Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 7 updates - #465

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-3bc24b60a9
Open

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#465
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/production-dependencies-3bc24b60a9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
playwright 1.62.0 1.63.0
@ai-sdk/anthropic 2.0.92 2.0.101
@ai-sdk/openai 2.0.117 2.0.125
@langchain/core 1.2.3 1.2.9
@langchain/langgraph 1.4.8 1.4.14
ai 5.0.223 5.0.253
undici 6.28.0 6.28.1

Updates playwright from 1.62.0 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 2.0.92 to 2.0.101

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

2.0.101

Patch Changes

  • 78a29c2: feat(anthropic): add fable 5.1 support

2.0.100

Patch Changes

  • cd8f35c: Preserve tool calls when using JSON structured output.
  • Updated dependencies [26165ee]
    • @​ai-sdk/provider-utils@​3.0.36

2.0.99

Patch Changes

  • 78c7304: fix(anthropic): order client tool calls after provider-executed tool results

2.0.98

Patch Changes

  • Updated dependencies [77d33c0]
    • @​ai-sdk/provider-utils@​3.0.35

2.0.97

Patch Changes

  • Updated dependencies [2fff9f1]
  • Updated dependencies [f364ea0]
    • @​ai-sdk/provider-utils@​3.0.34

2.0.96

Patch Changes

  • Updated dependencies [9e8e087]
    • @​ai-sdk/provider-utils@​3.0.33

2.0.95

Patch Changes

  • Updated dependencies [0e51b7b]
    • @​ai-sdk/provider-utils@​3.0.32

2.0.94

... (truncated)

Commits

Updates @ai-sdk/openai from 2.0.117 to 2.0.125

Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.125

Patch Changes

  • e0d0bd1: feat(openai): add GPT-6 reasoning configuration updates

2.0.124

Patch Changes

  • 7bebd57: feat(openai): add support for the gpt-6-astra

2.0.123

Patch Changes

  • Updated dependencies [26165ee]
    • @​ai-sdk/provider-utils@​3.0.36

2.0.122

Patch Changes

  • f70d0a3: Normalize non-object replayed Chat Completions tool arguments to empty objects.

2.0.121

Patch Changes

  • 77d33c0: Split OpenAI and Azure OpenAI embedding requests by a conservative UTF-8 byte budget derived from their aggregate token limit, in addition to input count limits.
  • Updated dependencies [77d33c0]
    • @​ai-sdk/provider-utils@​3.0.35

2.0.120

Patch Changes

  • Updated dependencies [2fff9f1]
  • Updated dependencies [f364ea0]
    • @​ai-sdk/provider-utils@​3.0.34

2.0.119

Patch Changes

  • Updated dependencies [9e8e087]
    • @​ai-sdk/provider-utils@​3.0.33

2.0.118

... (truncated)

Commits

Updates @langchain/core from 1.2.3 to 1.2.9

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.9

Patch Changes

@​langchain/core@​1.2.8

Patch Changes

  • #11369 d6ad973 Thanks @​hntrl! - fix(langchain): use unified endpoint for gateway

  • #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

    Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

    @langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

    modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

    Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

@​langchain/core@​1.2.7

Patch Changes

@​langchain/core@​1.2.6

Patch Changes

  • #11344 f08e0c6 Thanks @​hntrl! - fix: apply [Symbol.hasInstance] method to all comparable properties using .isInstance()

    We have some internal schemas that rely on z.instanceof(). This uses a strict instanceof check which can conflict if there are multiple versions of core installed. This overrides the Symbol.hasInstance method to use the same logic as .isInstance() to compare objects at runtime.

@​langchain/core@​1.2.5

Patch Changes

@​langchain/core@​1.2.4

Patch Changes

Commits
  • e493ed6 chore: version packages (#11393)
  • 8384848 fix(google-common): release endpoint routing fix as patch (#11413)
  • 8cfff4d feat(google): add gateway support for genai (#11405)
  • 7df258c chore(langchain): update langgraph deps (#11412)
  • 3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
  • fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
  • 0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
  • 5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
  • 5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
  • 43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.4.8 to 1.4.14

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.14

Patch Changes

  • #2747 fix(langgraph): pushMessage emits on the streamEvents v3 messages channel
  • Updated dependencies: @​langchain/langgraph-sdk

@​langchain/langgraph@​1.4.13

Patch Changes

@​langchain/langgraph@​1.4.12

Patch Changes

  • #2714 a2a59ec Thanks @​hntrl! - Update checkpoint integrations to require the patched checkpoint serializer release.

  • Updated dependencies [a2a59ec]:

    • @​langchain/langgraph-checkpoint@​1.1.5

@​langchain/langgraph@​1.4.11

Patch Changes

  • #2706 eaa5472 Thanks @​zduric-langchain! - fix(langgraph): dedupe merged callback handlers by identity

    mergeCallbacks concatenated handlers and inheritableHandlers while deduping tags, so a handler inherited by both the ambient and the explicit config picked up an extra registration at every graph boundary. With tracing on, a nested streamMode: "messages" run delivered every token twice.

  • Updated dependencies [3ce9f8d, 51b4202, a86f813]:

    • @​langchain/langgraph-sdk@​1.9.30

@​langchain/langgraph@​1.4.10

Patch Changes

@​langchain/langgraph@​1.4.9

Patch Changes

  • #2653 7880055 Thanks @​christian-bromann! - fix(langgraph): checkpoint Topic as a flat values list

    Match Python Topic checkpoints so Host JS graphs no longer put __pregel_tasks: [[], []] through the Python checkpointer. Keep reading legacy [seen, values] checkpoints for restore compatibility.

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.14

Patch Changes

  • #2747 5ce7f42 Thanks @​t3s7r! - fix(langgraph): pushMessage emits on the streamEvents v3 messages channel

  • Updated dependencies [dd287b4]:

    • @​langchain/langgraph-sdk@​1.10.1

1.4.13

Patch Changes

1.4.12

Patch Changes

  • #2714 a2a59ec Thanks @​hntrl! - Update checkpoint integrations to require the patched checkpoint serializer release.

  • Updated dependencies [a2a59ec]:

    • @​langchain/langgraph-checkpoint@​1.1.5

1.4.11

Patch Changes

  • #2706 eaa5472 Thanks @​zduric-langchain! - fix(langgraph): dedupe merged callback handlers by identity

    mergeCallbacks concatenated handlers and inheritableHandlers while deduping tags, so a handler inherited by both the ambient and the explicit config picked up an extra registration at every graph boundary. With tracing on, a nested streamMode: "messages" run delivered every token twice.

  • Updated dependencies [3ce9f8d, 51b4202, a86f813]:

    • @​langchain/langgraph-sdk@​1.9.30

1.4.10

Patch Changes

1.4.9

Patch Changes

... (truncated)

Commits

Updates ai from 5.0.223 to 5.0.253

Changelog

Sourced from ai's changelog.

5.0.253

Patch Changes

  • 5643ec9: fix(ai): allow manual continuations to reuse JSON tool outputs with undefined object properties
  • Updated dependencies [b436246]
    • @​ai-sdk/gateway@​2.0.147

5.0.252

Patch Changes

  • 2c12cd3: fix(ai): skip smoothStream delays while the document is hidden
  • Updated dependencies [cfa33a0]
  • Updated dependencies [8ee6f7d]
  • Updated dependencies [2287da5]
  • Updated dependencies [526f371]
    • @​ai-sdk/gateway@​2.0.146

5.0.251

Patch Changes

  • Updated dependencies [78a29c2]
    • @​ai-sdk/gateway@​2.0.145

5.0.250

Patch Changes

  • 4e3f54b: Validate persisted typed tool calls against current input and output schemas. Schema-incompatible empty or error inputs and completed or failed history from unavailable tools remain loadable as dynamic tool parts instead of exposing unvalidated values under current static tool types.
  • 26165ee: Mark transient network errors that occur while reading successful response bodies as retryable, including AI Gateway responses.
  • Updated dependencies [810dc70]
  • Updated dependencies [7a926ba]
  • Updated dependencies [25c1956]
  • Updated dependencies [26165ee]
    • @​ai-sdk/gateway@​2.0.144
    • @​ai-sdk/provider-utils@​3.0.36

5.0.249

Patch Changes

  • 989be6f: add operation-level outcomes to UI message stream end callbacks

5.0.248

... (truncated)

Commits
  • 582a805 Version Packages (#20317)
  • 5643ec9 [v5.0] fix: Allow manual continuations to reuse tool results containing undef...
  • cb3385d Version Packages (#20232)
  • 2c12cd3 [v5.0] fix: prevent smoothStream from stalling streams in background tabs (#2...
  • e3b73c3 Version Packages (#20146)
  • 86a7a37 Version Packages (#19865)
  • 26165ee Backport: fix: mark response body network errors as retryable (#19897)
  • 4e3f54b [v5.0] fix: reject stale persisted tool inputs without blocking unparsed or u...
  • 4504ad6 Version Packages (#19821)
  • 989be6f [v5.0] fix: UI message stream end callbacks cannot distinguish failed respons...
  • Additional commits viewable in compare view

Updates undici from 6.28.0 to 6.28.1

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits
  • ffc8aa0 Bumped v6.28.1 (#5773)
  • 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
  • ce31bc8 fix(retry): validate resumed response framing
  • 2af0faf fix(websocket): reject unrequested subprotocols
  • 07c60d9 fix(websocket): destroy inflater after decompression limit
  • bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
f4638b5 
…y with 7 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.62.0` | `1.63.0` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `2.0.92` | `2.0.101` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `2.0.117` | `2.0.125` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.3` | `1.2.9` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.4.8` | `1.4.14` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.223` | `5.0.253` |
| [undici](https://github.com/nodejs/undici) | `6.28.0` | `6.28.1` |



Updates `playwright` from 1.62.0 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.63.0)

Updates `@ai-sdk/anthropic` from 2.0.92 to 2.0.101
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@2.0.101/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@2.0.101/packages/anthropic)

Updates `@ai-sdk/openai` from 2.0.117 to 2.0.125
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@2.0.125/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@2.0.125/packages/openai)

Updates `@langchain/core` from 1.2.3 to 1.2.9
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.9)

Updates `@langchain/langgraph` from 1.4.8 to 1.4.14
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.14/libs/langgraph-core)

Updates `ai` from 5.0.223 to 5.0.253
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.253/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.253/packages/ai)

Updates `undici` from 6.28.0 to 6.28.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.28.0...v6.28.1)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 2.0.101
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 2.0.125
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/core"
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 5.0.253
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 6.28.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026
@dependabot
dependabot Bot requested a review from ceilf6 as a code owner September 9, 2026 03:57
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ceilf6 ceilf6 Awaiting requested review from ceilf6 ceilf6 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants