chore(deps): bump @a2ui/web_core, @copilotkit/react-core and @copilotkit/react-ui in /samples/copilotkit-generative-ui/frontend

[dependabot]

Bumps @a2ui/web_core to 0.10.4 and updates ancestor dependencies @a2ui/web_core, @copilotkit/react-core and @copilotkit/react-ui. These dependencies need to be updated together.

Updates @a2ui/web_core from 0.9.0 to 0.10.4

Release notes

Sourced from @​a2ui/web_core's releases.

a2ui-agent-sdk 0.7.0

• BREAKING: Validation modules a2ui.validation.* and a2ui.schema.validator are removed. Use A2uiCatalog.validate_components for component tree validation.
• BREAKING: A2uiCatalog.validator now returns a single-catalog PayloadValidator instance (from a2ui.core.validation) instead of A2uiValidator. PayloadValidator does not provide an envelope-walking .validate() method; call A2uiCatalog.validate_components or PayloadValidator.validate_component() / PayloadValidator.validate_function().
• BREAKING: A2uiTemplateManager is removed.
• BREAKING: Package dependency updated to require a2ui-core>=0.2.0,<0.3.0.
• Add type-safe Python Builder API under a2ui.builder for constructing A2UI component trees as nested objects and serializing them into protocol messages (#2425).
• A2uiCatalog.core_catalog now passes its common_types_schema through to Catalog.from_json, so a catalog that references the shared types across documents resolves them from that document instead of leaving the references unresolvable.
• Add SkillGenerator API and Skill / SkillSet domain models to compile inference format rules and component catalog definitions into standardized agent skill packages (SKILL.md) (#2516).
• Use is_at_least_version and ProtocolVersion.V1_0 in ExpressCompiler for protocol version comparisons.
• Update A2uiCompilationError to forward error details to A2uiError.details and inherit directly from A2uiError.

---

Published to PyPI: a2ui-agent-sdk 0.7.0

pip install a2ui-agent-sdk==0.7.0

a2ui-core 0.2.0

• BREAKING: Module paths and validation interfaces moved or changed in v0.2.0. Deprecation shims are provided for renamed public module paths; importing them emits a DeprecationWarning naming the new path. These shims will be removed in v0.3.0.

  Shimmed Modules (Deprecated; removal in v0.3.0):

  Old Path (v0.1.x)	New Path (v0.2.0)	Notes
  a2ui.core.basic_catalog.{components,function_apis,function_impls,styles}	a2ui.core.basic_catalog.v0_9.{components,function_apis,function_impls,styles}	Re-exports v0.9 basic catalog symbols
  a2ui.core.basic_catalog.expression_parser	a2ui.core.expressions.expression_parser	Re-exports ExpressionParser, Scanner, and limits
  a2ui.core.schema.{client_capabilities,client_to_server,constants,server_to_client}	a2ui.core.schema.v0_9.{client_capabilities,client_to_server,constants,server_to_client}	Also aliases A2uiClientError* and SPEC_VERSION*

  Unshimmed Internal Modules & Renames:

  Internal modules were moved without shims; callers should import from the new paths directly:

  • a2ui.core.rendering (and .component_context, .data_context, .generic_binder): moved to a2ui.core.resolution (and matching submodules).
  • a2ui.core.validating (and .integrity_checker, .topology_analyzer): moved to a2ui.core.validation (and a2ui.core.state.validation_helpers).
  • validate_component_integrity: moved to a2ui.core.validation as (components: dict[str, ComponentModel], root_id: str = ROOT_ID, config: ValidationConfig | None = None) -> None.
  • analyze_topology: moved to a2ui.core.validation as (components: dict[str, ComponentModel], root_id: str = ROOT_ID, config: ValidationConfig | None = None) -> set[str].

  Removed Modules and APIs:

  Removed (v0.1.x)	Replacement (v0.2.0)
  a2ui.core.validating.validator (A2uiValidator, A2uiValidatorError)	a2ui.core.validation.PayloadValidator
  a2ui.core.validating.catalog_schema_validator (CatalogSchemaValidator, extract_ref_fields)	a2ui.core.catalog.reference_map (ComponentRefSpec, build_component_ref_map)
  a2ui.core.validating.integrity_checker.get_component_references	ComponentRefSpec.extract_child_references, ComponentModel.get_child_references
  a2ui.core.state.{node_graph,component_node} (NodeGraph, ComponentNode)	Removed

... (truncated)

Changelog

Sourced from @​a2ui/web_core's changelog.

0.10.4

• (v0_9) Support JSON Pointer escaping (RFC 6901) in DataModel (#1796).
• (v0_8) Export UserAction as ClientEventUserAction from types.ts (#1942).

0.10.3

• Added the ability to swap out the signals implementation through the setSignalImplementation function.

0.10.2

• Updated openUrl to reject URLs with schema other than HTTP or HTTPs to fix a security issue where agents could execute arbitrary Javascript code.

0.10.1

• Add locale support to basic catalog functions (pluralize, formatNumber, formatCurrency) in v0.9 via catalog-level configuration.
• Remove .passthrough() from PluralizeApi schema for stricter validation.
• Allow overriding hard-coded recursion depth in DataValueSchema for v0.8 by introducing createDataValueSchema factory function.
• Fix formatString to JSON-stringify objects/arrays per spec instead of using JS default coercion.

0.10.0

• BREAKING CHANGE: Rename Icon path property to svgPath to fix type collision with DataBindingType.
• (v0_9) Add computeColorVariant helper function for basic catalog components to generate CSS formulas for color variants (light, dark, hover), allowing reuse across renderers.

0.9.1

• Add new FrameworkSignal concept, which represents a generic signal from a given framework like Preact or Angular.
  • Unused in this version; future versions will introduce this throughout web core and will likely be breaking changes.
• Export injectDefaultA2uiTheme with default CSS variable values used by the A2UI basic catalogs.

0.8.8

• Add the ability to access the schema of a component in a type-safe way.
  • Update ComponentApi object to be generic over its schema type.
  • Modify the basic component definitions to satisfies ComponentApi instead of : ComponentApi so their schema type can be inferred later.
  • Add an InferredComponentApiSchemaType type to extract the schema type from a ComponentApi object.

0.8.7

• Adds catalogId to v0.8 schemas (was removed by mistake earlier)
• Tweak schema definitions so they survive minification.

0.8.6

... (truncated)

Commits

• See full diff in compare view

Updates @copilotkit/react-core from 1.63.2 to 1.77.0

Release notes

Sourced from @​copilotkit/react-core's releases.

v1.77.0

Features

• feat(react-core): make intelligence indicator auto-mount configurable (#6612) (a161b38)
• feat(learning): capture raw browser activity as AG-UI events (#7556) (1840e7c)
• feat(mcp-apps): consolidate the Vue and Angular hosts onto the shared package (#7161) (06f61ae)
• feat(web-inspector): add an option to hide the Inspector indefinitely (#7542) (20ee84c)

Fixes

• fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run (#7600) (f1a9bb6)
• fix(a2ui): keep generated controls from submitting host forms (#7392) (214614a)
• fix(react, vue): preserve popup rounded corners (#6473) (0629f84)
• fix(a2ui-renderer): contain malformed component values (#7583) (a9b1c26)
• fix(core): pass ContentPart[] tool handler results through to the tool message (#7544) (579d0f7)
• fix(web-inspector): send onboarding_run_id on the Learning setup prompt click (#7561) (c69b965)
• fix: preserve LangGraph catalogs with merged AG-UI properties (#7558) (9c6f1dd)

Other Changes

• Improve Inspector conversation readability and tool-call presentation (#7374) (632b050)
• docs(runtime): document the agentId the Intelligence threads list requires (refs PE-476) (#7562) (16dbbdf)

v1.76.0

Features

• feat: AG-UI 1.0 for CopilotKit (#7270) (7693a04)

Fixes

• fix(runtime): stop reusing per-response provider ids as message ids (#7522) (5832fff)
• fix(web-inspector): fit and scale the Inspector on small screens (#7529) (5135c56)
• fix(runtime): prefix MCP tools whose names collide instead of dropping them (#7495) (c7c4538)

v1.75.2

Fixes

• fix(react-core): use new run IDs for standard interrupt resumes (#7001) (081e745)
• fix(vue): stop cloning run state six times per row for message slots (#7525) (bd39b04)

v1.75.1

Features

• feat(angular)!: render A2UI without Lit and support web component cat… (#7504) (b3d1aad)

Fixes

• fix(core): distinguish Intelligence replay errors from live failures (#7353) (278a78d)
• fix(mcp-apps-renderer): follow the host page's dark theme (#7467) (2476de1)
• fix(runtime): forward imported backend thread identity (#7489) (5fd09ab)

... (truncated)

Changelog

Sourced from @​copilotkit/react-core's changelog.

1.77.0 - 2026-10-02

Features

• feat(react-core): make intelligence indicator auto-mount configurable (#6612) (a161b38)
• feat(learning): capture raw browser activity as AG-UI events (#7556) (1840e7c)
• feat(mcp-apps): consolidate the Vue and Angular hosts onto the shared package (#7161) (06f61ae)
• feat(web-inspector): add an option to hide the Inspector indefinitely (#7542) (20ee84c)

Fixes

• fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run (#7600) (f1a9bb6)
• fix(a2ui): keep generated controls from submitting host forms (#7392) (214614a)
• fix(react, vue): preserve popup rounded corners (#6473) (0629f84)
• fix(a2ui-renderer): contain malformed component values (#7583) (a9b1c26)
• fix(core): pass ContentPart[] tool handler results through to the tool message (#7544) (579d0f7)
• fix(web-inspector): send onboarding_run_id on the Learning setup prompt click (#7561) (c69b965)
• fix: preserve LangGraph catalogs with merged AG-UI properties (#7558) (9c6f1dd)

Other Changes

• Improve Inspector conversation readability and tool-call presentation (#7374) (632b050)
• docs(runtime): document the agentId the Intelligence threads list requires (refs PE-476) (#7562) (16dbbdf)

1.76.0 - 2026-09-30

Features

• feat: AG-UI 1.0 for CopilotKit (#7270) (7693a04)

Fixes

• fix(runtime): stop reusing per-response provider ids as message ids (#7522) (5832fff)
• fix(web-inspector): fit and scale the Inspector on small screens (#7529) (5135c56)
• fix(runtime): prefix MCP tools whose names collide instead of dropping them (#7495) (c7c4538)

1.75.2 - 2026-09-30

Fixes

• fix(react-core): use new run IDs for standard interrupt resumes (#7001) (081e745)
• fix(vue): stop cloning run state six times per row for message slots (#7525) (bd39b04)

1.75.1 - 2026-09-29

Features

• feat(angular)!: render A2UI without Lit and support web component cat… (#7504) (b3d1aad)

Fixes

... (truncated)

Commits

• e745116 chore: release monorepo v1.77.0 (#7602)
• 95f0247 chore: release monorepo v1.77.0
• f1a9bb6 fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph ru...
• faac16d fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run
• 25e7e86 feat(release): publish Learning and monorepo previews together (#7597)
• 3622ab1 Merge branch 'main' into codex/learning-preview-canary
• c88a2dd ci(showcase): build no image for a package-only PR, all images for a workflow...
• edaf067 ci(showcase): build no image for a package-only PR, all images for a workflow...
• cfb9486 feat(release): publish Learning and monorepo previews together
• a161b38 feat(react-core): make intelligence indicator auto-mount configurable (#6612)
• Additional commits viewable in compare view

Updates @copilotkit/react-ui from 1.63.2 to 1.77.0

Release notes

Sourced from @​copilotkit/react-ui's releases.

v1.77.0

Features

• feat(react-core): make intelligence indicator auto-mount configurable (#6612) (a161b38)
• feat(learning): capture raw browser activity as AG-UI events (#7556) (1840e7c)
• feat(mcp-apps): consolidate the Vue and Angular hosts onto the shared package (#7161) (06f61ae)
• feat(web-inspector): add an option to hide the Inspector indefinitely (#7542) (20ee84c)

Fixes

• fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run (#7600) (f1a9bb6)
• fix(a2ui): keep generated controls from submitting host forms (#7392) (214614a)
• fix(react, vue): preserve popup rounded corners (#6473) (0629f84)
• fix(a2ui-renderer): contain malformed component values (#7583) (a9b1c26)
• fix(core): pass ContentPart[] tool handler results through to the tool message (#7544) (579d0f7)
• fix(web-inspector): send onboarding_run_id on the Learning setup prompt click (#7561) (c69b965)
• fix: preserve LangGraph catalogs with merged AG-UI properties (#7558) (9c6f1dd)

Other Changes

• Improve Inspector conversation readability and tool-call presentation (#7374) (632b050)
• docs(runtime): document the agentId the Intelligence threads list requires (refs PE-476) (#7562) (16dbbdf)

v1.76.0

Features

• feat: AG-UI 1.0 for CopilotKit (#7270) (7693a04)

Fixes

• fix(runtime): stop reusing per-response provider ids as message ids (#7522) (5832fff)
• fix(web-inspector): fit and scale the Inspector on small screens (#7529) (5135c56)
• fix(runtime): prefix MCP tools whose names collide instead of dropping them (#7495) (c7c4538)

v1.75.2

Fixes

• fix(react-core): use new run IDs for standard interrupt resumes (#7001) (081e745)
• fix(vue): stop cloning run state six times per row for message slots (#7525) (bd39b04)

v1.75.1

Features

• feat(angular)!: render A2UI without Lit and support web component cat… (#7504) (b3d1aad)

Fixes

• fix(core): distinguish Intelligence replay errors from live failures (#7353) (278a78d)
• fix(mcp-apps-renderer): follow the host page's dark theme (#7467) (2476de1)
• fix(runtime): forward imported backend thread identity (#7489) (5fd09ab)

... (truncated)

Changelog

Sourced from @​copilotkit/react-ui's changelog.

1.77.0 - 2026-10-02

Features

• feat(react-core): make intelligence indicator auto-mount configurable (#6612) (a161b38)
• feat(learning): capture raw browser activity as AG-UI events (#7556) (1840e7c)
• feat(mcp-apps): consolidate the Vue and Angular hosts onto the shared package (#7161) (06f61ae)
• feat(web-inspector): add an option to hide the Inspector indefinitely (#7542) (20ee84c)

Fixes

• fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run (#7600) (f1a9bb6)
• fix(a2ui): keep generated controls from submitting host forms (#7392) (214614a)
• fix(react, vue): preserve popup rounded corners (#6473) (0629f84)
• fix(a2ui-renderer): contain malformed component values (#7583) (a9b1c26)
• fix(core): pass ContentPart[] tool handler results through to the tool message (#7544) (579d0f7)
• fix(web-inspector): send onboarding_run_id on the Learning setup prompt click (#7561) (c69b965)
• fix: preserve LangGraph catalogs with merged AG-UI properties (#7558) (9c6f1dd)

Other Changes

• Improve Inspector conversation readability and tool-call presentation (#7374) (632b050)
• docs(runtime): document the agentId the Intelligence threads list requires (refs PE-476) (#7562) (16dbbdf)

1.76.0 - 2026-09-30

Features

• feat: AG-UI 1.0 for CopilotKit (#7270) (7693a04)

Fixes

• fix(runtime): stop reusing per-response provider ids as message ids (#7522) (5832fff)
• fix(web-inspector): fit and scale the Inspector on small screens (#7529) (5135c56)
• fix(runtime): prefix MCP tools whose names collide instead of dropping them (#7495) (c7c4538)

1.75.2 - 2026-09-30

Fixes

• fix(react-core): use new run IDs for standard interrupt resumes (#7001) (081e745)
• fix(vue): stop cloning run state six times per row for message slots (#7525) (bd39b04)

1.75.1 - 2026-09-29

Features

• feat(angular)!: render A2UI without Lit and support web component cat… (#7504) (b3d1aad)

Fixes

... (truncated)

Commits

• e745116 chore: release monorepo v1.77.0 (#7602)
• 95f0247 chore: release monorepo v1.77.0
• f1a9bb6 fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph ru...
• faac16d fix(deps): bump @​ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run
• 25e7e86 feat(release): publish Learning and monorepo previews together (#7597)
• 3622ab1 Merge branch 'main' into codex/learning-preview-canary
• c88a2dd ci(showcase): build no image for a package-only PR, all images for a workflow...
• edaf067 ci(showcase): build no image for a package-only PR, all images for a workflow...
• cfb9486 feat(release): publish Learning and monorepo previews together
• a161b38 feat(react-core): make intelligence indicator auto-mount configurable (#6612)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Latest scan for commit: 7f5c462 | Updated: 2026-10-03 19:02:40 UTC

Security Scan Results