[dependabot]

Bumps @mastra/core from 1.74.0 to 1.75.0.

Release notes

Sourced from @​mastra/core's releases.

October 7, 2026

Highlights

Span Query API (list completed spans across traces)

New core/server/client support lets you query individual completed spans (with filters, cursors, previews, and model cost) via storage.querySpans() / client.querySpans() / POST /api/observability/spans/query, enabling workflows like “show every failed tool_call in the last hour” without first finding traces.

Trace Aggregation with token + cost analytics (now across stores)

aggregateTraces() now supports token and cost measures (tokens.* sums/avgs and cost.sum/cost.avg with coverage + currency handling), and is implemented in the ClickHouse, DuckDB, and Postgres observability stores—making cost/tokens-first dashboards and “top spenders” queries a first-class capability.

Self-embedding vector stores for Semantic Recall (no client embedder required)

Semantic recall can now run against vector stores that generate embeddings themselves (MastraVector.isSelfEmbedding), including MongoDBVector via autoEmbed, so memory recall and message writes work without configuring a client-side embedder.

@​mastra/connect 1.0: new channels/providers capabilities (Teams, Discord credential security) + better observability

@mastra/connect reaches stable with a reworked provider API (providers allowlists, glob filters, top-level defaults, dynamic tool merging), adds Microsoft Teams to channels(), moves Discord to a single API-key bot-token credential stored in encrypted credentials, and now records connect tool calls as trace spans for end-to-end observability.

Sessions now persist one active model per thread + optional “no initial thread”

AgentController sessions now keep a single current model across mode switches (updated switch APIs and thinking-level persistence), and you can start sessions without creating a thread (createInitialThread: false / createSession({ createInitialThread: false }) + session.thread.ensureId()), reducing empty-thread clutter.

Breaking Changes

• @mastra/connect@1.0.0: discovered MCP tools no longer require approval by default; use requireApproval (replaces autoApproveTools) to opt in.
• @mastra/connect: API rename integrations → providers; removed legacy surfaces like the connect() alias of tools(), environment() sandbox credential surface, and several resolver helpers/exports.
• Slack channel integration id changed in channels() from slack → slack-channels (Slack tools remain on slack).
• AgentController model switching: removed modeId/scope; session.model.switch signature changed to switch(modelId, options?) and sessions persist one model per thread (mode switches no longer auto-change models).
• @mastra/react hooks: positional arguments replaced with a single object argument; all hooks accept queryOptions (TanStack Query), and hooks no longer guard on empty ids by default.

Changelog

@​mastra/core@1.75.0

Minor Changes

• Added the StorageMemoryRef type so a stored agent's memory field can reference a registered memory instance with { type: 'id', memoryId }, or hold an inline config. Existing inline configs are still accepted. (#25850)

  Also in: @​mastra/client-js@​1.52.0, @​mastra/server@​1.75.0

• Added support for several processes sharing one notification store, where only some of them can run a given thread. (#25741)

  dispatchDueNotifications accepts a resourceId to dispatch only that resource's due notifications. A delivery policy can return hold: true to leave a due notification pending for another dispatcher, without counting a delivery attempt.

  hold only applies when a due notification is dispatched. When a notification is first sent, return an action that does not deliver it, such as defer:

  import { defaultNotificationDeliveryDecision } from '@mastra/core/notifications';
  const agent = new Agent({
  // ...
  notifications: {
  deliveryPolicy: {
  decide: input =>
  canRunHere(input.record.resourceId)
  ? defaultNotificationDeliveryDecision(input)

... (truncated)

Commits

• b10b70f chore: version - exit prerelease mode
• 16c936c chore: regenerate providers and docs [skip ci]
• 2a478e0 chore: version packages
• fb03761 fix(core): scope ResponseCache by memory resource id (#26192)
• 7736c40 fix(core): stop fetchWithRetry retries when the request is aborted (#26164)
• 3439cb2 fix(core): stop Workspace chunking from emitting a redundant trailing overlap...
• 6a4f0bd fix(core): end the run when processToolResult aborts (#26157)
• da4eac9 fix(core): resolve string goal.scorer by scorer id (#26154)
• b7f7b4a chore: regenerate providers and docs [skip ci]
• 810b48d fix(core): stop defaultOptions.untilIdle from recursing into the idle loop (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud