Skip to content

fix: bump the npm-minor-patch group across 1 directory with 37 updates - #2444

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-460c397b12
Open

fix: bump the npm-minor-patch group across 1 directory with 37 updates#2444
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-460c397b12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 37 updates in the / directory:

Package From To
@ai-sdk/gateway 4.0.90 4.0.113
@google-cloud/text-to-speech 7.1.0 7.2.0
@google/genai 2.24.0 2.29.1
@opentelemetry/core 2.11.0 2.12.0
@types/node 26.0.0 26.6.5
ai 7.0.112 7.0.140
dotenv 18.0.3 18.0.8
openai 7.23.0 7.33.0
@modelcontextprotocol/sdk 1.30.1 1.32.1
turbo 2.11.3 2.11.8
undici 8.11.0 8.12.1
@ai-sdk/react 4.0.117 4.0.143
@flags-sdk/vercel 1.4.9 1.5.1
@opentelemetry/exporter-trace-otlp-http 0.222.0 0.223.0
@opentelemetry/instrumentation 0.222.0 0.223.0
@opentelemetry/resources 2.11.0 2.12.0
@opentelemetry/sdk-trace-base 2.11.0 2.12.0
@radix-ui/react-label 2.1.15 2.1.17
@radix-ui/react-separator 1.1.15 1.2.0
@radix-ui/react-tabs 1.1.21 1.2.1
@sentry/nextjs 11.0.0 11.7.0
@supabase/supabase-js 2.117.1 2.117.3
@v0-sdk/react 3.0.7 3.0.10
@vercel/blob 2.8.0 2.8.2
@vercel/functions 3.9.9 3.10.1
lucide-react 1.47.0 1.57.0
react-resizable-panels 4.13.2 4.14.5
redis 6.2.1 6.3.0
tldts 7.4.15 7.4.18
v0 3.0.7 3.0.10
zod 4.6.5 4.6.7
@playwright/test 1.63.0 1.64.1
eslint-config-next 16.3.6 16.4.1
jsdom 30.1.1 30.1.2
playwright 1.63.0 1.64.1
postcss 8.5.28 8.5.30
vite 8.3.0 8.3.4

Updates @ai-sdk/gateway from 4.0.90 to 4.0.113

Changelog

Sourced from @​ai-sdk/gateway's changelog.

4.0.113

Patch Changes

  • 42a2895: chore(provider/gateway): update gateway model settings files

4.0.112

Patch Changes

  • 685667c: chore(provider/gateway): update gateway model settings files
  • bdbeba3: feat(google): add gemini-4-argon model id and long decode support for generateContent: requests that reach the per-request cap (CONTINUATION) are continued automatically with usage summed across requests and the first request's prompt token count exposed as providerMetadata.google.initialPromptTokenCount, and the continuationToken provider option / provider metadata resume responses that used up their maxOutputTokens budget. generateText with the Interactions API now polls background: true model calls until they finish.
  • ec2af7b: chore(provider/gateway): update gateway model settings files

4.0.111

Patch Changes

  • Updated dependencies [9667bf2]
  • Updated dependencies [e57803c]
  • Updated dependencies [81663cc]
    • @​ai-sdk/provider-utils@​5.0.59
    • @​ai-sdk/provider@​4.0.27

4.0.110

Patch Changes

  • e280aa1: feat(gateway): send image files in decision state

4.0.109

Patch Changes

  • 5cf13d2: feat: map the top level embedding dimensions to provider settings
  • 908fd12: chore(provider/gateway): update gateway model settings files
  • Updated dependencies [4dbc902]
    • @​ai-sdk/provider@​4.0.26
    • @​ai-sdk/provider-utils@​5.0.58

4.0.108

Patch Changes

  • 9184a35: Add ordered text, file, and JSON parts to experimental decision state. Support image input in OpenAI Decisions and language model adapters. Gateway retains its existing string and JSON request format and rejects files, as does TypeSafe AI.

    Arrays passed directly as state now contain decision state parts. Wrap JSON arrays in an object or a json part.

    Normalize all public state forms into an array of parts before calling decision providers. Providers receive text and JSON objects as text and json parts.

... (truncated)

Commits

Updates @google-cloud/text-to-speech from 7.1.0 to 7.2.0

Release notes

Sourced from @​google-cloud/text-to-speech's releases.

os-login: v7.2.0

7.2.0 (2026-10-08)

Features

paginator: v7.2.0

7.2.0 (2026-10-08)

Features

resource-manager: v7.2.0

7.2.0 (2026-10-08)

Features

secret-manager: v7.2.0

7.2.0 (2026-10-08)

Features

service-directory: v7.2.0

7.2.0 (2026-10-08)

Features

text-to-speech: v7.2.0

7.2.0 (2026-10-08)

Features

video-intelligence: v7.2.0

7.2.0 (2026-10-08)

... (truncated)

Changelog

Sourced from @​google-cloud/text-to-speech's changelog.

7.2.0 (2026-10-08)

Features

7.1.1 (2026-09-28)

Bug Fixes

  • Update package.json and .gitignore across packages (#9378) (9c54cec)
Commits
  • 703154b chore: release main (#9584)
  • 6375767 chore(packages): migrate generated packages to runtime-agnostic test runner (...
  • 27c2f65 chore: release main (#9442)
  • 9c54cec fix: update package.json and .gitignore across packages (#9378)
  • cd8400f chore: upgrade to latest version of gapic-generator-typescript (#9374)
  • 65a9440 chore: revert update .nycrc, Contributing.md, and .gitignore across packages ...
  • 3ff5ae9 chore: update .nycrc, Contributing.md, and .gitignore across packages (#9144)
  • e96b309 chore: release main (#9262)
  • c249594 chore: upgrade librarian gapic-generator-typescript to v5.2.0 (#9252)
  • See full diff in compare view

Updates @google/genai from 2.24.0 to 2.29.1

Release notes

Sourced from @​google/genai's releases.

v2.29.1

2.29.1 (2026-10-13)

Bug Fixes

  • concatenate output_text across multi-step model responses in a turn (567cc8a)

v2.29.0

2.29.0 (2026-10-13)

Features

  • accumulate streaming continuation usage metadata and expose initialPromptTokenCount (dbc961f)
  • Add continuation_token to the Interactions interaction.status_update event. (a93776c)
  • Add a CONTINUATION_REQUIRED Interaction status (754f71f)
  • add billable token counts fields (839ffc2)
  • Add startOffset/endOffset to Transcription and interimTranscriptTimestampEnabled to RealtimeInputConfig (bdbf156)
  • Add usage in InteractionStatusUpdate events (8892aea)
  • automatically consume the continuation token (98637d1)
  • cli: update Speakeasy generator to v2.948.0, bump CLI to v0.4.2, and apply CLI overlay fixes (22d53ec)

Bug Fixes

  • clear intermediate CONTINUATION finishReason in streaming continuation (22706af)
  • do not record incomplete continuation stream turns in curated chat history (81c3c49)
  • gemini-api-cli: remove unsupported 2.5 and 1.6 models from Interactions model options and CLI examples (1002720)
  • js: do not set initial prompt token count for requests that do not use automatic consumption of continuation token (0885fb9)
  • js: fix streaming continuation edge cases (stale token, AbortError, initialPromptTokenCount) (f3d10a6)
  • Raise default HTTP timeouts so long-running requests aren't killed client-side (10e850c)
  • resume streaming generation from the latest checkpoint continuation token on mid-stream errors or cutoffs (625ac2c)
  • Update EnvironmentConfig.env schema to map keys to EnvVar or string. (8478e12)

v2.28.0

2.28.0 (2026-10-07)

Features

  • Support "allowlist": "disabled" in environment network config. (18bc392)
  • update discovery doc (4e996fe)

v2.27.0

2.27.0 (2026-10-02)

Features

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

2.29.1 (2026-10-13)

Bug Fixes

  • concatenate output_text across multi-step model responses in a turn (567cc8a)

2.29.0 (2026-10-13)

Features

  • accumulate streaming continuation usage metadata and expose initialPromptTokenCount (dbc961f)
  • Add continuation_token to the Interactions interaction.status_update event. (a93776c)
  • Add a CONTINUATION_REQUIRED Interaction status (754f71f)
  • add billable token counts fields (839ffc2)
  • Add startOffset/endOffset to Transcription and interimTranscriptTimestampEnabled to RealtimeInputConfig (bdbf156)
  • Add usage in InteractionStatusUpdate events (8892aea)
  • automatically consume the continuation token (98637d1)
  • cli: update Speakeasy generator to v2.948.0, bump CLI to v0.4.2, and apply CLI overlay fixes (22d53ec)

Bug Fixes

  • clear intermediate CONTINUATION finishReason in streaming continuation (22706af)
  • do not record incomplete continuation stream turns in curated chat history (81c3c49)
  • gemini-api-cli: remove unsupported 2.5 and 1.6 models from Interactions model options and CLI examples (1002720)
  • js: do not set initial prompt token count for requests that do not use automatic consumption of continuation token (0885fb9)
  • js: fix streaming continuation edge cases (stale token, AbortError, initialPromptTokenCount) (f3d10a6)
  • Raise default HTTP timeouts so long-running requests aren't killed client-side (10e850c)
  • resume streaming generation from the latest checkpoint continuation token on mid-stream errors or cutoffs (625ac2c)
  • Update EnvironmentConfig.env schema to map keys to EnvVar or string. (8478e12)

2.28.0 (2026-10-07)

Features

  • Support "allowlist": "disabled" in environment network config. (18bc392)
  • update discovery doc (4e996fe)

2.27.0 (2026-10-02)

Features

  • add lyria-3.5, gemini-omni-1.1-flash, and gemini-omni-flash-preview to Interactions Model enum (4ce63d1)
  • support continuation_token in Interactions (a888ad7)

2.26.0 (2026-10-01)

... (truncated)

Commits
  • 2e083a7 chore(main): release 2.29.1 (#2052)
  • 51cf872 chore(main): release 2.29.0
  • 567cc8a fix: concatenate output_text across multi-step model responses in a turn
  • 1693f7c chore(main): release 2.29.0 (#2013)
  • f66291c chore: return early on generate content if automatic continuation is not needed
  • 0885fb9 fix(js): do not set initial prompt token count for requests that do not use a...
  • 10e850c fix: Raise default HTTP timeouts so long-running requests aren't killed clien...
  • f3d10a6 fix(js): fix streaming continuation edge cases (stale token, AbortError, init...
  • 3ecb0b5 chore: internal change
  • 8478e12 fix: Update EnvironmentConfig.env schema to map keys to EnvVar or string.
  • Additional commits viewable in compare view

Updates @opentelemetry/core from 2.11.0 to 2.12.0

Release notes

Sourced from @​opentelemetry/core's releases.

v2.12.0

2.12.0

🚀 Features

  • chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086

🏠 Internal

  • feat(ci): support releasing from maintenance branches #6767 @​pichlermarc
    • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.
Changelog

Sourced from @​opentelemetry/core's changelog.

2.12.0

🏠 Internal

  • chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086
  • feat(ci): support releasing from maintenance branches #6767 @​pichlermarc
    • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.
Commits
  • 92b844e chore: prepare next v2.x release (#7151)
  • a859aff fix(web-common): export getElementXPath utility (#7124)
  • 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
  • d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
  • 5bd476e chore: move context manager to sdk-trace (#7086)
  • 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
  • 788922c ci: support maintenance branch releases (#7036)
  • See full diff in compare view

Updates @types/node from 26.0.0 to 26.6.5

Commits

Updates ai from 7.0.112 to 7.0.140

Changelog

Sourced from ai's changelog.

7.0.140

Patch Changes

  • 9523eb0: feat(ai): add configurable tool call execution concurrency
  • Updated dependencies [42a2895]
    • @​ai-sdk/gateway@​4.0.113

7.0.139

Patch Changes

  • Updated dependencies [685667c]
  • Updated dependencies [bdbeba3]
  • Updated dependencies [ec2af7b]
    • @​ai-sdk/gateway@​4.0.112

7.0.138

Patch Changes

  • eab278a: fix: resume interrupted chat streams when the page becomes visible again

    useChat with resume: true no longer starts a second resume request on mount when the chat is already submitted or streaming, e.g. when remounting with a shared Chat instance mid-stream.

  • 26d64e9: fix(ai): update tool outputs in the message containing the matching tool call

  • 75b3ea2: fix(ai): prevent duplicate message parts when resuming replayed streams

  • 69f4b82: fix(ai): prevent global type conflicts across SDK versions

  • e57803c: Add an optional shared citation representation to generated text and text-end stream events, separate from retrieved sources. Preserve citations in core result content and UI message text parts, including validation and persistence, without changing content or stream event discriminants.

  • 4c705d9: Fix validation of rounded choice probabilities in experimental_decide.

  • 5150d50: fix(ai): update streaming chat messages by stable ID

  • 9aef724: fix(workflow): report incomplete no-output model streams as errors

  • 7d0458b: fix(ai): reject approved tool calls without results before sending later context to providers

  • Updated dependencies [9667bf2]

  • Updated dependencies [e57803c]

  • Updated dependencies [81663cc]

    • @​ai-sdk/provider-utils@​5.0.59
    • @​ai-sdk/provider@​4.0.27
    • @​ai-sdk/gateway@​4.0.111

7.0.137

Patch Changes

  • e27cc64: fix(ai): discard unrelated message state when reading resumed streams

7.0.136

Patch Changes

... (truncated)

Commits
  • dbdbd0c Version Packages (#23269)
  • 9523eb0 feat: add configurable concurrency for SDK-executed tool calls (#22135)
  • 5dec614 Version Packages (#23122)
  • 543d42c Version Packages (#22437)
  • 75b3ea2 fix(ai): prevent duplicate message parts when resuming replayed streams (#22560)
  • eab278a fix: resume interrupted chat streams after returning to a backgrounded page (...
  • 5150d50 fix: preserve streaming assistant message identity when the chat message list...
  • e57803c fix: separate retrieved sources from normalized text citations (#21797)
  • 7d0458b fix: reject unresolved approved tool calls followed by later context (#22449)
  • 26d64e9 fix: addToolOutput results being dropped for tool calls in earlier messages (...
  • Additional commits viewable in compare view

Updates dotenv from 18.0.3 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)
Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • 2953207 18.0.7
  • 9944723 make more readable for undefined -> null
  • d455db0 Merge branch 'master' of github.com:motdotla/dotenv
  • Additional commits viewable in compare view

Updates openai from 7.23.0 to 7.33.0

Release notes

Sourced from openai's releases.

v7.33.0

7.33.0 (2026-10-14)

Features

  • add browser and computer toolsets (1/4) (#2936) (3811840)
  • api: add beta session spending limits (#2916) (f57c965)
  • api: add billing_not_active session error code (#2911) (ee3f743)
  • api: add OCI external-storage provider support (#2917) (80e210e)
  • api: add organization Decisions usage reporting (#2919) (3f8753e)
  • api: add shida to named Live voices (#2912) (d6d80a1)
  • api: add vault updates and metadata filters (#2906) (1bbc425)
  • api: align beta pagination limits and non-null parameters (#2915) (4ae463a)
  • api: expose image tool error and moderation details (#2935) (0bf85e0)
  • api: support image URLs and detailed safety alert explanations (#2918) (8297332)
  • api: support updating project API key expiry (#2922) (467a082)

Chores

  • api: clarify agent tool limits and environment pagination (#2920) (05b8763)
  • api: clarify decision creation documentation (#2913) (1c380ea)
  • api: clarify Decisions question and answer descriptions (#2910) (b5c7300)
  • api: document 128-character safety identifiers (#2909) (75a6810)
  • api: document decision choice constraints (#2914) (3add470)
  • api: document Files API rate-limit responses (#2908) (250b6ac)

v7.32.0

7.32.0 (2026-10-09)

Features

  • api: add agent environment suspension and expiration (#2904) (6e4ed63)

Bug Fixes

  • deps: bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge (#2896) (88b4c05)
  • runners: preserve detailed token usage in totalUsage (#2900) (88bb984)

Documentation

  • fix migration guide types troubleshooting link (#2901) (690e5d7)

v7.31.0

7.31.0 (2026-10-09)

... (truncated)

Changelog

Sourced from openai's changelog.

7.33.0 (2026-10-14)

Features

  • add browser and computer toolsets (1/4) (#2936) (3811840)
  • api: add beta session spending limits (#2916) (f57c965)
  • api: add billing_not_active session error code (#2911) (ee3f743)
  • api: add OCI external-storage provider support (#2917) (80e210e)
  • api: add organization Decisions usage reporting (#2919) (3f8753e)
  • api: add shida to named Live voices (#2912) (d6d80a1)
  • api: add vault updates and metadata filters (#2906) (1bbc425)
  • api: align beta pagination limits and non-null parameters (#2915) (4ae463a)
  • api: expose image tool error and moderation details (#2935) (0bf85e0)
  • api: support image URLs and detailed safety alert explanations (#2918) (8297332)
  • api: support updating project API key expiry (#2922) (467a082)

Chores

  • api: clarify agent tool limits and environment pagination (#2920) (05b8763)
  • api: clarify decision creation documentation (#2913) (1c380ea)
  • api: clarify Decisions question and answer descriptions (#2910) (b5c7300)
  • api: document 128-character safety identifiers (#2909) (75a6810)
  • api: document decision choice constraints (#2914) (3add470)
  • api: document Files API rate-limit responses (#2908) (250b6ac)

7.32.0 (2026-10-09)

Features

  • api: add agent environment suspension and expiration (#2904) (6e4ed63)

Bug Fixes

  • deps: bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge (#2896) (88b4c05)
  • runners: preserve detailed token usage in totalUsage (#2900) (88bb984)

Documentation

  • fix migration guide types troubleshooting link (#2901) (690e5d7)

7.31.0 (2026-10-09)

Features

... (truncated)

Commits
  • dd51b11 release: 7.33.0 (#2907)
  • 3811840 feat: add browser and computer toolsets (1/4) (#2936)
  • 0bf85e0 feat(api): expose image tool error and moderation details (#2935)
  • 467a082 feat(api): support updating project API key expiry (#2922)
  • 05b8763 chore(api): clarify agent tool limits and environment pagination (#2920)
  • 3f8753e feat(api): add organization Decisions usage reporting (#2919)
  • 8297332 feat(api): support image URLs and detailed safety alert explanations (#2918)
  • 80e210e feat(api): add OCI external-storage provider support (#2917)
  • f57c965 feat(api): add beta session spending limits (#2916)
  • 4ae463a feat(api): align beta pagination limits and non-null parameters (#2915)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.1 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (

@dependabot
fix: bump the npm-minor-patch group across 1 directory with 37 updates
58a6686 
Bumps the npm-minor-patch group with 37 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/gateway](https://github.com/vercel/ai/tree/HEAD/packages/gateway) | `4.0.90` | `4.0.113` |
| [@google-cloud/text-to-speech](https://github.com/googleapis/google-cloud-node/tree/HEAD/packages/google-cloud-texttospeech) | `7.1.0` | `7.2.0` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.24.0` | `2.29.1` |
| [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.0.0` | `26.6.5` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.112` | `7.0.140` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.3` | `18.0.8` |
| [openai](https://github.com/openai/openai-node) | `7.23.0` | `7.33.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.1` | `1.32.1` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.3` | `2.11.8` |
| [undici](https://github.com/nodejs/undici) | `8.11.0` | `8.12.1` |
| [@ai-sdk/react](https://github.com/vercel/ai/tree/HEAD/packages/react) | `4.0.117` | `4.0.143` |
| [@flags-sdk/vercel](https://github.com/vercel/flags) | `1.4.9` | `1.5.1` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.223.0` |
| [@opentelemetry/instrumentation](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.223.0` |
| [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` |
| [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` |
| [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.15` | `2.1.17` |
| [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.15` | `1.2.0` |
| [@radix-ui/react-tabs](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs) | `1.1.21` | `1.2.1` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `11.0.0` | `11.7.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.117.1` | `2.117.3` |
| [@v0-sdk/react](https://github.com/vercel/v0-sdk/tree/HEAD/packages/react) | `3.0.7` | `3.0.10` |
| [@vercel/blob](https://github.com/vercel/storage/tree/HEAD/packages/blob) | `2.8.0` | `2.8.2` |
| [@vercel/functions](https://github.com/vercel/vercel/tree/HEAD/packages/functions) | `3.9.9` | `3.10.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.47.0` | `1.57.0` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.13.2` | `4.14.5` |
| [redis](https://github.com/redis/node-redis) | `6.2.1` | `6.3.0` |
| [tldts](https://github.com/remusao/tldts) | `7.4.15` | `7.4.18` |
| [v0](https://github.com/vercel/v0-sdk/tree/HEAD/packages/v0-sdk) | `3.0.7` | `3.0.10` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.6` | `16.4.1` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.1` | `30.1.2` |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.30` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` |



Updates `@ai-sdk/gateway` from 4.0.90 to 4.0.113
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/gateway/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/gateway@4.0.113/packages/gateway)

Updates `@google-cloud/text-to-speech` from 7.1.0 to 7.2.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-texttospeech/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/dlp-v7.2.0/packages/google-cloud-texttospeech)

Updates `@google/genai` from 2.24.0 to 2.29.1
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v2.24.0...v2.29.1)

Updates `@opentelemetry/core` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/v2.12.0/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0)

Updates `@types/node` from 26.0.0 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `ai` from 7.0.112 to 7.0.140
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.140/packages/ai)

Updates `dotenv` from 18.0.3 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.3...v18.0.8)

Updates `openai` from 7.23.0 to 7.33.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.23.0...v7.33.0)

Updates `@modelcontextprotocol/sdk` from 1.30.1 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.1...1.32.1)

Updates `turbo` from 2.11.3 to 2.11.8
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.3...v2.11.8)

Updates `undici` from 8.11.0 to 8.12.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.11.0...v8.12.1)

Updates `@ai-sdk/react` from 4.0.117 to 4.0.143
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/react@4.0.143/packages/react)

Updates `@flags-sdk/vercel` from 1.4.9 to 1.5.1
- [Release notes](https://github.com/vercel/flags/releases)
- [Commits](https://github.com/vercel/flags/compare/@flags-sdk/vercel@1.4.9...@flags-sdk/vercel@1.5.1)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.222.0 to 0.223.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.223.0)

Updates `@opentelemetry/instrumentation` from 0.222.0 to 0.223.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.223.0)

Updates `@opentelemetry/resources` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/v2.12.0/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0)

Updates `@opentelemetry/sdk-trace-base` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/v2.12.0/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0)

Updates `@radix-ui/react-label` from 2.1.15 to 2.1.17
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label)

Updates `@radix-ui/react-separator` from 1.1.15 to 1.2.0
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator)

Updates `@radix-ui/react-tabs` from 1.1.21 to 1.2.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tabs/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tabs)

Updates `@sentry/nextjs` from 11.0.0 to 11.7.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@11.0.0...11.7.0)

Updates `@supabase/supabase-js` from 2.117.1 to 2.117.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.117.3/packages/core/supabase-js)

Updates `@v0-sdk/react` from 3.0.7 to 3.0.10
- [Release notes](https://github.com/vercel/v0-sdk/releases)
- [Commits](https://github.com/vercel/v0-sdk/commits/v3.0.10/packages/react)

Updates `@vercel/blob` from 2.8.0 to 2.8.2
- [Release notes](https://github.com/vercel/storage/releases)
- [Changelog](https://github.com/vercel/storage/blob/main/packages/blob/CHANGELOG.md)
- [Commits](https://github.com/vercel/storage/commits/@vercel/blob@2.8.2/packages/blob)

Updates `@vercel/functions` from 3.9.9 to 3.10.1
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/functions/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/go@3.10.1/packages/functions)

Updates `lucide-react` from 1.47.0 to 1.57.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.57.0/packages/lucide-react)

Updates `react-resizable-panels` from 4.13.2 to 4.14.5
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.13.2...4.14.5)

Updates `redis` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.2.1...redis@6.3.0)

Updates `tldts` from 7.4.15 to 7.4.18
- [Release notes](https://github.com/remusao/tldts/releases)
- [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md)
- [Commits](remusao/tldts@v7.4.15...v7.4.18)

Updates `v0` from 3.0.7 to 3.0.10
- [Release notes](https://github.com/vercel/v0-sdk/releases)
- [Commits](https://github.com/vercel/v0-sdk/commits/v3.0.10/packages/v0-sdk)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `eslint-config-next` from 16.3.6 to 16.4.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.1/packages/eslint-config-next)

Updates `jsdom` from 30.1.1 to 30.1.2
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.1...v30.1.2)

Updates `playwright` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `postcss` from 8.5.28 to 8.5.30
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.28...8.5.30)

Updates `vite` from 8.3.0 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@ai-sdk/gateway"
  dependency-version: 4.0.113
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@google-cloud/text-to-speech"
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@google/genai"
  dependency-version: 2.29.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: ai
  dependency-version: 7.0.140
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: dotenv
  dependency-version: 18.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: openai
  dependency-version: 7.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: turbo
  dependency-version: 2.11.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: undici
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@ai-sdk/react"
  dependency-version: 4.0.143
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@flags-sdk/vercel"
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.223.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/instrumentation"
  dependency-version: 0.223.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/resources"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@opentelemetry/sdk-trace-base"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@radix-ui/react-label"
  dependency-version: 2.1.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@radix-ui/react-separator"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@radix-ui/react-tabs"
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@sentry/nextjs"
  dependency-version: 11.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.117.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@v0-sdk/react"
  dependency-version: 3.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@vercel/blob"
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@vercel/functions"
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: react-resizable-panels
  dependency-version: 4.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: redis
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tldts
  dependency-version: 7.4.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: v0
  dependency-version: 3.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: eslint-config-next
  dependency-version: 16.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: jsdom
  dependency-version: 30.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: postcss
  dependency-version: 8.5.30
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from groupthinking as a code owner October 17, 2026 20:58
@vercel

vercel Bot commented Oct 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
v0-uvai Ready Ready Preview, v0 Oct 17, 2026 9:01pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 17, 2026
@coderabbitai

coderabbitai Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: groupthinking/EventRelay/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 6edd2f07-482a-434a-9fb9-e38dee9035c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

🔍 PR Validation

⚠️ Large PR detected (8230 lines changed)

@github-actions

github-actions Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@ai-sdk/gateway ^4.0.113 UnknownUnknown
npm/@ai-sdk/react 4.0.143 UnknownUnknown
npm/@flags-sdk/vercel ^1.5.1 UnknownUnknown
npm/@google/genai ^2.29.1 UnknownUnknown
npm/@opentelemetry/core 2.12.0 🟢 7.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/exporter-trace-otlp-http ^0.223.0 UnknownUnknown
npm/@opentelemetry/instrumentation 0.223.0 🟢 7.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/resources 2.12.0 🟢 7.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@opentelemetry/sdk-trace-base 2.12.0 🟢 7.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@playwright/test ^1.64.1 UnknownUnknown
npm/@radix-ui/react-label ^2.1.17 UnknownUnknown
npm/@radix-ui/react-separator ^1.2.0 UnknownUnknown
npm/@radix-ui/react-tabs ^1.2.1 UnknownUnknown
npm/@sentry/nextjs ^11.7.0 UnknownUnknown
npm/@supabase/supabase-js ^2.117.3 UnknownUnknown
npm/@v0-sdk/react 3.0.10 UnknownUnknown
npm/@vercel/blob ^2.8.2 UnknownUnknown
npm/@vercel/functions ^3.10.1 UnknownUnknown
npm/ai 7.0.140 UnknownUnknown
npm/eslint-config-next ^16.4.1 UnknownUnknown
npm/jsdom ^30.1.2 UnknownUnknown
npm/lucide-react ^1.57.0 UnknownUnknown
npm/openai ^7.33.0 UnknownUnknown
npm/postcss ^8.5.30 UnknownUnknown
npm/react-resizable-panels ^4.14.5 UnknownUnknown
npm/redis ^6.3.0 UnknownUnknown
npm/tldts 7.4.18 🟢 4.2
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/13 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/v0 3.0.10 UnknownUnknown
npm/vite ^8.3.4 UnknownUnknown
npm/zod ^4.6.7 UnknownUnknown
pip/filelock 4.2.1 UnknownUnknown
pip/openai 3.34.0 UnknownUnknown
pip/platformdirs 4.13.4 UnknownUnknown
pip/filelock 4.2.1 UnknownUnknown
npm/convert-source-map 2.0.0 🟢 3.9
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/convert-source-map 2.0.0 🟢 3.9
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@ai-sdk/gateway 4.0.113 UnknownUnknown
npm/@ai-sdk/provider 4.0.27 UnknownUnknown
npm/@ai-sdk/provider-utils 5.0.59 UnknownUnknown
npm/@google-cloud/text-to-speech 7.2.0 🟢 7.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@google/genai 2.29.1 UnknownUnknown
npm/@modelcontextprotocol/sdk 1.32.1 UnknownUnknown
npm/@opentelemetry/core 2.12.0 🟢 7.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@types/node 26.6.5 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/ai 7.0.140 UnknownUnknown
npm/convert-source-map 2.0.0 🟢 3.9
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/dotenv 18.0.8 🟢 4.6
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/20 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/openai 7.33.0 UnknownUnknown
npm/turbo 2.11.8 UnknownUnknown
npm/undici 7.30.1 🟢 7.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 6Found 15/24 approved changesets -- score normalized to 6
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/undici 8.12.1 🟢 7.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 6Found 15/24 approved changesets -- score normalized to 6
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/@ai-sdk/gateway 4.0.113 UnknownUnknown
npm/@ai-sdk/provider 4.0.27 UnknownUnknown
npm/@ai-sdk/provider-utils 5.0.59 UnknownUnknown
npm/@google-cloud/text-to-speech 7.2.0 🟢 7.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 7SAST tool detected but not run on all commits
Fuzzing⚠️ 0project is not fuzzed
npm/@google/genai 2.29.1 UnknownUnknown
npm/@modelcontextprotocol/sdk 1.32.1 UnknownUnknown
npm/@opentelemetry/core 2.12.0 🟢 7.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
npm/@types/node 26.6.5 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/ai 7.0.140 UnknownUnknown
npm/convert-source-map 2.0.0 🟢 3.9
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/dotenv 18.0.8 🟢 4.6
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/20 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/openai 7.33.0 UnknownUnknown
npm/turbo 2.11.8 UnknownUnknown
npm/undici 8.12.1 🟢 7.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 6Found 15/24 approved changesets -- score normalized to 6
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/undici 7.30.1 🟢 7.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 6Found 15/24 approved changesets -- score normalized to 6
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/convert-source-map 2.0.0 🟢 3.9
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/filelock 4.2.1 UnknownUnknown
pip/filelock 4.2.1 UnknownUnknown
pip/openai 3.34.0 UnknownUnknown
pip/platformdirs 4.13.4 UnknownUnknown
npm/convert-source-map 2.0.0 🟢 3.9
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • apps/web/package.json
  • docs/guides/requirements.txt
  • docs/knowledge_prototypes/mcp-servers/fetch-mcp/package-lock.json
  • docs/knowledge_prototypes/universal-automation-service/requirements.txt
  • package-lock.json
  • sdk/typescript/package-lock.json

@groupthinking groupthinking mentioned this pull request Oct 18, 2026
Open
4 of 8 tasks
@groupthinking groupthinking self-assigned this Oct 18, 2026
@groupthinking ChatGPT Codex Connector

groupthinking commented Oct 18, 2026

Copy link
Copy Markdown
Owner

Gemini dependency reconciliation: #2446 implements #2445 with @google/genai ^2.30.0 (locked 2.30.0) and 12 offline SDK contract cases. This batch's 2.29.1 update predates the October 14 continuation/grounding fixes. Keep #2446 as the focused owner of the Gemini change; refresh this broader batch after it lands, preserving the 2.30 floor and new tests. Both PRs are labeled needs-reconciliation and assigned to groupthinking per MERGE_POLICY.md. No unrelated dependencies in this batch were changed.

@groupthinking groupthinking mentioned this pull request Oct 18, 2026
Open
Copilot AI mentioned this pull request Oct 19, 2026
Draft
2 of 8 tasks

This branch was successfully deployed

1 active deployment
Preview — 58a66861 Deployed Oct 17, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@groupthinking groupthinking Awaiting requested review from groupthinking groupthinking is a code owner

Assignees

@groupthinking groupthinking

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code needs-reconciliation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@groupthinking