Skip to content

chore(deps): bump the production-dependencies group with 7 updates - #258

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-20996f43aa
Open

chore(deps): bump the production-dependencies group with 7 updates#258
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-20996f43aa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 7 updates:

Package From To
@oxlint/plugins 1.80.0 1.81.0
astro 7.2.9 7.3.1
@opencode-ai/sdk 1.18.25 1.18.27
@base-ui/react 1.7.0 1.8.0
lucide-react 1.35.0 1.41.0
@anthropic-ai/claude-agent-sdk 0.3.250 0.3.260
@anthropic-ai/sdk 0.122.0 0.123.0

Updates @oxlint/plugins from 1.80.0 to 1.81.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

Oxlint v1.81.0

🚀 Features

  • 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

  • 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
  • baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
  • 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
  • fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
  • e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
  • d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
  • 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
  • 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
  • bd15905 linter/react/no-unstable-nested-components: Check nested component object property names (#26101) (camc314)
  • 3910e2b linter/eslint/no-unassigned-vars: Skip Svelte and Vue files (#26042) (Hamody We)
  • 047f7ca linter/plugins: Fix interaction between JS plugins and Vue rules (#26080) (overlookmotel)
  • 8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)
  • dc464ff linter/unicorn/prefer-math-min-max: Avoid unsafe autofix (#26060) (camc314)

📚 Documentation

  • 464ddd1 linter: Support a shared short description for jest/vitest rules (#26186) (connorshea)
  • 9db5ad3 linter: Add short description to vue/no-dupe-keys (#26183) (connorshea)
  • db66f58 linter: Correct export/import mismatch in bar and foo example (#25927) (billychannnnnn)
  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Oxfmt v0.66.0

🚀 Features

  • 1fb37b6 formatter/css: Format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194) (leaysgur)

🐛 Bug Fixes

  • 9f81002 formatter: Re-add suppressed statement terminators per options.semi (#26220) (leaysgur)
  • 769ffd5 formatter: Print suppressed typecast parens (#26218) (leaysgur)
  • 5ff57f8 formatter/sort-imports: Handle custom side effect groups (#26217) (leaysgur)
  • 2f4d759 formatter: Do not skip cast comment lookup (#26216) (leaysgur)
  • 1213e12 formatter: Preserve comment for statement terminators and binary casts (#26213) (leaysgur)
  • 57e8e22 formatter_css: Space a folded sign after a call in Less operations (#26134) (leaysgur)
  • e4298fb formatter/jsdoc: Follow CommonMark for interrupting lists and guard wrapping from creating them (#26098) (leaysgur)
  • a1e21c2 formatter: Apply head body policy everywhere (#26074) (leaysgur)
  • 676b7e1 formatter: Keep comments in their for-head slot, before an empty-statement body and do-while (#26073) (leaysgur)

... (truncated)

Commits

Updates astro from 7.2.9 to 7.3.1

Release notes

Sourced from astro's releases.

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

... (truncated)

Commits

Updates @opencode-ai/sdk from 1.18.25 to 1.18.27

Commits

Updates @base-ui/react from 1.7.0 to 1.8.0

Release notes

Sourced from @​base-ui/react's releases.

v1.8.0

General changes

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Combobox

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.8.0

Sep 4, 2026

General changes

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Combobox

... (truncated)

Commits
  • 47b4052 [release] v1.8.0 (#5609)
  • dd13809 [toast] Accept an updater function in the update method instead of on data (#...
  • 670e95c [docs] Update docs infra to restore generated types (#5616)
  • e8526f7 [utils] Restore frozen EMPTY_ARRAY (#5620)
  • b7f6683 [number field] Preserve consumer selection when focusing the input (#5619)
  • b8c5d78 [context menu] Correct generated API metadata (#5523)
  • 261d699 [combobox][autocomplete] Document that items must not contain nullish entries...
  • 0a6ff44 [toast] Replace custom data wholesale and accept a function to derive it (#5611)
  • 2e1bddd [combobox][select] Make the multiple selection anchor lookup linear (#5613)
  • ad83c8a [code-infra] Run TypeScript 7 alongside the TS6 JS API (#5603)
  • Additional commits viewable in compare view

Updates lucide-react from 1.35.0 to 1.41.0

Release notes

Sourced from lucide-react's releases.

Version 1.41.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.40.0...1.41.0

Version 1.40.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.39.0...1.40.0

Version 1.39.0

What's Changed

Full Changelog: lucide-icons/lucide@1.38.0...1.39.0

... (truncated)

Commits

Updates @anthropic-ai/claude-agent-sdk from 0.3.250 to 0.3.260

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.260

What's changed

  • Added optional user_message_uuid to thinking_tokens system messages, linking thinking progress to the user message that triggered the turn
  • Added optional first_content_frame_ms, first_stream_post_ms, first_stream_post_ack_ms and first_stream_post_wall_ms fields to the success result message for remote-session latency breakdowns
  • Fixed managedSettings disableAutoMode: "disable" (either spelling) being dropped by the restrictive-only filter instead of turning auto mode off for the spawned session
  • Fixed rewindFiles() reporting success when no files could be restored (for example when checkpoint backups are missing); it now fails
  • Changed error_max_structured_output_retries results to append the last StructuredOutput tool error; validation errors now name the offending key, allowed values, and actual length or count
  • Changed rate_limit_event to also re-emit during an exceeded window on repeat 429s (about once per 30 seconds per limit window), so stream consumers can refresh stale rate-limit state
  • Updated to parity with Claude Code v2.1.260

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.260
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.260
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.260
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.260

v0.3.259

What's changed

  • Added user_message_uuids beside user_message_uuid on a turn's first reply frame and result: every user message the turn answered, so a reply to several merged messages can be matched to each
  • Added permissionPrompts: 'none' option to auto-deny permission prompts in sessions with nobody to answer them, without disabling auto mode's classifier
  • Updated to parity with Claude Code v2.1.259

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.259
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.259
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.259
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.259

v0.3.258

What's changed

  • Updated to parity with Claude Code v2.1.258

Update

</tr></table>

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.260

  • Added optional user_message_uuid to thinking_tokens system messages, linking thinking progress to the user message that triggered the turn
  • Added optional first_content_frame_ms, first_stream_post_ms, first_stream_post_ack_ms and first_stream_post_wall_ms fields to the success result message for remote-session latency breakdowns
  • Fixed managedSettings disableAutoMode: "disable" (either spelling) being dropped by the restrictive-only filter instead of turning auto mode off for the spawned session
  • Fixed rewindFiles() reporting success when no files could be restored (for example when checkpoint backups are missing); it now fails
  • Changed error_max_structured_output_retries results to append the last StructuredOutput tool error; validation errors now name the offending key, allowed values, and actual length or count
  • Changed rate_limit_event to also re-emit during an exceeded window on repeat 429s (about once per 30 seconds per limit window), so stream consumers can refresh stale rate-limit state
  • Updated to parity with Claude Code v2.1.260

0.3.259

  • Added user_message_uuids beside user_message_uuid on a turn's first reply frame and result: every user message the turn answered, so a reply to several merged messages can be matched to each
  • Added permissionPrompts: 'none' option to auto-deny permission prompts in sessions with nobody to answer them, without disabling auto mode's classifier
  • Updated to parity with Claude Code v2.1.259

0.3.258

  • Updated to parity with Claude Code v2.1.258

0.3.257

  • Added thinkingTokens to ModelUsage (a subset of outputTokens), and fixed result-message usage.output_tokens_details.thinking_tokens reporting 0 instead of the session's real count
  • Added tool_use_result.resourceLinks on user messages carrying MCP tool results: the resource_link blocks the tool returned, so hosts can render returned files without parsing the result text
  • Added optional resource_links to task_notification for an auto-backgrounded MCP tool call that completed, listing the files it returned by reference; join to the call via tool_use_id
  • Fixed mcp_reconnect and mcp_toggle acting on a same-named .mcp.json / ~/.claude.json server instead of the --mcp-config or mcp_set_servers one
  • Fixed mcp_toggle disable also removing the tools of a sibling MCP server whose name extends the disabled one's (disabling foo dropped foo__bar's tools)
  • Changed mcp_set_servers to also list a server whose connection attempt throws under added (with a failed row in mcp_status), not only under errors
  • Changed Agent tool calls to emit the periodic tool_progress heartbeat (heartbeat: true) like other long tools; heartbeat frames never clear a subagent_retry indicator
  • Fixed the browser SDK bundle (@anthropic-ai/claude-agent-sdk/browser) never streaming any messages on engines without native Symbol.dispose (Safari/iOS, Firefox ESR, older Chromium)
  • Fixed a background Bash task that is still running when a stream-json session ends right after an interrupt (stdin closed) never receiving its final task_notification
  • Fixed -p giving up on a long-running background subagent without actually stopping it, so background_tasks_changed kept listing it and events for it arrived after its stopped notification
  • Added detail option to Query.getContextUsage(): 'summary' answers from the last response's usage and local estimates without per-category token-count API calls (default 'full')
  • Updated to parity with Claude Code v2.1.257

0.3.256

  • Updated to parity with Claude Code v2.1.256

0.3.255

  • Updated to parity with Claude Code v2.1.255

0.3.254

  • Updated to parity with Claude Code v2.1.254

0.3.253

  • Updated to parity with Claude Code v2.1.253

... (truncated)

Commits

Updates @anthropic-ai/sdk from 0.122.0 to 0.123.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.123.0

0.123.0 (2026-09-01)

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

  • api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
  • api: manual updates (c6f0bda)
  • api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

  • keep credential file access out of non-Node bundles (ab6a4b2)

Chores

  • internal: codegen related update (788ea8b)

Documentation

  • changelog: detail the beta files/skills GA-shape change (#1175) (4951de0)
Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.123.0 (2026-09-01)

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

  • api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
  • api: manual updates (c6f0bda)
  • api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

  • keep credential file access out of non-Node bundles (ab6a4b2)

Chores

  • internal: codegen related update (788ea8b)

Documentation

  • changelog: detail the beta files/skills GA-shape change (#1175) (4951de0)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group with 7 updates
cabd285 
Bumps the production-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@oxlint/plugins](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugins) | `1.80.0` | `1.81.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.2.9` | `7.3.1` |
| [@opencode-ai/sdk](https://github.com/sst/opencode-sdk-js) | `1.18.25` | `1.18.27` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.7.0` | `1.8.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.35.0` | `1.41.0` |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.250` | `0.3.260` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.122.0` | `0.123.0` |


Updates `@oxlint/plugins` from 1.80.0 to 1.81.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/apps_v1.81.0/npm/oxlint-plugins)

Updates `astro` from 7.2.9 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.1/packages/astro)

Updates `@opencode-ai/sdk` from 1.18.25 to 1.18.27
- [Release notes](https://github.com/sst/opencode-sdk-js/releases)
- [Changelog](https://github.com/anomalyco/opencode-sdk-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sst/opencode-sdk-js/commits)

Updates `@base-ui/react` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react)

Updates `lucide-react` from 1.35.0 to 1.41.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react)

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.250 to 0.3.260
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.250...v0.3.260)

Updates `@anthropic-ai/sdk` from 0.122.0 to 0.123.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.122.0...sdk-v0.123.0)

---
updated-dependencies:
- dependency-name: "@oxlint/plugins"
  dependency-version: 1.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opencode-ai/sdk"
  dependency-version: 1.18.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.260
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.123.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@vercel

vercel Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
threadlines Ignored Ignored Preview Sep 7, 2026 1:18pm UTC

Request Review

@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:L labels Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code size:L vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants