Skip to content

chore(deps):(deps): bump the production-minor group with 12 updates - #6404

Open
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/production-minor-b7c69e719e
Open

chore(deps):(deps): bump the production-minor group with 12 updates#6404
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/production-minor-b7c69e719e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor group with 12 updates:

Package From To
@browserbasehq/stagehand 4.2.1 4.3.0
@cloudflare/shell 0.4.3 0.5.0
@cloudflare/think 0.20.2 0.21.0
@composio/core 0.22.0 0.27.0
chart.js 4.5.1 4.6.1
eve 0.80.1 0.83.0
framer-motion 14.3.0 14.6.0
langsmith 0.10.13 0.11.1
lucide-react 1.59.0 1.61.0
multer 2.4.0 2.5.0
nodemailer 10.1.2 10.2.1
react-hook-form 7.90.0 7.91.0

Updates @browserbasehq/stagehand from 4.2.1 to 4.3.0

Changelog

Sourced from @​browserbasehq/stagehand's changelog.

TypeScript SDK 4.3.0

Minor Changes

Patch Changes

Python SDK 4.3.0

Minor Changes

Patch Changes

Extension Runtime 1.2.0

Minor Changes

... (truncated)

Commits
  • 621c120 Release Stagehand packages (#3200)
  • cb9a1d1 [feat]: add extension archive getter (#3267)
  • 901eb27 feat: expose browser-side function waits across Stagehand SDKs (#3183)
  • ecb2a6b [feat]: expose headers param on localBrowser.connect() (#3263)
  • 6bf4146 [feat]: expose optional extensionCdpUrl param on localBrowser.connect() i...
  • c6b6f27 [fix]: align bb transport behaviour across SDKs (#3229)
  • 1c40ba7 [refactor]: remove worker-side HTTP request path (#3210)
  • 17de6ea [feat]: route gateway & cache requests through the SDKs (#3209)
  • 0735164 [feat]: add HTTP transport to TS SDK (#3205)
  • 2b050db [feat]: define RPC contract for client side requests (#3204)
  • Additional commits viewable in compare view

Updates @cloudflare/shell from 0.4.3 to 0.5.0

Release notes

Sourced from @​cloudflare/shell's releases.

@​cloudflare/shell@​0.5.0

Minor Changes

Changelog

Sourced from @​cloudflare/shell's changelog.

0.5.0

Minor Changes

Commits

Updates @cloudflare/think from 0.20.2 to 0.21.0

Release notes

Sourced from @​cloudflare/think's releases.

@​cloudflare/think@​0.21.0

Minor Changes

Patch Changes

  • #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

  • #2593 b905483 Thanks @​ben-reitz! - Reuse one Intl.DateTimeFormat per timezone when computing wall-clock scheduled task occurrences, cutting the CPU cost of each occurrence substantially. See #2583; thanks @​Bowiemb.

Changelog

Sourced from @​cloudflare/think's changelog.

0.21.0

Minor Changes

Patch Changes

  • #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

  • #2593 b905483 Thanks @​ben-reitz! - Reuse one Intl.DateTimeFormat per timezone when computing wall-clock scheduled task occurrences, cutting the CPU cost of each occurrence substantially. See #2583; thanks @​Bowiemb.

Commits
  • fc7f59f Version Packages (#2588)
  • 05843e4 fix(chat-recovery): seal a turn after repeated interrupted attempts (#2615)
  • b905483 fix(think): reuse one date formatter per timezone for scheduled tasks (#2593)
  • f56cd20 think: deprecate createExecuteTool in favour of the Workspace exec tool (#2565)
  • db4303c think: drop @​cloudflare/shell (#2562)
  • 998ae40 think: use the @​cloudflare/computer workspace tools (#2561)
  • 8c720d3 think, agents: work in a @​cloudflare/computer Workspace (#2560)
  • See full diff in compare view

Updates @composio/core from 0.22.0 to 0.27.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.27.0

Minor Changes

  • c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

    create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

    const session = await composio.create('user_123', {
  hooks: [
    {
      type: 'before_execute',
      id: 'no_external_email',
      name: 'No external email',
      appliesTo: { toolkits: ['gmail'] },
      handler: {
        type: 'condition_check',
        condition: 'Sending email to anyone outside example.org',
        action: 'block',
      },
    },
  ],
});

    A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

    session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

@​composio/core@​0.26.0

Minor Changes

  • e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

    Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

    On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

    The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

  • 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

  • 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

    toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

  • 3dd9a2c: Strip string format values that OpenAI structured outputs rejects from strict tool schemas

... (truncated)

Changelog

Sourced from @​composio/core's changelog.

0.27.0

Minor Changes

  • c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

    create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

    const session = await composio.create('user_123', {
  hooks: [
    {
      type: 'before_execute',
      id: 'no_external_email',
      name: 'No external email',
      appliesTo: { toolkits: ['gmail'] },
      handler: {
        type: 'condition_check',
        condition: 'Sending email to anyone outside example.org',
        action: 'block',
      },
    },
  ],
});

    A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

    session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

0.26.0

Minor Changes

  • e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

    Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

    On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

    The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

  • 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

  • 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

    toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

... (truncated)

Commits
  • 19a8404 Release: update version (#5057)
  • 9a4977f feat(core): add session hooks to TS and Python sessions (#4958)
  • a15956a Release: update version (#4928)
  • bff8c4a feat(core): rename hook handlers to condition_check and prompt_injection_check
  • 9d26fb8 fix(core): fold OpenAPI nullable into the type in strict tool schemas (#4997)
  • f1898b6 fix(sdk): enforce hooks/session-config parity and precise hook_results errors
  • f744fdf fix(core): match the hooks contract on staging
  • c2bbfa8 feat(core): add session hooks to TS and Python sessions
  • be12ce1 feat(core): warn once per deprecated toolkit version reported by the API (PLE...
  • 3dd9a2c fix(core): strip string formats strict mode rejects (#4936)
  • Additional commits viewable in compare view

Updates chart.js from 4.5.1 to 4.6.1

Release notes

Sourced from chart.js's releases.

v4.6.1

Essential Links

  • #12355 fix: trusted publishing fix + version 4.6.1 bump

Thanks to @​etimberg

v4.6.0

Essential Links

  • #12354 chore: version bump to 4.6.0 to prepare for release
  • #12328 test: stabilize overlapping polar-area label fixture

Enhancements

  • #12238 Corrected spacing in pie/doughnut/polarArea (Fixes #10059)
  • #12130 Enable scale title stroke (12092)

Bugs Fixed

  • #12283 filler plugin fill extends past line when offset: true + index scale min/max
  • #12155 Fix early exit from clearStacks
  • #12142 Use integer canvas dimensions

Types

  • #12321 fix(types): allow scriptable and indexed grid tick widths

Documentation

  • #12258 Add a note that axis labels can span lines
  • #12134 docs: Add note about flexbox/grid layout responsivity issue
  • #12139 Fix amount of category scales count in docs

Development

  • #12306 Bump actions/setup-node from 6 to 7
  • #12303 Bump actions/checkout from 6 to 7

... (truncated)

Commits
  • 76d8cf8 fix: trusted publishing fix + version 4.6.1 bump (#12355)
  • 4e5443d chore: version bump to 4.6.0 to prepare for release (#12354)
  • 7169e65 fix(types): allow scriptable and indexed grid tick widths (#12321)
  • 714b48c test: stabilize overlapping polar-area labels across browsers (#12328)
  • 6a86e23 Bump actions/setup-node from 6 to 7 (#12306)
  • afb3d64 Bump actions/checkout from 6 to 7 (#12303)
  • 0db976c Bump pnpm/action-setup from 4.2.0 to 6.1.0 (#12307)
  • d2ddcf9 Specify build script for compressed size (#12310)
  • b972574 filler plugin fill extends past line when offset: true + index scale min/max ...
  • 0ad783f Use node 24 for CI (#12309)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chart.js since your current version.


Updates eve from 0.80.1 to 0.83.0

Release notes

Sourced from eve's releases.

eve@0.83.0

Minor Changes

  • 12a1e90: DefaultSandbox now selects its provider once, when eve prepares the sandbox, and records the choice in the build: Vercel Sandbox on Vercel, then Docker when a daemon is reachable, then just-bash only in eve dev and eve eval. The runtime uses the recorded provider instead of probing the host again, so a build and its server can no longer select different providers. A production eve build with neither Vercel nor Docker no longer falls back to just-bash: the build succeeds, and opening the sandbox fails with an error that asks you to start Docker and rebuild, deploy to Vercel, or select a provider explicitly.

