Skip to content

Bump the npm-minor-and-patch group across 1 directory with 7 updates - #465

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/npm-minor-and-patch-fc204f4315
Closed

Bump the npm-minor-and-patch group across 1 directory with 7 updates#465
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/npm-minor-and-patch-fc204f4315

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 7 updates in the / directory:

Package From To
@anthropic-ai/claude-agent-sdk 0.3.278 0.3.289
@anthropic-ai/sdk 0.127.0 0.131.0
@modelcontextprotocol/sdk 1.30.0 1.32.0
@convex-dev/auth 0.0.95 0.0.96
@types/node 26.6.2 26.6.4
convex 1.45.0 1.46.0
convex-test 0.0.59 0.0.60

Updates @anthropic-ai/claude-agent-sdk from 0.3.278 to 0.3.289

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.289

What's changed

  • Updated to parity with Claude Code v2.1.289

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.289
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.289
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.289
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.289

v0.3.288

What's changed

  • Updated to parity with Claude Code v2.1.288

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.288
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.288
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.288
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.288

v0.3.287

What's changed

  • Added optional remote-session latency fields (first_text_post_queue_wait_ms, first_text_post_queued_behind) to the success result message
  • Fixed includePartialMessages streams sending a cut-short reply's message_stop late or never, so apps could show the reply as still in progress
  • Fixed the error for a revoked claude.ai login, which now reads "Failed to authenticate: OAuth token revoked" instead of a generic or "does not have access" message
  • Fixed a tool call to an in-process MCP server being left waiting after toggleMcpServer() disabled the server or setMcpServers() removed it
  • Fixed commands_changed arriving before init, or twice, at session start: the initialize response now includes commands registered at startup
  • Changed tool_use_result for a WebFetch or WebSearch call that steps aside for a priority "now" message to { detachedToolCall: true }; the result follows in a later turn
  • Changed tool_use_result for MCP tools: structuredContent over 1,048,576 JSON characters is left off and structuredContentOmitted: true set, except for SDK-server and MCP Apps tools
  • Updated to parity with Claude Code v2.1.287

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.287
</tr></table>

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.289

  • Updated to parity with Claude Code v2.1.289

0.3.288

  • Updated to parity with Claude Code v2.1.288

0.3.287

  • Added optional remote-session latency fields (first_text_post_queue_wait_ms, first_text_post_queued_behind) to the success result message
  • Fixed includePartialMessages streams sending a cut-short reply's message_stop late or never, so apps could show the reply as still in progress
  • Fixed the error for a revoked claude.ai login, which now reads "Failed to authenticate: OAuth token revoked" instead of a generic or "does not have access" message
  • Fixed a tool call to an in-process MCP server being left waiting after toggleMcpServer() disabled the server or setMcpServers() removed it
  • Fixed commands_changed arriving before init, or twice, at session start: the initialize response now includes commands registered at startup
  • Changed tool_use_result for a WebFetch or WebSearch call that steps aside for a priority "now" message to { detachedToolCall: true }; the result follows in a later turn
  • Changed tool_use_result for MCP tools: structuredContent over 1,048,576 JSON characters is left off and structuredContentOmitted: true set, except for SDK-server and MCP Apps tools
  • Updated to parity with Claude Code v2.1.287

0.3.286

  • Added the initialize response field sdk_mcp_manifests_parked and the system/init capabilities sdk_mcp_manifests and sdk_mcp_tools_list_changed
  • Fixed foreground subagents sometimes not receiving the task-tracking tools listed in tools or allowedTools
  • Fixed an SDK MCP server listing no tools when one tool's schema cannot be converted to JSON Schema; that tool is now left out with a warning naming it
  • Fixed toggleMcpServer() not disconnecting, and failing to re-enable, an in-process MCP server created with createSdkMcpServer(), except one named claude-in-chrome
  • Changed a person's priority now message to move running shell commands, agents and MCP calls to the background and join the running turn instead of stopping it
  • Changed the TypeScript Agent SDK to leave an omitted permissionMode to Claude Code, so a settings defaultMode now applies and, on third-party providers or with telemetry off, the session starts in auto mode like claude -p; pass permissionMode: 'default' for manual approvals
  • Updated to parity with Claude Code v2.1.286

0.3.285

  • Added an optional read.title (the artifact's stored title) to the Artifact tool's structured read result
  • Added provider_not_allowed to startup_failure_reason and allowedProviders to the Settings type
  • Fixed sessions with CLAUDE_CODE_FORK_SUBAGENT=1: a subagent's own Agent call now runs in the foreground, so the subagent gets the child's result
  • Fixed getSessionMessages() leaving out a message sent while Claude was working when the process stopped before the reply, or when another prompt followed it with no reply in between
  • Fixed toggleMcpServer(name, false) leaving the connection open for a server that had not yet connected when the session started, or whose config was edited after it connected
  • Fixed rewind_conversation leaving a backgrounded MCP tool call running after the message that started it was removed
  • Changed Bash/PowerShell timeout to bound a run_in_background command (was ignored; default 30 min, max 2 h); the stopped task notification for a stop at that limit says why
  • Changed getSubagentMessages() to also return the messages a subagent read while it ran, such as a message sent to it; offset and limit count these rows
  • Updated to parity with Claude Code v2.1.285

0.3.284

  • Added a renamed skill's directory name to its SlashCommand aliases when the name is plain and Claude Code ships no command by that name
  • Added applied.ultracodeAvailable and applied.ultracodeRequested to getSettings(): whether this session can run Ultracode, and whether it is requested, independent of whether it is in effect
  • Fixed forkSession() copies reading back the wrong history when cut at a progress row or fork briefing after a rewind, or when the session was compacted with some messages kept
  • Fixed getSessionMessages() leaving out messages from other agents, sessions and channels that the CLI transcript shows
  • Fixed { decision: 'block' } returned by Elicitation and ElicitationResult hook callbacks being ignored; it now declines the MCP elicitation
  • Fixed query() closing stdin before a follow-up turn woken by a finished background agent, which failed that turn's hooks, canUseTool and SDK MCP calls with "Stream closed"
  • Changed the first turn to still wait up to 2s for connecting MCP servers named in allowedTools or by an mcp_tool hook, even with CLAUDE_CODE_MCP_STARTUP_WAIT_MS set to 0

... (truncated)

Commits
  • 16cf0a7 chore: Update CHANGELOG.md
  • 36836f0 chore: Update CHANGELOG.md
  • 9d8cb9c chore: Update CHANGELOG.md
  • 0e21ebb chore: Update CHANGELOG.md
  • 28c70e2 ci: security hardening for the GitHub Actions workflow that calls Claude (#483)
  • 49ac970 chore: Update CHANGELOG.md
  • 41cad2a chore: Update CHANGELOG.md
  • fc99cf7 ci: pin the model for issue triage (#480)
  • 9e1902d chore: Update CHANGELOG.md
  • 9e477a1 chore: Update CHANGELOG.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/claude-agent-sdk since your current version.


Updates @anthropic-ai/sdk from 0.127.0 to 0.131.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.131.0

0.131.0 (2026-09-30)

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

  • api: add list spend limits endpoint (cfb78c8)

Chores

  • client: deprecate sonnet 4.5 (d72cfaf)

sdk: v0.130.0

0.130.0 (2026-09-30)

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

  • api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)
  • api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)
  • api: add per-user usage and cost reports to the Admin API analytics (0a74a28)
  • api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)
  • api: add repository error types to Managed Agents session errors (6735615)
  • api: allow removing a plugin's org-wide installation setting (c7d120f)
  • api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)
  • api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

  • api: make memory store description, metadata, archived_at required (ed68900)
  • api: type admin plugin preference and marketplace fields as enums (942ae01)
  • pagination: auto-paging continues past an empty page while next_page is set (2d75266)
  • tool-runner: only send API fields for runnable tools (#404) (a62c2a2)
  • tools: stop the session tool runner after any idle that ends the turn (#878) (cab32f8)

Chores

  • api: update MCP Tunnels types and descriptions (394d60c)
  • docs: remove placeholder enum descriptions (04f0812)
  • tests: fixture update (#381) (9cfe4d4)

sdk: v0.129.0

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.131.0 (2026-09-30)

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

  • api: add list spend limits endpoint (cfb78c8)

Chores

  • client: deprecate sonnet 4.5 (d72cfaf)

0.130.0 (2026-09-30)

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

  • api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)
  • api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)
  • api: add per-user usage and cost reports to the Admin API analytics (0a74a28)
  • api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)
  • api: add repository error types to Managed Agents session errors (6735615)
  • api: allow removing a plugin's org-wide installation setting (c7d120f)
  • api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)
  • api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

  • api: make memory store description, metadata, archived_at required (ed68900)
  • api: type admin plugin preference and marketplace fields as enums (942ae01)
  • pagination: auto-paging continues past an empty page while next_page is set (2d75266)
  • tool-runner: only send API fields for runnable tools (#404) (a62c2a2)
  • tools: stop the session tool runner after any idle that ends the turn (#878) (cab32f8)

Chores

  • api: update MCP Tunnels types and descriptions (394d60c)
  • docs: remove placeholder enum descriptions (04f0812)
  • tests: fixture update (#381) (9cfe4d4)

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

... (truncated)

Commits
  • d49bdab Merge pull request #1230 from anthropics/release-please--branches--main--chan...
  • 4759f20 chore: release main
  • 9ded9f3 codegen metadata
  • d72cfaf chore(client): deprecate sonnet 4.5
  • cfb78c8 feat(api): add list spend limits endpoint
  • e8f4c28 Merge branch 'main' into next
  • e6ca605 Merge pull request #1229 from anthropics/release-please--branches--main--chan...
  • 2dd6192 chore: release main
  • cab32f8 fix(tools): stop the session tool runner after any idle that ends the turn (#...
  • 0a74a28 feat(api): add per-user usage and cost reports to the Admin API analytics
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
  • 30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
  • 4b0051f chore: bump version to 1.31.0 (#2890)
  • Additional commits viewable in compare view

Updates @convex-dev/auth from 0.0.95 to 0.0.96

Changelog

Sourced from @​convex-dev/auth's changelog.

0.0.96

  • fix: check ID tables for refresh tokens and verifiers (#665)
  • fix: remove and redact some values in DEBUG logs (#598)
Commits

Updates @types/node from 26.6.2 to 26.6.4

Commits

Updates convex from 1.45.0 to 1.46.0

Changelog

Sourced from convex's changelog.

1.46.0

  • Added .optional() to all validators. For example, v.string().optional() is equivalent to v.optional(v.string()). This changes TypeScript compatibility between validators from different Convex versions; projects sharing validators across packages may need to align their convex dependency versions.
  • npx convex deploy --dry-run now warns when a schema change requires checking every document in large tables against the new schema, since these deploys can take a long time. The warning lists the affected tables along with their document counts and sizes.
  • Fixed a bug where npx convex deploy could fail with a deployment:data:view permission error when deleting indexes with a deploy key that only has deployment:deploy. The CLI now reuses the schema evaluation response to size the affected tables instead of reading them directly, so deployment:data:view is no longer required.
  • convex/server exports FunctionReference_future, a reference type whose arguments are checked similar to the way Convex checks them at runtime. Use it instead of FunctionReference when you accept someone else's Convex function as a callback and know which arguments you will pass it. Behavior summary: it rejects a function requiring arguments you never pass, rejects a function that does not declare a top-level argument you do pass, and accepts a function taking broader values than you pass. A plain FunctionReference gets the first and third backwards. The surplus-key check stops at the top level: a surplus key inside a nested object, array element, or union arm is not detected. A value of the type is usable with ctx.runMutation, ctx.scheduler.runAfter, createFunctionHandle, and every other API in this package that takes a reference, all of which now accept FunctionReference | FunctionReference_future. It is deliberately not assignable to a plain FunctionReference, so forwarding one into code typed that way is a compile error rather than a silent loss of argument checking. Library code that wants to accept either kind of reference should take that same union and read arguments and return types through FunctionArgs and FunctionReturnType, which accept either kind.
  • As a part of the FunctionReference_future work, the _args and _returnType slots on FunctionReference are deprecated. They'll be removed in a future version. FunctionReference gains an optional _fn slot that enables the checked comparison of args.
Commits
Maintainer changes

This version was pushed to npm by ayushdewanconvex, a new releaser for convex since your current version.


Updates convex-test from 0.0.59 to 0.0.60

Changelog

Sourced from convex-test's changelog.

0.0.60

  • Improves the implementation of finishAllScheduledFunctions to avoid false positives in the hung scheduled function detection.
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
@dependabot
dependabot Bot requested a review from 0thernet as a code owner October 7, 2026 00:34
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
@vercel

vercel Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
xcb Ready Ready Preview Oct 7, 2026 12:58am UTC

Request Review

@dependabot
Bump the npm-minor-and-patch group across 1 directory with 7 updates
ede3933 
Bumps the npm-minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.278` | `0.3.289` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.127.0` | `0.131.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.0` |
| [@convex-dev/auth](https://github.com/get-convex/convex-auth) | `0.0.95` | `0.0.96` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.4` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.45.0` | `1.46.0` |
| [convex-test](https://github.com/get-convex/convex-test) | `0.0.59` | `0.0.60` |



Updates `@anthropic-ai/claude-agent-sdk` from 0.3.278 to 0.3.289
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.278...v0.3.289)

Updates `@anthropic-ai/sdk` from 0.127.0 to 0.131.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.127.0...sdk-v0.131.0)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.0)

Updates `@convex-dev/auth` from 0.0.95 to 0.0.96
- [Changelog](https://github.com/get-convex/convex-auth/blob/main/CHANGELOG.md)
- [Commits](convex/convex-auth@v0.0.95...v0.0.96)

Updates `@types/node` from 26.6.2 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `convex` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/get-convex/convex-backend/releases)
- [Changelog](https://github.com/get-convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `convex-test` from 0.0.59 to 0.0.60
- [Changelog](https://github.com/get-convex/convex-test/blob/main/CHANGELOG.md)
- [Commits](convex/convex-test@v0.0.59...v0.0.60)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.289
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.131.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@convex-dev/auth"
  dependency-version: 0.0.96
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: convex
  dependency-version: 1.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: convex-test
  dependency-version: 0.0.60
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bun/npm-minor-and-patch-fc204f4315 branch from 139e702 to ede3933 Compare October 7, 2026 00:57
@github-actions
github-actions Bot enabled auto-merge (squash) October 7, 2026 00:57
@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 14, 2026
auto-merge was automatically disabled October 14, 2026 18:45

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/bun/npm-minor-and-patch-fc204f4315 branch October 14, 2026 18:45

This branch was successfully deployed

1 active deployment
Preview — ede39338 Deployed Oct 7, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@0thernet 0thernet Awaiting requested review from 0thernet 0thernet is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants