chore(deps): bump the minor-and-patch group across 1 directory with 41 updates

[dependabot]

Bumps the minor-and-patch group with 39 updates in the / directory:

Package	From	To
@ar-agents/identity	0.5.1	0.9.1
@capacitor/android	8.3.1	8.4.1
@capacitor/core	8.3.1	8.4.1
@capacitor/push-notifications	8.0.4	8.1.1
@formatjs/intl-localematcher	0.8.9	0.8.10
@google-cloud/profiler	6.0.4	6.0.5
@google-cloud/pubsub	5.3.0	5.3.1
@google-cloud/secret-manager	6.1.2	6.2.0
@google-cloud/storage	7.19.0	7.21.0
@google-cloud/tasks	6.2.2	6.2.3
@google/adk	1.1.0	1.3.0
@google/genai	2.6.0	2.10.0
@radix-ui/react-dialog	1.1.15	1.1.17
@radix-ui/react-select	2.2.6	2.3.1
@radix-ui/react-separator	1.1.8	1.1.10
@radix-ui/react-switch	1.2.6	1.3.1
@radix-ui/react-toggle	1.1.10	1.1.12
@radix-ui/react-toggle-group	1.1.11	1.1.13
@radix-ui/react-tooltip	1.2.8	1.2.10
@tanstack/react-query	5.100.14	5.101.2
@tanstack/react-virtual	3.13.24	3.14.4
cron-parser	5.5.0	5.6.1
google-auth-library	10.6.2	10.9.0
libphonenumber-js	1.13.6	1.13.7
lucide-react	1.16.0	1.22.0
mercadopago	3.0.0	3.1.0
next	16.2.6	16.2.9
pdfkit	0.18.0	0.19.1
react	19.2.6	19.2.7
@types/react	19.2.14	19.2.17
react-dom	19.2.6	19.2.7
recharts	3.8.1	3.9.0
@capacitor/cli	8.3.1	8.4.1
@playwright/test	1.60.0	1.61.1
@tailwindcss/postcss	4.3.0	4.3.1
esbuild	0.28.0	0.28.1
eslint	10.4.0	10.6.0
typescript-eslint	8.59.1	8.62.0
vitest	4.1.7	4.1.9

Updates @ar-agents/identity from 0.5.1 to 0.9.1

Release notes

Sourced from @​ar-agents/identity's releases.

@​ar-agents/identity@​0.9.1

Patch Changes

• #94 ce7d818 Thanks @​naza00000! - Sanitize monotributoCategoria and fechaInscripcion in AFIP padron data (DeepSec MEDIUM follow-up).

  The prompt-injection sanitizer covered nombre/domicilioFiscal/actividades but skipped monotributoCategoria and fechaInscripcion as "coded fields". The WSCDC parser actually fills both from raw AFIP response text (<descripcionCategoria>, contract/categorization dates), so a hostile taxpayer record could smuggle control/zero-width/bidi characters and instruction-like text through them into the agent loop. sanitizeAfipData now cleans both fields, and the _provenance note lists them as untrusted. condicion (a derived enum, never raw text) is the only field passed through.

@​ar-agents/identity-attest@​0.7.0

Minor Changes

• #92 f200577 Thanks @​naza00000! - Harden identity attestation against OTP brute-force races and cross-tenant reads (DeepSec MEDIUM).

  • OTP attempt counter race (rate-limit-bypass): completeVerification decremented attemptsRemaining with a non-atomic read-modify-write, so concurrent wrong submissions could all read the same counter and exceed maxAttempts. The client now atomically CLAIMS an attempt (new AttestationStore.decrementAttempts) BEFORE verifying, so even a fully concurrent burst can never run more than maxAttempts verifications. Infrastructure errors from an adapter refund the slot (new AttestationStore.incrementAttempts) so a transient external-IdP failure doesn't burn a legitimate user's attempt. Both new store methods are optional — stores that omit them fall back to a (single-process-safe) read-modify-write. InMemoryAttestationStore implements both atomically.
  • Cross-tenant attestation reads (cross-tenant-id): check_verification_status and get_attestation returned subject/claims/signature for any caller-supplied request_id. New optional IdentityAttestToolsOptions.authorizeRead(ctx) hook gates both read tools — construct the tools per request with the caller bound (e.g. compare ctx.externalReference), return false to deny, and the tool responds with not_authorized exposing no data. Omitting it preserves current behavior.

  New exports: IdentityAttestReadContext.

@​ar-agents/identity@​0.9.0

Minor Changes

• #90 5c2ff8c Thanks @​naza00000! - Harden the agent-callable AFIP padron lookup against abuse and prompt injection (DeepSec MEDIUM).

  • lookup_cuit_afip now enforces the CUIT checksum (parseCuit().valid) in code before querying AFIP, instead of relying on the tool description to tell the model to call validate_cuit first. Malformed CUITs short-circuit with a clear error and never reach the adapter.
  • New IdentityToolsOptions.authorizeLookup hook (IdentityLookupContext → IdentityLookupDecision) lets hosts add authorization, per-tenant allowlisting, or rate limiting. It runs after validation and before the adapter, and fails closed: returning false / { allowed: false, reason } denies the lookup without hitting AFIP.
  • AFIP free-text (nombre, domicilioFiscal, actividades) is now sanitized — control codes, zero-width characters, and bidi overrides stripped — both at the WSCDC parser and at the tool boundary, and tool output carries a _provenance marker tagging it as untrusted external data so an agent treats embedded text as data, never instructions.

  New exports: sanitizeRegistryText, sanitizeAfipData, withRegistryProvenance, REGISTRY_PROVENANCE, IdentityLookupContext, IdentityLookupDecision.

@​ar-agents/identity@​0.8.3

Patch Changes

• #89 043a4b1 Thanks @​naza00000! - Harden the AFIP SOAP envelope builders against XML injection (DeepSec MEDIUM).

  • identity buildGetPersonaSoap now validates cuitRepresentado / cuitToQuery as exactly 11 digits before building the envelope and XML-escapes them as defense-in-depth, so a malformed or hostile CUIT can no longer break out of the SOAP context.
  • facturacion solicitarCAE / getCotizacion now XML-escape every interpolated string field (auth CUIT, fchServDesde / fchServHasta / fchVtoPago, cbteFch, docNro, monId, and cbtesAsoc cuit / fecha). Numeric fields were already type-safe.

@​ar-agents/identity-attest@​0.6.0

Minor Changes

• #88 13eda70 Thanks @​naza00000! - Security hardening (DeepSec audit, all true-positive):

  • Attestation HMAC now covers claims + externalReference. The previous delimiter payload signed only id/verifier/method/trustLevel/subject/dates, so claims and externalReference could be tampered without invalidating the signature. Signing is now a canonical (sorted-key) serialization of every security-relevant field. BREAKING: signatures issued by older versions no longer verify (they were forgeable on those fields).
  • Auth0 verification binds to the requested subject. A valid Auth0 id_token for a different account no longer satisfies a request: subject.type:"oauth" requires payload.sub === subject.value; "email" requires

... (truncated)

Changelog

Sourced from @​ar-agents/identity's changelog.

0.9.1

Patch Changes

• #94 ce7d818 Thanks @​naza00000! - Sanitize monotributoCategoria and fechaInscripcion in AFIP padron data (DeepSec MEDIUM follow-up).

  The prompt-injection sanitizer covered nombre/domicilioFiscal/actividades but skipped monotributoCategoria and fechaInscripcion as "coded fields". The WSCDC parser actually fills both from raw AFIP response text (<descripcionCategoria>, contract/categorization dates), so a hostile taxpayer record could smuggle control/zero-width/bidi characters and instruction-like text through them into the agent loop. sanitizeAfipData now cleans both fields, and the _provenance note lists them as untrusted. condicion (a derived enum, never raw text) is the only field passed through.

0.9.0

Minor Changes

• #90 5c2ff8c Thanks @​naza00000! - Harden the agent-callable AFIP padron lookup against abuse and prompt injection (DeepSec MEDIUM).

  • lookup_cuit_afip now enforces the CUIT checksum (parseCuit().valid) in code before querying AFIP, instead of relying on the tool description to tell the model to call validate_cuit first. Malformed CUITs short-circuit with a clear error and never reach the adapter.
  • New IdentityToolsOptions.authorizeLookup hook (IdentityLookupContext → IdentityLookupDecision) lets hosts add authorization, per-tenant allowlisting, or rate limiting. It runs after validation and before the adapter, and fails closed: returning false / { allowed: false, reason } denies the lookup without hitting AFIP.
  • AFIP free-text (nombre, domicilioFiscal, actividades) is now sanitized — control codes, zero-width characters, and bidi overrides stripped — both at the WSCDC parser and at the tool boundary, and tool output carries a _provenance marker tagging it as untrusted external data so an agent treats embedded text as data, never instructions.

  New exports: sanitizeRegistryText, sanitizeAfipData, withRegistryProvenance, REGISTRY_PROVENANCE, IdentityLookupContext, IdentityLookupDecision.

0.8.3

Patch Changes

• #89 043a4b1 Thanks @​naza00000! - Harden the AFIP SOAP envelope builders against XML injection (DeepSec MEDIUM).

  • identity buildGetPersonaSoap now validates cuitRepresentado / cuitToQuery as exactly 11 digits before building the envelope and XML-escapes them as defense-in-depth, so a malformed or hostile CUIT can no longer break out of the SOAP context.
  • facturacion solicitarCAE / getCotizacion now XML-escape every interpolated string field (auth CUIT, fchServDesde / fchServHasta / fchVtoPago, cbteFch, docNro, monId, and cbtesAsoc cuit / fecha). Numeric fields were already type-safe.

0.8.2

Patch Changes

• Rebuild and republish from PII-scrubbed source. Versions published before the 2026-06-17 fixture scrub shipped a real CUIT and address in their README/AGENTS/cookbook/dist; this rebuild from the now-clean source removes them. No API changes. The earlier contaminated versions are deprecated on npm.

0.8.1

Patch Changes

• Frontier release: new packages x402 (HTTP 402 agent payments), bind (BIND APIBANK), fecred (AFIP WSFECred FCE MiPyME). BiasBusters description audit across the toolkit (EN+ES task phrasing). MCP SDK 1.29.

0.8.0

Minor Changes

• ea61bf9 Thanks @​naza00000! - IdentityError now extends ArAgentsError from @ar-agents/core.

  This gives the package a uniform error shape with the rest of the @ar-agents/* family so middleware (withRetry, withMetrics, etc.) can switch on the same code / retryable / context fields across

... (truncated)

Commits

• 63ef839 chore(release): version identity@0.9.1 (sanitize coded fields)
• ce7d818 fix(identity): sanitize monotributoCategoria + fechaInscripcion (DeepSec MEDI...
• f630d05 chore(release): version identity@0.9.0 (AFIP lookup hardening)
• 5c2ff8c fix(identity): harden AFIP lookup — validate, authorize, sanitize (DeepSec ME...
• 3b7d46a chore(release): version identity@0.8.3, facturacion@0.4.3 (SOAP-XML hardening)
• 043a4b1 fix(identity,facturacion): escape + validate SOAP envelope fields (DeepSec ME...
• 6bdffad Vercel-native hardening: AI SDK 7 + native tool-approval + BotID + Connect (#83)
• f438420 chore(release): regen manifests + discovery for bumped versions
• 92130e5 chore(release): rebuild + republish 17 packages from PII-scrubbed source
• 1035be0 Reconcile the treasury bridge onto main + harden (idempotency, society wiring...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by naza-ar, a new releaser for @​ar-agents/identity since your current version.

Updates @capacitor/android from 8.3.1 to 8.4.1

Release notes

Sourced from @​capacitor/android's releases.

8.4.1

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)
• cli: capture ios_package_manager in telemetry (#8482) (b4b297a)

8.3.4

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2

8.3.2 (2026-05-07)

Bug Fixes

• cli: add cSettings support for compiler flags in generated Package.swift (#8448) (0bd0676)

... (truncated)

Changelog

Sourced from @​capacitor/android's changelog.

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)
• cli: capture ios_package_manager in telemetry (#8482) (b4b297a)

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2 (2026-05-07)

Bug Fixes

• cli: add cSettings support for compiler flags in generated Package.swift (#8448) (0bd0676)
• cli: add system framework and weak framework support in SPM Package.swift (#8447) (3232f0f)
• cli: correct Capacitor plugin SPM compat check (#8440) (e5ccc45)
• cli: generate binaryTarget entries for custom xcframeworks in Package.swift (#8445) (1f7e33f)
• cli: generate resource entries in Package.swift (#8455) (790bd27)
• cli: handle Cordova plugins without iOS source files (#8443) (0da130e)
• cli: link plugin dependencies in Package.swift (#8457) (b3c769e)
• ios: support Cordova plugins with Package.swift (#8438) (139943b)
• SystemBars: avoid extra view padding on API <= 34 (#8439) (5b135a7)

Commits

• 7217b52 Release 8.4.1
• 6048e90 fix(cli): make SPM dependency patch work on prereleases (#8508)
• 28bb2c6 fix(cli): patch Capacitor SPM dependency version in plugins (#8492)
• 41fd9de Release 8.4.0
• 36b729d chore: Decrease timeout for CI jobs from 60 to 30 minutes (#8476)
• 4c6c321 fix(android): show only the requested system bar (#8480)
• d4ad7ff fix(SystemBars): respect insetsHandling disable (#8481)
• f1077ef chore: fix typo in declarations.ts (#8488)
• 1d031a4 fix(cli): revert live reload config on failure (#8485)
• b4b297a feat(cli): capture ios_package_manager in telemetry (#8482)
• Additional commits viewable in compare view

Updates @capacitor/core from 8.3.1 to 8.4.1

Release notes

Sourced from @​capacitor/core's releases.

8.4.1

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)
• cli: capture ios_package_manager in telemetry (#8482) (b4b297a)

8.3.4

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2

8.3.2 (2026-05-07)

Bug Fixes

• cli: add cSettings support for compiler flags in generated Package.swift (#8448) (0bd0676)

... (truncated)

Changelog

Sourced from @​capacitor/core's changelog.

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)
• cli: capture ios_package_manager in telemetry (#8482) (b4b297a)

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2 (2026-05-07)

Bug Fixes

• cli: add cSettings support for compiler flags in generated Package.swift (#8448) (0bd0676)
• cli: add system framework and weak framework support in SPM Package.swift (#8447) (3232f0f)
• cli: correct Capacitor plugin SPM compat check (#8440) (e5ccc45)
• cli: generate binaryTarget entries for custom xcframeworks in Package.swift (#8445) (1f7e33f)
• cli: generate resource entries in Package.swift (#8455) (790bd27)
• cli: handle Cordova plugins without iOS source files (#8443) (0da130e)
• cli: link plugin dependencies in Package.swift (#8457) (b3c769e)
• ios: support Cordova plugins with Package.swift (#8438) (139943b)
• SystemBars: avoid extra view padding on API <= 34 (#8439) (5b135a7)

Commits

• 7217b52 Release 8.4.1
• 6048e90 fix(cli): make SPM dependency patch work on prereleases (#8508)
• 28bb2c6 fix(cli): patch Capacitor SPM dependency version in plugins (#8492)
• 41fd9de Release 8.4.0
• 36b729d chore: Decrease timeout for CI jobs from 60 to 30 minutes (#8476)
• 4c6c321 fix(android): show only the requested system bar (#8480)
• d4ad7ff fix(SystemBars): respect insetsHandling disable (#8481)
• f1077ef chore: fix typo in declarations.ts (#8488)
• 1d031a4 fix(cli): revert live reload config on failure (#8485)
• b4b297a feat(cli): capture ios_package_manager in telemetry (#8482)
• Additional commits viewable in compare view

Updates @capacitor/push-notifications from 8.0.4 to 8.1.1

Release notes

Sourced from @​capacitor/push-notifications's releases.

@​capacitor/push-notifications@​8.1.1

8.1.1 (2026-05-15)

Note: Version bump only for package @​capacitor/push-notifications

@​capacitor/push-notifications@​8.1.0

8.1.0 (2026-05-15)

Features

• push-notifications: add banner and list presentation options for iOS (#2529) (f266d2e)

Commits

• 63c874c chore(release): publish [skip ci]
• 8ec56cb docs(push-notifications): update README to reflect banner and list Android be...
• 84131ae chore(release): publish [skip ci]
• f266d2e feat(push-notifications): add banner and list presentation options for iOS (#...
• 78bea4c feat(local-notifications): add presentationOptions config support for iOS (#2...
• See full diff in compare view

Updates @formatjs/intl-localematcher from 0.8.9 to 0.8.10

Release notes

Sourced from @​formatjs/intl-localematcher's releases.

@​formatjs/intl-localematcher: 0.8.10

0.8.10 (2026-06-03)

What's Changed

• build: dispatch release workflow for npm publishing by @​longlho in formatjs/formatjs#6677
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260521.1 by @​renovate[bot] in formatjs/formatjs#6679
• chore(deps): update dependency vite to v8.0.14 by @​renovate[bot] in formatjs/formatjs#6680
• chore(deps): update dependency ts-jest to v29.4.11 by @​renovate[bot] in formatjs/formatjs#6682
• chore(deps): update dependency webpack to v5.107.1 by @​renovate[bot] in formatjs/formatjs#6683
• chore(deps): update pnpm to v11.2.2 by @​renovate[bot] in formatjs/formatjs#6685
• chore(deps): update rust crate serde_json to v1.0.150 by @​renovate[bot] in formatjs/formatjs#6686
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260522.1 by @​renovate[bot] in formatjs/formatjs#6687
• chore: keep gazelle idempotent by @​longlho in formatjs/formatjs#6689
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260523.1 by @​renovate[bot] in formatjs/formatjs#6690
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260524.1 by @​renovate[bot] in formatjs/formatjs#6691
• chore(deps): update pnpm to v11.3.0 by @​renovate[bot] in formatjs/formatjs#6692
• chore(deps): update codescythe to 0.6.1 by @​longlho in formatjs/formatjs#6693
• fix(formatjs_cli): support id interpolation hash algorithms by @​longlho in formatjs/formatjs#6695
• chore(deps): update babel monorepo to v7.29.7 by @​renovate[bot] in formatjs/formatjs#6696
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260526.1 by @​renovate[bot] in formatjs/formatjs#6697
• chore(deps): update dependency oxc-transform to ^0.133.0 by @​renovate[bot] in formatjs/formatjs#6699
• chore(deps): update dependency webpack to v5.107.2 by @​renovate[bot] in formatjs/formatjs#6698
• chore(deps): update dependency oxfmt to ^0.52.0 by @​renovate[bot] in formatjs/formatjs#6702
• chore(deps): update dependency oxlint to v1.67.0 by @​renovate[bot] in formatjs/formatjs#6703
• chore(deps): update typescript-eslint monorepo to v8.60.0 by @​renovate[bot] in formatjs/formatjs#6704
• fix(deps): update dependency oxc-parser to ^0.133.0 by @​renovate[bot] in formatjs/formatjs#6705
• fix(formatjs_cli): speed up skipped message diagnostics by @​longlho in formatjs/formatjs#6709
• fix(deps): update rust crate oxc_data_structures to 0.133 by @​renovate[bot] in formatjs/formatjs#6713
• fix(deps): update rust OXC crates to 0.133 by @​longlho in formatjs/formatjs#6714
• build: verify generated package manifests from bazel deps by @​longlho in formatjs/formatjs#6701
• build: generate package manifests by @​longlho in formatjs/formatjs#6718
• chore(deps): update dependency @​rescripts/cli to v0.0.16 by @​renovate[bot] in formatjs/formatjs#6716
• chore(deps): update dependency react-scripts to v5.0.1 by @​renovate[bot] in formatjs/formatjs#6719
• build: align release-please with generated package manifests by @​longlho in formatjs/formatjs#6720
• chore(deps): update dependency @​rescripts/rescript-env to v0.0.14 by @​renovate[bot] in formatjs/formatjs#6717
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260527.1 by @​renovate[bot] in formatjs/formatjs#6724
• build: add bazel release-please workspace plugin by @​longlho in formatjs/formatjs#6723
• chore(deps): update dependency rolldown to v1.0.3 by @​renovate[bot] in formatjs/formatjs#6725

Full Changelog: https://github.com/formatjs/formatjs/compare/@​formatjs/intl-localematcher@0.8.9...@​formatjs/intl-localematcher@0.8.10

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​formatjs/fast-memoize bumped to 3.1.6

Commits

• 7930811 chore: release main (#6721)
• 4525fda chore(deps): update dependency rolldown to v1.0.3 (#6725)
• 0e70f24 build: add bazel release-please workspace plugin (#6723)
• eae5854 chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20260...
• 3c4dcb9 chore(deps): update dependency @​rescripts/rescript-env to v0.0.14 (#6717)
• e7496d1 build: align release-please with generated package manifests (#6720)
• 9119580 chore(deps): update dependency react-scripts to v5.0.1 (#6719)
• 076e91d chore(deps): update dependency @​rescripts/cli to v0.0.16 (#6716)
• 368aa19 build: generate package manifests (#6718)
• 77eccdb build: verify generated package manifests from bazel deps (#6701)
• Additional commits viewable in compare view

Updates @google-cloud/profiler from 6.0.4 to 6.0.5

Changelog

Sourced from @​google-cloud/profiler's changelog.

6.0.5 (2026-05-11)

Bug Fixes

• Bump all node submodules (#8178) (9fd76ef)

Commits

• 92b328b chore: release main (#8242)
• 0ad39e4 chore: update owlbot configs (#8229)
• 9fd76ef fix: bump all node submodules (#8178)
• See full diff in compare view

Updates @google-cloud/pubsub from 5.3.0 to 5.3.1

Changelog

Sourced from @​google-cloud/pubsub's changelog.

5.3.1 (2026-05-11)

Bug Fixes

• Bump all node submodules (#8178) (9fd76ef)
• pubsub: Remove messages from leasing on nackWithResponse (#7817) (841f0ca)

Commits

• See full diff in compare view

Updates @google-cloud/secret-manager from 6.1.2 to 6.2.0

Release notes

Sourced from @​google-cloud/secret-manager's releases.

grafeas: v6.2.0

6.2.0 (2026-06-16)

Features

• Regenerated google-cloud-monitoring (#8618) (4b5aff4)

secret-manager: v6.2.0

6.2.0 (2026-06-16)

Features

• Local OwlBot generation batch 2 (#8613) (243fb1a)

Bug Fixes

• google-cloud-secretmanager: Improve librarian.js script an re-add missing functions (#8424) (13d03c1)

service-directory: v6.2.0

6.2.0 (2026-06-16)

Features

• Local OwlBot generation batch 3 (#8614) (

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.