    DefaultSandbox.environment().open() now accepts networkPolicy, and its sessions expose setNetworkPolicy(). eve forwards the policy to the selected provider. Docker rejects any policy other than "allow-all" or "deny-all" when it opens the sandbox, instead of starting the container with open network access, and just-bash rejects any policy other than "allow-all".

    Sessions now record their sandbox under the provider name "default" instead of vercel, docker, or just-bash. Sessions saved by an earlier eve under the provider that DefaultSandbox selected resume the same sandbox. When a session's recorded state belongs to another provider or state protocol, for example after you change providers, eve now starts a fresh sandbox instead of failing; the old sandbox is not deleted. This upgrade is one-way: if you roll back to an earlier eve release, sessions created on this release fail to open their sandbox, because earlier releases reject state recorded under "default".

    VercelSandbox.environment() no longer captures a snapshot when the environment has no prepare callback, no managed workspace or skill files, and no source. Session sandboxes start from the image and install the base runtime themselves, as DefaultSandbox already did on Vercel. Such sessions now apply a networkPolicy set on the environment after base setup; before, only a policy passed to open() applied, so VercelSandbox.environment({ networkPolicy }) and DefaultSandbox.environment({ vercel: { networkPolicy } }) could leave a session with open network access.

  • 62112b5: The just-bash sandbox provider now runs on the public defineSandboxProvider() API, and customCommands and filesystem use eve-owned types from eve/sandbox/just-bash, such as JustBashCommand and JustBashFilesystem, that still accept just-bash's defineCommand() results and filesystems. Local just-bash templates rebuild once after upgrading, since their keys no longer include custom commands or the filesystem; reading a directory now rejects instead of returning null, and a command ending in a # comment runs in any working directory.

  • 8b68a92: Remove the microsandbox sandbox provider. The eve/sandbox/microsandbox export and the microsandbox option on DefaultSandbox.environment() are gone, and DefaultSandbox now selects Vercel Sandbox on Vercel, then Docker when a daemon is reachable, then just-bash. To migrate, switch MicrosandboxSandbox.image() and MicrosandboxSandbox.dockerfile() to DockerSandbox.image() and DockerSandbox.dockerfile() from eve/sandbox/docker, and remove the microsandbox dependency. A session that recorded a microsandbox sandbox starts a fresh sandbox from its current provider on its next ctx.getSandbox().

    eve no longer cleans up what microsandbox left on your machine. Before you uninstall microsandbox, use its tooling to remove sandboxes and snapshots whose names start with eve-sbx-. Then delete .eve/sandbox-cache/microsandbox in each app. If you used MicrosandboxSandbox.dockerfile(), also run docker rm -f eve-sandbox-registry to remove the local image registry it started, and remove the local images tagged 127.0.0.1:51921/eve/….

    Deployed self-modification (eve/self-modification/remote) now requires deploying on Vercel. Builds still succeed on any host, but in a deployment outside Vercel the deployed subagent fails with an error that names this requirement when it opens its sandbox.

  • 5b27aa8: Breaking for custom sandbox providers. defineSandboxProvider() now takes a byte-level SandboxConnection (spawn, readFile, writeFiles, removePath, stop, optional close and extensions), and eve derives the full sandbox session from it. Built-in providers are unchanged. See the custom sandbox providers guide. To migrate a provider:

    • Return { connection, state } from start() and a connection from resume(). onSandboxStop() and onRuntimeShutdown() become connection.stop(), and onSandboxDelete() folds into onSessionEnd() with reason: "deleted".
    • Replace ctx.resources and ctx.sourceRevision with ctx.templateKey() and ctx.populate(), and remove your own prepare option, which eve now runs. environment() receives {} instead of undefined when no options are passed. Set toolSessions: true to support keyed invokeTool calls.
    • Rename SandboxPreparedArtifact to SandboxJson, SandboxProviderSessionContext to SandboxSessionContext, and SandboxProviderPrepareContext to SandboxPrepareContext. SandboxProviderHandle and the SandboxProviderResource* and SandboxProviderTargetFile types are removed, as is ctx.host.

    eve/sandbox/provider also exports SandboxSessionGoneError, SandboxTemplateNotProvisionedError, and SANDBOX_AGENT_ENV. In eve/sandbox, SandboxSession gains a required writeFiles(), so hand-built sessions such as test doubles need one, and SandboxNetworkPolicy is now an eve-owned type rather than the Vercel Sandbox SDK's NetworkPolicy.

  • 3f698dd: Sandbox providers now key each sandbox by its session: start() must return the existing sandbox for ctx.session.id when one exists, and the required onSessionEnd(ctx, state | null, { reason }) takes no artifact and must delete by key when state is null. Session end now removes a sandbox even when the session never recorded it, such as one a subagent sharing the sandbox opened first. Built-in providers keep a session's sandbox across rebuilds and open-option changes.

  • 950409f: VercelSandbox now runs on the public defineSandboxProvider() API, keeping existing sandbox names, session state, and snapshots. Breaking: a relative workingDirectory now resolves from /workspace, and eve/sandbox/vercel no longer re-exports Drive, so import it from @vercel/sandbox instead.

Patch Changes

  • bd050f8: Clearer sandbox error messages. Sandbox errors now say what went wrong and how to fix it, for example when the build and the runtime select different providers, a prepared template is missing, a session's sandbox came from another provider, or the sandbox file does not export its environment.
  • 95571f1: Fix discovery of extension mounts written as export { default } from "<pkg>" inside a packaged extension, which eve extension build compiles to import x from "<pkg>"; export { x as default };.
  • 7066b20: eve dev memory no longer grows with every save. Each rebuild now compiles and bundles your agent in a short-lived child process, and each new version of your code is served by a fresh worker, so old copies of authored modules no longer stay loaded. Modules imported by relative path now keep their package's sideEffects setting, so identical source bundles the same way on every save; in "type": "module" apps, default imports of older CommonJS packages that set __esModule now follow Node's rules. Thanks @​callicles for reporting this in #5203.
  • dff87bc: eve dev now rebuilds once per edit to a source-backed workspace extension. Before, the temporary .eve-extension-build-* files from the extension build started a second, unnecessary rebuild.
  • 2b07d0a: The Discord channel can now answer DMs, mentions, and thread replies. discordChannel({ gateway: {} }) accepts messages forwarded from the Discord Gateway, and experimental_runDiscordGatewayRelay from the new eve/channels/discord/gateway entry point holds that connection, for example in a Vercel Daemon. In text channels, a mention starts a thread that holds the conversation, and a reply to any bot message continues the session that posted it; set gateway.startThread: false to answer in the channel, or return conversation or startThread from gateway.onMessage to decide per message. defaultDiscordMessageAuth gives a message's author the same principal defaultDiscordAuth gives them for commands and button presses.
  • 87962a0: eve add channel/discord now first asks whether people reach the agent through DMs, mentions, and threads, or a slash command. The first scaffolds the Discord Gateway relay in daemon/, registers it as a Vercel Daemon in vercel.json, enables gateway on the channel, turns on the bot's Message Content intent when Discord allows it, and skips registering /ask; the second keeps today's slash command setup and is what --yes picks. Non-interactive runs answer discord-messages with "gateway" or "commands".
  • acc76d5: The Discord channel now shows connection sign-ins. In a DM it posts the sign-in link and any confirmation code; in a server it posts a Sign in button that shows the link only to the person who has to sign in, in an ephemeral message. The message updates once the sign-in completes or is cancelled.
  • 4db529f: DockerSandbox now runs on the public defineSandboxProvider() contract. Container names, recorded session state, and template image references stay the same, so running sessions and prepared images from earlier builds keep working. A few behaviors change: sandbox.delete() removes the session's container by its session-derived name, honors the caller's abortSignal, and succeeds when the container is already gone; eve normalizes relative paths such as logs/../out.txt to /workspace/out.txt before they reach the container; and a Docker environment's prepare callback is typed with DockerSandboxSession.
  • 5cf30b6: A dynamic model resolver's step.started event now carries the index of the step it selects a model for. From the second step of a turn on, it used to carry the previous step's index, so per-step work keyed on stepIndex was attributed to the wrong step.
  • 3c25e62: A dynamic skill that stops returning files but is still returned now keeps the files already written to the sandbox, so files the sandbox provides another way, such as from its snapshot, stay in place. If you dropped files to take files away from some callers, stop returning the skill for them instead: a skill the resolver stops returning still has its files removed. On Vercel Sandbox, eve now writes a dynamic skill's files in one batch, with one path lookup and one upload instead of two round trips per file.
  • 1bbe939: eve eval artifacts now record each eval's startedAt and completedAt in summary.json, results.jsonl, and the per-eval detail file.
  • 448804d: An eval's derived.usage now takes each session's latest usage by time. An eval that captured a session again with an earlier snapshot reported that snapshot's lower total. Its costUsd is now absent when a counted session reported no cost, instead of summing only the sessions that did.
  • 94784e1: Validate idle session state inside the workflow before starting a deployment handoff, avoiding unnecessary successor starts when durable work is still pending. Preserve inbox ownership and the original session stream throughout the move.
  • 580417f: Fix repeated horizontal rules and question text accumulating in terminal scrollback during human-in-the-loop prompts. Question and approval drawers now fit small terminals, keeping the focused choice or text editor visible.
  • b848a51: Avoid an extra setup command when creating a Vercel sandbox from a prepared snapshot of the standard eve image without Drive mounts. eve now checks the base runtime again after authored preparation, so a prepare callback that breaks it fails the build; existing sandboxes, resumes, custom images or sources, Drive mounts, and sandboxes without a prepared snapshot keep their setup checks. Vercel templates rebuild once so every snapshot has passed the new check.
  • 39a8b4c: A session whose sandbox is gone (for example after a removed Docker container, a deleted Vercel Sandbox, or a deleted just-bash session directory) now starts a fresh sandbox on its next ctx.getSandbox(). Previously every sandbox call in that session failed with the same resume error until the session ended. Thanks @​bradhallett for reporting this in #5113 and @​moinulmoin for the just-bash case in #4440.
  • bb4afff: New sessions start their first model step sooner, and later turns no longer wait for their cancellation hooks to register before their first step. Thanks @​Lukavyi for reporting the startup latency in #876.
  • 798a91e: The Linq channel now rejects inbound webhooks with a 401 whenever its webhook verifier returns any falsy value, including the null that vercelOidc() returns for a missing or invalid token. Previously only false rejected a request, so Vercel Connect setups without a signingSecret accepted unsigned webhooks.
  • aaae448: Self-hosted eve start servers now reject requests to /.well-known/workflow/v1/flow that did not come from the server's own workflow queue, so a client can no longer forge a workflow delivery with a chosen run context or principal. Startup always recovers pending and running local workflow runs through the authenticated queue, ignoring WORKFLOW_LOCAL_RECOVER_ACTIVE_RUNS; queue deliveries must stay on the process that enqueued them.
  • 9d1998f: Export agentWithModel for agent/tools/agent.ts to opt into a root-copy tool whose model-facing input selects the AI Gateway model for each task.
  • cbc87ae: OpenAPI connection tool calls now follow redirects only within the base URL's origin. A redirect to another origin is returned as the tool result, with its target in location, instead of followed, so credentials in custom headers, such as an apiKey security scheme's header, no longer reach the redirect target. A same-origin redirect loop now fails after 10 hops with an explicit error.
  • 7a908f5: Compaction summaries now run on the AI SDK model instance set as compaction.model. Before, a direct model instance there was ignored and summaries ran on the agent's top-level model.

... (truncated)

Changelog

Sourced from eve's changelog.

0.83.0

Minor Changes

  • 12a1e90: DefaultSandbox now selects its provider once, when eve prepares the sandbox, and records the choice in the build: Vercel Sandbox on Vercel, then Docker when a daemon is reachable, then just-bash only in eve dev and eve eval. The runtime uses the recorded provider instead of probing the host again, so a build and its server can no longer select different providers. A production eve build with neither Vercel nor Docker no longer falls back to just-bash: the build succeeds, and opening the sandbox fails with an error that asks you to start Docker and rebuild, deploy to Vercel, or select a provider explicitly.

    DefaultSandbox.environment().open() now accepts networkPolicy, and its sessions expose setNetworkPolicy(). eve forwards the policy to the selected provider. Docker rejects any policy other than "allow-all" or "deny-all" when it opens the sandbox, instead of starting the container with open network access, and just-bash rejects any policy other than "allow-all".

    Sessions now record their sandbox under the provider name "default"<...

    Description has been truncated

@dependabot
chore(deps):(deps): bump the production-minor group with 12 updates
50487ee 
Bumps the production-minor group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@browserbasehq/stagehand](https://github.com/browserbase/stagehand/tree/HEAD/packages/sdk-ts) | `4.2.1` | `4.3.0` |
| [@cloudflare/shell](https://github.com/cloudflare/agents/tree/HEAD/packages/shell) | `0.4.3` | `0.5.0` |
| [@cloudflare/think](https://github.com/cloudflare/agents/tree/HEAD/packages/think) | `0.20.2` | `0.21.0` |
| [@composio/core](https://github.com/ComposioHQ/composio/tree/HEAD/ts/packages/core) | `0.22.0` | `0.27.0` |
| [chart.js](https://github.com/chartjs/Chart.js) | `4.5.1` | `4.6.1` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.80.1` | `0.83.0` |
| [framer-motion](https://github.com/motiondivision/motion) | `14.3.0` | `14.6.0` |
| [langsmith](https://github.com/langchain-ai/langsmith-javascript) | `0.10.13` | `0.11.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.59.0` | `1.61.0` |
| [multer](https://github.com/expressjs/multer) | `2.4.0` | `2.5.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.1.2` | `10.2.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.90.0` | `7.91.0` |


Updates `@browserbasehq/stagehand` from 4.2.1 to 4.3.0
- [Release notes](https://github.com/browserbase/stagehand/releases)
- [Changelog](https://github.com/browserbase/stagehand/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserbase/stagehand/commits/@browserbasehq/stagehand@4.3.0/packages/sdk-ts)

Updates `@cloudflare/shell` from 0.4.3 to 0.5.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/shell/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/@cloudflare/shell@0.5.0/packages/shell)

Updates `@cloudflare/think` from 0.20.2 to 0.21.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/think/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/@cloudflare/think@0.21.0/packages/think)

Updates `@composio/core` from 0.22.0 to 0.27.0
- [Release notes](https://github.com/ComposioHQ/composio/releases)
- [Changelog](https://github.com/ComposioHQ/composio/blob/next/ts/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ComposioHQ/composio/commits/@composio/core@0.27.0/ts/packages/core)

Updates `chart.js` from 4.5.1 to 4.6.1
- [Release notes](https://github.com/chartjs/Chart.js/releases)
- [Commits](chartjs/Chart.js@v4.5.1...v4.6.1)

Updates `eve` from 0.80.1 to 0.83.0
- [Release notes](https://github.com/vercel/eve/releases)
- [Changelog](https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md)
- [Commits](https://github.com/vercel/eve/commits/eve@0.83.0/packages/eve)

Updates `framer-motion` from 14.3.0 to 14.6.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.3.0...v14.6.0)

Updates `langsmith` from 0.10.13 to 0.11.1
- [Release notes](https://github.com/langchain-ai/langsmith-javascript/releases)
- [Changelog](https://github.com/langchain-ai/langsmith-javascript/blob/main/CHANGELOG.md)
- [Commits](langchain-ai/langsmith-javascript@v0.10.13...v0.11.1)

Updates `lucide-react` from 1.59.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `multer` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.4.0...v2.5.0)

Updates `nodemailer` from 10.1.2 to 10.2.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.1.2...v10.2.1)

Updates `react-hook-form` from 7.90.0 to 7.91.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.90.0...v7.91.0)

---
updated-dependencies:
- dependency-name: "@browserbasehq/stagehand"
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: "@cloudflare/shell"
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: "@cloudflare/think"
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: "@composio/core"
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: chart.js
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: eve
  dependency-version: 0.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: framer-motion
  dependency-version: 14.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: langsmith
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: multer
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: nodemailer
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: react-hook-form
  dependency-version: 7.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from daggerstuff as a code owner October 27, 2026 03:18
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 27, 2026
@vercel

vercel Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
pixelated Ignored Ignored Preview Oct 27, 2026 3:19am UTC

Request Review

@dependabot dependabot Bot added the pnpm Pull requests that update pnpm dependencies label Oct 27, 2026
@github-actions

github-actions Bot commented Oct 27, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 27, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • lhr-1793071269754
  • lhr-1793071282417
  • lhr-1793071294641
  • lhr-1793071305923
  • lhr-1793071317131
  • lhr-1793071328460
  • lhr-1793071339776
  • lhr-1793071351146
  • lhr-1793071362473

Reports are also available as workflow artifacts

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daggerstuff daggerstuff Awaiting requested review from daggerstuff daggerstuff is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pnpm Pull requests that update pnpm dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants