chore(deps): bump the npm-production group across 1 directory with 3 updates

[dependabot]

Bumps the npm-production group with 3 updates in the / directory: @anthropic-ai/claude-agent-sdk, js-yaml and react.

Updates @anthropic-ai/claude-agent-sdk from 0.3.250 to 0.3.276

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.276

What's changed

• Updated to parity with Claude Code v2.1.276

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.276
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.276
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.276
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.276

v0.3.275

What's changed

• Fixed a deferred tool call's result being emitted with internal keys such as toolUseResult instead of tool_use_result when the tool re-runs at the start of a resumed turn
• Fixed getSessionMessages() and forkSession() sometimes missing a turn's assistant message when called right after the turn's result message
• Fixed forkSession({ upToMessageId }) rejecting a client-supplied SDKUserMessage.uuid that is not in UUID format
• Fixed forkSession rejecting the id that getSessionMessages returns for a message sent while Claude was working, and a fork showing a re-run prompt twice
• Fixed getSessionMessages() omitting a task notification or other queued message that Claude read while running a tool; it now comes back where Claude read it
• Updated to parity with Claude Code v2.1.275

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.275
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.275
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.275
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.275

v0.3.274

What's changed

• Added startup_failure_reason to the error result a stream-json run writes before exiting on a known startup failure
• Added mcpServer: {name, source} to canUseTool options, mcp_server to tool hook inputs, and source to MCP server status rows, so hosts can key trust on source === "sdk"
• Added CLAUDE_CODE_MCP_STARTUP_WAIT_MS (pass via env) to bound or disable (0) the first-turn wait for connecting MCP servers
• Added CLAUDE_CODE_EMIT_STARTUP_TIMING=1 for stream-json hosts: the session's first system/init then carries the per-phase startup_timing breakdown that cloud sessions already emit
• Fixed getSessionMessages() omitting a message the user sent while Claude was running a tool; it now comes back as a user message where Claude read it
• Fixed missing origin: {kind: 'task-notification'} on the replayed user message when a background task finishes during a running turn (--replay-user-messages)
• Improved startup: the first turn no longer waits up to 2s for connecting MCP servers from settings files or plugins whose tools tool search defers; options.mcpServers servers are still awaited
• Changed queued background-task completions to share one model call: each still gets its own result, all but the last empty with num_turns: 0

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.276

• Updated to parity with Claude Code v2.1.276

0.3.275

• Fixed a deferred tool call's result being emitted with internal keys such as toolUseResult instead of tool_use_result when the tool re-runs at the start of a resumed turn
• Fixed getSessionMessages() and forkSession() sometimes missing a turn's assistant message when called right after the turn's result message
• Fixed forkSession({ upToMessageId }) rejecting a client-supplied SDKUserMessage.uuid that is not in UUID format
• Fixed forkSession rejecting the id that getSessionMessages returns for a message sent while Claude was working, and a fork showing a re-run prompt twice
• Fixed getSessionMessages() omitting a task notification or other queued message that Claude read while running a tool; it now comes back where Claude read it
• Updated to parity with Claude Code v2.1.275

0.3.274

• Added startup_failure_reason to the error result a stream-json run writes before exiting on a known startup failure
• Added mcpServer: {name, source} to canUseTool options, mcp_server to tool hook inputs, and source to MCP server status rows, so hosts can key trust on source === "sdk"
• Added CLAUDE_CODE_MCP_STARTUP_WAIT_MS (pass via env) to bound or disable (0) the first-turn wait for connecting MCP servers
• Added CLAUDE_CODE_EMIT_STARTUP_TIMING=1 for stream-json hosts: the session's first system/init then carries the per-phase startup_timing breakdown that cloud sessions already emit
• Fixed getSessionMessages() omitting a message the user sent while Claude was running a tool; it now comes back as a user message where Claude read it
• Fixed missing origin: {kind: 'task-notification'} on the replayed user message when a background task finishes during a running turn (--replay-user-messages)
• Improved startup: the first turn no longer waits up to 2s for connecting MCP servers from settings files or plugins whose tools tool search defers; options.mcpServers servers are still awaited
• Changed queued background-task completions to share one model call: each still gets its own result, all but the last empty with num_turns: 0
• Updated to parity with Claude Code v2.1.274

0.3.273

• Added a usage_report sibling (SDKUsageReport: session totals, the plan's usage rows as the server sends them, extra usage) on the assistant message that delivers a headless /usage result
• Added reason: "worker_restart" to task_notification messages when a background task was stopped by a worker process restart
• Added a one-line transcript notice when the SDK host's Stop or SessionStart hook callback times out, shown once until the host answers again
• Fixed a Stop, SubagentStop or SessionStart hook callback that exceeds its timeout being reported as a hook failure and discarding other hooks' decisions; it now counts as no decision
• Fixed the browser SSE transport dropping the live slash-command list update (system/commands_changed)
• Updated to parity with Claude Code v2.1.273

0.3.272

• Updated to parity with Claude Code v2.1.272

0.3.271

• Added optional omitClaudeMd to AgentDefinition in the agents option, so a subagent can run without user, project and local CLAUDE.md files; managed policy files still load
• Fixed listSessions, getSessionMessages and getSessionInfo with dir on Windows not finding sessions for a directory on a mapped network drive or SUBST drive
• Fixed sessionStore resume losing the global config when it is stored under the legacy .config.json name or an OAuth-suffixed file name
• Removed persistent from the MonitorInput tool type
• Updated to parity with Claude Code v2.1.271

0.3.270

• Updated to parity with Claude Code v2.1.270

... (truncated)

Commits

• 4919e06 chore: Update CHANGELOG.md
• e51cd0b chore: Update CHANGELOG.md
• 1317f7b chore: Update CHANGELOG.md
• d62d6ab chore: Update CHANGELOG.md
• 5a1fed9 chore: Update CHANGELOG.md
• 7705293 chore: Update CHANGELOG.md
• 332b0a9 chore: Update CHANGELOG.md
• 4fe7b3b chore: Update CHANGELOG.md
• 80eebc4 chore: Update CHANGELOG.md
• 65e2760 chore: Update CHANGELOG.md
• Additional commits viewable in compare view

Updates js-yaml from 5.4.1 to 5.4.2

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

Commits

• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (#36752)
• 900ae09 [flow] Bump flow to v0.317.0 (#36701)
• fbb1370 [flow] Bump flow to v0.307.1 (#36199)
• 56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
• 74568e8 [Flight] Transport AggregateErrors.errors (#36156)
• e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
• db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
• 3e1abcc [tests] Require exact error messages in assertConsole helpers (#35497)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.