chore(deps): bump the minor-and-patch group across 1 directory with 36 updates

[dependabot]

Bumps the minor-and-patch group with 36 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.107.0	0.122.0
@sentry/nextjs	10.62.0	10.72.0
@supabase/ssr	0.12.0	0.12.5
@supabase/supabase-js	2.108.2	2.112.4
@upstash/redis	1.38.0	1.38.3
dompurify	3.4.13	3.4.14
driver.js	1.6.0	1.8.0
groq-sdk	1.3.0	1.6.0
idb-keyval	6.2.6	6.3.0
next	16.2.12	16.3.3
next-intl	4.13.0	4.14.1
sharp	0.35.2	0.35.4
sonner	2.0.7	2.0.8
swagger-ui-react	5.32.6	5.32.14
@emnapi/core	1.11.1	1.11.3
@emnapi/runtime	1.11.1	1.11.3
@next/env	16.2.9	16.3.3
@playwright/test	1.61.1	1.62.1
@testing-library/react	16.3.2	16.3.3
@typescript-eslint/eslint-plugin	8.62.1	8.68.0
@typescript-eslint/parser	8.62.1	8.68.0
@vitest/coverage-v8	4.1.9	4.1.11
autoprefixer	10.5.2	10.5.4
eslint-config-next	16.2.11	16.3.3
lint-staged	17.2.0	17.4.1
tree-sitter	0.25.0	0.25.1
ts-jest	29.4.11	29.4.12
vitest	4.1.9	4.1.11
web-tree-sitter	0.26.10	0.26.13
@esbuild/linux-x64	0.28.1	0.28.2
@img/sharp-linux-x64	0.35.2	0.35.4
@parcel/watcher-darwin-arm64	2.5.6	2.6.0
@parcel/watcher-darwin-x64	2.5.6	2.6.0
@parcel/watcher-linux-x64-glibc	2.5.6	2.6.0
@parcel/watcher-linux-x64-musl	2.5.6	2.6.0
@swc/core-linux-x64-gnu	1.15.43	1.16.1

Updates @anthropic-ai/sdk from 0.107.0 to 0.122.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.122.0

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

sdk: v0.121.0

0.121.0 (2026-08-26)

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

Bug Fixes

• tools: keep the tool runner going on pause_turn (#288) (f040dc9)
• types: don't reference NodeJS.ProcessEnv from published types (#367) (fd38dfd)

Chores

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

  The beta Files and Skills namespaces (client.beta.files, client.beta.skills) no longer send the files-api-2025-04-14 / skills-2025-10-02 headers and return the same shapes as client.files / client.skills (with Beta-prefixed type names). Requests that still send those headers on raw HTTP keep receiving the beta shapes.

  Changes in the beta namespaces:

  • client.beta.skills.delete() now deletes a Skill together with all of its versions (previously refused while any version existed). It returns BetaDeletedSkill (was SkillDeleteResponse).
  • Beta Messages type BetaSkill (the {type, skill_id, version} entry in BetaContainer.skills) is renamed BetaContainerSkill; the request-side BetaSkillParams keeps its name. BetaSkill now names the Skill object returned by client.beta.skills.create() / retrieve() / list() (replacing SkillCreateResponse / SkillRetrieveResponse / SkillListResponse), and skill versions are BetaSkillVersion / BetaDeletedSkillVersion (replacing Version*Response).
  • client.beta.files.list() returns a BetaFileMetadataPageCursor (PageCursor<BetaFileMetadata> with data / next_page) and FileListParams paginates with page / ids (was BetaFileMetadataPage, a Page<BetaFileMetadata> with data, has_more, first_id, last_id and before_id / after_id); for await auto-pagination is unchanged. BetaSkill uses display_name (was display_title, also in SkillCreateParams) and latest_version_id (was latest_version), and BetaSkillVersion is addressed by its skver_… id (the Unix-timestamp version field is gone).

  Migration guides: Migrate from files-api-2025-04-14 · Migrate from skills-2025-10-02

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

0.121.0 (2026-08-26)

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

... (truncated)

Commits

• 7f3898c chore: release main
• 956ccb5 docs(api): clarify pagination on the organization rate-limit list endpoints
• 2131d80 fix(tools): let read return a view_range of a file over the size cap (#427)
• f830c8f fix(aws,bedrock): prefer env credentials over AWS_PROFILE (#436)
• 4d50ddf test(ecosystem): expect cross-realm timeout errors to classify correctly
• acdd669 fix(client): classify cross-realm DOMException abort/timeout errors correctly
• 0a14622 test(tools): pin that read, edit and the memory tool preserve CRLF and CR lin...
• 17035de docs: document TypeScript 5.0 as the minimum supported version
• 2f95d8a fix(client): use configured logger for SSE parse errors
• 33f5103 feat(api): beta files/skills namespaces use GA shapes; drop dated beta header...
• Additional commits viewable in compare view

Updates @sentry/nextjs from 10.62.0 to 10.72.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

• chore(v10): Add external contributor to CHANGELOG.md (#23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.1 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.28 KB
@​sentry/browser (incl. Tracing, Profiling)	50.17 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.83 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

• chore(v10): Add external contributor to CHANGELOG.md (#23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

10.71.0

Important Changes

• feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

• feat(v10/core): Deprecate scope.clear() method (#23231)
• fix(v10/core): Bound child span tracking on long-lived spans (#23406)

... (truncated)

Commits

• 0d23628 release: 10.72.0
• ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
• f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
• 7917b0d feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737)
• b61e912 fix(v10/node): Only end the process session when it is still ok (#23731)
• 4316785 test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)
• e09fdf8 fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• 817056d test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• 83c644d fix(v10/server-utils): Stop shipping orchestrion bundler plugins as productio...
• 04a52dd fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.0 to 0.12.5

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

• warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

• docs: add React Router middleware example by @​sornapudisuresh in supabase/ssr#274
• build(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 by @​dependabot[bot] in supabase/ssr#280
• build(deps): bump postcss from 8.5.15 to 8.5.25 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in supabase/ssr#281
• chore: update @​supabase/supabase-js to v2.112.3 by @​supabase-libs-pr-manager[bot] in supabase/ssr#282
• chore: update @​supabase/supabase-js to v2.112.4 by @​supabase-libs-pr-manager[bot] in supabase/ssr#285
• fix: warn when auth.storage is ignored by createBrowserClient/createServerClient by @​mandarini in supabase/ssr#284

New Contributors

• @​sornapudisuresh made their first contribution in supabase/ssr#274

Full Changelog: supabase/ssr@v0.12.4...v0.12.5-rc.154

v0.12.4

0.12.4 (2026-07-28)

Bug Fixes

• flush PKCE verifier slot removals on the server (#275) (6df6f03)

v0.12.4-rc.146

What's Changed

• chore: update @​supabase/supabase-js to v2.110.6 by @​supabase-libs-pr-manager[bot] in supabase/ssr#265
• chore: update @​supabase/supabase-js to v2.110.7 by @​supabase-libs-pr-manager[bot] in supabase/ssr#267
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in supabase/ssr#268
• docs: set up typedoc by @​mandarini in supabase/ssr#266
• chore: update @​supabase/supabase-js to v2.110.8 by @​supabase-libs-pr-manager[bot] in supabase/ssr#269
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in supabase/ssr#272
• build(deps): bump pnpm/action-setup from 6.0.5 to 6.0.9 by @​dependabot[bot] in supabase/ssr#271
• build(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in supabase/ssr#270
• chore: update @​supabase/supabase-js to v2.110.9 by @​supabase-libs-pr-manager[bot] in supabase/ssr#273
• fix: flush PKCE verifier slot removals on the server by @​mandarini in supabase/ssr#275

Full Changelog: supabase/ssr@v0.12.3...v0.12.4-rc.146

v0.12.3

0.12.3 (2026-07-14)

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.5 (2026-08-24)

Bug Fixes

• warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

0.12.4 (2026-07-28)

Bug Fixes

• flush PKCE verifier slot removals on the server (#275) (6df6f03)

0.12.3 (2026-07-14)

Bug Fixes

• cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

0.12.2 (2026-07-14)

Bug Fixes

• align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

0.12.1 (2026-07-13)

Bug Fixes

• cookies: deduplicate server cookie writes (#246) (035eabe)

Commits

• c5310fd chore(main): release 0.12.5 (#286)
• c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
• b4797e3 chore: update @​supabase/supabase-js to v2.112.4 (#285)
• 6f5bc21 chore: update @​supabase/supabase-js to v2.112.3 (#282)
• 35187b2 build(deps): bump postcss from 8.5.15 to 8.5.25 in the npm_and_yarn group acr...
• 1b761fd build(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 (#280)
• 69a6209 docs: add React Router middleware example (#274)
• 50e3409 chore(main): release 0.12.4 (#276)
• e17f546 chore: update @​supabase/supabase-js to v2.111.0 (#277)
• 6df6f03 fix: flush PKCE verifier slot removals on the server (#275)
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.108.2 to 2.112.4

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.4

2.112.4 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)
• postgrest: move override fixtures out of generated types, repair codegen (#2605)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.3

2.112.4-canary.3 (2026-08-24)

🩹 Fixes

• auth: warn on deprecated lock option and prevent unhandled refresh rejection (#2627)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.112.4-canary.2

2.112.4-canary.2 (2026-08-24)

🩹 Fixes

• auth: convert stolen-lock AbortError when acquireTimeout is 0 (#2616)
• realtime: respect custom logger for send() REST fallback warning (#2612)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• mmustafasenoglu @​mmustafasenoglu

v2.112.4-canary.1

2.112.4-canary.1 (2026-08-12)

This was a version bump only, there were no code changes.

v2.112.4-canary.0

2.112.4-canary.0 (2026-08-11)

🩹 Fixes

• postgrest: move override fixtures out of generated types, repair codegen (#2605)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.3 (2026-08-11)

🩹 Fixes

• supabase: improve trace propagation sampling and diagnostics (#2604)
• supabase: add trace context headers to canonical CORS allow-list (#2603)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

• supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

• supabase: forward db retry option (#2571)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

... (truncated)

Commits

• c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
• bbc167c chore(release): version 2.112.3 changelogs (#2608)
• e44447c fix(supabase): improve trace propagation sampling and diagnostics (#2604)
• 9f0358c fix(supabase): add trace context headers to canonical CORS allow-list (#2603)
• 84beab1 chore(release): version 2.112.2 changelogs (#2599)
• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
• a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
• Additional commits viewable in compare view

Updates @upstash/redis from 1.38.0 to 1.38.3

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.3

Patch Changes

• f020866: Send an Upstash-Telemetry-Retry header with the retry count on retried requests so retry rates are visible in server-side telemetry
• 777dc30: Trim telemetry header values before deduplicating so whitespace around existing values does not defeat the dedup check

@​upstash/redis@​1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

What's Changed

• DX-2861: trim telemetry dedup values by @​ytkimirti in upstash/redis-js#1442

Full Changelog: https://github.com/upstash/redis-js/compare/@​upstash/redis@1.38.2...@​upstash/redis@1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

@​upstash/redis@​1.38.2

Patch Changes

• c0f5ad7: Deduplicate telemetry header values so repeated mergeTelemetry calls no longer append the same sdk, platform or runtime tag multiple times

@​upstash/redis@​1.38.1

Patch Changes

• bd7a19f: Add a quick tip about creating a database via https://upstash.com/start-redis to the warnings shown when the Redis url or token is missing. On Cloudflare, the warning shown when both the url and the token are missing now names both wrangler secret put commands instead of only one.

Commits

• 74da1df chore: version packages (#1443)
• f020866 DX-2960: send Upstash-Telemetry-Retry header with the attempt number (DX-2960...
• 777dc30 fix: trim telemetry values before dedup and cover distinct-version case (#1442)
• fc3089b chore: version packages (#1441)
• c0f5ad7 fix: deduplicate telemetry header values in mergeTelemetry (#1440)
• e45fb78 chore: version packages (#1439)
• bd7a19f DX-2866: add start-redis tip to missing url/token warnings (#1438)
• 8cf6209 fix: stabilize flaky evalshaRo test by waiting for script replication
• 3024bb2 DX-2750: add ai sdk telemetry to redis search example (#1437)
• bf3f48a chore: add resource section to README (#1435)
• Additional commits viewable in compare view

Updates dompurify from 3.4.13 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

Updates driver.js from 1.6.0 to 1.8.0

Release notes

Sourced from driver.js's releases.

1.8.0

Added

• Hints: pulsing beacons that open a popover on click; overlay optional, the page stays interactive. driver.js/hints, ~5KB gzip. Guide. (#363)
• advanceOnClick (driver and step level) to advance the tour by clicking the highlighted element itself. (#606)
• waitForElement (driver and step level) to wait up to N ms for a step's element before treating it as missing. (#606)
• sideEffects field in package.json for better tree-shaking.

Changed

• Popover internals shared between tours and hints; tour behaviour verified unchanged against 1.7.0.
• Build migrated from vite to tsdown; artifact names, exports map and CDN globals unchanged, sizes within ±2%.

Fixed

• skipMissingElement: the last reachable step now shows Done and runs onDoneClick; step queries like isLastStep() account for skips. (#616)

1.7.0

Added

• skipMissingElement option to skip a step whose target element is missing (#489, #395)
• index on the options passed to every hook (#490)
• --driver-popover-font-family CSS variable to set the popover font (#607)

Changed

• The popover title and description now render in the default font stack. Set --driver-popover-font-family to use your own.

Fixed

• Icon fonts placed inside a step description are no longer overridden (#510, #512)
• Each driver() call keeps its own config, steps and state, (#571)
• Popover no longer jumps when its content has images that load after render.

Commits

• ccc94cb 1.8.0
• b93a4fc Add advanceOnClick and waitForElement
• ab56c56 Fix missing step and button texts #616
• 3821035 Increase beacon indicator size
• 8678291 Refactor tests
• e2aa992 Reorganize internals and unify step popover
• b4d221f Add onButtonClick to take over the hint button
• 09484c7 Clean up the hints module
• 95df19e Give the hint popover and its arrow one seamless shadow
• 24763f9 Anchor overlay-mode hints to the element and enlarge the hint arrow
• Additional commits viewable in compare view

Updates groq-sdk from 1.3.0 to 1.6.0

Release notes

Sourced from groq-sdk's releases.

v1.6.0

1.6.0 (2026-08-25)

Full Changelog: v1.5.0...v1.6.0

Features

• chat: add Qwen3.8 reasoning guidance (c2b0264)

Chores

• GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.yaml [skip ci] (99fc8ef)
• GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (8d224a0)
• GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (2c5b7aa)
• internal: allow the mock server port to be set with STAINLESS_MOCK_PORT (90cec2d)

Styles

• chat: format completion params union (

[deepsource-io]

DeepSource Code Review

We reviewed changes in 6e22da7...f1e7101 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Sep 1, 2026 12:20a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.