chore(deps): bump the minor-and-patch group across 1 directory with 18 updates by dependabot[bot] · Pull Request #25 · rogeriochaves/open-managed-agents

dependabot · 2026-06-29T08:15:18Z

Bumps the minor-and-patch group with 18 updates in the / directory:

Package	From	To
turbo	`2.9.5`	`2.10.0`
ws	`8.20.0`	`8.21.0`
@anthropic-ai/sdk	`0.87.0`	`0.106.0`
dotenv	`17.4.1`	`17.4.2`
tsx	`4.21.0`	`4.22.4`
@langwatch/scenario	`0.4.9`	`0.4.15`
@hono/swagger-ui	`0.5.3`	`0.6.1`
better-sqlite3	`12.8.0`	`12.11.1`
hono	`4.12.12`	`4.12.27`
openai	`6.34.0`	`6.45.0`
pg	`8.20.0`	`8.22.0`
@tanstack/react-query	`5.97.0`	`5.101.2`
react	`19.2.5`	`19.2.7`
@types/react	`19.2.14`	`19.2.17`
react-dom	`19.2.5`	`19.2.7`
react-router-dom	`7.14.0`	`7.18.0`
@tailwindcss/vite	`4.2.2`	`4.3.1`
tailwindcss	`4.2.2`	`4.3.1`

Updates turbo from 2.9.5 to 2.10.0

Release notes

Sourced from turbo's releases.

Turborepo v2.10.0

What's Changed

create-turbo

feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in vercel/turborepo#6747

chore: Update dependencies found in audits by @anthonyshew in vercel/turborepo#12586

@turbo/codemod

feat: Handle package manager catalogs in migration codemod by @anthonyshew in vercel/turborepo#12496

fix: Always update $schema URL to versioned format during migration by @anthonyshew in vercel/turborepo#12529

fix: Support turbo.jsonc in codemod transforms by @anthonyshew in vercel/turborepo#12532

fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in vercel/turborepo#12542

eslint

chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in vercel/turborepo#12604

@turbo/repository

feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in vercel/turborepo#12487

chore: Update to Rust 1.95.0 by @ognevny in vercel/turborepo#12636

@turbo/telemetry

fix: Suppress telemetry alert when running on Vercel by @anthonyshew in vercel/turborepo#12576

Examples

feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in vercel/turborepo#12414

build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in vercel/turborepo#12537

fix: Add missing @types/node to with-svelte example apps by @anthonyshew in vercel/turborepo#12585

feat(sandbox): Bump @vercel/sandbox from v1 to beta by @marc-vercel in vercel/turborepo#12595

chore: Update examples to Turbo 2.9.6 by @cursor[bot] in vercel/turborepo#12600

examples: Add Ultracite example by @haydenbleasel in vercel/turborepo#12615

Changelog

docs: Release post for 2.9 by @anthonyshew in vercel/turborepo#12441

docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in vercel/turborepo#12500

fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in vercel/turborepo#12506

Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in vercel/turborepo#12507

fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in vercel/turborepo#12509

fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in vercel/turborepo#12503

docs: Document turbo.* generator variables by @anthonyshew in vercel/turborepo#12511

fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in vercel/turborepo#12514

fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in vercel/turborepo#12516

fix: Update AI-generated response disclaimer to include human attribution by @anthonyshew with @Copilot in vercel/turborepo#12517

fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in vercel/turborepo#12520

fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in vercel/turborepo#12519

feat: Add incremental task caching by @anthonyshew in vercel/turborepo#12531

docs: Send siteId as label on feedback GitHub issues by @molebox in vercel/turborepo#12527

Replace local ai-agent-detection with @vercel/agent-readability by @molebox in vercel/turborepo#12528

fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in vercel/turborepo#12535

fix: Only enforce signature key length for keys that exist by @anthonyshew in vercel/turborepo#12538

fix: Validate engine concurrency after task-level filtering by @anthonyshew in vercel/turborepo#12540

feat: Allow --affected and --filter to be combined by @anthonyshew in vercel/turborepo#12543

fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in vercel/turborepo#12513

fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in vercel/turborepo#12545

fix: Bun workspace lockfile pruning producing invalid output by @JRoy in vercel/turborepo#12548

fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in vercel/turborepo#12557

... (truncated)

Commits

12fb0d9 publish 2.10.0 to registry
a12323b release(turborepo): 2.9.19-canary.10 (#13130)
65175fe fix: Hash selected dependency outputs instead of tasks (#13129)
5ba8917 fix: Improve watch graceful shutdown (#13128)
75ee2cc chore: Update to Rust 1.96.0 (#12974)
6dccf5a fix: Restart deferred hash consumers in watch (#13127)
4ebb50f feat: Add deferred hashing for task inputs (#13125)
517e1a5 docs: Fix stderr debugging guidance (#13122)
0220b35 fix: Respect task inputs when stopping interruptible persistent tasks in watc...
6988692 fix: Add ComSpec and PATHEXT to default Windows env passthrough (#13114)
Additional commits viewable in compare view

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
See full diff in compare view

Updates @anthropic-ai/sdk from 0.87.0 to 0.106.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk: v0.106.0

0.106.0 (2026-06-24)

Full Changelog: sdk-v0.105.0...sdk-v0.106.0

Features

client: add support for system.message streaming events (a7c14b7)

Bug Fixes

helpers: single source for x-stainless-helper, append semantics, and tag the fallback middleware (#107) (106bea0)

Chores

api: add support for new refusal category (b38fd01)

api: add support for sending User Profile ID in request headers (198583e)

sdk: v0.105.0

0.105.0 (2026-06-18)

Full Changelog: sdk-v0.104.2...sdk-v0.105.0

Features

api: add support for new code_execution_20260120 tool (8dc2b54)

stream: lazily parse partial tool json input (#99) (e55ceee)

Chores

internal/deps: bump swc to 1.15.40 (#97) (a1d4d75)

internal: use are the types wrong directly (#94) (3d362af)

tests: stop using deprecated models (#98) (65ae1af)

sdk: v0.104.2

0.104.2 (2026-06-15)

Full Changelog: sdk-v0.104.1...sdk-v0.104.2

Chores

api: remove retired models from API and SDKs (a942876)

sdk: v0.104.1

0.104.1 (2026-06-09)

Full Changelog: sdk-v0.104.0...sdk-v0.104.1

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

0.106.0 (2026-06-24)

Full Changelog: sdk-v0.105.0...sdk-v0.106.0

Features

client: add support for system.message streaming events (a7c14b7)

Bug Fixes

helpers: single source for x-stainless-helper, append semantics, and tag the fallback middleware (#107) (106bea0)

Chores

api: add support for new refusal category (b38fd01)

api: add support for sending User Profile ID in request headers (198583e)

0.105.0 (2026-06-18)

Full Changelog: sdk-v0.104.2...sdk-v0.105.0

Features

api: add support for new code_execution_20260120 tool (8dc2b54)

stream: lazily parse partial tool json input (#99) (e55ceee)

Chores

internal/deps: bump swc to 1.15.40 (#97) (a1d4d75)

internal: use are the types wrong directly (#94) (3d362af)

tests: stop using deprecated models (#98) (65ae1af)

0.104.2 (2026-06-15)

Full Changelog: sdk-v0.104.1...sdk-v0.104.2

Chores

api: remove retired models from API and SDKs (a942876)

0.104.1 (2026-06-09)

Full Changelog: sdk-v0.104.0...sdk-v0.104.1

Bug Fixes

api: add frontier_llm refusal category (465e686)

... (truncated)

Commits

0ffdbfa chore: release main (#1098)
ab700dc chore: release main
a322517 feat(api): add support for new code_execution_20260120 tool
65a0106 feat(stream): lazily parse partial tool json input (#99)
384ab51 chore(tests): stop using deprecated models (#98)
a49a191 chore(internal/deps): bump swc to 1.15.40 (#97)
7ac63f3 chore(internal): use are the types wrong directly (#94)
fbee0d1 chore: release main
e984ba4 chore(api): remove retired models from API and SDKs
9a0442d chore: release main
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @anthropic-ai/sdk since your current version.

Updates dotenv from 17.4.1 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

Improved skill files - tightened up details (#1009)

Commits

f116f70 17.4.2
3a81612 fix visual order of faq
13f55a8 Merge branch 'skill'
4bbbf73 reorganize faq
c3da64b Merge pull request #1009 from motdotla/skill
6f743b1 update source
fc2c624 update skill
972315b Tighten up skill
2795fce reorganize faq
d5495d4 adjust skill
Additional commits viewable in compare view

Updates tsx from 4.21.0 to 4.22.4

Release notes

Sourced from tsx's releases.

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

This release is also available on:

npm package (@latest dist-tag)

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

decode typed loader source (dce02fc)

preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

npm package (@latest dist-tag)

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

preserve CJS JSON require in ESM hooks (35b700b)

preserve named exports from CommonJS TypeScript (11de737)

support module.exports require(esm) interop (cf8f199)

This release is also available on:

npm package (@latest dist-tag)

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

resolve tsconfig path aliases containing a colon (#780) (6979f28)

This release is also available on:

npm package (@latest dist-tag)

... (truncated)

Commits

1ce8463 fix: resolve CommonJS directory requires inside dependencies (#803)
dce02fc fix: decode typed loader source
68f72f3 fix: preserve entrypoint with TypeScript preload hooks
69455cf test: cover package exports for ambiguous ESM reexports
35b700b fix: preserve CJS JSON require in ESM hooks
ef807db chore: update testing dependencies
3917090 test: document compatibility test taxonomy
de8113f refactor: centralize Node capability facts
c1f62db test: consolidate tsconfig path edge coverage
4e08174 test: consolidate loader hook coverage
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates @langwatch/scenario from 0.4.9 to 0.4.15

Release notes

Sourced from @langwatch/scenario's releases.

javascript: v0.4.15

0.4.15 (2026-06-25)

Bug Fixes

voice/#648: terminal drain on non-audio completion (EL + WebSocket) (#693) (c42320e)

javascript: v0.4.14

0.4.14 (2026-06-19)

Features

#660: expose context param on scenario.judge() public API (#667) (900f3d8)

sdk: add langwatch config to ScenarioConfig for race-condition-free multi-tenant runs (#545) (eab72b3)

Bug Fixes

#655: replace brittle judge criteria with generic behavioral criteria in audio examples (#679) (732d426)

security: bump hono >=4.12.25 and ws >=8.21.0 (#684) (5050488)

voice/#661: port sliding-idle-deadline to TypeScript receiveAudio (#668) (c66ed6d)

voice/ts: explicit EL ConvAI turn-commit so scripted next-turn receive re-engages (#596) (795ae8e)

javascript: v0.4.13

0.4.13 (2026-06-11)

Bug Fixes

deps: close 16 npm security alerts in scenario examples (#637) (ced16fe)

deps: close 25 npm security alerts in docs and the JS SDK (#620) (ca91380)

deps: close CRITICAL shell-quote and uuid alerts in JS SDK (#636) (abdc38f)

voice/#623: reframe realtime agent audio turns so the voiced sim does not echo them (#653) (9302877)

voice/sdk/#451: stop re-stringifying input_audio array in event-reporter (#639) (d5188d3)

voice/sdk/#451: stop re-stringifying input_audio array in event-reporter (see+listen) (d5188d3)

voice+judge: surface dropped model tool calls (#630 + #631) (#635) (de60f82)

voice: hosted ElevenLabs single-exchange ceiling — docs + enriched timeout error (#643) (aae16be)

voice: surface tool-only realtime turns (no audio chunk) (#647) (6041447)

Miscellaneous

deps/#608: migrate elevenlabs@1.59.0 → @elevenlabs/elevenlabs-js (#611) (6498df4)

examples/voice/#486: retire legacy gpt-4o-audio-preview surface, migrate supported audio examples to gpt-audio-mini (#612) (1ebdd1c)

Documentation

... (truncated)

Commits

0e12e59 chore(main): release javascript 0.4.15 (#704)
c42320e fix(voice/#648): terminal drain on non-audio completion (EL + WebSocket) (#693)
886af57 chore(main): release javascript 0.4.14 (#678)
b819849 fix(#161): re-parse criteria when LLM returns stringified JSON dict (#552)
007a69f feat(#666): per-role voice modality negotiation — declaration-first, two-phas...
5050488 fix(security): bump hono >=4.12.25 and ws >=8.21.0 (#684)
900f3d8 feat(#660): expose context param on scenario.judge() public API (#667)
732d426 fix(#655): replace brittle judge criteria with generic behavioral criteria in...
e89d00c feat(voice): realtime_langwatch_session context manager for live OpenAI Realt...
795ae8e fix(voice/ts): explicit EL ConvAI turn-commit so scripted next-turn receive r...
Additional commits viewable in compare view

Updates @hono/swagger-ui from 0.5.3 to 0.6.1

Release notes

Sourced from @hono/swagger-ui's releases.

@hono/swagger-ui@0.6.1

Patch Changes

#1795 3ca0fab1f52dcbef755363ca43b94bb654de4bab Thanks @matzehecht! - do not delete version and baseUrl from the passed swagger ui options ref

@hono/swagger-ui@0.6.0

Minor Changes

#1776 1844c8bc785b7cacc647d835d1374eb88d314823 Thanks @travzhang! - add support for custom CDN base URL in remoteAssets

Changelog

Sourced from @hono/swagger-ui's changelog.

0.6.1

Patch Changes

#1795 3ca0fab1f52dcbef755363ca43b94bb654de4bab Thanks @matzehecht! - do not delete version and baseUrl from the passed swagger ui options ref

0.6.0

Minor Changes

#1776 1844c8bc785b7cacc647d835d1374eb88d314823 Thanks @travzhang! - add support for custom CDN base URL in remoteAssets

Commits

bbf1bdb Version Packages (#1796)
3ca0fab fix(swagger-ui): do not delete version and baseUrl from the passed swagger ui...
9d0dee4 Version Packages (#1783)
1844c8b feat(swagger-ui): add support for custom CDN base URL in remoteAssets… (#1776)
475cd12 chore: update typescript to 5.9.3 (#1741)
b532f31 refactor(cloudflare-access): decode token types (#1717)
fbec266 chore(deps-dev): bump hono from 4.11.3 to 4.11.4 (#1710)
c7edf1e chore(deps-dev): upgrade @cloudflare/vitest-pool-workers and vitest (#1714)
03a28c5 fix: less strict template expressions (#1681)
1f8372e chore(typescript): add @tsconfig/strictest (#1679)
Additional commits viewable in compare view

Updates better-sqlite3 from 12.8.0 to 12.11.1

Release notes

Sourced from better-sqlite3's releases.

v12.11.1

What's Changed

Fix Electron v42 build errors on Windows by @m4heshd in WiseLibs/better-sqlite3#1488

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.11.0

⚠️CAUTION: NOT A VIABLE RELEASE

Use v12.11.1 instead.

What's Changed

Add missing Electron v42 build target by @m4heshd in WiseLibs/better-sqlite3#1486

Full Changelog: WiseLibs/better-sqlite3@v12.10.1...v12.11.0

v12.10.1

What's Changed

Bump the github-actions group across 1 directory with 4 updates by @dependabot[bot] in WiseLibs/better-sqlite3#1451

Fix V8 external API usage for Electron 42 by @tstone-1 in WiseLibs/better-sqlite3#1475

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

v12.10.0

What's Changed

Update SQLite to version 3.53.1 by @JoshuaWise in WiseLibs/better-sqlite3#1467

Add support for Node.js v26 prebuilds and remove EOL builds (Node.js v20, v23) by @m4heshd in WiseLibs/better-sqlite3#1468

Temporarily rollback support for Electron v42 prebuilds by @m4heshd in WiseLibs/better-sqlite3#1470

Enable percentile functions by @Maxime-J in WiseLibs/better-sqlite3#1447

Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0

v12.9.1

⚠️CAUTION: NOT A VIABLE RELEASE

Electron v39+ prebuilds are not building successfully at the moment. Stick to v12.9.0 for now.

What's Changed

Enable percentile functions by @Maxime-J in WiseLibs/better-sqlite3#1447

Add support for electron v42 prebuilds by @m4heshd in WiseLibs/better-sqlite3#1466

New Contributors

@Maxime-J made their first contribution in WiseLibs/better-sqlite3#1447

Full Changelog: WiseLibs/better-sqlite3@v12.9.0...v12.9.1

... (truncated)

Commits

4cbc39c 12.11.1
02b743f Fix Electron v42 build errors on Windows (#1488)
39a6e55 12.11.0
f36d8c6 Add missing Electron v42 build target (#1486)
da6152c 12.10.1
5bb63a2 Fix V8 external API usage for Electron 42 (#1475)
ca60e36 Bump the github-actions group across 1 directory with 4 updates (#1451)
f93f490 Update SQLite to version 3.53.2 (#1483)
d8885f9 12.10.0
3f89324 Temporarily rollback support for Electron v42 prebuilds (#1470)
Additional commits viewable in compare view

Updates hono from 4.12.12 to 4.12.27

Release notes

Sourced from hono's releases.

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

What's Changed

fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in honojs/hono#5013

ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in honojs/hono#5028

chore: remove unused devcontainer and gitpod configs by @yusukebe in honojs/hono#5029

chore: replace arg and glob with Bun native APIs in build script by @yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

... (truncated)

Commits

97c6fe1 4.12.27
aa92177 Merge commit from fork
cd3f6f7 Merge commit from fork
d4853a8 fix(jsx): make merged context-isolation tests pass tsc type check (#5037)
6735fea fix(jsx): cast awaitedFallback through unknown to fix Deno type check (#5036)
fab3b13 Merge commit from fork
9f0dadf ci: use npm Staged publishing (#5035)
27b7992 4.12.26
d29982c chore: replace arg and glob with Bun native APIs in build script
16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates openai from 6.34.0 to 6.45.0

Release notes

Sourced from openai's releases.

v6.45.0

6.45.0 (2026-06-24)

Full Changelog: v6.44.0...v6.45.0

Features

add afterCompletion hook to runTools (#1064) (4976c22)

realtime: support sideband call_id connections (

…8 updates Bumps the minor-and-patch group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [turbo](https://github.com/vercel/turborepo) | `2.9.5` | `2.10.0` | | [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.0` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.87.0` | `0.106.0` | | [dotenv](https://github.com/motdotla/dotenv) | `17.4.1` | `17.4.2` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.4` | | [@langwatch/scenario](https://github.com/langwatch/scenario) | `0.4.9` | `0.4.15` | | [@hono/swagger-ui](https://github.com/honojs/middleware/tree/HEAD/packages/swagger-ui) | `0.5.3` | `0.6.1` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.8.0` | `12.11.1` | | [hono](https://github.com/honojs/hono) | `4.12.12` | `4.12.27` | | [openai](https://github.com/openai/openai-node) | `6.34.0` | `6.45.0` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.22.0` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.97.0` | `5.101.2` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.7` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.17` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.7` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.14.0` | `7.18.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.2` | `4.3.1` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.3.1` | Updates `turbo` from 2.9.5 to 2.10.0 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.5...v2.10.0) Updates `ws` from 8.20.0 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.21.0) Updates `@anthropic-ai/sdk` from 0.87.0 to 0.106.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.87.0...sdk-v0.106.0) Updates `dotenv` from 17.4.1 to 17.4.2 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.1...v17.4.2) Updates `tsx` from 4.21.0 to 4.22.4 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.22.4) Updates `@langwatch/scenario` from 0.4.9 to 0.4.15 - [Release notes](https://github.com/langwatch/scenario/releases) - [Changelog](https://github.com/langwatch/scenario/blob/main/RELEASE_PLEASE.md) - [Commits](langwatch/scenario@javascript/v0.4.9...javascript/v0.4.15) Updates `@hono/swagger-ui` from 0.5.3 to 0.6.1 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/swagger-ui/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/swagger-ui@0.6.1/packages/swagger-ui) Updates `better-sqlite3` from 12.8.0 to 12.11.1 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.8.0...v12.11.1) Updates `hono` from 4.12.12 to 4.12.27 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.12...v4.12.27) Updates `openai` from 6.34.0 to 6.45.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v6.34.0...v6.45.0) Updates `pg` from 8.20.0 to 8.22.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg) Updates `@tanstack/react-query` from 5.97.0 to 5.101.2 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.2/packages/react-query) Updates `react` from 19.2.5 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react) Updates `@types/react` from 19.2.14 to 19.2.17 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.5 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) Updates `react-router-dom` from 7.14.0 to 7.18.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.0/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.0/packages/react-router-dom) Updates `@tailwindcss/vite` from 4.2.2 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@types/react` from 19.2.14 to 19.2.17 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `tailwindcss` from 4.2.2 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ws dependency-version: 8.21.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.106.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: dotenv dependency-version: 17.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tsx dependency-version: 4.22.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@langwatch/scenario" dependency-version: 0.4.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@hono/swagger-ui" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: better-sqlite3 dependency-version: 12.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.12.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: openai dependency-version: 6.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pg dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.101.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-router-dom dependency-version: 7.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.2.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-29T08:15:20Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Navigation Menu

chore(deps): bump the minor-and-patch group across 1 directory with 18 updates - #25

chore(deps): bump the minor-and-patch group across 1 directory with 18 updates#25
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-b0640b805e

dependabot Bot commented on behalf of github Jun 29, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Turborepo v2.10.0

What's Changed

create-turbo

@​turbo/codemod

eslint

@​turbo/repository

@​turbo/telemetry

Examples

Changelog

8.21.0

Features

Bug fixes

8.20.1

sdk: v0.106.0

0.106.0 (2026-06-24)

Features

Bug Fixes

Chores

sdk: v0.105.0

0.105.0 (2026-06-18)

Features

Chores

sdk: v0.104.2

0.104.2 (2026-06-15)

Chores

sdk: v0.104.1

0.104.1 (2026-06-09)

0.106.0 (2026-06-24)

Features

Bug Fixes

Chores

0.105.0 (2026-06-18)

Features

Chores

0.104.2 (2026-06-15)

Chores

0.104.1 (2026-06-09)

Bug Fixes

17.4.2 (2026-04-12)

Changed

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

javascript: v0.4.15

0.4.15 (2026-06-25)

Bug Fixes

javascript: v0.4.14

0.4.14 (2026-06-19)

Features

Bug Fixes

javascript: v0.4.13

0.4.13 (2026-06-11)

Bug Fixes

Miscellaneous

Documentation

@​hono/swagger-ui@​0.6.1

Patch Changes

@​hono/swagger-ui@​0.6.0

Minor Changes

0.6.1

Patch Changes

0.6.0

Minor Changes

v12.11.1

What's Changed

v12.11.0

⚠️CAUTION: NOT A VIABLE RELEASE

What's Changed

dependabot Bot commented on behalf of github Jun 29, 2026 •

edited

Loading

`@turbo/codemod`

`@turbo/repository`

`@turbo/telemetry`

`@hono/swagger-ui@0`.6.1

`@hono/swagger-ui@0`.6.0

CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice