Update dependency promptfoo to ^0.122.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
promptfoo (source)	^0.121.0 → ^0.122.0

---

Release Notes

promptfoo/promptfoo (promptfoo)

v0.122.0

Compare Source

⚠ BREAKING CHANGES

• drop Node.js 20 support (#​10260)

Bug Fixes

• deps: keep the Shai-Hulud compromised versions unreachable (#​10301) (db2a066)
• deps: patch undici in code-scan-action and guard both lockfiles (#​10278) (15bf41f)
• deps: pin socket.io-parser above the packet-decoder DoS (#​10279) (d0f2a83)
• deps: repair Biome and undici upgrade regressions (#​10292) (3565a3c)
• deps: restore XML entity decoding for xlsx test files (#​10249) (00cdeb9)
• deps: update anthropic packages (#​10234) (6279230)
• deps: update anthropic packages (#​10277) (f8609a6)
• deps: update dependency execa to v10 (#​10227) (bab74b8)
• deps: update opentelemetry (#​10290) (5638797)
• providers: correct Nscale model identifiers (#​10259) (249b125)
• providers: stop leaking Nscale provider settings into the request body (#​10258) (d23f86a)
• providers: stop WebSocket evals from hanging when a stream stalls (#​10266) (60898c7)

Miscellaneous Chores

• drop Node.js 20 support (#​10260) (26b725b)

v0.121.20

Compare Source

Features

• providers: add Claude Opus 5 support (#​10210) (ff84f13)
• providers: add current Azure, Claude, and Gemini models (#​10128) (5c216a1)
• providers: add Kimi K3 support to Moonshot provider (#​10132) (a1168b6)
• websocket: support URL templating (#​10171) (a9aaced)

Bug Fixes

• assertions: default conversation-relevance threshold to 0.5 (#​10142) (2812d76)
• azure: avoid crash on empty completion choices (#​10124) (17d8d03)
• deps: align Renovate npm registry (#​10115) (688a905)
• deps: update anthropic packages (#​10146) (cfa9bee)
• deps: update anthropic packages (#​10199) (2d3f3f1)
• deps: update anthropic packages (#​10229) (2834215)
• deps: update dependency js-yaml to v5.2.2 [security] (#​10218) (18ea879)
• eval: avoid prompt index collisions for duplicate providers (#​10208) (5aa0958)
• eval: isolate conversation history by result column (#​10212) (a377bb7)
• integrations: migrate Langfuse prompts to SDK v5 (#​10131) (08b3f50)
• providers: align OpenAI models and capabilities (#​10125) (e17ce87)
• providers: preserve WebSocket retries for certificate-like URLs (#​10197) (85e0710)
• providers: reject Vertex Omni passthrough follow-ups (#​10135) (8482570)
• providers: restore secret-safe WebSocket retries (#​10176) (6d89cbb)
• python: keep worker control markers on their own line (#​10097) (6bc2b95)
• redteam: harden risk reports and WebSocket timeout tests (#​10211) (9ab178e)
• redteam: improve risk-category report row accessibility (b163738)
• redteam: preserve generation provider selection (#​10133) (ac8971f)
• site: repair stale event pages, dead links, and hydration mismatches (#​10215) (b0e3c25)

v0.121.19

Compare Source

Features

• providers: add Bedrock GPT-5.6 frontier support (#​10081) (a97c8eb)
• providers: add Meta Model API (Muse Spark) provider (#​10041) (e6f06da)
• providers: add Open Interpreter provider (#​10079) (c4d9028)
• providers: add xAI Grok 4.5 support (#​10032) (83cedf0)
• providers: honor CLAUDE_CONFIG_DIR for Claude Code creds (#​9980) (a643f8b)
• providers: support GPT-5.6 GA (#​10040) (3280625)
• redteam: account for generation-phase token usage (#​9967) (e0d1698)
• redteam: add goblin strategy (#​10057) (c0c86f1)
• types: optional token-usage fields on public types/schemas (#​9962) (7365c32)
• util: add token-usage helpers (error/generation accumulation) (#​9969) (79ebc2d)

Bug Fixes

• assertions: allow numeric 0 as contains/icontains value (#​10012) (06d8105)
• assertions: return pass:false for tool calls missing a function object (#​10076) (ffd8922)
• azure: avoid crash on empty choices array when reading logprobs (#​9867) (f189f84)
• code-scan: harden action supply chain (#​9991) (17e90eb)
• db: protect user database from test runners (#​9590) (aabb699)
• deps: update anthropic packages (#​10037) (fed1d2a)
• deps: update anthropic packages (#​10066) (24a3ef1)
• deps: update dependency js-yaml to v5.2.1 (#​10052) (fe22aa7)
• deps: update opentelemetry (#​10067) (03e3f2a)
• eval: combineFilterConditions doesn't recognize lowercase 'or' (#​10087) (25fedb6)
• matchers: count missing faithfulness verdicts as unsupported (#​9984) (ce4a3d3)
• matchers: preserve reserved grader vars in model-graded matchers (#​10042) (9f6afcc)
• matchers: preserve reserved rag grader vars (#​9994) (6e9e2ee)
• providers: address xAI response edge cases (#​10072) (0300eb0)
• providers: avoid app-server config recursion (#​10078) (61a043f)
• providers: bill GPT-5.6 image input tokens (#​10050) (ab52ee0)
• providers: clamp DeepSeek cached tokens in cost calc (#​9908) (eca0cdc)
• providers: correct Codex SDK provider config handling (#​9963) (a311483)
• providers: guard array access in Bedrock Titan and Cohere output handlers (#​9897) (9a2aa85)
• providers: handle TrueFoundry guardrail blocks (#​10021) (a9cfc86)
• providers: preserve TrueFoundry filter errors (#​10027) (051914a)
• providers: report cached request counts in token usage (#​9970) (2392ce3)
• providers: stringify simulated user provider outputs (#​10019) (46ee400)
• redteam: add missing lowercase f to homoglyph map (#​10071) (fe3151e)
• redteam: clean up Hydra and Hex handling (#​10077) (ef61281)
• redteam: encode hex strategy payloads as UTF-8 bytes (#​10073) (080dc99)
• redteam: match cross-session leaks case-insensitively (#​10074) (53d7586)
• redteam: pass target output to structured graders (#​10068) (c5f205d)
• redteam: preserve punctuation in Pig Latin encoding (#​10025) (fe6bf3a)
• redteam: stop empty prompts at metadata boundaries (#​10015) (3957d90)
• util: handle even backslashes before slash comments (#​10030) (fd607d1)
• util: handle single-quoted escaped paths (#​10080) (01694e7)
• util: remove unused NormalizedTokenUsage export (#​10065) (402a84d)

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 10am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Caution

[High Risk] Replacing both GCP service VMs will change their internal IPs and break consumers pinned to 10.10.0.2 and 10.10.0.3

The rollout is replacing both GCP service instances for inventory-api and payments-api in europe-west2-b, and the planned configuration no longer pins their current internal IPs 10.10.0.2 and 10.10.0.3. In google_compute_instance, omitting network_ip causes Google Cloud to assign a new ephemeral internal address on creation, so these replacements will not keep the existing addresses.

Any service discovery, firewall rules, or client configuration outside Terraform that still points at 10.10.0.2 or 10.10.0.3 will fail as soon as the old instances are destroyed and the new ones come up on different IPs. Because both services are being replaced together on the same network and subnet, this creates a coordinated contract break across multiple internal APIs rather than an isolated single-instance interruption.
_{View reasoning tree here.}

Signals

Routine → Multiple compute and monitoring resources showing unusual routine changes at 1 event/week for the last 2-5 months, with an email subscription resource at 2 events/week for the last 5 months and several API server resources at 3-4 events/week for the last 3-5 months, which is infrequent compared to typical patterns.

_{Additional Change Details:} Items 90 Edges 198 model|risks_v6 ✨Encryption Key State Risk ✨KMS Key Creation