Skip to content

chore(deps): bump the npm-minor-and-patch group with 7 updates - #45

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-9717d24b8a
Closed

chore(deps): bump the npm-minor-and-patch group with 7 updates#45
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-9717d24b8a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 29, 2026

Copy link
Copy Markdown

Bumps the npm-minor-and-patch group with 7 updates:

Package From To
@hono/zod-validator 0.7.6 0.8.0
@modelcontextprotocol/sdk 1.26.0 1.29.0
agents 0.7.9 0.13.3
hono 4.12.22 4.12.23
@cloudflare/vitest-pool-workers 0.16.9 0.16.10
vue 3.5.33 3.5.35
wrangler 4.94.0 4.95.0

Updates @hono/zod-validator from 0.7.6 to 0.8.0

Release notes

Sourced from @​hono/zod-validator's releases.

@​hono/zod-validator@​0.8.0

Minor Changes

  • #1881 e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67 Thanks @​T4ko0522! - fix(zod-validator): surface the default 400 failure response so it propagates to the RPC schema (refs honojs/hono#3746).
    • Widen the no-hook overload return type to MiddlewareHandler<E, P, V, TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>>, so the default c.json(result, 400) body reaches MergeMiddlewareResponse<M_k> on the Hono side and shows up in hc<typeof app> as a typed 400 branch.
    • Intersect the inferred middleware response with Response (Response & TypedResponse<...>) in both ZodValidatorFailureResponse<T> and ExtractValidationResponse<VF> so a zValidator(...) middleware remains assignable to a plain MiddlewareHandler (avoids a TS2322 regression caused by bare TypedResponse).
    • Collapse the no-hook overload to also accept undefined for the hook parameter together with the options.validationFunction, allowing zValidator(target, schema, undefined, { validationFunction }) to match the typed-failure path.
    • Bump peerDependencies.hono to >=4.10.0 because this PR now relies on the 4-argument MiddlewareHandler<E, P, I, R> signature introduced in Hono v4.10.0; on hono <4.10.0, MiddlewareHandler only accepts 3 type arguments and consumers would hit TS2707 even though peer ranges currently allow it.
Changelog

Sourced from @​hono/zod-validator's changelog.

0.8.0

Minor Changes

  • #1881 e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67 Thanks @​T4ko0522! - fix(zod-validator): surface the default 400 failure response so it propagates to the RPC schema (refs honojs/hono#3746).
    • Widen the no-hook overload return type to MiddlewareHandler<E, P, V, TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>>, so the default c.json(result, 400) body reaches MergeMiddlewareResponse<M_k> on the Hono side and shows up in hc<typeof app> as a typed 400 branch.
    • Intersect the inferred middleware response with Response (Response & TypedResponse<...>) in both ZodValidatorFailureResponse<T> and ExtractValidationResponse<VF> so a zValidator(...) middleware remains assignable to a plain MiddlewareHandler (avoids a TS2322 regression caused by bare TypedResponse).
    • Collapse the no-hook overload to also accept undefined for the hook parameter together with the options.validationFunction, allowing zValidator(target, schema, undefined, { validationFunction }) to match the typed-failure path.
    • Bump peerDependencies.hono to >=4.10.0 because this PR now relies on the 4-argument MiddlewareHandler<E, P, I, R> signature introduced in Hono v4.10.0; on hono <4.10.0, MiddlewareHandler only accepts 3 type arguments and consumers would hit TS2707 even though peer ranges currently allow it.
Commits
  • a08b023 Version Packages (#1887)
  • e90e4fb feat(zod-validator): surface the default 400 on the no-hook overload and keep...
  • e762ac0 feat(eslint): ignoring variables and parameters prefixed with _ (#1772)
  • 475cd12 chore: update typescript to 5.9.3 (#1741)
  • 96ae310 chore: update Zod/Valibot import examples to use namespace imports in docs an...
  • fbec266 chore(deps-dev): bump hono from 4.11.3 to 4.11.4 (#1710)
  • c7edf1e chore(deps-dev): upgrade @cloudflare/vitest-pool-workers and vitest (#1714)
  • 03a28c5 fix: less strict template expressions (#1681)
  • 1f8372e chore(typescript): add @tsconfig/strictest (#1679)
  • 49db969 chore(eslint): update suppressions (#1678)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.29.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

... (truncated)

Commits

Updates agents from 0.7.9 to 0.13.3

Release notes

Sourced from agents's releases.

agents@0.13.3

Patch Changes

  • #1580 a1cd51b Thanks @​threepointone! - Improve session auto-compaction estimates by including the Session-managed frozen system prompt, support custom token counters, and expose an auto-compaction error callback.

  • #1559 f942ffe Thanks @​cjol! - Stash chat turn recovery metadata before inference starts so interrupted pre-stream turns can be reconciled by chat recovery. Pre-stream interruptions now automatically retry the existing unanswered user message when it is still safe to do so.

  • #1579 d0b4d0e Thanks @​threepointone! - Ensure Agent-generated workflow instance IDs always satisfy the Workflows runtime ID validator.

  • #1567 3cfa498 Thanks @​cjol! - Return error statuses for in-band stream errors across programmatic chat turns.

  • #1578 6fa7fd7 Thanks @​threepointone! - Use path-scoped identities for newly-created sub-agents while preserving legacy bare-name identities for existing registry entries.

  • #1578 6fa7fd7 Thanks @​threepointone! - Avoid self-deadlocking facet startup when same-name sub-agents hydrate WebSocket connection state after wake.

agents@0.13.2

Patch Changes

  • #1570 4f14b9c Thanks @​threepointone! - Add agents/chat-sdk, a Chat SDK StateAdapter backed by Agents sub-agents.

    This new package entrypoint exports:

    • createChatSdkState(), a convenience factory for Chat SDK state.
    • ChatSdkStateAdapter, the concrete adapter implementation.
    • ChatSdkStateAgent, the default sub-agent used for durable Chat SDK state.
    • defaultThreadShard() and defaultKeyShard(), the default sharding helpers used by the adapter.

    The adapter stores Chat SDK subscriptions, concurrency locks, pending queues, generic cache entries, callback metadata, thread and channel state, persisted message history, and transcript lists in Durable Object SQLite. State is sharded through parent.subAgent() so a messenger ingress Agent can keep Chat SDK infrastructure state inside child facets instead of requiring a separate top-level Durable Object binding for every state shard.

    createChatSdkState() now works with the default ChatSdkStateAgent class when it is re-exported from the Worker entrypoint. It also defaults parent from getCurrentAgent() when called inside an Agent lifecycle method or request handler, so the common setup is:

    export { ChatSdkStateAgent } from "agents/chat-sdk";
    const chat = new Chat({
    adapters,
    state: createChatSdkState(),
    });

    Applications that need custom state behavior can still pass a custom agent subclass and explicit parent.

    This also documents the sub-agent configuration model more clearly: production Workers should export facet classes, but facet-only child classes do not belong in new_sqlite_classes unless they are also used as top-level Durable Objects. Test wrangler configs may still include facet classes as test-only Durable Object bindings for @cloudflare/vitest-pool-workers compatibility, while keeping them out of new_sqlite_classes.

agents@0.13.1

Patch Changes

  • #1563 32cde40 Thanks @​threepointone! - Add managed fiber jobs with idempotent acceptance, optional completion waiting, inspection, cancellation, explicit recovery outcomes, and retained terminal status records.

agents@0.13.0

... (truncated)

Changelog

Sourced from agents's changelog.

0.13.3

Patch Changes

  • #1580 a1cd51b Thanks @​threepointone! - Improve session auto-compaction estimates by including the Session-managed frozen system prompt, support custom token counters, and expose an auto-compaction error callback.

  • #1559 f942ffe Thanks @​cjol! - Stash chat turn recovery metadata before inference starts so interrupted pre-stream turns can be reconciled by chat recovery. Pre-stream interruptions now automatically retry the existing unanswered user message when it is still safe to do so.

  • #1579 d0b4d0e Thanks @​threepointone! - Ensure Agent-generated workflow instance IDs always satisfy the Workflows runtime ID validator.

  • #1567 3cfa498 Thanks @​cjol! - Return error statuses for in-band stream errors across programmatic chat turns.

  • #1578 6fa7fd7 Thanks @​threepointone! - Use path-scoped identities for newly-created sub-agents while preserving legacy bare-name identities for existing registry entries.

  • #1578 6fa7fd7 Thanks @​threepointone! - Avoid self-deadlocking facet startup when same-name sub-agents hydrate WebSocket connection state after wake.

0.13.2

Patch Changes

  • #1570 4f14b9c Thanks @​threepointone! - Add agents/chat-sdk, a Chat SDK StateAdapter backed by Agents sub-agents.

    This new package entrypoint exports:

    • createChatSdkState(), a convenience factory for Chat SDK state.
    • ChatSdkStateAdapter, the concrete adapter implementation.
    • ChatSdkStateAgent, the default sub-agent used for durable Chat SDK state.
    • defaultThreadShard() and defaultKeyShard(), the default sharding helpers used by the adapter.

    The adapter stores Chat SDK subscriptions, concurrency locks, pending queues, generic cache entries, callback metadata, thread and channel state, persisted message history, and transcript lists in Durable Object SQLite. State is sharded through parent.subAgent() so a messenger ingress Agent can keep Chat SDK infrastructure state inside child facets instead of requiring a separate top-level Durable Object binding for every state shard.

    createChatSdkState() now works with the default ChatSdkStateAgent class when it is re-exported from the Worker entrypoint. It also defaults parent from getCurrentAgent() when called inside an Agent lifecycle method or request handler, so the common setup is:

    export { ChatSdkStateAgent } from "agents/chat-sdk";
    const chat = new Chat({
    adapters,
    state: createChatSdkState(),
    });

    Applications that need custom state behavior can still pass a custom agent subclass and explicit parent.

    This also documents the sub-agent configuration model more clearly: production Workers should export facet classes, but facet-only child classes do not belong in new_sqlite_classes unless they are also used as top-level Durable Objects. Test wrangler configs may still include facet classes as test-only Durable Object bindings for @cloudflare/vitest-pool-workers compatibility, while keeping them out of new_sqlite_classes.

0.13.1

Patch Changes

... (truncated)

Commits

Updates hono from 4.12.22 to 4.12.23

Release notes

Sourced from hono's releases.

v4.12.23

What's Changed

Full Changelog: honojs/hono@v4.12.22...v4.12.23

Commits
  • 83bfb3b 4.12.23
  • bcd290a fix(utils/ipaddr): do not compress a single 0 group to :: (#4971)
  • c968177 feat(compress): add contentTypeFilter option and `COMPRESSIBLE_CONTENT_TYPE_R...
  • 0265a54 docs(contribution): add AI Usage Policy (#4970)
  • c84c5d2 feat(context): export the Context class publicly (#4543)
  • 82dad62 fix(serve-static): normalize all backslashes in file paths, not just the firs...
  • See full diff in compare view

Updates @cloudflare/vitest-pool-workers from 0.16.9 to 0.16.10

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.16.10

Patch Changes

Commits

Updates vue from 3.5.33 to 3.5.35

Release notes

Sourced from vue's releases.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.34

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.35 (2026-05-27)

Bug Fixes

Performance Improvements

  • reactivity: skip type checks for cached proxies (#14860) (5734fe9)
  • runtime-dom: optimize array event handler dispatch (#14828) (bb18dc8)
  • server-renderer: avoid materializing iterables in ssrRenderList (#14821) (1b7a2cc)

3.5.34 (2026-05-06)

Bug Fixes

  • compiler-sfc: infer Vue ref wrapper types when source is unresolvable (#14758) (7f46fd4), closes #14729
  • compiler-sfc: preserve hash hrefs on <image> elements (#14756) (090b2e3)
  • compiler-sfc: resolve type re-exports inside declare global (#14766) (acfffe3)
  • reactivity: prevent orphan effect when created in a stopped scope (#14778) (c8e2d4a), closes #14777
  • runtime-core: avoid symbol coercion during props validation (#8539) (23d4fb5), closes #8487
  • suspense: avoid DOM leak with out-in transition in v-if fragment (#14762) (9667e0d), closes #14761
Commits
  • 8be32d6 release: v3.5.35
  • 80fc139 fix(runtime-core): skip idle persisted transition hooks in keep-alive moves (...
  • d6c7371 ci: use backup action for size report comments
  • bb18dc8 perf(runtime-dom): optimize array event handler dispatch (#14828)
  • 5734fe9 perf(reactivity): skip type checks for cached proxies (#14860)
  • 584beb1 fix(teleport): skip child unmount when pending mount discarded (#14876) (#14877)
  • 34a0ded fix(compiler-core): avoid double processing v-for keys with v-memo (#14861)
  • 170fc95 fix(runtime-core): avoid repeated hydration mismatch checks (#14857)
  • 1b7a2cc perf(server-renderer): avoid materializing iterables in ssrRenderList (#14821)
  • 3d077f2 fix(compiler-sfc): resolve top-level exports from files registered as global ...
  • Additional commits viewable in compare view

Updates wrangler from 4.94.0 to 4.95.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-minor-and-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.7.6` | `0.8.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.29.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.7.9` | `0.13.3` |
| [hono](https://github.com/honojs/hono) | `4.12.22` | `4.12.23` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.16.9` | `0.16.10` |
| [vue](https://github.com/vuejs/core) | `3.5.33` | `3.5.35` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.94.0` | `4.95.0` |


Updates `@hono/zod-validator` from 0.7.6 to 0.8.0
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.8.0/packages/zod-validator)

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.29.0)

Updates `agents` from 0.7.9 to 0.13.3
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.13.3/packages/agents)

Updates `hono` from 4.12.22 to 4.12.23
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.22...v4.12.23)

Updates `@cloudflare/vitest-pool-workers` from 0.16.9 to 0.16.10
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/HEAD/packages/vitest-pool-workers)

Updates `vue` from 3.5.33 to 3.5.35
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.33...v3.5.35)

Updates `wrangler` from 4.94.0 to 4.95.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/HEAD/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@hono/zod-validator"
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: agents
  dependency-version: 0.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: hono
  dependency-version: 4.12.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vue
  dependency-version: 3.5.35
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.95.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript labels May 29, 2026
@dependabot
dependabot Bot requested a review from JSONbored as a code owner May 29, 2026 04:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript labels May 29, 2026
@dosubot dosubot Bot added the size:XS label May 29, 2026
@JSONbored JSONbored closed this May 29, 2026
@dependabot @github

dependabot Bot commented on behalf of github May 29, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-9717d24b8a branch May 29, 2026 06:55
@JSONbored JSONbored added gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. gittensor:feature Gittensor-scored feature linked to a feature issue — scores a 0.25x multiplier. and removed gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. labels Jun 10, 2026
xfodev added a commit to xfodev/loopover that referenced this pull request Jul 20, 2026
…sing form in extractLinkedIssueNumbers

self-review-context.ts's linked-issue extraction claimed to mirror
src/db/repositories.ts's extractLinkedIssueNumbers but diverged in the two
ways the host's own comments warn against (JSONbored#7527):

1. It stripped inline code spans by `body.replace(/`[^`]*`/g, "")` before
   matching. Removing a span leaves the surrounding whitespace, so
   "Fixes `x` JSONbored#45" collapsed to "Fixes  JSONbored#45" and fabricated a link the
   original text never had. Switched to the host's byte-range approach:
   compute each code span's [start,end) and reject any keyword match whose
   range overlaps one, keeping the original text intact.
2. Its pattern recognized only the bare `#N` and qualified `owner/repo#N`
   forms. Added the full-URL closing form
   `KEYWORD https://github.com/owner/repo/issues/N` (and `www.`), same-repo
   scoped exactly like the qualified form -- a miner PR closing an issue via a
   pasted URL previously undercounted its own linked issues in the
   pre-submission self-review, the same gap the host fixed for the gate.

The bare and qualified forms keep identical semantics; this is an additive
parity fix. The function is now exported so the regression cases assert it
directly. This lighter port intentionally omits the host's 50-item overflow
cap + dedup set (the miner scans only its own small PR body), noted in the
comment.

Closes JSONbored#7527
loopover-orb Bot pushed a commit that referenced this pull request Jul 20, 2026
…sing form in extractLinkedIssueNumbers (#7550)

self-review-context.ts's linked-issue extraction claimed to mirror
src/db/repositories.ts's extractLinkedIssueNumbers but diverged in the two
ways the host's own comments warn against (#7527):

1. It stripped inline code spans by `body.replace(/`[^`]*`/g, "")` before
   matching. Removing a span leaves the surrounding whitespace, so
   "Fixes `x` #45" collapsed to "Fixes  #45" and fabricated a link the
   original text never had. Switched to the host's byte-range approach:
   compute each code span's [start,end) and reject any keyword match whose
   range overlaps one, keeping the original text intact.
2. Its pattern recognized only the bare `#N` and qualified `owner/repo#N`
   forms. Added the full-URL closing form
   `KEYWORD https://github.com/owner/repo/issues/N` (and `www.`), same-repo
   scoped exactly like the qualified form -- a miner PR closing an issue via a
   pasted URL previously undercounted its own linked issues in the
   pre-submission self-review, the same gap the host fixed for the gate.

The bare and qualified forms keep identical semantics; this is an additive
parity fix. The function is now exported so the regression cases assert it
directly. This lighter port intentionally omits the host's 50-item overflow
cap + dedup set (the miner scans only its own small PR body), noted in the
comment.

Closes #7527
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file gittensor:feature Gittensor-scored feature linked to a feature issue — scores a 0.25x multiplier.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant