 4.151.1 to 4.152.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/HEAD/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@astrojs/markdoc"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 7.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@composio/core"
  dependency-version: 0.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@composio/vercel"
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: agents
  dependency-version: 0.30.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: astro
  dependency-version: 7.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: dependency-cruiser
  dependency-version: 18.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: eslint-plugin-n
  dependency-version: 18.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: headroom-ai
  dependency-version: 0.41.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: knip
  dependency-version: 6.42.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: markdownlint
  dependency-version: 0.42.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: mcp-remote
  dependency-version: 0.15.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: oxc-parser
  dependency-version: 0.155.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: oxfmt
  dependency-version: 0.74.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: oxlint
  dependency-version: 1.89.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: rollup
  dependency-version: 4.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: satori
  dependency-version: 0.63.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: wrangler
  dependency-version: 4.152.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-d80495fc1c branch from ca62823 to 3432291 Compare October 26, 2026 07:54
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • Report files not found (see artifacts)

Reports are also available as workflow artifacts

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 26, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-d80495fc1c branch October 26, 2026 22:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daggerstuff daggerstuff Awaiting requested review from daggerstuff daggerstuff is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pnpm Pull requests that update pnpm dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@daggerstuff