Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #470

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-e24fc7aaa7
Open

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#470
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-e24fc7aaa7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
playwright 1.62.0 1.63.0
@ai-sdk/anthropic 2.0.92 2.0.102
@ai-sdk/openai 2.0.117 2.0.127
@langchain/core 1.2.3 1.2.11
@langchain/langgraph 1.4.8 1.4.15
ai 5.0.223 5.0.257
undici 6.28.0 6.28.1
yaml 2.9.0 2.9.1

Updates playwright from 1.62.0 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 2.0.92 to 2.0.102

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

2.0.102

Patch Changes

  • Updated dependencies [c2089a9]
  • Updated dependencies [ab3990f]
    • @​ai-sdk/provider@​2.0.4
    • @​ai-sdk/provider-utils@​3.0.37

2.0.101

Patch Changes

  • 78a29c2: feat(anthropic): add fable 5.1 support

2.0.100

Patch Changes

  • cd8f35c: Preserve tool calls when using JSON structured output.
  • Updated dependencies [26165ee]
    • @​ai-sdk/provider-utils@​3.0.36

2.0.99

Patch Changes

  • 78c7304: fix(anthropic): order client tool calls after provider-executed tool results

2.0.98

Patch Changes

  • Updated dependencies [77d33c0]
    • @​ai-sdk/provider-utils@​3.0.35

2.0.97

Patch Changes

  • Updated dependencies [2fff9f1]
  • Updated dependencies [f364ea0]
    • @​ai-sdk/provider-utils@​3.0.34

2.0.96

Patch Changes

  • Updated dependencies [9e8e087]
    • @​ai-sdk/provider-utils@​3.0.33

... (truncated)

Commits

Updates @ai-sdk/openai from 2.0.117 to 2.0.127

Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.127

Patch Changes

  • fd889a3: fix(openai): return an AI SDK error for empty chat completion choices
  • Updated dependencies [c2089a9]
  • Updated dependencies [ab3990f]
    • @​ai-sdk/provider@​2.0.4
    • @​ai-sdk/provider-utils@​3.0.37

2.0.126

Patch Changes

  • 022f24b: Include explicit message item types in Azure AI Foundry Responses requests.
  • a15b75a: Add async function tool calling support for OpenAI Responses models.

2.0.125

Patch Changes

  • e0d0bd1: feat(openai): add GPT-6 reasoning configuration updates

2.0.124

Patch Changes

  • 7bebd57: feat(openai): add support for the gpt-6-astra

2.0.123

Patch Changes

  • Updated dependencies [26165ee]
    • @​ai-sdk/provider-utils@​3.0.36

2.0.122

Patch Changes

  • f70d0a3: Normalize non-object replayed Chat Completions tool arguments to empty objects.

2.0.121

Patch Changes

  • 77d33c0: Split OpenAI and Azure OpenAI embedding requests by a conservative UTF-8 byte budget derived from their aggregate token limit, in addition to input count limits.
  • Updated dependencies [77d33c0]
    • @​ai-sdk/provider-utils@​3.0.35

... (truncated)

Commits

Updates @langchain/core from 1.2.3 to 1.2.11

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.11

Patch Changes

  • #11603 fec9cd8 Thanks @​thushanth-bengre-langchain! - fix(core): build streaming llmOutput.tokenUsage from the fully-accumulated chunk instead of whichever individual chunk's usage_metadata arrived last

    Affects both core streaming paths — .stream()/.streamEvents() (_streamIterator) and .invoke()/.generate() when a streaming-preferring callback is attached (_generateWithCache's hasStreamingHandler branch). Previously, llmOutput.tokenUsage was overwritten by each chunk in turn, so only the last chunk carrying usage_metadata won — correct for providers that emit one cumulative total on a final chunk, but wrong for providers (e.g. @langchain/google, @langchain/anthropic) that emit usage_metadata as a per-chunk delta across multiple chunks, where the values must be summed.

    Note for provider authors: this assumes each streamed chunk's usage_metadata is either a per-chunk delta or appears only on a single final chunk. A provider that instead repeats a cumulative total on every chunk will now see it summed (and inflated) in llmOutput.tokenUsage, matching the existing behavior of the correctly-working message.usage_metadata field.

    Also fixes @langchain/google's invoke({streaming: true}) path (no streaming-preferring callback attached), where llmOutput was never populated at all.

  • #11590 ffebdc2 Thanks @​thushanth-bengre-langchain! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses response_metadata.output directly, preserving every reasoning item's id/encrypted_content in original order. In v1, AIMessage.contentBlocks (outputVersion: "v1") is fixed the same way. additional_kwargs.reasoning is unchanged.

@​langchain/core@​1.2.10

Patch Changes

@​langchain/core@​1.2.9

Patch Changes

@​langchain/core@​1.2.8

Patch Changes

  • #11369 d6ad973 Thanks @​hntrl! - fix(langchain): use unified endpoint for gateway

  • #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

    Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

    @langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

    modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

    Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

@​langchain/core@​1.2.7

Patch Changes

Commits
  • 778566e chore: version packages (#11607)
  • 18b71af feat(google-genai): add outputDimensionality parameter to GoogleGenerativeAIE...
  • 35368db fix(google): surface groundingMetadata/citationMetadata on streaming path (#1...
  • 78b2923 fix(google): preserve tool call id and thoughtSignature in native streaming (...
  • ffebdc2 fix(openai): correctly handle multiple reasoning items in v1 content blocks (...
  • c9ae847 fix(google): set includeServerSideToolInvocations when mixing tools (#11611)
  • bc88b75 fix(google): route Vertex multi-region endpoints (#11433)
  • fec9cd8 fix(core): build streaming llmOutput.tokenUsage from accumulated usage (#11603)
  • 194a063 fix(google): allowlist JSON Schema keywords for Gemini schemas (#11606)
  • b0a0d3f fix(deps): upgrade Vitest to address GHSA-82fw-gwwq-j7x9 (#11599)
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.4.8 to 1.4.15

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.15

Patch Changes

  • #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

    Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

    Matches Python's callback-level behavior: transforms also affect chain events and message streaming, so omitting outputs can suppress messages returned directly by nodes and omitting inputs can affect message deduplication.

  • Updated dependencies [3234c69, 3234c69, 11a4535, 2fab6fd, 4fc118f, db4bdad, 55fa26b]:

    • @​langchain/langgraph-sdk@​1.11.0

@​langchain/langgraph@​1.4.15-rc.0

Patch Changes

  • #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

    Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

  • Updated dependencies [2fab6fd]:

    • @​langchain/langgraph-sdk@​1.10.3-rc.0

@​langchain/langgraph@​1.4.14

Patch Changes

  • #2747 fix(langgraph): pushMessage emits on the streamEvents v3 messages channel
  • Updated dependencies: @​langchain/langgraph-sdk

@​langchain/langgraph@​1.4.13

Patch Changes

@​langchain/langgraph@​1.4.12

Patch Changes

  • #2714 a2a59ec Thanks @​hntrl! - Update checkpoint integrations to require the patched checkpoint serializer release.

  • Updated dependencies [a2a59ec]:

    • @​langchain/langgraph-checkpoint@​1.1.5

@​langchain/langgraph@​1.4.11

Patch Changes

  • #2706 eaa5472 Thanks @​zduric-langchain! - fix(langgraph): dedupe merged callback handlers by identity

    mergeCallbacks concatenated handlers and inheritableHandlers while deduping tags, so a handler inherited by both the ambient and the explicit config picked up an extra registration at every graph boundary. With tracing on, a nested streamMode: "messages" run delivered every token twice.

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.15

Patch Changes

  • #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

    Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

    Matches Python's callback-level behavior: transforms also affect chain events and message streaming, so omitting outputs can suppress messages returned directly by nodes and omitting inputs can affect message deduplication.

  • Updated dependencies [3234c69, 3234c69, 11a4535, 2fab6fd, 4fc118f, db4bdad, 55fa26b]:

    • @​langchain/langgraph-sdk@​1.11.0

1.4.15-rc.0

Patch Changes

  • #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

    Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

  • Updated dependencies [2fab6fd]:

    • @​langchain/langgraph-sdk@​1.10.3-rc.0

1.4.14

Patch Changes

  • #2747 5ce7f42 Thanks @​t3s7r! - fix(langgraph): pushMessage emits on the streamEvents v3 messages channel

  • Updated dependencies [dd287b4]:

    • @​langchain/langgraph-sdk@​1.10.1

1.4.13

Patch Changes

1.4.12

Patch Changes

  • #2714 a2a59ec Thanks @​hntrl! - Update checkpoint integrations to require the patched checkpoint serializer release.

  • Updated dependencies [a2a59ec]:

    • @​langchain/langgraph-checkpoint@​1.1.5

1.4.11

... (truncated)

Commits

Updates ai from 5.0.223 to 5.0.257

Changelog

Sourced from ai's changelog.

5.0.257

Patch Changes

  • Updated dependencies [0d4a425]
    • @​ai-sdk/gateway@​2.0.151

5.0.256

Patch Changes

  • Updated dependencies [73fa129]
  • Updated dependencies [5a19081]
    • @​ai-sdk/gateway@​2.0.150

5.0.255

Patch Changes

  • c2089a9: Retry unclassified empty image results, preserve completed-attempt diagnostics, add provider-independent result retryability classification, preserve it through the AI Gateway, and mark Google Vertex RAI-filtered results as terminal.
  • 7f4e217: fix(ai): decode text data URLs in Node.js
  • Updated dependencies [c2089a9]
  • Updated dependencies [ab3990f]
    • @​ai-sdk/gateway@​2.0.149
    • @​ai-sdk/provider@​2.0.4
    • @​ai-sdk/provider-utils@​3.0.37

5.0.254

Patch Changes

  • Updated dependencies [79ac7d9]
  • Updated dependencies [ca8f9e5]
    • @​ai-sdk/gateway@​2.0.148

5.0.253

Patch Changes

  • 5643ec9: fix(ai): allow manual continuations to reuse JSON tool outputs with undefined object properties
  • Updated dependencies [b436246]
    • @​ai-sdk/gateway@​2.0.147

5.0.252

Patch Changes

  • 2c12cd3: fix(ai): skip smoothStream delays while the document is hidden
  • Updated dependencies [cfa33a0]
  • Updated dependencies [8ee6f7d]

... (truncated)

Commits

Updates undici from 6.28.0 to 6.28.1

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits
  • ffc8aa0 Bumped v6.28.1 (#5773)
  • 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
  • ce31bc8 fix(retry): validate resumed response framing
  • 2af0faf fix(websocket): reject unrequested subprotocols
  • 07c60d9 fix(websocket): destroy inflater after decompression limit
  • bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
  • See full diff in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
90efea2 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.62.0` | `1.63.0` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `2.0.92` | `2.0.102` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `2.0.117` | `2.0.127` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.3` | `1.2.11` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.4.8` | `1.4.15` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.223` | `5.0.257` |
| [undici](https://github.com/nodejs/undici) | `6.28.0` | `6.28.1` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |



Updates `playwright` from 1.62.0 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.63.0)

Updates `@ai-sdk/anthropic` from 2.0.92 to 2.0.102
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@2.0.102/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@2.0.102/packages/anthropic)

Updates `@ai-sdk/openai` from 2.0.117 to 2.0.127
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@2.0.127/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@2.0.127/packages/openai)

Updates `@langchain/core` from 1.2.3 to 1.2.11
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.11)

Updates `@langchain/langgraph` from 1.4.8 to 1.4.15
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.15/libs/langgraph-core)

Updates `ai` from 5.0.223 to 5.0.257
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.257/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.257/packages/ai)

Updates `undici` from 6.28.0 to 6.28.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.28.0...v6.28.1)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 2.0.102
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 2.0.127
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/core"
  dependency-version: 1.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 5.0.257
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 6.28.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026
@dependabot
dependabot Bot requested a review from ceilf6 as a code owner September 16, 2026 03:56
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ceilf6 ceilf6 Awaiting requested review from ceilf6 ceilf6 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants