fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@ai-sdk/mcp (source)	2.0.65 → 2.0.66
@ai-sdk/vue (source)	4.0.126 → 4.0.127
@iconify-json/lucide	1.2.138 → 1.2.139
@types/node (source)	26.6.3 → 26.6.4
agents (source)	0.24.0 → 0.26.0
ai (source)	7.0.126 → 7.0.127
nuxt-og-image (source)	6.10.1 → 6.10.3
pnpm (source)	10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e → 10.34.6
vue-tsc (source)	3.3.11 → 3.3.12

---

Release Notes

vercel/ai (@​ai-sdk/mcp)

v2.0.66

Compare Source

Patch Changes

• 3ff0f54: feat(mcp): add AuthorizationServerMismatchError for OAuth authorization server pin mismatches

vercel/ai (@​ai-sdk/vue)

v4.0.127

Compare Source

Patch Changes

• Updated dependencies [158a718]
• Updated dependencies [bb8d33e]
• Updated dependencies [284dc11]
• Updated dependencies [ba8afe9]
  • ai@​7.0.127

cloudflare/agents (agents)

v0.26.0

Compare Source

Minor Changes

• #​2451 df9c0ef Thanks @​aron-cf! - Update pi-durable and pi-ai to ^1.0.0. See Pi harness docs for details.

v0.25.0

Compare Source

Minor Changes

• #​2005 c2f7672 Thanks @​cjol! - Native RPC calls to async Agent and Think methods now start lifecycle initialization first; address Agents by name because raw IDs from newUniqueId() and idFromString() now fail their first async RPC. See Lifecycle.

Patch Changes

• #​2390 c55ec80 Thanks @​threepointone! - Report a failed agent-tool child as failed even when it was evicted before recording the failure. See Agent tools.

• #​2384 f904999 Thanks @​threepointone! - Fix agent-tool chunks being duplicated or dropped on reconnect, child re-attach, and fiber recovery. See Agent tools.

• #​2364 5e0507e Thanks @​threepointone! - Add eventDelivery: "terminal" to runAgentTool to forward only lifecycle, progress, and milestone events for a run. See Agent tools.

• #​2448 54f9ca7 Thanks @​aron-cf! - Add experimental agents/models/ai-sdk, a provider for Workers AI and AI Gateway over the AI binding. See Models.

• #​2446 5cf86f8 Thanks @​aron-cf! - Add experimental agents/models/pi-ai, a pi-ai provider for Workers AI and AI Gateway over the AI binding. See Models for pi-ai.

• #​2424 1e54cf1 Thanks @​aron-cf! - Add experimental agents/harnesses/pi to host pi-durable sessions in a Durable Object. See Pi harness and the runnable example.

• #​2391 d3fe93c Thanks @​threepointone! - Keep a tool call's input when its approval request arrives before the input finishes streaming (#​1872). See Human in the loop.

• #​2369 9b70fdb Thanks @​ben-reitz! - loadCdpSpec accepts an optional sessionId to read the protocol from an existing Browser Run session. See Browse the web.

• #​2368 ed4f5ab Thanks @​ben-reitz! - connectBrowserSession throws a BrowserRenderingError with the HTTP status when Browser Run returns no WebSocket. See Browse the web.

• #​2294 abda4e3 Thanks @​ben-reitz! - Add Browser Run hostname guardrails, close and activity callbacks, and the CdpConnection name while retaining CdpSession as a deprecated alias. See Browse the web.

• #​2372 6e1c346 Thanks @​ben-reitz! - Add persistent browser tools for AI SDK and TanStack AI, backed by experimental Browser sessions. See Browse the web.

• #​2371 9cddcd3 Thanks @​ben-reitz! - CdpConnection.send() rejects immediately when its socket is closed instead of waiting for the timeout. See Browse the web.

• #​2379 d49aa82 Thanks @​ben-reitz! - cdp.spec() and loadCdpSpec() now include command parameters, return types, and type details, so a model can see how to call a CDP method. See Browse the web.

• #​2394 e837967 Thanks @​threepointone! - useAgentChat loads the new agent's history when the agent address passed to useAgent changes (#​1864, #​1874). See Client SDK.

• #​2378 dbf170c Thanks @​threepointone! - useAgentChat gains onTurnEnd, and terminal chat frames carry outcomes and user message IDs so clients can settle sends correctly across recovery and reconnects. Replay, tool callbacks, and turn state now remain consistent through terminal delivery; see Chat agents.

• #​2019 d5562e0 Thanks @​justanotherbyte! - A WebSocket close before the final done frame now puts useAgentChat in the error state instead of showing a truncated answer as complete (#​2013). See Chat agents.

• #​2036 040db5c Thanks @​justanotherbyte! - Stop storing compaction summaries that clients echo back, and hide duplicates already stored (#​1984). See Sessions.

• #​2405 11f87b5 Thanks @​threepointone! - Context blocks can set whenChanged: "remind" to send changes as a reminder after the cached prompt instead of rewriting it. See Context.

• #​2399 cbb859b Thanks @​threepointone! - Sub-agent broadcasts make at most one root call, and none when no client would receive them. See Sub-agents.

• #​2398 d44b67d Thanks @​threepointone! - Sub-agents no longer sync root-owned host jobs, which could fail a facet's first call after restart. See Sub-agents.

• #​2400 498bc29 Thanks @​threepointone! - Fix WebSocket connections to sub-agents nested more than one level deep. See Sub-agents.

• #​2344 a91f669 Thanks @​threepointone! - useAgentChat lets the server snapshot repair a scrambled cross-tab or resumed assistant message instead of keeping it until reload. See Chat agents.

• #​2361 7588509 Thanks @​threepointone! - useAgentChat calls onToolCall only after the stream ends, and only for tool calls still waiting on the client (#​2195). See Client tools.

• #​2238 c3a4010 Thanks @​mattzcarey! - Interfaces can now be used as Props on Agent, AIChatAgent, Think, and routing helpers. See Routing.

• #​2040 2afe0e0 Thanks @​AntoniTok! - Keep assistant messages and tool outputs attached to the correct turn when a provider reuses a toolCallId; resolveToolMergeId is deprecated in favour of reconcileMessages. See Chat agents.

• #​2402 01d190e Thanks @​threepointone! - useAgent and AgentClient resolve ready only after the agent's state arrives, so state is no longer briefly undefined (#​2268). See Client SDK.

• #​2039 c658b83 Thanks @​justanotherbyte! - useAgentChat keeps messages sent while disconnected when reconnecting, including Think transcripts, instead of erasing them (#​1983). See Chat agents.

• #​2322 677c022 Thanks @​threepointone! - Correct the documented default and unit of ChatRecoveryConfig.maxRecoveryWork. See Chat agents: recovery work units.

• #​2401 218df4a Thanks @​threepointone! - Clients stop reconnecting after a sub-agent rejects a WebSocket, connection errors report every close that ends reconnection, and terminal rejections use close codes 4000 + status (#​2118). See Sub-agents.

• #​2348 39361fa Thanks @​threepointone! - Fix text appearing twice when reconnecting during a tool continuation. See Resumable streaming.

• #​2340 3b278b2 Thanks @​threepointone! - onChatResponse still fires, with recovered: true, for a turn persisted just before a Durable Object reset (#​2266, #​1842). See Think lifecycle hooks.

• #​2363 d72d343 Thanks @​threepointone! - runFiber() no longer calls onFiberRecovered() for work that already finished (#​2305). See Durable execution.

• #​2404 9d125c8 Thanks @​threepointone! - Add session.mirror() to keep an in-memory transcript in sync with a session's change feed. See Sessions.

• #​2236 14f7c6a Thanks @​mattzcarey! - Keep attachment references when a message that already contains attachment pointers is written back, so its media isn't garbage-collected. See Sessions.

• #​2231 040458e Thanks @​mattzcarey! - updateMessage() detects unchanged messages from a stored content hash, cutting reads on large messages. See Sessions.

• #​2392 4f26402 Thanks @​threepointone! - Settle approved tool calls that never ran once the conversation moves past them, so later turns don't send unresolved tool calls (#​2382). See Human in the loop.

• #​2387 9f70bc8 Thanks @​threepointone! - Messenger replies hold the thread lock and retain queued follow-ups during slow delivery; typing updates are serialized and settle before reply text arrives. See Think messengers.

• #​2417 9906881 Thanks @​threepointone! - A regeneration interrupted by a restart now recovers on its own branch. See Multi-chat.

• #​2403 6b5b4a0 Thanks @​threepointone! - Fix useAgentChat throwing "Maximum update depth exceeded" during long streamed answers (#​2217). See Chat agents.

• #​2366 aaba6cb Thanks @​ben-reitz! - With storeTools: true, oversized tool payloads are recorded with base64 data summarized instead of being dropped. See Observability.

• #​2343 a2f6f94 Thanks @​threepointone! - Harden transient chat recovery across Think and AI Chat, including retry budgeting, cancellation, terminal error delivery, and recovery after restarts. See the agents/chat recovery helpers.

• #​2024 310c343 Thanks @​cjol! - deleteSubAgent now closes the sub-agent's direct client connections, so late messages can't recreate it (#​2003). See Sub-agents.

• #​2339 1edc989 Thanks @​threepointone! - Truncate older tool results after model conversion so toModelOutput and provider-executed tools keep valid outputs (#​2014). See Sessions.

• #​2272 5dbf6c2 Thanks @​mattzcarey! - withX402Client enforces maxPaymentValue against the payment requirement selected for signing, before signing or retrying the tool call. See Pay from Agents SDK.

vercel/ai (ai)

v7.0.127

Compare Source

Patch Changes

• 158a718: feat(ai): select and rank eligible deferred tools via 'search()' callback in tool search
• bb8d33e: fix(ai): cancel merged UI message streams when the consumer disconnects
• 284dc11: fix(ai): accept unchanged tool approval inputs created in another JavaScript realm
• ba8afe9: feat(ai): add a configurable maxResults for number of tools returned in tool search
• Updated dependencies [d1bb9e8]
  • @​ai-sdk/gateway@4.0.103

nuxt-modules/og-image (nuxt-og-image)

v6.10.3

Compare Source

   🐞 Bug Fixes

• runtime: Preserve missing resolver page status  -  by @​harlan-zw in #​717 (cdb0d)

    View changes on GitHub

v6.10.2

Compare Source

   🐞 Bug Fixes

• runtime: Return 404 for unavailable zero-runtime images  -  by @​harlan-zw in #​715 (3ed89)

    View changes on GitHub

pnpm/pnpm (pnpm)

v10.34.6

Compare Source

Patch Changes

• e7888e5: pnpm self-update now resolves and verifies pnpm through registry, authentication, proxy, and TLS settings from trusted non-project configuration. Project configuration and the default project pnpmfile can no longer redirect the pnpm download or disable engine identity verification.

• 46bc7c9: pnpm no longer tells you to update itself with Corepack or with pnpm add -g:

  • The update notification now suggests pnpm self-update, or the standalone install script when pnpm is running under Corepack. It used to suggest corepack use pnpm@<version>, or pnpm add -g pnpm / pnpm add -g @pnpm/exe when pnpm was not installed by the standalone script — but pnpm add -g refuses to install pnpm and points at pnpm self-update anyway, and @pnpm/exe is not published for pnpm v12 or newer, where the unscoped pnpm package is itself the native executable.
  • pnpm self-update under Corepack now points at the standalone install script too, instead of telling you to update pnpm with Corepack.

• 46bc7c9: Updated adm-zip to v0.6.0, which fixes a memory-exhaustion vulnerability where a crafted ZIP file could make it allocate 4 GB of memory. adm-zip is used to extract the Node.js, Bun, and Deno archives that pnpm downloads on Windows.

• Updated the embedded Node.js release keys to the current canonical nodejs/release-keys list.

• Updated the embedded npm registry signing keys to the set currently advertised by npm.

• 702ad5f: Update the embedded Node.js release keys with the new key added to nodejs/release-keys (Stewart X Addison, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD).

Platinum Sponsors

Gold Sponsors

vuejs/language-tools (vue-tsc)

v3.3.12

Compare Source

language-core

• security: prevent arbitrary code execution via inline @plugins compiler options (GHSA-vgrw-xjpj-wh8r) - Thanks to @​serkodev!
• feat: infer first parameter type of default factory for defineModel (#​6210) - Thanks to @​KazariEX!
• feat: report duplicate CSS module names (#​6198) - Thanks to @​serkodev!
• fix: keep union props when using withDefaults (#​6180) (#​6183) - Thanks to @​xia-chao!
• fix: keep inference-only props string single-line with block comments (#​6230) - Thanks to @​00200200!
• fix: support calling template bindings without .value (#​6181)
• fix: avoid type guards missing from the tsc bundle in template binding analysis (#​6214) - Thanks to @​ValentinYoushkevich!
• fix: pad directive hook signatures to check short-arity directive bindings (#​6197) - Thanks to @​serkodev!
• fix: override vueCompilerOptions.plugins instead of merging (#​6208)
• fix: deduplicate vueCompilerOptions.plugins on resolve (#​6125) - Thanks to @​camonunez!
• fix: report duplicate non-identifier CSS module names (#​6199) - Thanks to @​serkodev!
• fix: eliminate synthesized ignore for style scoped classes alias (#​6194) - Thanks to @​serkodev!
• fix: consume synthesized $event in compound event handlers (#​6193) - Thanks to @​serkodev!
• fix: eliminate synthesized ignore in codegen (#​6191)
• fix: use default slot name for bare v-slot (#​6190)
• fix: eliminate unmapped codegen diagnostics (#​6179)
• fix: prevent template token boundary double-mapping (#​6178)
• fix: correct mapping boundary of dot value accesses - Thanks to @​KazariEX!
• fix: stop typedef jsdoc from leaking into emitted dts - Thanks to @​KazariEX!
• perf: precompile attribute glob matchers (#​6227) - Thanks to @​Cherry!

component-meta

• fix: stop checking JS Vue files as TS (#​6231) - Thanks to @​hungateJoseph!

tsc

• fix: prevent watch mode crash on incremental build (#​6213) - Thanks to @​uturnr!

typescript-plugin

• fix: don't abort reference span fix-up at style-less files (#​6192) - Thanks to @​serkodev!

vscode

• perf: reduce focus mode overhead (#​6187) - Thanks to @​serkodev!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.