chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@ai-sdk/anthropic (source)	3.0.92 → 3.0.96
@ai-sdk/google (source)	3.0.88 → 3.0.91
@ai-sdk/openai (source)	3.0.80 → 3.0.84
@commitlint/cli (source)	21.2.0 → 21.2.1
@types/node (source)	25.9.4 → 25.9.5
@vitest/coverage-v8 (source)	4.1.9 → 4.1.10
ai (source)	6.0.219 → 6.0.224
harper (source)	5.1.15 → 5.1.18
hono (source)	4.12.27 → 4.12.29
oxlint (source)	1.72.0 → 1.73.0
semantic-release	25.0.5 → 25.0.6
tsx (source)	4.22.5 → 4.23.0
vitest (source)	4.1.9 → 4.1.10

---

Release Notes

vercel/ai (@​ai-sdk/anthropic)

v3.0.96

Compare Source

v3.0.95

Compare Source

v3.0.94

Compare Source

Patch Changes

• 0952964: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose secureJsonParse from provider-utils.
• 764baab: Normalize a bare https://api.anthropic.com base URL to include /v1.
• Updated dependencies [0952964]
  • @​ai-sdk/provider-utils@​4.0.36

v3.0.93

Compare Source

vercel/ai (@​ai-sdk/google)

v3.0.91

Compare Source

Patch Changes

• bbac4da: Fix Google tool result conversion to send file data as inline data instead of JSON text on the legacy tool-result path.
• 3fda3bc: Expand standalone Google threshold provider options into safety settings.
• e1af05f: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation
• Updated dependencies [e1af05f]
  • @​ai-sdk/provider@​3.0.14
  • @​ai-sdk/provider-utils@​4.0.38

v3.0.90

Compare Source

Patch Changes

• b585445: Backport Gemini Interactions video output parsing and per-modality output token breakdown for AI SDK v6.
• 1825ecc: Backport vertex.interactions() for the Gemini Interactions API on Vertex AI for AI SDK v6.
• afee362: Pass documented Gemini external HTTPS file URLs through without downloading them.
• 327642b: fix: more precise default message for tool execution denial
• Updated dependencies [d559de9]
  • @​ai-sdk/provider-utils@​4.0.37

v3.0.89

Compare Source

Patch Changes

• 0952964: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose secureJsonParse from provider-utils.
• f0bfb31: Fix Google embedding batch size to respect the Gemini API limit of 100 requests per batch.
• Updated dependencies [0952964]
  • @​ai-sdk/provider-utils@​4.0.36

vercel/ai (@​ai-sdk/openai)

v3.0.84

Compare Source

v3.0.83

Compare Source

v3.0.82

Compare Source

v3.0.81

Compare Source

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.1

Compare Source

Note: Version bump only for package @​commitlint/cli

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

vercel/ai (ai)

v6.0.224

Compare Source

v6.0.223

Compare Source

v6.0.222

Compare Source

Patch Changes

• e1af05f: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation
• Updated dependencies [2bfb16a]
• Updated dependencies [34b5acc]
• Updated dependencies [e1af05f]
• Updated dependencies [1ce0d1c]
  • @​ai-sdk/gateway@​3.0.146
  • @​ai-sdk/provider@​3.0.14
  • @​ai-sdk/provider-utils@​4.0.38

v6.0.221

Compare Source

v6.0.220

Compare Source

Patch Changes

• 158d027: Sort tool results by their tool call order when converting generation output to response messages.
• eb3cdd9: Fix extractJsonMiddleware preserving leading whitespace in the final streamed text suffix when no markdown fence prefix was stripped.
• Updated dependencies [7dea716]
• Updated dependencies [4f7fe37]
• Updated dependencies [0952964]
  • @​ai-sdk/gateway@​3.0.144
  • @​ai-sdk/provider-utils@​4.0.36

harperfast/harper (harper)

v5.1.18

Compare Source

Blob replication reliability

• Blob apply loop could freeze on wire-carried save flags (#​1641) — the apply path gated a receiver's commit on the sender's in-flight save state, which could freeze the whole apply loop if that stream stalled. Apply commits are no longer gated on those flags at all; instead, a local write with a fresh blob now gates its own commit on the blob's durable save, so a record can no longer commit (and replicate) a not-yet-durable blob reference.
• Cache record headers could be corrupted after a shared response body (#​1709) — mutating a cached record's headers/status in finalizeResponse could mutate the live cached record itself when the response body was shared, corrupting future reads of that record. The response path now copies before mutating.

Fleet upgrade & deployment

• Graceful worker-shutdown drain hook (#​1621) — adds a registry (registerShutdownDrain) that lets in-flight work (e.g. in-progress blob sends) finish before a worker thread exits, instead of being cut off mid-transfer during a rolling restart or upgrade.
• Deploy could silently truncate the tarball on a dangling symlink (#​1718) — deploy_component reported success even when a dangling symlink caused the packaging walker to stop early and drop every entry queued after it. The packager now pre-scans for dangling symlinks and excludes just those, instead of the walk bailing out silently.
• Docker entrypoint exec-format error on 5.1.x (#​1619) — the container entrypoint could be written empty via a RUN heredoc redirect, producing an exec format error at startup. It's now written via a COPY heredoc so the image boots reliably.
• npm latest/next dist-tags could be stolen by an older release line (#​1690) — publishing any release moved the latest/next tag regardless of version, so a 5.0.x patch published after a 5.1.x release could steal latest back onto 5.0.x. The tag now only moves forward for the line it belongs to.
• Periodic re-read safety net for the TLS cert watcher (#​1394) — adds a polling fallback alongside the filesystem watcher so a missed cert-rotation event (e.g. from certain volume mounts) doesn't leave a node running on a stale certificate indefinitely.

MQTT

• Shared MQTT port across workers (#​1603) — workers now share the MQTT listener port (except on macOS), so MQTT works correctly on multi-worker instances.

MCP

• Missing MCP-Protocol-Version header on an established session no longer 400s (#​1694) — clients that negotiated a newer protocol version but omit the header on individual requests (permitted by spec) were incorrectly rejected. The session's already-negotiated version is now used when the header is absent.
• Static plugin serving nothing when urlPath is configured (#​1584) — fixes a static-file plugin regression where a configured urlPath resulted in no files being served.

Also in this release

• threads.preload config to preload modules (e.g. APM agents) on worker threads (#​1569).
• fix(queue): waitForDrain no longer hangs if the queue empties without emitting a drained event (#​1643).

Full Changelog: HarperFast/harper@v5.1.17...v5.1.18

v5.1.17

Compare Source

Replication & blob reliability

• Blob catch-up no longer 404s mid-transfer (#​1563) — an in-flight replication blob receive now returns 503 instead of 404. A receiver catching up on a blob that is still streaming retries cleanly instead of treating it as permanently missing and advancing past it.

Fleet upgrade & deployment

• Docker entrypoint exec-format error on 5.1.x (#​1619) — the container entrypoint could be written empty via a RUN heredoc redirect, producing an exec format error at startup. It is now written via a COPY heredoc so the image boots reliably.
• Ship npm-shrinkwrap.json in the published package (#​1623) — locks the published dependency tree so installs of the release resolve a reproducible set of dependencies.

MQTT

• Shared MQTT port across workers (#​1603) — workers now share the MQTT listener port (except on macOS), so MQTT works correctly on multi-worker instances.

Full Changelog: HarperFast/harper@v5.1.15...v5.1.17

honojs/hono (hono)

v4.12.29

Compare Source

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in #​5092
• chore: fix no-op tsc in test script by @​yusukebe in #​5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in #​5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in #​5081
• test(workerd): add compatibilityDate by @​yusukebe in #​5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in #​5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in #​5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in #​5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in #​5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in #​5084

New Contributors

• @​codebybilal18 made their first contribution in #​5081
• @​Arman-Luthra made their first contribution in #​5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

Compare Source

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in #​5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in #​5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in #​5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in #​5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in #​5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in #​5059
• chore: bump devDependencies by @​yusukebe in #​5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in #​5033
• docs(context-storage): fix JSDoc by @​yusukebe in #​5086

New Contributors

• @​EduardF1 made their first contribution in #​5047
• @​greymoth-jp made their first contribution in #​5059
• @​VihaanAgarwal made their first contribution in #​5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

oxc-project/oxc (oxlint)

v1.73.0

Compare Source

🚀 Features

• a2c97f3 linter/unicorn: Implement explicit-timer-delay rule (#​23612) (Mikhail Baev)
• 85735cb linter/unicorn: Implement no-confusing-array-with rule (#​23638) (Shekhu☺️)
• cb4fbb9 linter/eslint: Implement no-unreachable-loop rule (#​23975) (Todor Andonov)
• dc32112 linter/eslint/no-constant-binary-expression: Check relational comparisons (#​24088) (camc314)
• d963967 linter/unicorn/no-array-sort: Add allowAfterSpread option (#​24043) (Boshen)
• 0a75682 linter: Add per-rule timings for type-aware linting (#​22488) (camchenry)
• 743e222 linter/react: Add disallowedValues option for forbid-dom-props rule (#​23970) (Mikhail Baev)

🐛 Bug Fixes

• bdb51c7 linter/jest/prefer-ending-with-an-expect: Validate config patterns (#​24122) (camc314)
• 45d607d linter/react/forbid-component-props: Make allow/disallow lists optional in schema (#​24024) (Boshen)

semantic-release/semantic-release (semantic-release)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

privatenumber/tsx (tsx)

v4.23.0

Compare Source

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #​809 hi#signal privatenumber/tsx#145 #​809

---

This release is also available on:

• npm package (@​latest dist-tag)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dawsontoth]

Reviewed via scheduled Renovate triage. CI shows one failing test — ink/main.test.tsx > MainConfig > completes the walkthrough for Anthropic and updates .env (expected writeFileSync to be called). I cloned the branch and ran it locally: the full suite passes 345/345, and that specific test passed 3/3 on repeat runs. It's a flaky async-timing assertion (vi.waitFor on writeFileSync), not a real regression, and the diff is lockfile-only transitive bumps. Re-running the Test job should clear it — not requesting changes. 🤖

[github-actions]

🎉 This PR is included in version 0.16.25 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