Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 3 updates - #1625

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-4c3e55582a
Open

build(deps): bump the minor-and-patch group across 1 directory with 3 updates#1625
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-4c3e55582a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 3 updates in the / directory: @assistant-ui/react, @aws-sdk/lib-storage and next.

Updates @assistant-ui/react from 0.14.29 to 0.15.8

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react-a2a@​0.2.28

Patch Changes

@​assistant-ui/react-o11y@​0.0.38

Patch Changes

@​assistant-ui/react-o11y@​0.0.37

Patch Changes

@​assistant-ui/react-o11y@​0.0.34

Patch Changes

  • #5430 dcacd9b - feat: AuiProvider extends/config grammar. config={AuiConfig({...})} alone creates a top-level root client; nested providers must pass extends — a client to extend, or null to isolate (dev-enforced). An empty config creates a client extending the extends client; ref exposes the resulting client. The config prop only accepts configs built with AuiConfig(...) (branded type). AssistantRuntimeProvider gains an optional config prop whose scopes are provided alongside the runtime scope. The useAui({...}) extension overload and the AuiProvider value prop are deprecated; value={client} now exposes a client extending the given one (same scopes, new identity) rather than the exact instance. useAui({}) with an empty scope object now mounts a rooted host (so the scope set can grow across renders) instead of a passthrough derived-only client. useAuiState state enumeration (Object.keys/spread) now includes scopes inherited from parent clients, matching in-operator behavior. Clients derived from a hand-built parent (a plain object with subscribe/on) forward scoped on(...) listeners to the parent's on instead of throwing for scopes the parent does not expose. (@​Yonom)

  • #5605 afb59f2 - fix: prevent cyclic span parent links from crashing observability trees (@​Kinfe123)

  • Updated dependencies [dcacd9b, aa302ee, aa302ee, 71cf74e]:

    • @​assistant-ui/store@​0.3.4
    • @​assistant-ui/tap@​0.9.10

@​assistant-ui/react@​0.15.5

Patch Changes

  • #5476 02b9dc1 - fix: allow callers to override the default type="button" on action button primitives (@​ephraimduncan)

  • #5564 31a427a - fix: hydrate assistant transport resumes from their retained initial state (@​Kinfe123)

  • #5415 271d85d - fix: AttachmentPrimitive.Thumb now renders custom children and supports asChild instead of always overriding them with the automatic label (@​ephraimduncan)

  • #5421 e7a696c - fix: AttachmentPrimitive.Thumb no longer renders a bare "." for extension-less filenames; falls back to the attachment type (@​ephraimduncan)

  • #5430 dcacd9b - feat: AuiProvider extends/config grammar. config={AuiConfig({...})} alone creates a top-level root client; nested providers must pass extends — a client to extend, or null to isolate (dev-enforced). An empty config creates a client extending the extends client; ref exposes the resulting client. The config prop only accepts configs built with AuiConfig(...) (branded type). AssistantRuntimeProvider gains an optional config prop whose scopes are provided alongside the runtime scope. The useAui({...}) extension overload and the AuiProvider value prop are deprecated; value={client} now exposes a client extending the given one (same scopes, new identity) rather than the exact instance. useAui({}) with an empty scope object now mounts a rooted host (so the scope set can grow across renders) instead of a passthrough derived-only client. useAuiState state enumeration (Object.keys/spread) now includes scopes inherited from parent clients, matching in-operator behavior. Clients derived from a hand-built parent (a plain object with subscribe/on) forward scoped on(...) listeners to the parent's on instead of throwing for scopes the parent does not expose. (@​Yonom)

  • #5416 c5b88f1 - fix: ignore Escape during IME composition in ComposerPrimitiveInput so dismissing a composition candidate no longer cancels the composer (@​ephraimduncan)

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.8

Patch Changes

  • Republish of 0.15.6 (registry staged-version conflicts blocked 0.15.6 and 0.15.7; contents identical).

0.15.6

Patch Changes

0.15.5

Patch Changes

  • #5476 02b9dc1 - fix: allow callers to override the default type="button" on action button primitives (@​ephraimduncan)

  • #5564 31a427a - fix: hydrate assistant transport resumes from their retained initial state (@​Kinfe123)

  • #5415 271d85d - fix: AttachmentPrimitive.Thumb now renders custom children and supports asChild instead of always overriding them with the automatic label (@​ephraimduncan)

  • #5421 e7a696c - fix: AttachmentPrimitive.Thumb no longer renders a bare "." for extension-less filenames; falls back to the attachment type (@​ephraimduncan)

  • #5430 dcacd9b - feat: AuiProvider extends/config grammar. config={AuiConfig({...})} alone creates a top-level root client; nested providers must pass extends — a client to extend, or null to isolate (dev-enforced). An empty config creates a client extending the extends client; ref exposes the resulting client. The config prop only accepts configs built with AuiConfig(...) (branded type). AssistantRuntimeProvider gains an optional config prop whose scopes are provided alongside the runtime scope. The useAui({...}) extension overload and the AuiProvider value prop are deprecated; value={client} now exposes a client extending the given one (same scopes, new identity) rather than the exact instance. useAui({}) with an empty scope object now mounts a rooted host (so the scope set can grow across renders) instead of a passthrough derived-only client. useAuiState state enumeration (Object.keys/spread) now includes scopes inherited from parent clients, matching in-operator behavior. Clients derived from a hand-built parent (a plain object with subscribe/on) forward scoped on(...) listeners to the parent's on instead of throwing for scopes the parent does not expose. (@​Yonom)

  • #5416 c5b88f1 - fix: ignore Escape during IME composition in ComposerPrimitiveInput so dismissing a composition candidate no longer cancels the composer (@​ephraimduncan)

  • #5420 129d0c1 - fix: defer blob URL revocation in ActionBarPrimitive.ExportMarkdown so the download fetch can start before the URL is revoked (@​ephraimduncan)

  • #5585 1160d8b - fix: settle assistant transport runs when finish callbacks fail (@​Kinfe123)

  • #5418 cc85bf4 - fix: compose SelectionToolbarRoot onMouseDown with composeEventHandlers so user handlers run before preventDefault (@​ephraimduncan)

  • #5650 34cec64 - feat: two-lane, placement-aware message queue with steer-by-default mid-run sends (@​Yonom)

    ExternalThreadQueueAdapter is reshaped: enqueue(message, { steer }) splits into enqueue(message) / steer(message), steer(queueItemId) becomes move(queueItemId, { lane: "steer", insertAfter: null }), clear(reason) is dropped (queue clear policy is now host-owned), and steerItems / move / edit and QueueItemState.parts are required.

  • Updated dependencies [dcacd9b, d52928d, d8a59ad, e70da91, aac3a8c, aa302ee, aa302ee, 71cf74e, 34cec64]:

    • @​assistant-ui/store@​0.3.4

... (truncated)

Commits
Attestation changes

This version has no provenance attestation, while the previous version (0.14.29) was attested. Review the package versions before updating.


Updates @aws-sdk/lib-storage from 3.1096.0 to 3.1105.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1105.0

3.1105.0(2026-08-06)

Chores
  • lib-dynamodb: add error msg and fallback when incompatible client is supplied (#8231) (e663d41f)
New Features
  • clients: update client endpoints as of 2026-08-06 (e4f7b32f)
  • client-cloudwatch-logs: This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes. (e17fff6f)
  • client-socialmessaging: Add support for WhatsApp Conversions APIs. (5c29a869)
  • client-gamelift: Adds support for C8a, C8i, C9g, M8a, M8i, and M9g EC2 instance type families for managed EC2 and container fleets. Also adds explicit anchors on most string regexes. (30dfd63a)
  • client-securityhub: Security Hub is adding a new public API, ListFreeTrialStatusesV2 to describe the free trial statuses of the Security Hub service and its opt-in features. (e44b3582)
  • client-bedrock-agentcore-control: Add support for Gateway rate limits and Runtime instances in Amazon Bedrock AgentCore. Customers can now configure rate limits scoped to control request rates, token consumption rates, and active connection rates. Customers can now create capacity providers to launch runtimes on their EC2 instances. (865d21ef)
  • client-device-farm: Adds support for service generated insights across runs, jobs, and tests. (6c601b71)
  • client-sagemaker: Releases new Model Customization SequenceLength parameter for Training and g7 instance types for Training and Processing. (14bd2ac7)
  • client-agent-registry-control: Agent Registry's Public Preview release (a137863d)
  • client-backup: AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. (636228a9)
  • client-mediatailor: AWS Elemental MediaTailor now supports concurrent function execution. The new Concurrent Executor function type runs multiple independent child functions in parallel within a single lifecycle hook, reducing pipeline latency to the duration of the slowest call instead of the sum of all calls. (1cf61475)
  • client-marketplace-agreement: GetAgreementTerms now returns a new term variant in AcceptedTerm, netPaymentTerm, with a paymentDuePeriod field (example "P30D"). (50b0d6d5)
  • client-agent-registry: Agent Registry's Public Preview release (632ae479)
  • client-kafka: MSK Clusters can now deliver authorizer logs alongside broker logs to the destinations defined by you (b7e31937)
  • client-bedrock-agentcore: Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider. (bd301533)
  • client-auto-scaling: EC2 Auto Scaling now supports being managed by other AWS services via the operator field. (f5d54fce)
  • client-ec2: Adds a new optional IncludeLocalZones parameter to the Spot Placement Score API that defaults to false. When set to true, the Spot Placement Score API will consider the relevant Local Zones with Spot capacity when computing the Spot Placement Score. (43673842)
  • client-marketplace-discovery: GetOfferTerms now returns netPaymentTerm in offerTerms, specifying payment due period after invoice date. The paymentDuePeriod field uses ISO 8601 duration format (e.g., "P30D" for net 30 days). This is a backward-compatible addition. See API documentation for full structure and examples. (f4fd7ae7)
  • client-s3: AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. (faf65602)

For list of updated packages, view updated-packages.md in assets-3.1105.0.zip

v3.1104.0

3.1104.0(2026-08-05)

New Features
  • client-deadline: AWS Deadline Cloud now reports persistent volume costs alongside compute and license costs. Customers can view per-fleet storage costs in Usage Explorer by selecting the Usage Type grouping, helping them better understand the costs of their infrastructure. (f6649b9d)
  • client-bedrock-agentcore-control: Adding support for fine-grained access control for AgentCore Memory through managed AgentCore Gateway HTTP Connectors. (448fc0f7)
  • client-glue: Added the PutDataCatalogExportConfiguration to export Glue Data Catalog metadata to systems tables stored in S3 Tables. (31c69446)
  • client-acm-pca: Private Certificate Authority service now supports RSASSA-PSS signing algorithm. (203b57d1)
  • client-ecs: New enum values added for Agent Connectivity issues (13e0f989)

For list of updated packages, view updated-packages.md in assets-3.1104.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1105.0 (2026-08-06)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1104.0 (2026-08-05)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1103.0 (2026-08-04)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1102.0 (2026-08-03)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1101.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1100.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1099.0 (2026-07-30)

... (truncated)

Commits

Updates next from 16.2.12 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 3…
8b4460b 
… updates

Bumps the minor-and-patch group with 3 updates in the / directory: [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react), [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) and [next](https://github.com/vercel/next.js).


Updates `@assistant-ui/react` from 0.14.29 to 0.15.8
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/HEAD/packages/react)

Updates `@aws-sdk/lib-storage` from 3.1096.0 to 3.1105.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1105.0/lib/lib-storage)

Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.0)

---
updated-dependencies:
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-storage"
  dependency-version: 3.1105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Aug 10, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b4460b69b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread package.json
"@ai-sdk/openai": "~3.0.74",
"@ai-sdk/react": "~3.0.210",
"@assistant-ui/react": "^0.14.23",
"@assistant-ui/react": "^0.15.8",

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate the root Bun lockfile

In CI and container builds, this dependency bump leaves bun.lock out of sync: the lockfile still records @assistant-ui/react at ^0.14.23/0.14.23, @aws-sdk/lib-storage at 3.1096.0, and next at 16.2.12, while .github/workflows/ci.yml:36-37 and Dockerfile:15-21 both install with bun install --frozen-lockfile. With these package.json changes alone, the frozen install cannot use the committed lockfile for the new versions and fails during dependency installation, so CI/builds are blocked until the root bun.lock is updated in the same commit.

Useful? React with 👍 / 👎.

@krishagel Claude

krishagel commented Aug 10, 2026

Copy link
Copy Markdown
Member

🤖 pr-fix routine: blocked — cannot regenerate the lockfile in this environment

Diagnosis (confirmed, not a guess):

Four checks fail — Test, Lint, and Type Check, Validate CDK Infrastructure, Unified Content PostgreSQL Lifecycle, and Auth Edge Production Artifact. All four die on the same step, bun install --frozen-lockfile:

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile and commit the updated lockfile

This PR modifies only package.json (3 bumps) and does not touch bun.lock, which still pins all three old versions:

Package package.json (this PR) bun.lock (unchanged)
next 16.3.0 16.2.12
@assistant-ui/react ^0.15.8 0.14.23
@aws-sdk/lib-storage 3.1105.0 3.1096.0

So bun install --frozen-lockfile is correctly refusing. CI on dev at this PR's exact base commit (e39c3f5) is green, so this is PR-caused, not a pre-existing base-branch failure.

The fix is one command — bun install at the repo root, then commit the updated bun.lock. I could not run it: registry.npmjs.org is not in this session's egress allowlist (403 on all three packages), and a lockfile entry requires the package's real sha512 integrity hash from the registry. I will not fabricate one.

Systemic root cause — this is the 10th open PR blocked the same way.

.github/dependabot.yml still declares package-ecosystem: "npm" for both / and /infra. This repo has no package-lock.json or yarn.lock — it uses bun.lock. Dependabot's npm ecosystem edits package.json only and cannot update bun.lock, so every Dependabot JS PR desyncs the lockfile and fails --frozen-lockfile.

Currently blocked on this exact cause: #1566, #1567, #1570, #1571, #1572, #1573, #1574, #1575, #1576, and this one. (#1561 and #1563 are stuck for unrelated reasons; #1562, #1564, #1597 are green and just awaiting review.)

This was already reported on #1566 on Aug 4 and the config is unchanged, so I'm escalating rather than repeating it per-PR. Two options for a human:

  1. Per-PR: run bun install on each branch and push the lockfile.
  2. Once, permanently: switch .github/dependabot.yml to package-ecosystem: "bun" for both directories so Dependabot maintains bun.lock itself. I deliberately did not make this change — it reshapes every future dependency PR, it would not fix this PR (dependabot config only takes effect for newly-created PRs after it merges to the default branch), and I can't validate it from here. That should be your call.

A third option, if you want this routine to fix these itself: add registry.npmjs.org to the routine environment's network egress allowlist, and I can regenerate lockfiles directly on future fires.

The routine will not pick this PR up again until someone removes the pr-fix-stuck label.

Generated by Claude Code

@krishagel krishagel added the pr-fix-stuck pr-fix routine gave up — human attention needed label Aug 10, 2026 — with Claude
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code pr-fix-stuck pr-fix routine gave up — human attention needed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@krishagel