Skip to content

deps: Bump the dev-tooling group across 1 directory with 28 updates - #18

Closed
dependabot[bot] wants to merge 148 commits into
mainfrom
dependabot/npm_and_yarn/dev-tooling-cfed3acbf0
Closed

dependabot[bot] wants to merge 148 commits into
mainfrom
dependabot/npm_and_yarn/dev-tooling-cfed3acbf0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026 •

Copy link
Copy Markdown

Bumps the dev-tooling group with 28 updates in the / directory:

Package From To
@biomejs/biome 1.9.4 2.5.10
tsx 4.22.4 4.23.12
typescript 5.9.3 7.0.2
zod 3.25.76 4.4.3
@types/node 24.13.2 26.2.0
@modelcontextprotocol/sdk 1.29.0 1.30.0
chokidar 4.0.3 5.0.0
esbuild 0.24.2 0.28.2
astro 6.4.8 7.2.4
@astrojs/check 0.9.9 0.9.10
ws 8.21.0 8.21.3
@codemirror/lang-markdown 6.5.0 6.5.2
@dagrejs/dagre 1.1.8 3.1.1
@tiptap/extension-link 2.27.2 3.30.3
@tiptap/pm 2.27.2 3.30.3
@tiptap/react 2.27.2 3.30.3
@tiptap/starter-kit 2.27.2 3.30.3
@uiw/react-codemirror 4.25.10 4.25.11
@xyflow/react 12.11.0 12.11.3
markdown-it 14.2.0 15.0.0
react 18.3.1 19.2.8
@types/react 18.3.31 19.2.18
react-dom 18.3.1 19.2.8
@types/react-dom 18.3.7 19.2.5
react-router-dom 6.30.4 7.18.2
@types/markdown-it 14.1.2 14.2.0
@vitejs/plugin-react 6.0.2 6.1.0
vite 8.0.16 8.2.2

Updates @biomejs/biome from 1.9.4 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
    <Component /* c */ client:load />
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
    <div class={/* a note */}>x</div>
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
    <div>{/* only a comment */}</div>
  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
      <p>a</p>
    </>
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
    const a = "</script>";
    // </script> in a comment
    ---
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
    <Component /* c */ client:load />
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
    <div class={/* a note */}>x</div>
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
    <div>{/* only a comment */}</div>
  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
      <p>a</p>
    </>
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
    const a = "</script>";
    // </script> in a comment
    ---
  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

    <!-- c -->

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​biomejs/biome since your current version.


Updates tsx from 4.22.4 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes


This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

  • map Node test locations (2f55884)
  • support data URLs in tsImport (b94f46f)

This release is also available on:

v4.23.8

... (truncated)

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • b94f46f fix: support data URLs in tsImport
  • Additional commits viewable in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates zod from 3.25.76 to 4.4.3

Release notes

Sourced from zod's releases.

v4.4.3

Commits:

  • 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
  • 2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern
  • 9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)
  • b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)
  • f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3
  • 1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md

v4.4.2

Commits:

  • 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (#5901)
  • 20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps
  • 6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
  • 4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing
  • bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents
  • cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
  • 292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor
  • 1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion
  • 1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance
  • e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes
  • e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights
  • 905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing
  • bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md
  • 8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch
  • 02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (#5929)
  • 88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated baseUrl from tsconfig
  • c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2

v4.4.1

Commits:

  • 481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow
  • 95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations
  • cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (#5900)
  • edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1
  • 180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor

v4.4.0

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

... (truncated)

Commits
  • 1fb56a5 docs: document release procedure in AGENTS.md
  • f3c9ec0 4.4.3
  • c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent...
  • 1cab693 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 9195250 docs: remove Mintlify from bronze sponsors (churned)
  • 2c70332 docs: normalize bronze sponsor logos to github avatar pattern
  • 7391be8 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Updates @types/node from 24.13.2 to 26.2.0

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates chokidar from 4.0.3 to 5.0.0

Release notes

Sourced from chokidar's releases.

5.0.0

  • Make the package ESM-only. Reduces on-disk package size from ~150kb to ~80kb
  • Increase minimum node.js version to v20.19. The versions starting from it support loading esm files from cjs
  • fix: Make types more precise paulmillr/chokidar#1424
  • perf: re-use double slash regex paulmillr/chokidar#1435
  • Update readdirp to ESM-only v5
  • Lots of minor improvements in tests
  • Increase security of NPM releases. Switch to token-less Trusted Publishing, with help of jsbt
  • Switch compilation mode to isolatedDeclaration-based typescript for simplified auto-generated docs

New Contributors

Full Changelog: paulmillr/chokidar@4.0.3...5.0.0

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chokidar since your current version.


Updates esbuild from 0.24.2 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
    import Alias = Base.SomeType;
  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
    .a .b {
      & .b:not(& .c) {
        color: red;
      }
    }
    /* Old output (with --minify) */
    .a .b{.b:not(& .c){color:red}}
    /* New output (with --minify) */
    .a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
    function foo() {
      let x
      bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.


Updates astro from 6.4.8 to 7.2.4

Release notes

Sourced from astro's releases.

astro@7.2.4

Patch Changes

  • #17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

  • #17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

  • #17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.

  • #17703 771b0a9 Thanks @​astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig

  • Updated dependencies [05763a0, bc171af]:

    • @​astrojs/internal-helpers@​0.10.4
    • @​astrojs/markdown-satteri@​0.3.7
    • @​astrojs/markdown-remark@​7.2.4

astro@7.2.3

Patch Changes

  • #17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

  • #17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

  • #17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

  • #17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

    The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

    As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

  • #17723 c3b9aed Thanks @​florian-lefebvre! - Fixes a link in font providers JSDoc annotations

  • #17699 e28d227 Thanks @​ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.

    • When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
    • Two i18n configuration options were being used incorrectly in the examples.
    • The indentation of some code blocks was broken on hover.
  • #17572 2066f39 Thanks @​matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.

  • #17685 9f15609 Thanks @​astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js

  • #17636 51723b1 Thanks @​matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.

  • #17631 cf29bec Thanks @​matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.

  • Updated dependencies [8c193f6]:

    • @​astrojs/internal-helpers@​0.10.3
    • @​astrojs/markdown-remark@​7.2.3

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.4

Patch Changes

  • #17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

  • #17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

  • #17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.

  • #17703 771b0a9 Thanks @​astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig

  • Updated dependencies [05763a0, bc171af]:

    • @​astrojs/internal-helpers@​0.10.4
    • @​astrojs/markdown-satteri@​0.3.7
    • @​astrojs/markdown-remark@​7.2.4

7.2.3

Patch Changes

  • #17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

  • #17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

  • #17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

  • #17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

    The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

    As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

  • #17723

Codestz and others added 30 commits June 13, 2026 23:40
An adaptive agentic layer for Claude Code: right-sized orchestration,
SDLC specialists, and durable memory that compounds.

- 9 internal design docs (.docs/internal/01–09)
- Roster: 8 agents + 13 skills (incl. conducting) + references
- Conductor front door (/agentry) + 10 node commands
- Plugin assembly: .claude-plugin manifests, .mcp.json (mem), SessionStart primer hook
- pnpm monorepo: @agentry/core (typed contract) + @agentry/memory (scaffold)
- check-plugin gate, biome, tsconfig base, MIT license

Memory MCP implementation + benchmark harness are next; Workbench is V2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- .docs/internal/10-execution-roadmap.md: phased, acceptance-gated build plan (0→completion)
- CLAUDE.md: enforce the code bar (SRP, types-in-core, ports-and-adapters, right-sized) + standing rules
- @agentry/core: split index.ts into enums/memory/artifacts/events/config; index is a pure barrel
- plugin.json: add homepage + repository (github.com/Codestz/agentry)
- pnpm install: lockfile committed (node_modules gitignored)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Clean ports-and-adapters (domain → application → persistence → resolution → tools):
- domain: id (ULID + origin-qualified), ports, ranking, dedup
- resolution: two-root (global ~/.agentry + project) + scope→origin
- persistence: JSON file-store (source of truth) + in-memory node:sqlite/FTS5 index
  (rebuilt at startup — simpler than temp+swap; files remain truth)
- application: MemoryService (write+dedup-reinforce, recall+prime, search, update,
  feedback usefulness-signal, stats, episode_write) + flows (distill/consolidate, propose-only)
- tools: 9 thin MCP adapters + stdio server entry
- 5 node:test units green + headless stdio smoke (server lists all 9 tools)
- esbuild → committed dist/index.js (zero-install); check-plugin fully green

Roadmap (doc 10): Phase 1 done headless; live /mcp reload check pending. Phase 2 next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude Code spawns Node 22, whose bundled SQLite lacks FTS5 → the
`CREATE VIRTUAL TABLE … USING fts5` threw "no such module: fts5" → the mem
server exited on startup (MCP -32000).

Capability-first storage: try FTS5, fall back to a plain table + token scan
when absent. Verified write→recall round-trips on both node 24 (FTS5) and
node 22 (fallback). esbuild target → node22. dist rebuilt (lockstep).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Root .mcp.json double-loaded — once as the plugin config (CLAUDE_PLUGIN_ROOT
defined, works) and once as PROJECT config when working inside the agentry repo
(CLAUDE_PLUGIN_ROOT undefined → "Missing environment variables" → -32000 in /mcp).
A dogfooding-only collision. Inlining mcpServers into plugin.json removes the
standalone file the project loader chokes on; the plugin server is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Honors doc 07's design (frontmatter + prose body) over the JSON I'd shipped:
- file-store: <slug>-<ulid>.md, YAML frontmatter + body (text/task), via bundled `yaml`
- one file per id (stale-slug sibling removed on rewrite); dedup-reinforce still
  prevents same-concept duplicates at write time — the ulid is identity, not a dup source
- id: add slug(); index.ts + tests use MarkdownFileStore; 5/5 tests green; dist rebuilt
- doc 07: document the on-disk format + the in-memory-index implementation note

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
yaml@2 is CommonJS; bundled into ESM its internal require("process") hit
esbuild's "Dynamic require not supported" → mem crashed on startup. Add a
--banner createRequire shim so esbuild's __require resolves a real require.
Verified write→recall on node 22 (the runtime Claude Code spawns) + 5/5 tests.
dist rebuilt (lockstep).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The inline esbuild command crossed the smell line once it needed a shell-escaped
banner inside a JSON script. Move to packages/memory/build.mjs (esbuild JS API):
readable, no escaping, room to grow (sourcemaps/minify/externals). package.json
build → `node build.mjs`. dist rebuilt — banner intact, boots on node 22, 5/5 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
doc 02 §3 promised manual removal but doc 07's tool surface never specced it, so
pruning required a filesystem rm. Add memory_forget(id): deletes a memory from the
live store and disk by id. FileStore.deleteFact/deleteEpisode ports + service.forget
+ tool + test (6/6 green). Updated doc 07 to 10 tools. dist rebuilt (lockstep).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Memory core done + live-verified (/mcp green, round-trip, 6/6, 10 tools). Phase 2 (dogfood) next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Prints the plugin.json version and exits 0 (handy for CI/release). First task
built through /agentry (one-shot route — no orchestration tax). Gate unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dogfooding surfaced the conductor skipping designed gates: it inlined acceptance
criteria (no spec.md) and dispatched the architect to produce plan+ADR+tasks in
one pass — collapsing the spec gate and plan gate. Root cause was loose skill
content, not the architect (which did its job). Fixes:
- conducting: Spec is ALWAYS a written artifact; spec gate + plan gate are
  mandatory ordered stops; plan first → gate → then split (never bundled).
- architect: when dispatched to plan, produce Plan + ADR only; split is a
  separate dispatch after the plan gate.

Behavior lives in the skills, not operator memory — so the fix is in the skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bare /agentry isn't possible for a multi-skill plugin (plugins.md:45 — single-skill
only). Rename the front-door command (commands/agentry.md → go.md) to a clean verb;
update conducting skill description, the SessionStart primer message, README, CLAUDE.md.
Namespaced nodes (/agentry:spec etc.) unchanged. Internal design docs still say
/agentry conceptually (sweep later).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Onboard (explorer) caught two drifts via recall of the inline-MCP gotcha:
- layout showed a root .mcp.json → it's inline in plugin.json now
- "design docs (01–09)" → 01–10

Comprehension → finding → fix; the moat's recall drove the catch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Grouped pass-checklist with per-section counts + FAIL/OK tally; ANSI color gated
on TTY and NO_COLOR so piped/CI output stays plain. Built through /agentry:go
(routed one-shot) and distilled into a repo memory.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Built through /agentry:go (decompose+verify: implementer ⇄ verifier).
- core: Fact gains `decay` (strike counter) + `archived` status + `archivedAt`.
- feedback(): recalled-but-unused decays usefulness + adds a strike; cite+pass
  resets strikes; archives at threshold (4, doc 02 §7 knob) only once usefulness
  floors at 0; suspect/fail path doesn't strike toward archive.
- archived excluded from recall (task+prime), search, activeFacts; stats gains an
  `archived` bucket. recover() + memory_recover tool (11th) undo a false-archive
  and re-index. db-index.add() made idempotent so recover can't dup FTS rows
  (verifier-caught). 13 tests green; dist rebuilt (lockstep).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
From the decay+archive run — three gaps, all fixed in the durable layer:
1. Spec/plan/tasks must be PERSISTED as files in .agentry/work/<id>/ before
   gating — reasoning them in chat without the artifact is the failure.
2. Build loop rebuilds dist on packages/memory/src changes (dist-lockstep) —
   the live MCP runs the bundle, not src; check-plugin before the ship gate.
3. Fix-loop = re-dispatch a FRESH implementer with the verifier's fix contract,
   not SendMessage (which may be unavailable) — clean context, exact refs.

conducting: gate-writes-file + Build-loop section + 2 anti-patterns.
implementer: dist-lockstep edge case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
From the decay+archive run, stated project-AGNOSTICALLY (Agentry ships into any
repo; project specifics live in that repo's CLAUDE.md/memory, discovered):
1. Gates persist their artifact as a FILE in .agentry/work/<id>/ before gating
   (spec/plan/tasks) — not just reasoned in chat.
2. Build loop: keep build artifacts in sync with source + run the project's
   build/lint/tests/gate before ship — DISCOVER those commands from the repo,
   never hardcode them here.
3. Fix-loop = re-dispatch a FRESH implementer with the verifier's fix contract
   (don't depend on SendMessage) — clean context, exact refs.

conducting: gate-writes-file, Build-loop section, 2 anti-patterns.
implementer: generic "rebuild the artifact your source generates" edge case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Folds in the parity insight: same model → average-task quality is parity, so
measuring it proves nothing. Reframe around the four edges + edge-revealing
metrics:
- §1a "parity trap": escaped-defect rate (R1′ bug-seeded), requirement coverage
  (R2), warm−cold delta (R3), no-tax (R0). The moat is the only CATEGORICAL edge
  (plain can't recall) — land it first; the rest are rates over N runs.
- §3 metrics: add escaped-defect + warm−cold; demote average AC-pass to substrate.
- §4 C1–C4 sharpened to the edge metrics. §8: add R1′ bug-seeded regime.
- Build the harness LAST (after dogfooding stabilizes the conductor/skills);
  interim signal = a manual duel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…dump

Per maintainer call — don't auto-inject the warm set at SessionStart (no task yet
→ generic top-N is low-relevance and taxes every session). The primer is a minimal
nudge (counts + front-door + optional continue-context pointer, hard-capped);
relevant memory enters context via the conductor's task-specific recall. Reframed
doc 02 §2 (recall gate) + §5 (continue-context) + doc 07 §3 (priming hook). The
primer code was already minimal — this aligns the docs to it and to the principle.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Setup, build/test/check commands, the code bar + process rules (dist-lockstep,
reload-gated, run check before commit), commit convention. Built through
/agentry:go (one-shot); project specifics recalled from CLAUDE.md/repo-facts +
verified accurate against package.json and the tree.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
)

* Actionable, consistent error handling across the 11 memory MCP tools

Every @agentry/memory tool now returns one structured error envelope on a
genuine failure, marked as an MCP error (isError:true) instead of a silent
success flag — so a calling model that can only see the response can
self-correct.

What changed:
- @agentry/core: new MemoryError contract (zod) — { code, what, why, fix }
  over a closed code set (bad-input | not-found | invalid-state | internal |
  storage-read). Single source of truth, barrel-exported.
- memory/tools: err() serializer (sibling of ok()), a builder module
  (notFound/badInput/invalidState/storageRead/internal) as the one home for
  codes + prose, and shared adapter plumbing (guard/partial) in adapter.ts.
- memory-service: update/forget/recover/feedback/distill now return typed
  discriminated outcomes; adapters map them to ok/err. recover splits
  not-found vs invalid-state. Semantic bad-input (blank id) is an error.
- Partial tools (feedback, distill): all ids invalid -> error; some valid ->
  success reporting applied + skipped[{id,reason}].
- write surfaces a no-op supersedes as additive WriteResult.supersededMissing.
- Persistence read failures are surfaced (ports ReadResult channel; file-store
  stops swallowing corrupt records) and reported via memory_stats.readErrors.

Consistency is structural: one core type, one builder module, one serializer —
nothing per-tool to drift. internal() takes no error argument, so a stack/path
leak is structurally impossible.

Tests: 33 memory + 5 core pass. dist rebuilt in lockstep; check-plugin clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Harden planning craft from the error-handling dogfood run

Generic improvements surfaced while running the MCP error-handling task
through /agentry:go (kept project-agnostic — shipped payload):

- Task contracts gain `excludes` (must-not-touch), the explicit negative of
  `owns` — enforces the boundary from both sides.
- Pin exact names on any surface a sibling consumes (the consumer codes
  against a frozen signature, not a paraphrase).
- New anti-pattern "Unverified-state assumption" — a task must verify repo
  state and adjust, never assert an unchecked "absent"/"present" claim.
- Tasks carry their leave-it-green verify/build steps, discovered from the
  repo (never hardcoded — the task names specifics, the skill stays generic).
- Architect emits the structured task frontmatter explicitly (don't bury
  owns/exposes/deps/satisfies in prose — keep coverage machine-checkable).
- Canonical work-folder layout: ADRs as a folder (adr/NNN-slug.md, a
  numbered append-only series), mirroring tasks/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The partial() all-invalid path joined skipped ids and fed them to the
single-id notFound() builder, so the `why` read `id "g:A, g:B"` — multiple
ids looking like one. Add a notFoundMany() builder (same code:"not-found"
and field set, AC4) that lists each id distinctly quoted; partial() uses it
for >1 id and keeps notFound() for the single-id case. Strengthened the
all-invalid test to assert each id appears quoted (regression guard).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The dist-lockstep check compared dist-vs-src mtimes, but git doesn't preserve
mtimes — a clone, checkout, or squash-merge rewrites them, producing a false
"dist is older than src" warning when the bundle was never actually stale
(seen twice after merging PRs #1 and #2). Repeated false warnings train
contributors to ignore the gate.

Fix: build.mjs stamps a SHA-256 of all src file contents into dist/.srchash;
check-plugin recomputes and compares. Checkout-proof, and it catches the real
failure (src edited but dist not rebuilt). Shared scripts/lib/src-hash.mjs so
the two sides can't drift.

Verified: touching a src file (mtime only) stays "up to date"; a content
change without rebuild reports "stale".

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dogfood finding: a fresh-session conductor one-shotted "emit events to
events.jsonl" — skipping the spec/plan gates — and silently guessed the crux
design choice (resolved a hook's work-id by "newest-mtime folder", a fragile
heuristic). Root cause: the signals→shape rubric is a flat, equal-weight
matrix. 4/5 signals said "floor" (few files, reversible, precedent exists),
only Unknowns said "escalate" — so it averaged to one-shot. Bias-to-floor was
one-directional (a vivid over-routing failure, no under-routing counterweight),
and escalation triggers were mid-flight-only.

Fix (generic, durable layer):
- Override rule: the HIGHEST-severity signal sets the floor, not the average.
  A real unknown or an undecided design fork VETOES one-shot → >= spec-first
  regardless of file count. Small footprint != small decision.
- New signal "Decision-content" (is there an undecided fork?), decoupled from
  Scope, so a 2-file task with a load-bearing choice routes correctly.
- Pre-flight fork check before any edit (triggers are no longer mid-flight-only).
- Symmetric framing in go.md: pair the one-liner over-routing failure with the
  under-routing one (cite the mtime work-id incident).
- Broaden the spec-gate trigger from "under-specified" to "under-specified OR
  specified-goal-with-undecided-mechanism".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…or/model now apply)

All 8 agents had a plain multi-line `description:` containing <example> blocks.
That's malformed YAML — it breaks at the first inline colon (e.g. "Examples:",
"user:"), so every frontmatter field AFTER the description (model, color,
skills) was silently dropped at load. Net effect: agents were NOT preloading
their craft skills, NOT applying their color, NOT honoring model — we'd been
running the whole roster on the body prompt alone.

Fix (proven against the official plugin-dev/agent-creator.md reference):
- `description: |` block scalar (2-space indent) so example-laden text is
  literal and can't break parsing.
- Clean key:values first (name/model/color/skills), description last.
- Distinct, valid colors per agent (magenta isn't a valid value; architect
  +product-owner and explorer+researcher had collided):
  architect=blue designer=purple explorer=cyan implementer=green
  librarian=yellow product-owner=orange researcher=pink verifier=red

Verified: all 8 frontmatters parse with name/model/color/skills/description; check-plugin 6/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Capability matrix for plugin subagents (what's usable vs ignored), the
block-scalar frontmatter standard (the fix landed in ec5a2e8), the corrected
Workbench events mechanism (plugin-level SubagentStart/SubagentStop, not
per-agent hooks), deeper references per skill, and the roster fragility audit.
Draft — pending sign-off.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The fix-loop guidance hedged "SendMessage may be unavailable in this
environment" — a conditional reference to a tool that's gated behind an
experimental flag and absent in most harnesses. Stale, confusing guidance.
Replace with the durable principle on its own merits: a fresh implementer
carrying the verifier's fix contract is reliable + reproducible; don't rely
on resuming a prior agent's muddied context. No tool name, fully generic.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The architect dropped its ADR at the work-dir root: the adr/-folder convention
lived only in the conductor's command/skill, not in the architect's own
instructions — so when dispatched, its craft never carried it. The conducting
layout line was also ambiguous ("single docs stay at the root" → one ADR read
as a single doc).

Fix: architect's output contract now names the exact path
(.agentry/work/<id>/adr/NNN-slug.md, always a folder); conducting layout line
disambiguated — adr/ and tasks/ are always folders (numbered append-only
series), even with one entry; spec.md/plan.md stay at root.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Plugin-level hooks emit a WorkEvent per subagent start/stop into
.agentry/work/<id>/events.jsonl, work-id resolved by a session-keyed
pointer the PostToolUse binder writes (ADR-001 — no mtime, no marker).

- core: WorkEvent gains additive agentId?/session? (correlate start↔stop,
  partition by session)
- hooks/work-id-binder.mjs: PostToolUse Write|Edit → session_id→workId
  pointer at .agentry/run/sessions/<sid>.json (atomic tmp+rename)
- hooks/subagent-emit.mjs: SubagentStart/Stop → resolve pointer, append
  one JSONL WorkEvent; unresolved → silent skip
- hooks.json: events nested under top-level "hooks" wrapper (the bare form
  silently fails to load — even SessionStart never fires); commands quoted
- dep-free node builtins, always exit 0 (non-blocking), silent in non-Agentry repos

Live-fired after relaunch: AC1 binder→pointer, AC2/AC4 Subagent*→events,
agentId correlation, AC3 one-object-per-line. 21 hook + 3 core tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codestz and others added 22 commits June 20, 2026 20:44
The channels docs previously presented only --dangerously-load-development-channels
as the way to enable channels. That flag bypasses Anthropic's approved allowlist and
is for custom / in-development channels — Agentry's own bridge needs it today because
it isn't officially listed. Official allowlisted channels (Telegram/Discord/iMessage)
use --channels plugin:<name>@<marketplace>. Document both paths across the install,
channels, and troubleshooting pages.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…er fix, run-guard hook, flow-compliance eval

After v2.0 (Flow MCP, Workbench, channels) the harness described its process but didn't
enforce it — proven live when the conductor bypassed Flow + spec-first on a multi-file
build. This wires the whole surface to Flow and adds teeth + measurement.

A — wiring + the frontmatter fix:
- go.md mandates run_start + event_emit(routing-decision) as the first above-floor action;
  the 7 node commands reference their real Flow tools.
- architect.md + planning skill author task bodies as plain markdown (## Contract, no
  leading ---); fixes the double-frontmatter that rendered broken in the Workbench.
- 5 specialist agents gain role-scoped Flow I/O + a Workbench/channel steering note;
  reviewing/integrating/shipping skills learn the review loop + permission relay.

B — teeth:
- plugin/hooks/flow-run-guard.mjs (dep-free PostToolUse) flags a flow-skipped marker when
  a gate artifact is written with no run; respects the one-shot floor.

C — measurement:
- packages/eval flow-compliance probe asserts on the events/artifact surface (run_start
  before dispatch, spec before tasks, single frontmatter, no skip flag); above-floor
  detection is artifact-based. Caught a real regression on its first run.
- packages/flow task-file-store defensively strips a leading --- block; flow +
  workbench-server dists rebuilt (dist-lockstep).

Live-verified after restart: the hook flags a bypass, a correctly-conducted run PASSes the
probe (single-frontmatter proven on a deliberately-malformed task body), and a run that
skips the routing event correctly FAILs. check-plugin 10/10; flow 132, eval 191, hook 18.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…gitignored .agentry/work tree

Three workbench-server tests (fs-work-repository, event-store REAL layer, work-reader)
read the live .agentry/work/<run>/ tree as their 'real shapes' fixture. That tree is
gitignored (.gitignore: .agentry), so a clean CI checkout has no runs and the tests fail
the 'fixture run dir present / at least one run present' preconditions — red CI on every
push, including the v0.2.0 tag.

Commit the reference run as tracked fixture data under test/fixtures/work-fixture/ (no
.agentry segment, so not ignored) + a loader that copies it into a temp .agentry/work/
at setup; repoint the three REAL-layer tests at the temp cwd. Content unaltered, so the
asserted shapes are preserved. Workbench-server 123/123 with the live tree hidden.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…, docs site, harness enforcement, CI fix)

The root CHANGELOG.md stopped at 0.1.2 and the web changelog page predated the harness
work. Add the full 0.2.0 entry (Added/Changed/Fixed) to both, and the compare links.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…, results-gated)

Restructure @agentry/eval from 5 accreted probes into 3 public probes — Moat
(warm-vs-cold, the categorical headline), Right-sizing (results-gated routing),
and Honesty (overclaim + flow-compliance) — plus a shared judge engine and
relocated conduct primitives. Retire the bare/raw-Claude comparison: the bench is
Agentry-value-only (routing precision + the moat + cost), not "beats bare Claude".

- Unify routing + outcome into ONE conduct-and-judge harness: conduct once,
  capture the routed shape AND judge the produced result, score results-gated
  (lighter+good=win, lighter+bad=under-route-failure, heavier+good=tax,
  no-signal=indeterminate). Kills the bare label-match accuracy bug.
- Extract one shared judge engine (judge/); relocate shared conduct primitives
  (conduct/); park quality/; delete superseded routing/outcome/outcome-judge/
  flow-compliance.
- De-bare the matrix; derive the cell/run label from --model (no hardcoded Sonnet).
- Pre-register thresholds X (right-sizing) + W (moat) as falsifiable forms
  (calibration-pending) — never invented numbers.
- Re-lead the report IA: Moat -> Right-sizing -> Honesty; drop the bare delta,
  the routing label-match, and the parked decision-quality from the public page.
- Author 8 dual fixtures (defended floor + golden/broken/oracle).
- Harden the judge parser to tolerate fenced/prose-wrapped JSON; sharpen 4
  fixture brokens so the discrimination controls clear with margin.

Built via Agentry's own process (spec -> plan -> split -> 10 tasks -> assemble-verify).
R1 conduct-once validated live (rs-clamp -> one-shot, judged 1.00). First full
calibration baseline ran clean but SATURATED (8/8 one-shot, all 1.00); a validity
probe confirmed routing capture works headless (a hard task escalated to
spec-first), so the fixtures are too easy, not the instrument broken — harder
discriminating fixtures are the next step before any public run.

413/413 tests green, typecheck clean, check-plugin OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…xture

A 3-module in-memory job queue (store + retry/dead-letter worker + index) with a
defended spec-first floor. Live-verified: the conductor escalates it to spec-first
(not one-shot), judged 1.00 → right-sizing-success, and the no-retry broken
discriminates cleanly from golden at the controls gate. Adds the missing
non-one-shot tier the saturated baseline lacked (the 8 original fixtures all
one-shot). seed fails / golden passes / broken fails the oracle; 416/416 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A 5-module in-memory relational store (schema/table/query/relations/index with
cross-cutting referential integrity). Defended floor: decompose. Live finding:
the conductor routed it spec-first (not decompose) and built it perfectly
(judged 1.00 → right-sizing-success) — evidence the model's decompose threshold
is high and it does NOT over-orchestrate even substantial multi-module systems.
Controls discriminate (broken fails 4 oracle tests on 3 planted defects);
seed fails / golden passes / broken fails; 419/419 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…roadcast)

Workbench review-comment (and human status-change) channel notifications were
emitted UNCONDITIONALLY for every run's sidecar — and since each session's stdio
flow process watches the same `.agentry/work/*` tree, a comment on run A spammed
every other session, including ones conducting unrelated runs.

Now session-targeted, with a safe orphan-broadcast fallback so no comment is lost:
- process-identity.ts: per-process holder of the runs/session this process has
  operated on (a stdio MCP process is 1:1 with a session, so process-global
  identity == session identity). Captured at the top of resolveRunContext from the
  explicit `run` (ADR-005 normal path) + optional `session_id` args.
- comment-routing.ts: pure shouldRouteToThisSession — route if the run is ours
  (myRuns or our persisted session pointer); drop if claimed by another session;
  broadcast if orphan (no live match, no pointer owner) so a Workbench-only run's
  comment is never lost.
- run-pointer.ts: sessionsBoundTo(cwd, run) — which sessions the binder bound to a
  run (the "is this run claimed by anyone" signal).
- ChannelBridge + StatusBridge take an optional shouldEmit gate (default always-on,
  preserving every existing test); applied after the seen/consume step so a
  not-ours comment is consumed once and never re-evaluated.

150/150 flow tests green, typecheck clean. Rebuilt plugin/flow/index.js (+ .srchash)
and refreshed plugin/workbench/server/.srchash (dist-lockstep); check-plugin 0/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… expanded conductor prompt

runWarm built `/agentry:go <task>` — the bare slash form, which is a 0-turn no-op
under `claude -p` (the model never runs). So every moat warm conduct settled with
num_turns:0, never routed, never recalled — the seed-did-not-land aborts were an
artifact, and the moat was never validly measured. Now uses buildConductorPrompt
(the expanded go.md, same fix the right-sizing probe already had) + the
moat-specific memory-priming directive. Verified: the conductor now runs (5 turns).

NOTE: a SECOND blocker remains (separate fix) — the conduct loads --plugin-dir but
NOT the plugin's mem/flow MCP servers, so memory_recall is unavailable; seed-landing
still fails until the mem MCP is loaded into the conduct.

419/419 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…(discrimination 1.0)

`--plugin-dir` loads the plugin's skills/commands/agents but NOT its MCP servers, so
every conduct ran with NO memory faculty — the conductor had no memory_recall tool,
so the moat seed could never land (the mcp_servers at init showed only the host's
globals, no agentry_mem). Added Invocation.mcpConfig → `claude -p --mcp-config`, and
the moat probe now passes the bundled mem server (plugin/mem/index.js), which roots
project memory at the conduct cwd (the sandbox workingDir where seedFact wrote).

Result, with both this + the 0-turn fix: agentry_mem loads, memory_recall fires (6×),
seed lands 2/2, and the moat SCORES — compoundRate 1.0, decoyLightenRate 0,
discrimination 1.0: the relevant fact collapses the fork (warm→one-shot) while the
irrelevant decoy holds (→spec-first). The categorical edge, controls-gated. N=2,
directional. 419/419 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ariance conductor

The moat effect is real but per-task conductor routing is stochastic, so a single
k=1 draw swings wildly (discrimination 1.0 -> abort across runs). Now reports RATES
over k repeats: compoundRate = (relevant repeats that LANDED and routed lighter) /
(relevant repeats that LANDED) — a non-landed relevant repeat is indeterminate
(recall never fired) and excluded; seedLandingRate is the validity readout;
decoyLightenRate is the false-positive base rate; discrimination = compoundRate -
decoyLightenRate, with per-task spread. Seed-landing gate is now a RATE FLOOR (>=0.5)
not all-or-nothing. CLI: run moat --runs <k> --model <id>. Also: mandatory-recall
directive + 6 project-specific forks (industry-default forks the model already knows
leaked the decoy; swapped for genuinely-unguessable project decisions). 425/425 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…RKING code, not just a lighter route

Closed a measurement hole: moat `compounded` was route-only (landed && lighter), so
memory making the conductor skip the spec into a BROKEN one-shot would still score as
a moat win. Now `compounded = landed && lighter && resultGood` — the warm-relevant
one-shot's produced tree is judged (shared outcome rubric + an apply-the-decision
clause that feeds the recalled fact to the judge), and only a lighter route that
ALSO produces correct code counts. A landed+lighter+BAD run is surfaced as a distinct
`lighterButBad` signal (never silently a win). Mirrors rightsizing's results-gating.
CLI: --judge-model. 428/428 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The moat conducts are independent (fresh sandbox each) but ran strictly serial, so
a k=3 x 6-task run was 36 serial conducts (~60-90 min). Now flattens the
(task x repeat x arm) conducts into work items with pre-assigned unique idSeeds and
drives them through mapPool(concurrency) — mirroring the rightsizing probe. Results
reassemble deterministically (a staggered-runner test asserts parallel outcomes ==
serial, and all idSeeds unique). CLI: run moat --concurrency <n> (default 1; keep
3-4 on live Opus runs). Orchestration-only — gates/aggregation/result-quality
untouched, same numbers. 431/431 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ecall tool_use

Seed-landing aborted 0/18 on Opus even though the seeded fact demonstrably reached
the conductor: the conductor accessed it via the Read tool (reading the seeded
.agentry/memory/facts/*.md in its working dir) instead of the memory_recall MCP tool,
and the detector required a memory_recall tool_use to register recall. Now a relevant
run LANDS when its distinctive signature SURFACES in the run (recall MCP OR file-read
of the project-memory store — both valid durable-memory access; the decoy control
attributes the routing effect to the relevant fact's CONTENT, not the access
mechanism). Requiring the tool_use was too narrow. 431/431 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ench report

Pre-registered targets calibrated from the first measured runs: moat W=0.5 (moat-n6
discrimination 0.67, N=6, seed 6/6, gated — clears it; moat-mem 1.0 N=2 confirms);
rightsizing X=0.8 (rs-baseline-k3 right-sizing-success 1.0, over-route-tax=0,
under-route-failure=0 — clears it, with the saturation caveat carried in the note).
Generated the self-contained dashboard results/2026-06-23/rs-baseline-k3/index.html
stitching all three probes (moat headline 0.67, right-sizing no-tax, honesty 0/30
overclaim). Zero-API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…roxy)

The moat measured routing-shape-lightening (memory makes the conductor route
lighter) — a weak proxy for memory's real value (error-prevention / better
decisions), as the reshape concluded. Deleted src/moat/ + all wiring: the
`run moat` CLI subcommand, report/moat.ts, MoatData, the loadMoat call, the moat
template section. Kept the back-compat "moat" RunKind literal so historical run
dirs still read. First step of reshaping the eval into a value-axis quality bench
(plan: ok-so-now-what). 393/393 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…lity axes)

src/bench/: conduct Agentry once per fixture, then score four ABSOLUTE axes from
that single run (no baseline, no routing label-match):
  A decisionQuality  — judge the decision trail (.agentry/work spec/plan/adr) with the 5-dim rubric
  B codeQuality + correctnessPassRate — judge the produced tree (4-dim rubric) + the hidden oracle
  C overclaimRate    — said-done but judged-bad or oracle-fail (trust it unreviewed)
  D escapedDefectRate + verifyFireRate — on bug-prone fixtures, a bug shipped past the verifier
Controls-first (code golden↔broken + planted decision gold↔poor) gate the judges
before any score. Pure scorer (bench/score.ts), conduct-once probe (bench/probe.ts),
rubrics re-exported from the existing engine. Zero-API tests (fake runner + canned
judge over a bench-mini fixture). 416/416 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Phase 5: `run bench` subcommand drives runBenchProbe (RunKind += "bench"),
mirroring run rightsizing — --fixtures-dir/--fixture/--k/--concurrency/--model/
--judge-model/--plugin-dir, decisionControlsDir = <fixtures>/_controls. run
rightsizing kept (removed in the cleanup step).

Phase 3: 10 realistic, harder fixtures under fixtures/bench/ — 5 bug-prone (float-
money, CSV-quoting, business-days off-by-one, LRU-vs-FIFO, tier-boundary), 5 with a
genuine hidden decision (rate-limiter window, retry policy, due-date semantics, LRU
use-on-get), 3 multi-file with real seams, 1 trivial. Each: seed FAILS / golden
PASSES / broken FAILS its hidden oracle (bug-prone oracles carry a subtle-bug probe).
Shared Axis-A decision gold/poor controls. Loader test asserts the corpus + spread.

455/455 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rebuilt the report (the old one was ugly) around the 4-axis bench. PageData now
leads with BenchData; src/report/load-bench.ts narrows the latest scored kind:"bench"
run; the new template.html is two tiers — a persuasive public SUMMARY (4-axis
scorecard with plain-English claims + mean±std·n + the showcase strip of descriptive
value: structure/memory/specialists/Workbench) over a technical DRILL-DOWN (per-task
census, axis distribution, controls-passed block). Designer-verified in a browser
(both tiers screenshot-checked); WCAG AA contrast (bumped --faint, a neutral, to
clear AA). Rewrote docs/evals prose to the 4 axes. rightsizing/honesty subsumed
(loaders kept for the cleanup step). 452/452 green, astro check clean, token-drift OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…robes (bench subsumes them)

The bench harness now owns all four axes, so the old probes are dead. Moved the shared
conduct primitives oracle.ts + compliance.ts to src/conduct/ (bench imports them);
deleted src/rightsizing/, src/report/{rightsizing,honesty}.ts, the honesty/quality
probe sources (kept quality/rubric.ts — bench's DECISION_RUBRIC), the run rightsizing
CLI handler + cellsFromFlag + --cell, the dead readRunInputs/fixture-routing pipeline,
and fixtures/rightsizing. Public CLI is now `run bench | replay | report`. Kept the
historical RunKind literals for back-compat reads. 327/327 green, check-plugin OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…5 harder fixtures

The full bench surfaced two real things: (1) the Axis-B code judge can be fooled
by clean-but-wrong code (gave bn-lru-cache 1.00 while the hidden oracle failed) —
the meter working as intended; (2) the verifier never fired in any conduct, because
verify is route-coupled (decompose-only) + prompt-described, not a mandated harness
step. Measuring "did verify fire" graded a non-feature, so it's removed.

- Strip verifyFireRate + verifyFired everywhere (score/probe/report-model/load-bench/
  template/tests). The OUTCOME that mattered — a defect shipped under a "done" claim —
  survives as escaped-defect, folded into honesty (Axis C, the bug-prone slice of overclaim).
- Repoint the Axis-B code-discrimination control from golden↔broken to golden↔SEED:
  a `broken` build is clean-but-functionally-wrong (judge rightly rates it MEDIUM on
  CODE QUALITY, so it can't clear the LOW bar) — that's the oracle's job; the seed
  (target unimplemented) is genuinely poor CODE. This is why the bench kept aborting
  at the trust-gate.
- parseScore: recover the dimensions block when a long rationale truncates the JSON
  tail (the dominant real-judge flake); bound the rationale to one sentence. The grade
  is the dimensions; a mangled rationale tail no longer discards a valid verdict.
- +5 fixtures (10 → 15): bn-job-queue, bn-event-ledger, bn-middleware-pipeline,
  bn-dag-scheduler (decompose-scale, 5-module, hidden cross-cutting decision + subtle
  integration bug) and bn-interval-merge (spec-first, boundary off-by-one). Each:
  seed fails / golden passes / broken fails its hidden oracle; all 5 discriminate
  gold 1.00 ↔ seed 0.00 with the real judge.

343/343 green, typecheck + check-plugin clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps the dev-tooling group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `1.9.4` | `2.5.10` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.12` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.4.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.2` | `26.2.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [chokidar](https://github.com/paulmillr/chokidar) | `4.0.3` | `5.0.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.24.2` | `0.28.2` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.4.8` | `7.2.4` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.3` |
| [@codemirror/lang-markdown](https://github.com/codemirror/lang-markdown) | `6.5.0` | `6.5.2` |
| [@dagrejs/dagre](https://github.com/dagrejs/dagre) | `1.1.8` | `3.1.1` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `2.27.2` | `3.30.3` |
| [@tiptap/pm](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/pm) | `2.27.2` | `3.30.3` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `2.27.2` | `3.30.3` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `2.27.2` | `3.30.3` |
| [@uiw/react-codemirror](https://github.com/uiwjs/react-codemirror) | `4.25.10` | `4.25.11` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.0` | `12.11.3` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.2.0` | `15.0.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `18.3.1` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.31` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `18.3.1` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.2.5` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.4` | `7.18.2` |
| [@types/markdown-it](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/markdown-it) | `14.1.2` | `14.2.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.2.2` |



Updates `@biomejs/biome` from 1.9.4 to 2.5.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome)

Updates `tsx` from 4.22.4 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.12)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

Updates `zod` from 3.25.76 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.4.3)

Updates `@types/node` from 24.13.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `chokidar` from 4.0.3 to 5.0.0
- [Release notes](https://github.com/paulmillr/chokidar/releases)
- [Commits](paulmillr/chokidar@4.0.3...5.0.0)

Updates `esbuild` from 0.24.2 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.24.2...v0.28.2)

Updates `astro` from 6.4.8 to 7.2.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.4/packages/astro)

Updates `@astrojs/check` from 0.9.9 to 0.9.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.10/packages/language-tools/astro-check)

Updates `ws` from 8.21.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.21.3)

Updates `@codemirror/lang-markdown` from 6.5.0 to 6.5.2
- [Changelog](https://github.com/codemirror/lang-markdown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/lang-markdown/commits)

Updates `@dagrejs/dagre` from 1.1.8 to 3.1.1
- [Release notes](https://github.com/dagrejs/dagre/releases)
- [Changelog](https://github.com/dagrejs/dagre/blob/master/changelog.md)
- [Commits](dagrejs/dagre@v1.1.8...v3.1.1)

Updates `@tiptap/extension-link` from 2.27.2 to 3.30.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.3/packages/extension-link)

Updates `@tiptap/pm` from 2.27.2 to 3.30.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages/pm/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.3/packages/pm)

Updates `@tiptap/react` from 2.27.2 to 3.30.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.3/packages/react)

Updates `@tiptap/starter-kit` from 2.27.2 to 3.30.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.3/packages/starter-kit)

Updates `@uiw/react-codemirror` from 4.25.10 to 4.25.11
- [Release notes](https://github.com/uiwjs/react-codemirror/releases)
- [Commits](uiwjs/react-codemirror@v4.25.10...v4.25.11)

Updates `@xyflow/react` from 12.11.0 to 12.11.3
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.3/packages/react)

Updates `markdown-it` from 14.2.0 to 15.0.0
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.2.0...15.0.0)

Updates `react` from 18.3.1 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 18.3.31 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 18.3.1 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 18.3.7 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-router-dom` from 6.30.4 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)

Updates `@types/markdown-it` from 14.1.2 to 14.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/markdown-it)

Updates `@types/react` from 18.3.31 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 18.3.7 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.2 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

Updates `vite` from 8.0.16 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: chokidar
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: astro
  dependency-version: 7.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@codemirror/lang-markdown"
  dependency-version: 6.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@dagrejs/dagre"
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/extension-link"
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/pm"
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/react"
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@uiw/react-codemirror"
  dependency-version: 4.25.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@xyflow/react"
  dependency-version: 12.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: markdown-it
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: react-router-dom
  dependency-version: 7.18.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/markdown-it"
  dependency-version: 14.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 27, 2026
@Codestz Codestz closed this Oct 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-tooling-cfed3acbf0 branch October 31, 2026 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant