Skip to content

chore(deps): bump the minor-and-patch group with 2 updates - #1568

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-a42ba98486
Closed

chore(deps): bump the minor-and-patch group with 2 updates#1568
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-a42ba98486

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 2 updates: @assistant-ui/react and @aws-sdk/lib-storage.

Updates @assistant-ui/react from 0.14.29 to 0.15.1

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.1

Patch Changes

@​assistant-ui/react@​0.15.0

Minor Changes

  • #5275 9a7e776 - feat: property API for aui — nullary scope accessors are now properties (aui.thread.getState() instead of aui.thread().getState()); calling them still works but is deprecated. Accessors keep source/query/name selection metadata as properties; these are reserved names for scope methods. An unavailable scope's accessor no longer throws at selection time: aui.thread always succeeds and is always truthy, .source is null, and any other property read (or a call) throws — check availability via aui.thread.source != null. Accessor identity is binding-keyed: stable across renders without structural change, new on structural change — memoization keyed on an accessor now invalidates exactly when its binding changes. (@​Yonom)

  • #5281 2f5d0d4 - feat: drop APIs deprecated in v0.12/v0.14 — the legacy context hooks (useAssistantRuntime, useThreadRuntime, useThread, useMessageRuntime, useMessage, useComposerRuntime, useComposer, useMessagePartRuntime, useMessagePart, useAttachmentRuntime, useAttachment, useThreadListItemRuntime, useThreadListItem, useThreadList, useEditComposer and their attachment variants; use useAui / useAuiState), the component-only ToolsState.tools map (use toolUIs), and the "mcp-app" group key in groupPartByType (use "standalone-tool-call"). See the v0.15 migration guide. (@​Yonom)

Patch Changes

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.1

Patch Changes

0.15.0

Minor Changes

  • #5275 9a7e776 - feat: property API for aui — nullary scope accessors are now properties (aui.thread.getState() instead of aui.thread().getState()); calling them still works but is deprecated. Accessors keep source/query/name selection metadata as properties; these are reserved names for scope methods. An unavailable scope's accessor no longer throws at selection time: aui.thread always succeeds and is always truthy, .source is null, and any other property read (or a call) throws — check availability via aui.thread.source != null. Accessor identity is binding-keyed: stable across renders without structural change, new on structural change — memoization keyed on an accessor now invalidates exactly when its binding changes. (@​Yonom)

  • #5281 2f5d0d4 - feat: drop APIs deprecated in v0.12/v0.14 — the legacy context hooks (useAssistantRuntime, useThreadRuntime, useThread, useMessageRuntime, useMessage, useComposerRuntime, useComposer, useMessagePartRuntime, useMessagePart, useAttachmentRuntime, useAttachment, useThreadListItemRuntime, useThreadListItem, useThreadList, useEditComposer and their attachment variants; use useAui / useAuiState), the component-only ToolsState.tools map (use toolUIs), and the "mcp-app" group key in groupPartByType (use "standalone-tool-call"). See the v0.15 migration guide. (@​Yonom)

Patch Changes

Commits

Updates @aws-sdk/lib-storage from 3.1096.0 to 3.1100.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1100.0

3.1100.0(2026-07-31)

Chores
  • add packages-internal to root tsconfig inclusion (#8240) (a0f3fb58)
New Features
  • clients: update client endpoints as of 2026-07-31 (30d44c7e)
  • client-bcm-pricing-calculator: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (edce242c)
  • client-bcm-recommended-actions: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (7bed97ab)
Bug Fixes
  • core/protocols: v2 JSON codec updates and JsonBytesStringAdapter (#8238) (a1001f4b)
Tests

For list of updated packages, view updated-packages.md in assets-3.1100.0.zip

v3.1099.0

3.1099.0(2026-07-30)

Chores
New Features
  • clients: update client endpoints as of 2026-07-30 (e93ec43a)
  • client-pricing-plan-manager: Adds support for Public PricingPlanManager SDK (f5af47b6)
  • client-securityagent: Adds support for providing a branch override when configured integrated repositories (0f5a2dd0)
  • client-iam: Improved IAM Policy Simulator accuracy. Simulator now evaluates SCP conditions and resource scoping, returns explicitDeny for explicit SCP denials, and reports accurate cross-account decisions. (d8cd86e4)
  • client-network-firewall: Adds UPDATING field to Container Association Status (65a8fd3f)
  • client-kafka: Amazon MSK Express brokers now support streaming tables for Apache Iceberg, continuously materializing Apache Kafka topics as Iceberg tables in Amazon S3 Tables. Express brokers also now support data delivery to Amazon S3 general purpose buckets. (16236255)
  • client-lambda: Add Python3.15 (python3.15) and NodeJs 26 (nodejs26.x) support to AWS Lambda (e9cf5069)
  • client-sagemaker: Adds support for g7 family instance types for SageMaker Studio JupyterLab and CodeEditor apps for IAD (us-east-1), PDX (us-west-2), CMH (us-east-2). (5e4ec9ce)
  • client-bedrock-agentcore-control: Adds support for configuring models through the OpenResponses API for custom evaluators. CreateEvaluator and UpdateEvaluator now accept an OpenResponses model configuration for LLM-as-a-Judge evaluations. (9cfbf372)

For list of updated packages, view updated-packages.md in assets-3.1099.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1100.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1099.0 (2026-07-30)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1098.0 (2026-07-29)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1097.0 (2026-07-28)

Note: Version bump only for package @​aws-sdk/lib-storage

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 2 updates: [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react) and [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage).


Updates `@assistant-ui/react` from 0.14.29 to 0.15.1
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react@0.15.1/packages/react)

Updates `@aws-sdk/lib-storage` from 3.1096.0 to 3.1100.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1100.0/lib/lib-storage)

---
updated-dependencies:
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-storage"
  dependency-version: 3.1100.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69a765e7e7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread package.json
"@ai-sdk/openai": "~3.0.74",
"@ai-sdk/react": "~3.0.210",
"@assistant-ui/react": "^0.14.23",
"@assistant-ui/react": "^0.15.1",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate removed assistant-ui hooks before bumping

This upgrade crosses @assistant-ui/react 0.15, whose release notes for the bumped version state that the legacy context hooks including useThreadRuntime, useThread, useMessage, useComposerRuntime, useMessagePart, and useAttachment were dropped. Those hooks are still imported in Nexus/Assistant Architect code paths such as components/features/assistant-architect/assistant-architect-streaming.tsx:36, app/(protected)/nexus/_components/prompt-auto-loader.tsx:5, and components/assistant-ui/attachment.tsx:16, so once the dependency actually resolves to 0.15 the app will fail to typecheck/build until these call sites are migrated or the bump is held back.

Useful? React with 👍 / 👎.

Comment thread package.json
"@aws-sdk/credential-providers": "^3.982.0",
"@aws-sdk/lib-dynamodb": "~3.1095.0",
"@aws-sdk/lib-storage": "3.1096.0",
"@aws-sdk/lib-storage": "3.1100.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Commit the updated Bun lockfile

This changes the root dependency manifest without updating the root bun.lock: the lockfile still records @assistant-ui/react as ^0.14.23/0.14.23 and @aws-sdk/lib-storage as 3.1096.0. The checked CI workflow installs with bun install --frozen-lockfile at .github/workflows/ci.yml:37 (and other jobs do the same), and bun install --help confirms that flag disallows lockfile changes, so these jobs/build images cannot proceed from the submitted manifest until the regenerated bun.lock is committed with the bump.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Member

🤖 pr-fix routine: blocked — marking pr-fix-stuck

I picked this PR up (4 failing checks) and investigated both failures. I confirmed the two P1 findings from the Codex review and could not resolve either autonomously. Details below.

Blocker 1 — stale bun.lock (unfixable in the routine's sandbox)

Every failing job dies at install with:

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile and commit the updated lockfile

This PR modifies only package.jsonbun.lock still pins @assistant-ui/react at 0.14.23 and @aws-sdk/lib-storage at 3.1096.0. All CI jobs install with bun install --frozen-lockfile (.github/workflows/ci.yml:37, plus 6 more sites), so nothing can proceed.

The obvious fix is to regenerate and commit the lockfile. I cannot do that here — the routine's sandbox has no npm registry access:

$ curl https://registry.npmjs.org/zod
Host not in allowlist: registry.npmjs.org. Add this host to your network egress settings to allow access.

bun install resolves the two changed packages and fails with 403. This is an environment egress-policy restriction, not a defect in this PR, and routing around it is explicitly disallowed.

Blocker 2 — @assistant-ui/react 0.15 is a breaking API change

0.15 drops the legacy context hooks (useThreadRuntime, useThread, useMessage, useComposerRuntime, useMessagePart, useAttachment). I grepped the tree and 7 files still import them:

  • app/(protected)/nexus/_components/prompt-auto-loader.tsx
  • app/(protected)/nexus/_components/chat/nexus-thinking-indicator.tsx
  • app/(protected)/nexus/_components/tools/tool-group.tsx
  • components/assistant-ui/mermaid-diagram.tsx
  • components/assistant-ui/thread.tsx
  • components/assistant-ui/attachment.tsx
  • components/features/assistant-architect/assistant-architect-streaming.tsx

Even with a correct lockfile this would fail typecheck/build until those call sites are migrated. That migration touches Nexus conversation code, which per CLAUDE.md requires reading /docs/features/nexus-conversation-architecture.md first and has broken repeatedly — not something I'll attempt blind, with no ability to install the dependency, typecheck, or run the app to verify.

Systemic note (affects far more than this PR)

bun.lock has never been touched by a Dependabot commit in this repo — the last change to it came from #1494. Dependabot's package-ecosystem: "npm" is not maintaining the Bun lockfile, so every npm Dependabot PR here lands with a stale lockfile and red CI by construction. That matches the current queue: #1566, #1567, #1569, #1570, #1571#1576 are all red or already pr-fix-stuck.

Worth fixing once at the source rather than per-PR. Options:

  1. Add a CI step (or a Dependabot post-update hook) that runs bun install and commits the regenerated bun.lock.
  2. Switch the npm ecosystem entries to a lockfile Dependabot maintains.
  3. Have a maintainer run bun install locally and push the lockfile onto each Dependabot branch.

Suggested next step for this PR

Given #2, I'd hold this bump: split @aws-sdk/lib-storage 3.1096.0 → 3.1100.0 (safe patch) out from @assistant-ui/react 0.14 → 0.15, and schedule the assistant-ui migration as its own tracked piece of work.

The routine won't pick this PR up again while pr-fix-stuck is set. Remove the label to re-queue it.


Generated by Claude Code

@krishagel krishagel added the pr-fix-stuck pr-fix routine gave up — human attention needed label Aug 4, 2026 — with Claude
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev/minor-and-patch-a42ba98486 branch August 10, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code pr-fix-stuck pr-fix routine gave up — human attention needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant