Skip to content

chore(deps): bump the npm-minor-and-patch group across 1 directory with 27 updates - #581

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-551bc6b4e9
Open

chore(deps): bump the npm-minor-and-patch group across 1 directory with 27 updates#581
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-551bc6b4e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 27 updates in the / directory:

Package From To
@assistant-ui/core 0.2.22 0.3.16
@assistant-ui/react 0.14.27 0.15.17
@assistant-ui/store 0.2.21 0.3.11
monaco-editor 0.52.2 0.56.0
react-router-dom 7.18.2 7.18.3
tsx 4.23.12 4.23.13
@anthropic-ai/sandbox-runtime 0.0.71 0.0.74
@daytona/sdk 0.204.1 0.207.0
@hono/swagger-ui 0.2.2 0.6.1
zod 4.4.3 4.5.4
@ai-sdk/alibaba 2.0.37 2.0.39
@ai-sdk/anthropic 4.0.44 4.0.46
@ai-sdk/google 4.0.53 4.0.58
@ai-sdk/moonshotai 3.0.41 3.0.43
@ai-sdk/openai 4.0.49 4.0.52
@ai-sdk/openai-compatible 3.0.39 3.0.41
@ai-sdk/provider 4.0.8 4.0.9
@ai-sdk/provider-utils 5.0.32 5.0.34
@nats-io/nats-core 3.0.2 3.4.0
@opentelemetry/core 2.10.0 2.11.0
ai 7.0.82 7.0.85
openai 7.5.0 7.8.0
@openuidev/react-headless 0.9.4 0.9.13
@openuidev/react-lang 0.2.9 0.2.15
@openuidev/react-ui 0.13.3 0.13.10
lucide-react 0.562.0 0.577.0
@testing-library/react 16.3.2 16.3.3

Updates @assistant-ui/core from 0.2.22 to 0.3.16

Release notes

Sourced from @​assistant-ui/core's releases.

@​assistant-ui/core@​0.3.16

Patch Changes

  • #6224 c70c911 - docs: name @assistant-ui/ai-sdk in JSDoc examples (@​okisdev)

    the import examples on injectQuoteContext, unstable_injectInteractableContext, and the interactable and message JSDoc pointed at @assistant-ui/react-ai-sdk. they now name the framework-neutral package, which is where these live; the old package re-exports it, so both imports resolve.

  • #6360 e0fa1e6 - fix: roll back AssistantFrame providers on registration, release, and disposal failures (@​Kinfe123)

  • #6346 b2f148e - refactor: share the attachment add cancellation machinery between the composer core and the store client. (@​okisdev)

  • #6365 9dabbce - refactor: notify every thread runtime subscriber before rethrowing a subscriber error. (@​okisdev)

  • #6262 5a3e9f7 - refactor: move the run report tool call shape and its serialization into assistant-cloud (@​okisdev)

  • #6297 43d52ad - fix: keep prepended id-less messages in the external message converter (@​Kinfe123)

  • #6268 cdfc34d - fix: tag static ai-sdk/v6 tool calls as frontend in cloud run telemetry (@​okisdev)

  • #6222 4000eed - fix: cancelling an edit session cancels its in-flight attachment adds and removes its non-complete attachments through the attachment adapter (@​Kinfe123)

  • #6329 8217a6e - refactor: derive executing-tool running state inside the external-store runtime; adapters now pass raw provider isRunning. (@​okisdev) the assistant transport runtime enables tool invocations too, so it now keeps the thread running while a client tool executes instead of reporting idle.

  • #6369 3fcf338 - refactor: collapse the external message converter's duplicate derivation chains into one pure module. (@​okisdev)

  • #6324 4802d23 - fix: derive requires-action for pending and interrupted tool calls in the external-store convertMessage path; messages with unresolved tool calls now report requires-action instead of complete (@​ShobhitPatra)

  • #6174 c3fd2b3 - fix: evict deleted external-store messages so no phantom branch survives. the setMessages path evicts immediately; the onDelete path evicts at the confirming host snapshot (@​Kinfe123)

  • #6271 231d148 - fix: keep prepended history when convertMessage returns no id (@​okisdev)

  • #6439 7e03b66 - refactor: share the file part source resolution branch (@​okisdev)

  • #6236 1263c1f - fix: report frame tool failures whose error message is empty (@​Kinfe123)

  • #6458 465a7a6 - fix: default assistant frame messaging to the current origin (@​Kinfe123)

  • #6197 5355528 - fix: preserve incomplete tool-call part statuses (@​Gujiassh)

  • #6199 e97f7c6 - fix: resolve InMemoryThreadList index selectors within the archived/regular subset (@​Kinfe123)

  • #6345 a6d2da5 - refactor: share the interactable persistence scheduler between the tap client and the legacy surface. (@​okisdev) a save that settles after its interactable unregistered no longer recreates the removed persistence-status entry.

  • #6328 6b797ca - refactor: share the runtime lifecycle callback invoker from core internal. (@​okisdev) callback errors continue to be reported and swallowed through the shared invoker.

  • #6257 bea47ed - fix: type MCP app metadata in ThreadMessageLike tool calls (@​rupic-app)

... (truncated)

Changelog

Sourced from @​assistant-ui/core's changelog.

0.3.16

Patch Changes

  • #6224 c70c911 - docs: name @assistant-ui/ai-sdk in JSDoc examples (@​okisdev)

    the import examples on injectQuoteContext, unstable_injectInteractableContext, and the interactable and message JSDoc pointed at @assistant-ui/react-ai-sdk. they now name the framework-neutral package, which is where these live; the old package re-exports it, so both imports resolve.

  • #6360 e0fa1e6 - fix: roll back AssistantFrame providers on registration, release, and disposal failures (@​Kinfe123)

  • #6346 b2f148e - refactor: share the attachment add cancellation machinery between the composer core and the store client. (@​okisdev)

  • #6365 9dabbce - refactor: notify every thread runtime subscriber before rethrowing a subscriber error. (@​okisdev)

  • #6262 5a3e9f7 - refactor: move the run report tool call shape and its serialization into assistant-cloud (@​okisdev)

  • #6297 43d52ad - fix: keep prepended id-less messages in the external message converter (@​Kinfe123)

  • #6268 cdfc34d - fix: tag static ai-sdk/v6 tool calls as frontend in cloud run telemetry (@​okisdev)

  • #6222 4000eed - fix: cancelling an edit session cancels its in-flight attachment adds and removes its non-complete attachments through the attachment adapter (@​Kinfe123)

  • #6329 8217a6e - refactor: derive executing-tool running state inside the external-store runtime; adapters now pass raw provider isRunning. (@​okisdev) the assistant transport runtime enables tool invocations too, so it now keeps the thread running while a client tool executes instead of reporting idle.

  • #6369 3fcf338 - refactor: collapse the external message converter's duplicate derivation chains into one pure module. (@​okisdev)

  • #6324 4802d23 - fix: derive requires-action for pending and interrupted tool calls in the external-store convertMessage path; messages with unresolved tool calls now report requires-action instead of complete (@​ShobhitPatra)

  • #6174 c3fd2b3 - fix: evict deleted external-store messages so no phantom branch survives. the setMessages path evicts immediately; the onDelete path evicts at the confirming host snapshot (@​Kinfe123)

  • #6271 231d148 - fix: keep prepended history when convertMessage returns no id (@​okisdev)

  • #6439 7e03b66 - refactor: share the file part source resolution branch (@​okisdev)

  • #6236 1263c1f - fix: report frame tool failures whose error message is empty (@​Kinfe123)

  • #6458 465a7a6 - fix: default assistant frame messaging to the current origin (@​Kinfe123)

  • #6197 5355528 - fix: preserve incomplete tool-call part statuses (@​Gujiassh)

  • #6199 e97f7c6 - fix: resolve InMemoryThreadList index selectors within the archived/regular subset (@​Kinfe123)

  • #6345 a6d2da5 - refactor: share the interactable persistence scheduler between the tap client and the legacy surface. (@​okisdev) a save that settles after its interactable unregistered no longer recreates the removed persistence-status entry.

  • #6328 6b797ca - refactor: share the runtime lifecycle callback invoker from core internal. (@​okisdev) callback errors continue to be reported and swallowed through the shared invoker.

  • #6257 bea47ed - fix: type MCP app metadata in ThreadMessageLike tool calls (@​rupic-app)

... (truncated)

Commits
  • b6e7ab8 chore: update versions (#6193)
  • 465a7a6 fix(core): default assistant frames to same-origin (#6458)
  • e0fa1e6 fix(core): roll back failed frame registrations (#6360)
  • 546dae8 fix(core): derive requires-action when importing messages into the repository...
  • 7e03b66 refactor(core): share the file part source resolution branch (#6439)
  • a06be56 refactor(core): share the message repository session layer between a2a and ag...
  • 027f5e2 refactor: share the pending tool-call scan, abortable load, and create fallba...
  • 1cfab36 fix(core): converter review fixes that missed the #6369 squash (#6379)
  • 3fcf338 refactor(core): collapse the external message converter derivation chains (#6...
  • 9dabbce refactor(core): extend BaseSubscribable in the thread runtime cores (#6365)
  • Additional commits viewable in compare view

Updates @assistant-ui/react from 0.14.27 to 0.15.17

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.17

Patch Changes

@​assistant-ui/react@​0.15.16

Patch Changes

  • #6136 f7bd2d9 - fix: keep DevTools updates flowing when a subscriber throws (@​Kinfe123)

  • #6055 1f3eaa7 - fix: contain SandboxHost render failures after teardown (@​Kinfe123)

  • #6110 48f95b1 - chore: delete the dead ensureBinding and useRuntimeState utilities (@​samdickson22)

    src/context/react/utils/ensureBinding.ts and src/context/react/utils/useRuntimeState.ts imported only each other. Nothing else in the repo referenced them, neither appears in the package barrel or the api-surface snapshot, and the "."-only exports map made them unreachable to consumers. ensureBinding was an external caller of __internal_bindMethods that no longer had a caller of its own; the runtime classes bind themselves in their constructors, so nothing changes at runtime. The public API surface is

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.17

Patch Changes

0.15.16

Patch Changes

  • #6136 f7bd2d9 - fix: keep DevTools updates flowing when a subscriber throws (@​Kinfe123)

  • #6055 1f3eaa7 - fix: contain SandboxHost render failures after teardown (@​Kinfe123)

  • #6110 48f95b1 - chore: delete the dead ensureBinding and useRuntimeState utilities (@​samdickson22)

    src/context/react/utils/ensureBinding.ts and src/context/react/utils/useRuntimeState.ts imported only each other. Nothing else in the repo referenced them, neither appears in the package barrel or the api-surface snapshot, and the "."-only exports map made them unreachable to consumers. ensureBinding was an external caller of __internal_bindMethods

... (truncated)

Commits
  • b6e7ab8 chore: update versions (#6193)
  • 465a7a6 fix(core): default assistant frames to same-origin (#6458)
  • 16eb703 fix(react): apply mcp app host options after commit (#6370)
  • 95ed44d fix(react): keep slash commands scoped to committed renders (#6406)
  • 6bb1c8b fix(react): keep mcp app server routing commit-safe (#6404)
  • 13c5997 fix(react): apply live completion fetchers after commit (#6390)
  • bac7cd6 fix(react): apply sandbox bridge options after commit (#6389)
  • 1d2e68b chore(react): drop unreachable legacy forwarding sources (#6335)
  • e96d3de chore: update dependencies (#6305)
  • 36edccb fix(react): export createSuggestionAdapter from the dist packages (#6207)
  • Additional commits viewable in compare view

Updates @assistant-ui/store from 0.2.21 to 0.3.11

Release notes

Sourced from @​assistant-ui/store's releases.

@​assistant-ui/store@​0.3.11

Patch Changes

Changelog

Sourced from @​assistant-ui/store's changelog.

0.3.11

Patch Changes

0.3.10

Patch Changes

  • #6068 ac0c836 - fix: stabilize unstable_useAdapters results on both adapter faces and warn on an unkeyed history factory. the React host's synthesized provider now absorbs a fresh but shallow-equal adapters bag the same way the RemoteThreadList store entry does, reusing the store's useShallowStable primitive through its internal entry, and the store entry warns in development when a history adapter arrives while the thread factory is unkeyed, since switching threads would silently keep the first thread's history. (@​okisdev)

  • #5831 2b0fec7 - feat: aui.optional.<scope> resolves an unavailable scope to undefined instead of a throwing accessor, mirroring s.optional on the state side; the documented availability check moves off source != null (@​okisdev)

  • #5998 f44163f - fix: stop active chats only when their standalone client is destroyed (@​Kinfe123)

  • #5834 d80e988 - fix: model-context registrations follow the committed scope across structural replacements. The new useAssistantScopeEffect(scope, effect, deps) re-runs a registration when the scope's bound client is replaced (cleaning up against the old one first) while ignoring value updates, and the toolkit, runtime-adapter, interactables, and MCP registration sites now use it instead of registering once against a stable client ref. (@​okisdev)

  • #5897 74dca03 - fix: cache live config source reads between notifications so getConfig satisfies the useSyncExternalStore getSnapshot contract (@​Yonom)

  • #5913 1b9c33d - feat: hoist the shared binding utilities to the client entry. createClientFacade (stable client facade over a source) and createLastValidCache/createStaleReporter (by-index shrink guard with an injectable expiry scheduler) were duplicated per framework bridge; they now live on @​assistant-ui/store/client so bridges cannot drift. (@​okisdev)

  • #5618 82e2bde - refactor: the config path rides React's scheduler instead of a self-scheduled tap root (@​Yonom)

  • #5889 52df42d - feat: subscription-owned lifecycle for createAssistantClient. the handle now rides tap's mountOnSubscribe: scopes render lazily on first read, mount when the first subscriber attaches, and soft unmount one task after the last subscriber releases (effects clean up, state is retained, a later subscriber remounts the same scopes). state updates before the first subscriber throw; an imperative consumer without a reactive framework holds a no-op subscription. destroy() remains the permanent teardown: synchronous while subscribers are attached; after the last release it defers to the soft unmount that release already scheduled. requires @​assistant-ui/tap ^0.9.12. (@​okisdev)

  • #5928 6c9e7dd - feat: hoist the viewport scroll math to the client entry. isViewportAtBottom, viewportOverflows, isUserScrollUp, and observeContentResize were vue-local; they now live on @​assistant-ui/store/client so the svelte viewport consumes the same implementation. (@​okisdev)

  • #6014 7748e15 - feat: host remote thread runtimeHooks as keyed tap resources on the list hook. useRemoteThreadListRuntime mounts one useResources host after each thread's unstable_Provider, so the first runtimeHook call already sees Provider adapters. AdapterSink only publishes those adapters. @assistant-ui/store/client exports useConfiguredAui and useAssistantContextProvider so that host can extend and provide a client the same way AuiProvider does in React. (@​okisdev)

  • #5914 0d2e23f - feat: new threads.selectionChanged event carrying threadId and previousThreadId; deprecate threadListItem.switchedTo/switchedAway in its favor. Un-deprecate the semantically meaningful events (thread.runStart, thread.runEnd, thread.initialize, composer.send, composer.attachmentAdd). (@​Yonom)

    The new event fires in situations where the deprecated pair did not, so the selection-driven defaults (scrollToBottomOnThreadSwitch, unstable_focusOnThreadSwitched) now engage there too: InMemoryThreadList emits on selection changes (it previously emitted no switch events at all), switchToNewThread() emits for the newly created thread, and runtimes that resolve a deep-linked threadId/initialThreadId after mount (useRemoteThreadListRuntime) emit when the deep link resolves, with the initial placeholder thread as previousThreadId.

0.3.9

Patch Changes

  • #5829 4b75b8f - fix: scoped event listeners under a derived-only provider filter against the child's own bindings instead of the parent's, in both directions and through scope-less intermediate hosts (@​okisdev)

  • #5795 00a630a - fix: publish hosted scope rebinds before descendant layout effects (@​Gujiassh)

  • #5769 f59d24b - fix: deliver threadListItem.switchedTo to default-scope listeners (#5699). the thread list item client now emits the switch from its own observed selection transition, after the flush that rebinds the derived scopes, instead of relaying the runtime's synchronous notification. scoped listeners now resolve their scope against the host's current client at delivery time, so a listener subscribed before a structural swap follows the scope's present binding; the notification manager re-reads t...

    Description has been truncated

    [!NOTE]
    Medium Risk
    Wide dependency churn on assistant-ui, Zod, AI SDK, sandbox/Daytona, and API docs (swagger-ui) can change runtime behavior without any in-repo code edits; validation and chat flows deserve extra smoke/regression testing.

    Overview
    This PR only updates dependency versions in packages/frontend, packages/trueforge-ui, packages/trueforge-core, and packages/trueforge, plus the regenerated pnpm-lock.yaml. There are no application source changes.

    Chat / UI: @assistant-ui/core, @assistant-ui/react, and @assistant-ui/store are raised on frontend and trueforge-ui (including a 0.2.x → 0.3.x line on core/store and 0.14 → 0.15 on react). Monaco moves 0.52 → 0.56 on frontend; OpenUI (@openuidev/react-*), lucide-react, and react-router-dom (patch on frontend; trueforge-ui dependency range is narrowed from ^6 || ^7 to ^7 only).

    Server / agents: Zod is unified at 4.5.4 in core, server, and UI. Vercel AI SDK packages and ai are bumped in trueforge-core, along with OpenAI, Daytona, NATS (3.0.2 → 3.4.0), and OpenTelemetry. The trueforge package picks up newer sandbox-runtime, Daytona, and a larger jump on @hono/swagger-ui (0.2 → 0.6).

    Tooling: tsx patch bumps where declared.

    Reviewed by Cursor Bugbot for commit 945614d. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump the npm-minor-and-patch group across 1 directory wi…
945614d 
…th 27 updates

Bumps the npm-minor-and-patch group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@assistant-ui/core](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/core) | `0.2.22` | `0.3.16` |
| [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react) | `0.14.27` | `0.15.17` |
| [@assistant-ui/store](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/store) | `0.2.21` | `0.3.11` |
| [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.52.2` | `0.56.0` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.2` | `7.18.3` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |
| [@anthropic-ai/sandbox-runtime](https://github.com/anthropic-experimental/sandbox-runtime) | `0.0.71` | `0.0.74` |
| [@daytona/sdk](https://github.com/daytona/clients) | `0.204.1` | `0.207.0` |
| [@hono/swagger-ui](https://github.com/honojs/middleware/tree/HEAD/packages/swagger-ui) | `0.2.2` | `0.6.1` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [@ai-sdk/alibaba](https://github.com/vercel/ai/tree/HEAD/packages/alibaba) | `2.0.37` | `2.0.39` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `4.0.44` | `4.0.46` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `4.0.53` | `4.0.58` |
| [@ai-sdk/moonshotai](https://github.com/vercel/ai/tree/HEAD/packages/moonshotai) | `3.0.41` | `3.0.43` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.49` | `4.0.52` |
| [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `3.0.39` | `3.0.41` |
| [@ai-sdk/provider](https://github.com/vercel/ai/tree/HEAD/packages/provider) | `4.0.8` | `4.0.9` |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `5.0.32` | `5.0.34` |
| [@nats-io/nats-core](https://github.com/nats-io/nats.js) | `3.0.2` | `3.4.0` |
| [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.10.0` | `2.11.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.82` | `7.0.85` |
| [openai](https://github.com/openai/openai-node) | `7.5.0` | `7.8.0` |
| [@openuidev/react-headless](https://github.com/thesysdev/openui/tree/HEAD/packages/react-headless) | `0.9.4` | `0.9.13` |
| [@openuidev/react-lang](https://github.com/thesysdev/openui/tree/HEAD/packages/react-lang) | `0.2.9` | `0.2.15` |
| [@openuidev/react-ui](https://github.com/thesysdev/openui/tree/HEAD/packages/react-ui) | `0.13.3` | `0.13.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.562.0` | `0.577.0` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |



Updates `@assistant-ui/core` from 0.2.22 to 0.3.16
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/core@0.3.16/packages/core)

Updates `@assistant-ui/react` from 0.14.27 to 0.15.17
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react@0.15.17/packages/react)

Updates `@assistant-ui/store` from 0.2.21 to 0.3.11
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/store/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/store@0.3.11/packages/store)

Updates `monaco-editor` from 0.52.2 to 0.56.0
- [Release notes](https://github.com/microsoft/monaco-editor/releases)
- [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md)
- [Commits](microsoft/monaco-editor@v0.52.2...v0.56.0)

Updates `react-router-dom` from 7.18.2 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

Updates `@anthropic-ai/sandbox-runtime` from 0.0.71 to 0.0.74
- [Release notes](https://github.com/anthropic-experimental/sandbox-runtime/releases)
- [Commits](anthropics/sandbox-runtime@v0.0.71...v0.0.74)

Updates `@daytona/sdk` from 0.204.1 to 0.207.0
- [Release notes](https://github.com/daytona/clients/releases)
- [Commits](https://github.com/daytona/clients/commits/v0.207.0)

Updates `@hono/swagger-ui` from 0.2.2 to 0.6.1
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/swagger-ui/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/swagger-ui@0.6.1/packages/swagger-ui)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `@ai-sdk/alibaba` from 2.0.37 to 2.0.39
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/alibaba/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/alibaba@2.0.39/packages/alibaba)

Updates `@ai-sdk/anthropic` from 4.0.44 to 4.0.46
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.46/packages/anthropic)

Updates `@ai-sdk/google` from 4.0.53 to 4.0.58
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.58/packages/google)

Updates `@ai-sdk/moonshotai` from 3.0.41 to 3.0.43
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/moonshotai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/moonshotai@3.0.43/packages/moonshotai)

Updates `@ai-sdk/openai` from 4.0.49 to 4.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.52/packages/openai)

Updates `@ai-sdk/openai-compatible` from 3.0.39 to 3.0.41
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai-compatible/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@3.0.41/packages/openai-compatible)

Updates `@ai-sdk/provider` from 4.0.8 to 4.0.9
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider@4.0.9/packages/provider)

Updates `@ai-sdk/provider-utils` from 5.0.32 to 5.0.34
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@5.0.34/packages/provider-utils)

Updates `@nats-io/nats-core` from 3.0.2 to 3.4.0
- [Release notes](https://github.com/nats-io/nats.js/releases)
- [Commits](nats-io/nats.js@v3.0.2...v3.4.0)

Updates `@opentelemetry/core` from 2.10.0 to 2.11.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.10.0...v2.11.0)

Updates `ai` from 7.0.82 to 7.0.85
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.85/packages/ai)

Updates `openai` from 7.5.0 to 7.8.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.5.0...v7.8.0)

Updates `@openuidev/react-headless` from 0.9.4 to 0.9.13
- [Commits](https://github.com/thesysdev/openui/commits/HEAD/packages/react-headless)

Updates `@openuidev/react-lang` from 0.2.9 to 0.2.15
- [Commits](https://github.com/thesysdev/openui/commits/HEAD/packages/react-lang)

Updates `@openuidev/react-ui` from 0.13.3 to 0.13.10
- [Commits](https://github.com/thesysdev/openui/commits/HEAD/packages/react-ui)

Updates `lucide-react` from 0.562.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

---
updated-dependencies:
- dependency-name: "@assistant-ui/core"
  dependency-version: 0.3.16
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@assistant-ui/store"
  dependency-version: 0.3.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: monaco-editor
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@anthropic-ai/sandbox-runtime"
  dependency-version: 0.0.74
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@daytona/sdk"
  dependency-version: 0.207.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@hono/swagger-ui"
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/alibaba"
  dependency-version: 2.0.39
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.58
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/moonshotai"
  dependency-version: 3.0.43
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/openai-compatible"
  dependency-version: 3.0.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/provider"
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 5.0.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@nats-io/nats-core"
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: ai
  dependency-version: 7.0.85
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: openai
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@openuidev/react-headless"
  dependency-version: 0.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@openuidev/react-lang"
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@openuidev/react-ui"
  dependency-version: 0.13.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2026
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Sep 3, 2026
@changeset-bot

changeset-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 945614d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor[bot]
cursor Bot reviewed Sep 3, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 945614d. Configure here.

Comment thread packages/frontend/package.json
"@assistant-ui/store": "0.2.21",
"@assistant-ui/core": "0.3.16",
"@assistant-ui/react": "0.15.17",
"@assistant-ui/store": "0.3.11",

@cursor cursor Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile misses assistant-ui upgrades

High Severity

package.json pins @assistant-ui/core 0.3.16, @assistant-ui/react 0.15.17, and @assistant-ui/store 0.3.11, but pnpm-lock.yaml still records specifiers 0.2.22 / 0.14.27 / 0.2.21 and contains no 0.3/0.15 entries. pnpm install --frozen-lockfile fails, so CI and reproducible installs cannot resolve the declared versions.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 945614d. Configure here.

Comment thread packages/trueforge-ui/package.json
"@assistant-ui/react": "0.15.17",
"@openuidev/react-headless": "^0.9.13",
"@openuidev/react-lang": "^0.2.15",
"@openuidev/react-ui": "^0.13.10",

@cursor cursor Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assistant-ui peers stay on 0.2

Medium Severity

Direct @assistant-ui/core / @assistant-ui/react dependencies moved to 0.3.16 / 0.15.17, but optional peers remain ^0.2.22 / ^0.14.24 and @truefoundry/assistant-ui-runtime stays on 0.1.26, which still resolves core@0.2.22 and store@0.2.21. Hosts that follow the published peer range (or the runtime) get a second assistant-ui copy and the AuiProvider singleton failure.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 945614d. Configure here.

Comment thread packages/trueforge-core/package.json
"winston": "^3.19.0",
"ws": "^8.21.3",
"zod": "^4.4.3"
"zod": "^4.5.4"

@cursor cursor Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Published packages lack a changeset

Low Severity

Shipped dependency ranges changed in @truefoundry/trueforge-core, @truefoundry/trueforge, and @truefoundry/trueforge-ui (frontend assets also land in the server tarball) without a new .changeset/*.md. Release tooling will not bump those packages for this PR.

Additional Locations (2)
Fix in Cursor Fix in Web

Triggered by project rule: TrueForge review rules

Reviewed by Cursor Bugbot for commit 945614d. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@govindavashishtha govindavashishtha Awaiting requested review from govindavashishtha govindavashishtha is a code owner
@sayan-truefoundry sayan-truefoundry Awaiting requested review from sayan-truefoundry sayan-truefoundry is a code owner
@qaifi-tf qaifi-tf Awaiting requested review from qaifi-tf qaifi-tf is a code owner
@vinit-truefoundry vinit-truefoundry Awaiting requested review from vinit-truefoundry vinit-truefoundry is a code owner
@kumarsks619 kumarsks619 Awaiting requested review from kumarsks619 kumarsks619 is a code owner
@sajal-truefoundry sajal-truefoundry Awaiting requested review from sajal-truefoundry sajal-truefoundry is a code owner
@debajyoti-truefoundry debajyoti-truefoundry Awaiting requested review from debajyoti-truefoundry debajyoti-truefoundry is a code owner
@chiragjn chiragjn Awaiting requested review from chiragjn chiragjn is a code owner
@heerambavi1998 heerambavi1998 Awaiting requested review from heerambavi1998 heerambavi1998 is a code owner
@sr07asthana sr07asthana Awaiting requested review from sr07asthana sr07asthana is a code owner
@bhaveshpatel640 bhaveshpatel640 Awaiting requested review from bhaveshpatel640 bhaveshpatel640 is a code owner
@thesujai thesujai Awaiting requested review from thesujai thesujai is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants