Skip to content

chore(deps): update all non-major dependencies#288

Merged
HugoRCD merged 1 commit into
mainfrom
renovate/all-minor-patch
Jul 20, 2026
Merged

chore(deps): update all non-major dependencies#288
HugoRCD merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@ai-sdk/mcp (source) ^2.0.10 → ^2.0.15 age confidence dependencies patch
@changesets/cli (source) ^2.31.0 → ^2.31.1 age confidence devDependencies patch
@iconify-json/lucide ^1.2.116 → ^1.2.118 age confidence devDependencies patch
@iconify-json/simple-icons ^1.2.89 → ^1.2.90 age confidence devDependencies patch 1.2.91
@nuxt/ui (source) ^4.9.0 → ^4.10.0 age confidence dependencies minor
@nuxthub/core (source) ^0.10.7 → ^0.10.8 age confidence dependencies patch
@vitejs/plugin-vue (source) ^6.0.7 → ^6.0.8 age confidence devDependencies patch
@vitejs/plugin-vue (source) ^6.0.7 → ^6.0.8 age confidence dependencies patch
@vue/compiler-sfc (source) ^3.5.38 → ^3.5.40 age confidence peerDependencies patch
@vue/compiler-sfc (source) ^3.5.39 → ^3.5.40 age confidence devDependencies patch
agents (source) >=0.16.0 → >=0.17.4 age confidence peerDependencies minor
ai (source) ^7.0.22 → ^7.0.31 age confidence dependencies patch
evlog (source) ^2.20.0 → ^2.22.0 age confidence devDependencies minor
evlog (source) ^2.20.0 → ^2.22.0 age confidence dependencies minor
node 22 → 22.23.1 age confidence uses-with minor
pnpm (source) 11.6.0 → 11.15.0 age confidence packageManager minor 11.15.1
pnpm (source) 10.34.3 → 10.34.5 age confidence packageManager patch
turbo (source) ^2.10.4 → ^2.10.5 age confidence devDependencies patch
vite (source) ^8.1.4 → ^8.1.5 age confidence devDependencies patch
vue (source) ^3.5.38 → ^3.5.40 age confidence peerDependencies patch
vue (source) ^3.5.39 → ^3.5.40 age confidence devDependencies patch

Release Notes

vercel/ai (@​ai-sdk/mcp)

v2.0.15

Compare Source

Patch Changes

v2.0.14

Compare Source

Patch Changes

  • 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

    • Runtime-validate _meta.ui and drop malformed or non-string fields.
    • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
    • Derive a concrete postMessage target origin and validate inbound message origins.
    • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
    • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.

v2.0.13

Compare Source

Patch Changes

v2.0.12

Compare Source

Patch Changes
changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes
  • #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
nuxt/ui (@​nuxt/ui)

v4.10.0

Compare Source

Features
Bug Fixes
  • AuthForm: track password visibility per field (#​6638) (0faeb92)
  • BlogPost/ChangelogVersion: format date in UTC to prevent hydration mismatch (#​6722) (fe5bb23)
  • Button: allow inline event handlers with non-void return types (#​6668) (269080a)
  • Carousel: prevent reset when plugin props use inline objects (f41d11e), closes #​6221
  • ChatMessages: re-evaluate streaming indicator on each render (#​6673) (5c986dd)
  • components: forward $attrs to root element when to prop is absent (#​6628) (d3b5f1d)
  • components: forward data-slot to component root (#​6643) (c9c5232)
  • components: respect prefers-reduced-motion in animations (#​6723) (f951529)
  • ContentNavigation: key items by identity to prevent leading icon flash (#​6640) (09fb52b)
  • defineShortcuts: add missing arrowdown to shiftable keys (#​6702) (2128414)
  • defineShortcuts: defer standalone shortcuts that prefix a chain (#​6703) (76ee176)
  • Editor: prevent suggestion menu blinking on keystroke (#​6712) (7e6d8b0)
  • FileUpload: add aria-disabled attribute when disabled (#​6653) (c3b2996)
  • inertia: make useRoute().fullPath reactive across navigations (#​6696) (c256997)
  • Link: apply rel prop to internal links (#​6677) (276302e)
  • Link: fall back to original path when localePath fails (#​6637) (906e8fd)
  • LocaleSelect: add missing keys in emoji mapping (#​6629) (fab73ab)
  • module: avoid unhead v2-only hookOnce in colors plugin (#​6658) (e4ca579)
  • SelectMenu/InputMenu: only re-highlight first item with create-item (#​6689) (a71dece)
  • Separator: forward fall-through attributes to root (#​6641) (88baabc)
  • theme: use logical properties for RTL (#​6724) (3179012)
  • types: type prose components in app config (#​6711) (d56e39a)
  • useComponentProps: let app config defaultVariants override withDefaults (#​6686) (f5e58fb)
  • useFileUpload: keep dropzone type filter reactive to accept (#​6699) (000aba4)
  • useResizable: recover from corrupted persisted storage (#​6704) (4c60745)
  • useResizable: share resize logic between mouse and touch (#​6705) (730a54c)
  • useScrollspy: unobserve previous headings on update (#​6700) (5944067)
  • useToast: dedupe duplicate ids and handle max of 0 (#​6698) (71c623b)
Performance Improvements
  • components: drop the redundant inner in component extend (#​6647) (3bf1a92)
  • module: declare sideEffects for barrel tree-shaking (#​6729) (2cc2849)
  • types: decouple useComponentProps from the component-types barrel (#​6648) (6576fb8)
  • types: import cross-component types from source, not the barrel (#​6646) (7eab4bc)
  • vue: skip rewriting unchanged templates (#​6730) (14b6001)
nuxt-hub/core (@​nuxthub/core)

v0.10.8

Compare Source

compare changes

🩹 Fixes
  • blob: Use variable for vercel-blob dynamic import (#​810)
  • Resolve module add exports error (#​858)
  • docs: Align tab content in examples (fe2a97f)
  • sql: Use dialect-aware identifier quoting in CLI commands (#​889)
  • blob: Declare @​vercel/blob as optional peer dependency (#​904)
  • Resolve types for server auto-imports (#​905)
  • db: Avoid reusing hyperdrive postgres client (#​895)
  • db: Skip hyperdrive build migrations (#​868)
  • Pin pnpm to 11.7.0 to resolve CI self-installer crash (#​913)
  • db: Build schema with platform 'node' to silence UNRESOLVED_IMPORT warnings (#​912)
📖 Documentation
  • cloudflare: Clarify d1 deployment migrations (#​862)
  • Remove sqlite support warning for drizzle studio (#​909)
  • Document cloudflare workers builds d1 pattern (#​897)
  • Add cloudflare hyperdrive docs (#​875)
🤖 CI
  • Add mkdist as direct devDependency (#​903)
❤️ Contributors
vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features
Bug Fixes
vuejs/core (@​vue/compiler-sfc)

v3.5.40

Compare Source

Bug Fixes

v3.5.39

Compare Source

Bug Fixes
cloudflare/agents (agents)

v0.17.4

Compare Source

Patch Changes

  • #​1902 a9d78c0 Thanks @​mattzcarey! - Always apply the Worker-safe CfWorkerJsonSchemaValidator to MCP client connections by default.

    MCPClientConnection now owns the default (merged in its constructor), so every construction path uses the Worker-safe validator unless the caller supplies their own — including the RPC addMcpServer(name, namespace) path via MCPClientManager.connect(), which previously skipped it. Without the default, the MCP SDK fell back to its AJV validator when a server exposed tools with outputSchema; AJV compiles schemas with new Function, which Workers disallows, failing discovery with "Code generation from strings disallowed for this context".

    connect() now builds connections through createConnection() instead of duplicating construction, so the two paths can no longer drift. Caller-supplied client.jsonSchemaValidator overrides are respected on the live connection; because validator instances cannot survive JSON serialization, they are no longer persisted, and a previously persisted, serialization-degraded validator is ignored on restore — after hibernation the connection falls back to the Worker-safe default instead of failing discovery.

  • #​1903 3ba6a78 Thanks @​mattzcarey! - MCP client: url-mode elicitation support with a real elicitation handler

    • Agents can now respond to server-initiated elicitation/create requests by
      calling this.mcp.configureElicitationHandlers({ form, url }), typically in
      onStart(). The advertised modes are persisted with each MCP server, so
      connections restored after Durable Object hibernation re-advertise them at
      the handshake and the handlers re-attach when onStart runs.
    • Connections advertise elicitation modes based on what can actually be
      handled: they advertise exactly the modes with configured handlers at the
      initialize handshake; without handlers they advertise no elicitation
      capability. An explicit
      client.capabilities.elicitation (e.g. via addMcpServer) always wins,
      is persisted with the server options, and survives hibernation — it is no
      longer clobbered by a hardcoded value.

  • #​1925 762998d Thanks @​mattzcarey! - MCP client: consume the persisted capability seed at first use instead of at restore-time read

    The capability stamp persisted on each MCP server row (used to re-advertise elicitation modes at the handshake after Durable Object hibernation) was read-and-cleared when the connection object was created, before any connection attempt. Wakes that never reached a handshake burned it: a restore that parked on a pending OAuth flow, or a wake interrupted between restore and onStart re-stamping the rows, left the next wake's connections negotiating without the elicitation capability until some later reconnect.

    The stamp is now read without clearing and only cleared once a seeded handshake actually completes in a session that has not configured handlers, preserving the one-successful-restore semantics: after the seed is used in a completed handshake it no longer re-advertises stale modes, and any configureElicitationHandlers call still re-stamps every row. Sessions with handlers configured own their row stamps, so a handshake there (e.g. re-adding a server under a stable id) keeps the fresh stamp in place for the next wake.

  • #​1910 9e1b733 Thanks @​mattzcarey! - MCP client: advertise no elicitation capability when no handler is configured

    Connections without an elicitation handler previously advertised form-mode
    elicitation while rejecting every elicitation request that arrived, so
    spec-compliant servers chose elicitation over their fallback flows and the
    tool call failed mid-flight. Connections now advertise the elicitation
    capability only when it can be handled: form mode, URL mode, or both, based on
    handlers configured via this.mcp.configureElicitationHandlers({ form, url }).
    Connections without handlers advertise no elicitation capability, letting
    servers fall back gracefully.

    An explicit client.capabilities.elicitation declaration remains authoritative.
    Only advertise modes your Agent can handle.

  • #​1869 f274903 Thanks @​mattzcarey! - Fix addMcpServer() reporting ready for an HTTP MCP connection that was restored while OAuth is still in progress.

    For an existing AUTHENTICATING connection, addMcpServer() now prefers the live authorization URL, otherwise returns a persisted absolute HTTP(S) authorization URL. If neither is available, it reconnects the existing connection without re-registering it: a new authorization URL is returned and persisted, a connected result is discovered before returning ready, and failed or incomplete OAuth results throw instead of falling through to ready.

v0.17.3

Compare Source

Patch Changes

v0.17.1

Compare Source

Patch Changes

  • #​1826 1bbd9bc Thanks @​threepointone! - Add a tight, OOM-specific retry budget to chat recovery so a memory-limit crash loop seals fast and attributably (#​1825).

    When a recovery turn hits a Durable Object memory-limit reset (the isolate exceeded its 128 MB limit), recovery now classifies it as a distinct, deterministic failure rather than a deploy-style transient. A memory reset re-OOMs on re-run (the turn's working set, not the platform, is the cause), so it must NOT be deferred and retried forever like a code-update/connection-lost transient. Each such crash bumps a durable per-incident oomAttempts counter; recovery retries a small number of times (new chatRecovery.maxOomRetries, default 3) — in case the OOM was a transient spike — then seals with reason="out_of_memory". This is far tighter than the generic maxRecoveryWork backstop because an OOM is attributable and each re-run re-runs the model.

    This complements the finite maxRecoveryWork default: the OOM budget is the fast path for memory resets that surface as catchable errors thrown from recovery bookkeeping (e.g. storage/SQL rejections after the reset), while maxRecoveryWork remains a backstop for the hard-kill case where no in-isolate code runs to record the OOM.

    Adds an alarm-boundary circuit breaker (agents) as the universal backstop for the case the in-DO budgets can't catch (#​1825): a memory-limit reset that bypasses them entirely — thrown before the budget code runs (e.g. boot-time state hydration OOMs), or whose own small writes also OOM under memory pressure. Left unhandled, such an error propagates out of alarm() and the platform auto-retries the alarm forever, re-running the doomed, billable turn each cycle. Agent.alarm() now intercepts ONLY Durable Object memory-limit resets at the outermost frame — where the heavy turn has unwound and GC has reclaimed its footprint, so the seal/purge writes can land where mid-turn ones OOMed. A durable strike counter tolerates a few resets (new static options.maxAlarmMemoryLimitStrikes, default 3) — backing off the looping rows so the retry is not a hot loop — then seals the recovery (out_of_memory) and surgically purges only the looping schedule rows, leaving unrelated scheduled tasks intact. A new alarm:memory_limit_reset observability event is emitted. Everything except memory-limit resets re-throws exactly as before.

    Also broadens and exports the isDurableObjectMemoryLimitReset(error) predicate from agents (a sibling to isDurableObjectCodeUpdateReset / isPlatformTransientError): it now matches the shared "exceeded its memory limit" fragment so truncated/reworded surfacings (observed in real #​1825 logs) still classify.

  • #​1826 1bbd9bc Thanks @​threepointone! - Fix neverending chat-recovery retries when a Durable Object isolate runs out of memory mid-turn (#​1825).

    chatRecovery.maxRecoveryWork now defaults to a generous finite backstop (1000) instead of Infinity. An isolate that exceeds its memory limit and is reset mid-stream has usually already streamed a little content, which bumps the durable progress counter. On the next wake recovery reads that as forward progress and resets both progress-keyed bounds — the attempt cap (maxAttempts) and the no-progress window (noProgressTimeoutMs) — and because each crash lands inside the alarm-debounce window the attempt counter is pinned too. With the work budget disabled (Infinity), no instrument could ever seal the turn, so recovery re-ran the turn (and its LLM calls) forever. The work meter is the one signal that keeps climbing across such a loop, so a finite default seals a runaway with reason="work_budget_exceeded" instead of looping.

    Work only accrues from the first interruption until the turn completes, so a normal interrupted turn never approaches the cap. A very long agentic turn that legitimately produces a large amount of content under heavy interruption can raise maxRecoveryWork (or set it to Infinity to restore the previous fully-unbounded behavior, ideally paired with a shouldKeepRecovering predicate that bounds the runaway via real token/cost accounting).

v0.17.0

Compare Source

Minor Changes

  • #​1758 6b46b04 Thanks @​threepointone! - Add progress signalling and durable milestones for agent-tool sub-agents
    (#​1758, rfc-detached-agent-tools §progress, phases 4a + 4b).

    A sub-agent running as an agent tool (awaited or detached/background) can now
    report mid-run progress:

    // Inside the child sub-agent (e.g. from a tool's execute):
await this.reportProgress({
  fraction: 0.6,
  phase: "deploying",
  message: "Generating menu page…",
});

    These signals ride the child's own turn stream as a transient
    data-agent-progress part, so they re-broadcast to the parent's connected
    clients and surface on AgentToolRunState.progress via useAgentToolEvents — a
    background-runs tray can render a live bar / phase / status line without drilling
    in. Highlights:

    • reportProgress({ fraction?, message?, phase?, data? }, { persist? }) on
      chat agents (@cloudflare/think, AIChatAgent); a no-op with a dev warning on
      the base Agent and when called outside an active agent-tool run. The framework
      resolves the run id from the active turn — no threading required. Bursts are
      coalesced (latest-wins; a fraction >= 1 "done" frame always flushes). data
      is live-only unless { persist: true }.
    • onProgress(run, progress) parent hook, fired best-effort from the tail
      for both awaited and detached runs.
    • Latest-snapshot persistence + recovery inspect. The child stores a
      progress_json + last_signal_at on its run row and surfaces it through
      inspectAgentToolRun().progress, so a rehydrated parent reconstructs progress
      after eviction.
    • Resetting no-progress budget for detached runs. Once a detached child has
      reported at least one signal, the backbone gives up if it then goes silent for
      detachedNoProgressBudgetMs (default 1h; per-run override via
      detached: { noProgressBudgetMs }), surfaced as interrupted with the
      no-progress reason. A child that never reports is bounded only by the absolute
      detachedMaxBudgetMs ceiling — we never give up on a run merely for being slow.

v0.16.2

Compare Source

Patch Changes

  • #​1767 f03dee6 Thanks @​threepointone! - Reduce Think Durable Object SQLite reads during normal wakes and text-only turns.

    Think now avoids automatic media-eviction scans until hydration has been windowed or an oversized appended message has been observed. The shared resumable stream buffer also avoids per-wake metadata-column introspection by creating new tables with the current columns and lazily migrating legacy tables only when a stream write needs it.

  • #​1722 9f8e14b Thanks @​mattzcarey! - Fix two MCP client OAuth bugs found by the new conformance suite, and add MCP conformance testing.

    • MCPClientConnection now finishes OAuth on the transport that received the 401. A fresh transport loses the resource metadata URL from the WWW-Authenticate header, so token exchange fell back to the default /token path and failed against authorization servers at non-default locations.
    • MCPClientConnection.init() detaches the previous transport before reconnecting. Re-authorizing after a mid-session 401 (scope step-up, token revocation) previously failed permanently with "Already connected to a transport".
    • Added the official @modelcontextprotocol/conformance suite (as used by the MCP TypeScript SDK) running against the MCP client (Agent + MCPClientManager), McpAgent, and createMcpHandler + WorkerTransport — all hosted in workerd via wrangler dev. See packages/agents/conformance/README.md.

  • #​1767 f03dee6 Thanks @​threepointone! - Cache the active branch tip in AgentSessionProvider so finding the latest leaf no longer scans the whole session on every read and append.

    latestLeafRow() previously ran an anti-join over every message row (O(rows)) to locate the branch tip — on each hydration AND each auto-parent append, so on long transcripts it dominated a wake's read cost. The tip is now maintained in place on append/delete/clear; a cached tip is re-validated on read with an O(1) existence + still-childless check (so it self-heals if another writer deletes the tip or gives it a child), and the full scan only runs when that check fails or the cache is cold. Per-hydration and per-append tip lookups drop from O(rows) to O(1), and the full scan never runs more often than before.

v0.16.1

Compare Source

Patch Changes

  • #​1757 92a5ba1 Thanks @​threepointone! - Bump the partyserver dependency to ^0.5.8, which base64-encodes the
    x-partykit-props header so props containing non-ASCII characters (e.g.
    accented names) no longer trigger workerd's "header value contains non-ASCII
    characters" warning (which throws a TypeError in browser fetch
    implementations). The header is decoded back to the original Unicode payload on
    the server, and raw-JSON values from older callers are still accepted for
    backwards compatibility.

  • #​1754 151d457 Thanks @​threepointone! - Pin accepted WebSocket connections to binaryType = "arraybuffer". On Worker
    compatibility_dates >= 2026-03-17 the runtime defaults a server WebSocket's
    binaryType to "blob" (the websocket_standard_binary_type flag), so binary
    frames arrive as Blob instead of ArrayBuffer. The Agent protocol and every
    downstream consumer (e.g. @cloudflare/voice audio frames, user onMessage
    handlers that check message instanceof ArrayBuffer) have always relied on
    ArrayBuffer. The Agent now sets connection.binaryType = "arraybuffer" when a
    connection is established, restoring the historical contract regardless of
    compatibility date without requiring the no_websocket_standard_binary_type
    flag. (The hibernatable webSocketMessage handler always delivers
    ArrayBuffer, so this only affects non-hibernating agents.)

    Also bumps the partyserver dependency to ^0.5.7, which pins binaryType at
    the connection layer (accept()), accepts non-hibernating connections in
    half-open mode, and suppresses retryable transport-teardown errors on
    already-closing/closed connections. With partyserver now pinning binaryType
    itself, the Agent's own pin becomes defense-in-depth (kept for older partyserver
    versions and custom connections) and runs once per connection per isolate
    lifetime instead of on every state access.

  • #​1754 151d457 Thanks @​threepointone! - Add Browser Run Live View support to the browser tools. The cdp connector
    gains a getLiveViewUrl({ targetId?, mode? }) tool that returns a link a human
    can open to watch and control a session in real time — the building block for
    human-in-the-loop handoffs (login, MFA, CAPTCHA, sensitive input), paired with
    the runtime's durable approval pause. BrowserConnector also exposes a
    host-side liveView() helper for surfacing the shared session's Live View URLs
    in your own UI; each BrowserLiveViewTarget includes the tab's current
    pageUrl so you can label tabs and filter out blank/internal pages. New
    LiveViewMode, BrowserLiveView, BrowserLiveViewTarget, and
    BrowserLiveViewUrl types are exported from agents/browser.

  • #​1754 151d457 Thanks @​threepointone! - Add Browser Run Quick Actions to the browser tools: stateless, one-shot
    browsing that needs only the browser binding — no Durable Object, loader, or
    sandbox. New primitives in agents/browser (browserMarkdown,
    browserExtract, browserLinks, browserScrape, browserContent,
    browserSnapshot, browserScreenshot, browserPdf, plus runQuickAction)
    wrap the quickAction() binding and unwrap its { success, result } envelope.
    A new createQuickActionTools({ browser }) (from agents/browser/ai) returns
    AI SDK tools (browser_markdown, browser_extract, browser_links,
    browser_scrape, opt-in browser_content) so an agent can read a page

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nuxt-mcp-toolkit-docs Ready Ready Preview, Comment Jul 20, 2026 7:06am

Request Review

@HugoRCD
HugoRCD merged commit e303bc1 into main Jul 20, 2026
10 of 11 checks passed
@HugoRCD
HugoRCD deleted the renovate/all-minor-patch branch July 20, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@HugoRCD