[dependabot]

Bumps the js-npm group in /crates/bashkit-js with 5 updates:

Package	From	To
@langchain/core	1.3.0	1.3.2
@types/node	26.6.5	26.6.6
ava	8.1.1	8.2.0
oxlint	1.89.0	1.90.0
@napi-rs/wasm-runtime	1.2.5	1.2.6

Updates @langchain/core from 1.3.0 to 1.3.2

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.3.2

Patch Changes

• #12051 71fd01a Thanks @​thushanth-bengre-langchain! - feat(core): add addNotificationMetadata, getNotificationMetadata and the NotificationMetadata type for marking messages the agent harness adds.

@​langchain/core@​1.3.1

Patch Changes

• #12026 178af31 Thanks @​eliornl! - fix(core): deliver callbacks once to a handler registered twice by merged configs

  Merging two runnable configs that both carry the same callback handler, as happens when an agent's streamEvents() runs inside a LangGraph node with tracing on, registered that handler twice, so it received every callback twice: every streamed chunk arrived twice. The configured callback manager now keeps each handler once, in order, including a handler passed as a plain object of methods that merged configs wrapped twice.

• #12042 50343ba Thanks @​sera-wi! - fix(core): include node metadata in Graph.toJSON() output when set, matching Python

• #12048 304d190 Thanks @​sera-wi! - fix(core): escape drawMermaid node metadata labels and leave out object values, so metadata with brackets or objects no longer breaks Mermaid parsing

Commits

• 4fafaba chore: version packages (#12068)
• 71fd01a feat(core): add addNotificationMetadata and getNotificationMetadata (#12051)
• e8c5dc8 chore: version packages (#12047)
• b5135cc feat(openai,langchain): support Decisions API and agent middleware (#11930)
• 52d2ba8 fix(aws): use this.caller in ChatBedrockConverse to support retries (#11463)
• 178af31 fix(core): deliver callbacks once to a handler registered twice by merged con...
• 304d190 fix(core): make drawMermaid node metadata labels safe (#12048)
• 50343ba fix(core): include node metadata in Graph.toJSON() (#12042)
• d1d0692 chore: version packages (#12044)
• 95b191b feat(openai): refresh model profiles from models.dev (#12046)
• Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates ava from 8.1.1 to 8.2.0

Release notes

Sourced from ava's releases.

v8.2.0

What's Changed

• Improve t.throws message when function doesn't throw by @​nightt5879 in avajs/ava#3462
• Fix assertion property when snapshot comparisons fail; fix code comment typos by @​maxtaran2010 in avajs/ava#3465
• Report timeouts without crashing the TAP reporter by @​tianrking in avajs/ava#3471
• Guard against undefined variable when test file selection throws by @​tsushanth in avajs/ava#3473
• Fix TAP reporter assertion locations by @​deepanshupal in avajs/ava#3485

New Contributors

• @​nightt5879 made their first contribution in avajs/ava#3462
• @​maxtaran2010 made their first contribution in avajs/ava#3465
• @​tianrking made their first contribution in avajs/ava#3471
• @​tsushanth made their first contribution in avajs/ava#3473
• @​deepanshupal made their first contribution in avajs/ava#3485

Full Changelog: avajs/ava@v8.1.2...v8.2.0

v8.1.2

This is a patch release to fix some npm metadata.

What's Changed

• Switch back to long-hand form for the package.json repository field by @​novemberborn in avajs/ava#3502

Full Changelog: avajs/ava@v8.1.1...v8.1.2

Commits

• 8640039 v8.2.0
• 9d3cd5d Fix TAP reporter assertion locations (#3485)
• 1a53961 Guard against undefined variable when test file selection throws
• 8293ce3 Report timeouts without crashing the TAP reporter
• a967e2f Fix typos in source code and comments (#3465)
• fdc858c Improve t.throws message when function doesn't throw (#3462)
• 95297b6 v8.1.2
• 1259f84 Switch back to long-hand form for the package.json repository field (#3502)
• See full diff in compare view

Updates oxlint from 1.89.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

• cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

• 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
• 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
• e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
• f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
• 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
• 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• See full diff in compare view

Updates @napi-rs/wasm-runtime from 1.2.5 to 1.2.6

Commits

• 4fff029 chore(release): publish
• aa02eb5 fix(wasm-runtime): align bundled plugins with exact emnapi peers (#3650)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	a575b9e	Commit Preview URL Branch Preview URL	Nov 02 2026, 09:51 AM