deps: this week's minor and patch updates, measured together

[irparent]

What this changes

This week's minor and patch dependency updates in one change, measured together, in place of eleven separate pull requests. Each lockfile was regenerated on Linux (node:24, --package-lock-only), so it carries every platform's optional packages.

Where	Update	Covers
root	@modelcontextprotocol/sdk 1.30.1 → 1.32.0 (the newest in range)	#821
root	@typescript-eslint/eslint-plugin and parser 8.70.1 → 8.71.0	#816
root	vitest and @vitest/coverage-v8 5.0.2 → 5.0.3 (installed together: the coverage plugin pins vitest exactly)	#819
dashboard/	@typescript-eslint/parser 8.70.1 → 8.71.0, and its plugin with it, so the lockfile holds one copy of the family rather than two	#815
dashboard/	@storybook/react-vite and @storybook/addon-docs 10.6.0 → 10.6.1	#820, #823
dashboard/	lucide-react 1.47.0 → 1.52.0	#824
website/	next and eslint-config-next 16.3.6 → 16.3.8	#825
website/	framer-motion 13.4.4 → 13.5.1	#826
packages/sdk/	@anthropic-ai/sdk 0.131, ai 7.0.127, openai 7.27 (test-time only; the peer ranges users install against are unchanged)	#827
packages/langchain/	@langchain/core 1.2.13 → 1.2.14 (test-time only; the peer range is unchanged)	#817

The three major updates come separately: TypeScript 6.0 for the root and the SDK (#822, #828), and Vitest 5 for the dashboard (#818).

Checks

All run in a worktree with these lockfiles freshly installed (npm ci in each of the five directories), not against an older install:

• The truthbase was captured with these dependencies: 4,772 of 4,772 root tests pass, with nothing skipped. claims:generate reports no change.
• Lint and typecheck pass for the root (lint, typecheck, typecheck:tests), the dashboard, the website, the SDK (typecheck and build) and the LangChain handler.
• Every claims, schema, proof and version check exits 0, run unpiped.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 4, 2026 10:24am UTC

[github-actions]

Iris gate — 1 of 2 tripped --fail-on detector_veto

iris-eval ingest: 3 stored, 1 tripped --fail-on detector_veto (2 of 3 evaluated in dataset "release-gate")

Trace	Verdict	Basis	Rules, classes or missing inputs	Evidence
507da3de3d64d918a4fac9d9e606e235	failed	detector_veto + risk_over_loss	no_pii, pii_leak, credential_leak	no_pii: AWS Access Key (output 45–65)

Verdict basis	Traces
detector_veto	2
clean	1

Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean}

[github-actions]

Iris gate — 1 stored, nothing tripped --fail-on any

iris-eval ingest: 1 stored, 0 tripped --fail-on any

Verdict basis	Traces
clean	1

Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean}