Skip to content

build(deps): bump the server-minor-patch group with 8 updates - #189

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server-minor-patch-f3068d2f29
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server-minor-patch-f3068d2f29

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the server-minor-patch group with 8 updates:

Package From To
@anthropic-ai/sdk 0.133.0 0.135.0
dotenv 18.0.7 18.0.8
marked 18.1.0 18.1.1
openai 7.32.0 7.34.0
sanitize-html 2.18.0 2.18.1
eslint 10.12.0 10.13.0
typescript-eslint 8.71.1 8.71.2
vitest 5.0.3 5.0.5

Updates @anthropic-ai/sdk from 0.133.0 to 0.135.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.135.0

Features

  • api: add between_tools to thinking types in model capabilities
  • api: add the speed parameter and usage.speed to Messages
  • api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

  • client: close streams dropped without being read to the end
  • client: keep an unread JSONL response open while it is held

Chores

  • ci: speed up breaking change detection
  • docs: describe headers on Managed Agents and telemetry endpoints

Documentation

  • api: note that some models need a beta header to use speed

sdk-v0.134.0

Features

  • api: add execution_identity to Managed Agents agents

  • api: add organization_type_not_supported error to spend limit lists

  • api: add telemetry destination test endpoint

  • api: add telemetry destinations to the Admin API

  • client: add native support for OpenTelemetry tracing

    If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

  • api: rename telemetry destination test response model
  • client: close an unread stream that was dropped while tracing is on
  • client: don't follow redirects on token requests
  • client: treat proxy-authorization as a sensitive header

Bug Fixes

  • streaming: tolerate unknown event types in MessageStream and BetaMessageStream
  • streaming: stop throwing "Unexpected event order" for an event before message_start
  • streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.135.0 (2026-10-15)

Features

  • api: add between_tools to thinking types in model capabilities
  • api: add the speed parameter and usage.speed to Messages
  • api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

  • client: close streams dropped without being read to the end
  • client: keep an unread JSONL response open while it is held

Chores

  • ci: speed up breaking change detection
  • docs: describe headers on Managed Agents and telemetry endpoints

Documentation

  • api: note that some models need a beta header to use speed

0.134.0 (2026-10-14)

Features

  • api: add execution_identity to Managed Agents agents

  • api: add organization_type_not_supported error to spend limit lists

  • api: add telemetry destination test endpoint

  • api: add telemetry destinations to the Admin API

  • client: add native support for OpenTelemetry tracing

    If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

  • api: rename telemetry destination test response model
  • client: close an unread stream that was dropped while tracing is on
  • client: don't follow redirects on token requests
  • client: treat proxy-authorization as a sensitive header

Bug Fixes

  • streaming: tolerate unknown event types in MessageStream and BetaMessageStream
  • streaming: stop throwing "Unexpected event order" for an event before message_start

... (truncated)

Commits
  • 04a4c28 release: 0.135.0
  • 69dbe62 Merge pull request #935 from anthropics/synced/published
  • b61a531 feat(helpers): retry a rate-limited fast fallback at standard speed (#943)
  • 38d0ab4 feat(api): add between_tools to thinking types in model capabilities
  • 366b53b chore(docs): describe headers on Managed Agents and telemetry endpoints
  • ca50812 docs(api): note that some models need a beta header to use speed
  • 03f6012 fix(helpers): honor speed overrides from fallback entries when streaming (#942)
  • 88bf034 docs(changelog): shorten the OpenTelemetry tracing note (#941)
  • 7c807a0 fix(client): close streams dropped without being read to the end
  • 64758f6 feat(api): add the speed parameter and usage.speed to Messages
  • Additional commits viewable in compare view

Updates dotenv from 18.0.7 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)
Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • See full diff in compare view

Updates marked from 18.1.0 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

  • cli: honor an explicitly empty string input (#4113) (ec3a4e5)
  • end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
  • keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
  • keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
  • let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
  • make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
  • match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
  • preserve enclosing link state after parsing images (#4123) (cc07bb9)
  • respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

  • avoid repeated raw string copies in nested lists (#4082) (7e8754d)
Commits
  • cdbdc01 chore(release): 18.1.1 [skip ci]
  • 2134976 docs: add AGENTS.md (#4125)
  • 699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
  • 6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
  • eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
  • 7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
  • cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
  • 627d9ae fix: make walkTokens linear by appending values in place (#4121)
  • 4bd2528 fix: respect tab stops in list continuation indentation (#4119)
  • 9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
  • Additional commits viewable in compare view

Updates openai from 7.32.0 to 7.34.0

Release notes

Sourced from openai's releases.

v7.34.0

7.34.0 (2026-10-14)

Features

  • api: add regional processing residency options (#2942) (0f53768)

Bug Fixes

  • deps-dev: bump @​cloudflare/workers-types from 5.20260927.1 to 5.20261005.1 in /ecosystem-tests/cloudflare-worker (#2928) (d8b450e)
  • deps-dev: bump @​types/node from 26.4.1 to 26.6.4 (#2923) (55bfde2)
  • deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs (#2931) (6f2c0ab)
  • deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs-auto (#2932) (66c3d52)
  • deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts4.5-jest28 (#2933) (1abf914)
  • deps-dev: bump oxfmt from 0.70.0 to 0.72.0 (#2924) (ca86f0a)
  • deps-dev: bump oxlint from 1.82.0 to 1.87.0 (#2927) (76563b3)
  • deps-dev: bump vitest from 5.0.1 to 5.0.3 (#2925) (475db88)
  • deps-dev: bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/cloudflare-worker (#2929) (6886675)
  • deps: bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs (#2930) (233e488)
  • deps: bump undici from 8.10.2 to 8.11.2 (#2926) (4c4aa8b)

Chores

  • api: clarify Decisions request and response fields (#2940) (9f07cfc)

v7.33.0

7.33.0 (2026-10-14)

Features

  • add browser and computer toolsets (1/4) (#2936) (3811840)
  • api: add beta session spending limits (#2916) (f57c965)
  • api: add billing_not_active session error code (#2911) (ee3f743)
  • api: add OCI external-storage provider support (#2917) (80e210e)
  • api: add organization Decisions usage reporting (#2919) (3f8753e)
  • api: add shida to named Live voices (#2912) (d6d80a1)
  • api: add vault updates and metadata filters (#2906) (1bbc425)
  • api: align beta pagination limits and non-null parameters (#2915) (4ae463a)
  • api: expose image tool error and moderation details (#2935) (0bf85e0)
  • api: support image URLs and detailed safety alert explanations (#2918) (8297332)
  • api: support updating project API key expiry (#2922) (467a082)

Chores

  • api: clarify agent tool limits and environment pagination (#2920) (05b8763)

... (truncated)

Changelog

Sourced from openai's changelog.

7.34.0 (2026-10-14)

Features

  • api: add regional processing residency options (#2942) (0f53768)

Bug Fixes

  • deps-dev: bump @​cloudflare/workers-types from 5.20260927.1 to 5.20261005.1 in /ecosystem-tests/cloudflare-worker (#2928) (d8b450e)
  • deps-dev: bump @​types/node from 26.4.1 to 26.6.4 (#2923) (55bfde2)
  • deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs (#2931) (6f2c0ab)
  • deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs-auto (#2932) (66c3d52)
  • deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts4.5-jest28 (#2933) (1abf914)
  • deps-dev: bump oxfmt from 0.70.0 to 0.72.0 (#2924) (ca86f0a)
  • deps-dev: bump oxlint from 1.82.0 to 1.87.0 (#2927) (76563b3)
  • deps-dev: bump vitest from 5.0.1 to 5.0.3 (#2925) (475db88)
  • deps-dev: bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/cloudflare-worker (#2929) (6886675)
  • deps: bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs (#2930) (233e488)
  • deps: bump undici from 8.10.2 to 8.11.2 (#2926) (4c4aa8b)

Chores

  • api: clarify Decisions request and response fields (#2940) (9f07cfc)

7.33.0 (2026-10-14)

Features

  • add browser and computer toolsets (1/4) (#2936) (3811840)
  • api: add beta session spending limits (#2916) (f57c965)
  • api: add billing_not_active session error code (#2911) (ee3f743)
  • api: add OCI external-storage provider support (#2917) (80e210e)
  • api: add organization Decisions usage reporting (#2919) (3f8753e)
  • api: add shida to named Live voices (#2912) (d6d80a1)
  • api: add vault updates and metadata filters (#2906) (1bbc425)
  • api: align beta pagination limits and non-null parameters (#2915) (4ae463a)
  • api: expose image tool error and moderation details (#2935) (0bf85e0)
  • api: support image URLs and detailed safety alert explanations (#2918) (8297332)
  • api: support updating project API key expiry (#2922) (467a082)

Chores

  • api: clarify agent tool limits and environment pagination (#2920) (05b8763)
  • api: clarify decision creation documentation (#2913) (1c380ea)
  • api: clarify Decisions question and answer descriptions (#2910) (b5c7300)

... (truncated)

Commits
  • 85e528a release: 7.34.0 (#2941)
  • 0f53768 feat(api): add regional processing residency options (#2942)
  • 76563b3 fix(deps-dev): bump oxlint from 1.82.0 to 1.87.0 (#2927)
  • 4c4aa8b fix(deps): bump undici from 8.10.2 to 8.11.2 (#2926)
  • 55bfde2 fix(deps-dev): bump @​types/node from 26.4.1 to 26.6.4 (#2923)
  • d8b450e fix(deps-dev): bump @​cloudflare/workers-types from 5.20260927.1 to 5.20261005...
  • ca86f0a fix(deps-dev): bump oxfmt from 0.70.0 to 0.72.0 (#2924)
  • 6886675 fix(deps-dev): bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/clou...
  • 66c3d52 fix(deps-dev): bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-...
  • 233e488 fix(deps): bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs ...
  • Additional commits viewable in compare view

Updates sanitize-html from 2.18.0 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

  • Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

    This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

  • Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

    Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)
Commits

Updates typescript-eslint from 8.71.1 to 8.71.2

Release notes

Sourced from typescript-eslint's releases.

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

  • eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
  • eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
  • eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
  • eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
  • type-utils: match linked packages and packages with missing version in TypeOrValueSpecifier (#12948)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vitest from 5.0.3 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific depen...

Description has been truncated

Bumps the server-minor-patch group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.133.0` | `0.135.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.7` | `18.0.8` |
| [marked](https://github.com/markedjs/marked) | `18.1.0` | `18.1.1` |
| [openai](https://github.com/openai/openai-node) | `7.32.0` | `7.34.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.18.0` | `2.18.1` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.1` | `8.71.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` |


Updates `@anthropic-ai/sdk` from 0.133.0 to 0.135.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.133.0...sdk-v0.135.0)

Updates `dotenv` from 18.0.7 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.7...v18.0.8)

Updates `marked` from 18.1.0 to 18.1.1
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.0...v18.1.1)

Updates `openai` from 7.32.0 to 7.34.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.32.0...v7.34.0)

Updates `sanitize-html` from 2.18.0 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `typescript-eslint` from 8.71.1 to 8.71.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint)

Updates `vitest` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: dotenv
  dependency-version: 18.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: marked
  dependency-version: 18.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: openai
  dependency-version: 7.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: typescript-eslint
  dependency-version: 8.71.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from mk7luke as a code owner October 19, 2026 15:36
@diffsentry

diffsentry Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

⏭️ DiffSentry — no reviewable changes. This pull request only contains 2 files DiffSentry skips, so there's nothing to review.

Ignored (minified, generated, or lockfile) (1)
  • package-lock.json
No reviewable changes (1)
  • package.json

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 26, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/server-minor-patch-f3068d2f29 branch October 26, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants