Skip to content

chore(deps): bump the npm-minor-and-patch group across 1 directory with 24 updates - #531

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-6774037592
Closed

chore(deps): bump the npm-minor-and-patch group across 1 directory with 24 updates#531
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-6774037592

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 24 updates in the / directory:

Package From To
@assistant-ui/core 0.2.22 0.3.16
@assistant-ui/react 0.14.27 0.15.17
@assistant-ui/store 0.2.21 0.3.11
monaco-editor 0.52.2 0.56.0
react-router-dom 7.18.2 7.18.3
@anthropic-ai/sandbox-runtime 0.0.71 0.0.74
@daytona/sdk 0.204.1 0.207.0
@hono/swagger-ui 0.2.2 0.6.1
zod 4.4.3 4.5.3
@ai-sdk/alibaba 2.0.37 2.0.38
@ai-sdk/anthropic 4.0.44 4.0.45
@ai-sdk/google 4.0.53 4.0.57
@ai-sdk/moonshotai 3.0.41 3.0.42
@ai-sdk/openai 4.0.49 4.0.51
@ai-sdk/openai-compatible 3.0.39 3.0.40
@ai-sdk/provider-utils 5.0.32 5.0.33
@nats-io/nats-core 3.0.2 3.4.0
ai 7.0.82 7.0.84
openai 7.5.0 7.8.0
@openuidev/react-headless 0.9.4 0.9.13
@openuidev/react-lang 0.2.9 0.2.15
@openuidev/react-ui 0.13.3 0.13.10
lucide-react 0.562.0 0.577.0
@testing-library/react 16.3.2 16.3.3

Updates @assistant-ui/core from 0.2.22 to 0.3.16

Release notes

Sourced from @​assistant-ui/core's releases.

@​assistant-ui/core@​0.3.16

Patch Changes

  • #6224 c70c911 - docs: name @assistant-ui/ai-sdk in JSDoc examples (@​okisdev)

    the import examples on injectQuoteContext, unstable_injectInteractableContext, and the interactable and message JSDoc pointed at @assistant-ui/react-ai-sdk. they now name the framework-neutral package, which is where these live; the old package re-exports it, so both imports resolve.

  • #6360 e0fa1e6 - fix: roll back AssistantFrame providers on registration, release, and disposal failures (@​Kinfe123)

  • #6346 b2f148e - refactor: share the attachment add cancellation machinery between the composer core and the store client. (@​okisdev)

  • #6365 9dabbce - refactor: notify every thread runtime subscriber before rethrowing a subscriber error. (@​okisdev)

  • #6262 5a3e9f7 - refactor: move the run report tool call shape and its serialization into assistant-cloud (@​okisdev)

  • #6297 43d52ad - fix: keep prepended id-less messages in the external message converter (@​Kinfe123)

  • #6268 cdfc34d - fix: tag static ai-sdk/v6 tool calls as frontend in cloud run telemetry (@​okisdev)

  • #6222 4000eed - fix: cancelling an edit session cancels its in-flight attachment adds and removes its non-complete attachments through the attachment adapter (@​Kinfe123)

  • #6329 8217a6e - refactor: derive executing-tool running state inside the external-store runtime; adapters now pass raw provider isRunning. (@​okisdev) the assistant transport runtime enables tool invocations too, so it now keeps the thread running while a client tool executes instead of reporting idle.

  • #6369 3fcf338 - refactor: collapse the external message converter's duplicate derivation chains into one pure module. (@​okisdev)

  • #6324 4802d23 - fix: derive requires-action for pending and interrupted tool calls in the external-store convertMessage path; messages with unresolved tool calls now report requires-action instead of complete (@​ShobhitPatra)

  • #6174 c3fd2b3 - fix: evict deleted external-store messages so no phantom branch survives. the setMessages path evicts immediately; the onDelete path evicts at the confirming host snapshot (@​Kinfe123)

  • #6271 231d148 - fix: keep prepended history when convertMessage returns no id (@​okisdev)

  • #6439 7e03b66 - refactor: share the file part source resolution branch (@​okisdev)

  • #6236 1263c1f - fix: report frame tool failures whose error message is empty (@​Kinfe123)

  • #6458 465a7a6 - fix: default assistant frame messaging to the current origin (@​Kinfe123)

  • #6197 5355528 - fix: preserve incomplete tool-call part statuses (@​Gujiassh)

  • #6199 e97f7c6 - fix: resolve InMemoryThreadList index selectors within the archived/regular subset (@​Kinfe123)

  • #6345 a6d2da5 - refactor: share the interactable persistence scheduler between the tap client and the legacy surface. (@​okisdev) a save that settles after its interactable unregistered no longer recreates the removed persistence-status entry.

  • #6328 6b797ca - refactor: share the runtime lifecycle callback invoker from core internal. (@​okisdev) callback errors continue to be reported and swallowed through the shared invoker.

  • #6257 bea47ed - fix: type MCP app metadata in ThreadMessageLike tool calls (@​rupic-app)

... (truncated)

Changelog

Sourced from @​assistant-ui/core's changelog.

0.3.16

Patch Changes

  • #6224 c70c911 - docs: name @assistant-ui/ai-sdk in JSDoc examples (@​okisdev)

    the import examples on injectQuoteContext, unstable_injectInteractableContext, and the interactable and message JSDoc pointed at @assistant-ui/react-ai-sdk. they now name the framework-neutral package, which is where these live; the old package re-exports it, so both imports resolve.

  • #6360 e0fa1e6 - fix: roll back AssistantFrame providers on registration, release, and disposal failures (@​Kinfe123)

  • #6346 b2f148e - refactor: share the attachment add cancellation machinery between the composer core and the store client. (@​okisdev)

  • #6365 9dabbce - refactor: notify every thread runtime subscriber before rethrowing a subscriber error. (@​okisdev)

  • #6262 5a3e9f7 - refactor: move the run report tool call shape and its serialization into assistant-cloud (@​okisdev)

  • #6297 43d52ad - fix: keep prepended id-less messages in the external message converter (@​Kinfe123)

  • #6268 cdfc34d - fix: tag static ai-sdk/v6 tool calls as frontend in cloud run telemetry (@​okisdev)

  • #6222 4000eed - fix: cancelling an edit session cancels its in-flight attachment adds and removes its non-complete attachments through the attachment adapter (@​Kinfe123)

  • #6329 8217a6e - refactor: derive executing-tool running state inside the external-store runtime; adapters now pass raw provider isRunning. (@​okisdev) the assistant transport runtime enables tool invocations too, so it now keeps the thread running while a client tool executes instead of reporting idle.

  • #6369 3fcf338 - refactor: collapse the external message converter's duplicate derivation chains into one pure module. (@​okisdev)

  • #6324 4802d23 - fix: derive requires-action for pending and interrupted tool calls in the external-store convertMessage path; messages with unresolved tool calls now report requires-action instead of complete (@​ShobhitPatra)

  • #6174 c3fd2b3 - fix: evict deleted external-store messages so no phantom branch survives. the setMessages path evicts immediately; the onDelete path evicts at the confirming host snapshot (@​Kinfe123)

  • #6271 231d148 - fix: keep prepended history when convertMessage returns no id (@​okisdev)

  • #6439 7e03b66 - refactor: share the file part source resolution branch (@​okisdev)

  • #6236 1263c1f - fix: report frame tool failures whose error message is empty (@​Kinfe123)

  • #6458 465a7a6 - fix: default assistant frame messaging to the current origin (@​Kinfe123)

  • #6197 5355528 - fix: preserve incomplete tool-call part statuses (@​Gujiassh)

  • #6199 e97f7c6 - fix: resolve InMemoryThreadList index selectors within the archived/regular subset (@​Kinfe123)

  • #6345 a6d2da5 - refactor: share the interactable persistence scheduler between the tap client and the legacy surface. (@​okisdev) a save that settles after its interactable unregistered no longer recreates the removed persistence-status entry.

  • #6328 6b797ca - refactor: share the runtime lifecycle callback invoker from core internal. (@​okisdev) callback errors continue to be reported and swallowed through the shared invoker.

  • #6257 bea47ed - fix: type MCP app metadata in ThreadMessageLike tool calls (@​rupic-app)

... (truncated)

Commits
  • b6e7ab8 chore: update versions (#6193)
  • 465a7a6 fix(core): default assistant frames to same-origin (#6458)
  • e0fa1e6 fix(core): roll back failed frame registrations (#6360)
  • 546dae8 fix(core): derive requires-action when importing messages into the repository...
  • 7e03b66 refactor(core): share the file part source resolution branch (#6439)
  • a06be56 refactor(core): share the message repository session layer between a2a and ag...
  • 027f5e2 refactor: share the pending tool-call scan, abortable load, and create fallba...
  • 1cfab36 fix(core): converter review fixes that missed the #6369 squash (#6379)
  • 3fcf338 refactor(core): collapse the external message converter derivation chains (#6...
  • 9dabbce refactor(core): extend BaseSubscribable in the thread runtime cores (#6365)
  • Additional commits viewable in compare view

Updates @assistant-ui/react from 0.14.27 to 0.15.17

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.17

Patch Changes

@​assistant-ui/react@​0.15.16

Patch Changes

  • #6136 f7bd2d9 - fix: keep DevTools updates flowing when a subscriber throws (@​Kinfe123)

  • #6055 1f3eaa7 - fix: contain SandboxHost render failures after teardown (@​Kinfe123)

  • #6110 48f95b1 - chore: delete the dead ensureBinding and useRuntimeState utilities (@​samdickson22)

    src/context/react/utils/ensureBinding.ts and src/context/react/utils/useRuntimeState.ts imported only each other. Nothing else in the repo referenced them, neither appears in the package barrel or the api-surface snapshot, and the "."-only exports map made them unreachable to consumers. ensureBinding was an external caller of __internal_bindMethods that no longer had a caller of its own; the runtime classes bind themselves in their constructors, so nothing changes at runtime. The public API surface is

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.17

Patch Changes

0.15.16

Patch Changes

  • #6136 f7bd2d9 - fix: keep DevTools updates flowing when a subscriber throws (@​Kinfe123)

  • #6055 1f3eaa7 - fix: contain SandboxHost render failures after teardown (@​Kinfe123)

  • #6110 48f95b1 - chore: delete the dead ensureBinding and useRuntimeState utilities (@​samdickson22)

    src/context/react/utils/ensureBinding.ts and src/context/react/utils/useRuntimeState.ts imported only each other. Nothing else in the repo referenced them, neither appears in the package barrel or the api-surface snapshot, and the "."-only exports map made them unreachable to consumers. ensureBinding was an external caller of __internal_bindMethods

... (truncated)

Commits
  • b6e7ab8 chore: update versions (#6193)
  • 465a7a6 fix(core): default assistant frames to same-origin (#6458)
  • 16eb703 fix(react): apply mcp app host options after commit (#6370)
  • 95ed44d fix(react): keep slash commands scoped to committed renders (#6406)
  • 6bb1c8b fix(react): keep mcp app server routing commit-safe (#6404)
  • 13c5997 fix(react): apply live completion fetchers after commit (#6390)
  • bac7cd6 fix(react): apply sandbox bridge options after commit (#6389)
  • 1d2e68b chore(react): drop unreachable legacy forwarding sources (#6335)
  • e96d3de chore: update dependencies (#6305)
  • 36edccb fix(react): export createSuggestionAdapter from the dist packages (#6207)
  • Additional commits viewable in compare view

Updates @assistant-ui/store from 0.2.21 to 0.3.11

Release notes

Sourced from @​assistant-ui/store's releases.

@​assistant-ui/store@​0.3.11

Patch Changes

@​assistant-ui/store@​0.3.10

Patch Changes

  • #6068 ac0c836 - fix: stabilize unstable_useAdapters results on both adapter faces and warn on an unkeyed history factory. the React host's synthesized provider now absorbs a fresh but shallow-equal adapters bag the same way the RemoteThreadList store entry does, reusing the store's useShallowStable primitive through its internal entry, and the store entry warns in development when a history adapter arrives while the thread factory is unkeyed, since switching threads would silently keep the first thread's history. (@​okisdev)

  • #5831 2b0fec7 - feat: aui.optional.<scope> resolves an unavailable scope to undefined instead of a throwing accessor, mirroring s.optional on the state side; the documented availability check moves off source != null (@​okisdev)

  • #5998 f44163f - fix: stop active chats only when their standalone client is destroyed (@​Kinfe123)

  • #5834 d80e988 - fix: model-context registrations follow the committed scope across structural replacements. The new useAssistantScopeEffect(scope, effect, deps) re-runs a registration when the scope's bound client is replaced (cleaning up against the old one first) while ignoring value updates, and the toolkit, runtime-adapter, interactables, and MCP registration sites now use it instead of registering once against a stable client ref. (@​okisdev)

  • #5897 74dca03 - fix: cache live config source reads between notifications so getConfig satisfies the useSyncExternalStore getSnapshot contract (@​Yonom)

  • #5913 1b9c33d - feat: hoist the shared binding utilities to the client entry. createClientFacade (stable client facade over a source) and createLastValidCache/createStaleReporter (by-index shrink guard with an injectable expiry scheduler) were duplicated per framework bridge; they now live on @​assistant-ui/store/client so bridges cannot drift. (@​okisdev)

  • #5618 82e2bde - refactor: the config path rides React's scheduler instead of a self-scheduled tap root (@​Yonom)

  • #5889 52df42d - feat: subscription-owned lifecycle for createAssistantClient. the handle now rides tap's mountOnSubscribe: scopes render lazily on first read, mount when the first subscriber attaches, and soft unmount one task after the last subscriber releases (effects clean up, state is retained, a later subscriber remounts the same scopes). state updates before the first subscriber throw; an imperative consumer without a reactive framework holds a no-op subscription. destroy() remains the permanent teardown: synchronous while subscribers are attached; after the last release it defers to the soft unmount that release already scheduled. requires @​assistant-ui/tap ^0.9.12. (@​okisdev)

  • #5928 6c9e7dd - feat: hoist the viewport scroll math to the client entry. isViewportAtBottom, viewportOverflows, isUserScrollUp, and observeContentResize were vue-local; they now live on @​assistant-ui/store/client so the svelte viewport consumes the same implementation. (@​okisdev)

  • #6014 7748e15 - feat: host remote thread runtimeHooks as keyed tap resources on the list hook. useRemoteThreadListRuntime mounts one useResources host after each thread's unstable_Provider, so the first runtimeHook call already sees Provider adapters. AdapterSink only publishes those adapters. @assistant-ui/store/client exports useConfiguredAui and useAssistantContextProvider so that host can extend and provide a client the same way AuiProvider does in React. (@​okisdev)

  • #5914 0d2e23f - feat: new threads.selectionChanged event carrying threadId and previousThreadId; deprecate threadListItem.switchedTo/switchedAway in its favor. Un-deprecate the semantically meaningful events (thread.runStart, thread.runEnd, thread.initialize, composer.send, composer.attachmentAdd). (@​Yonom)

    The new event fires in situations where the deprecated pair did not, so the selection-driven defaults (scrollToBottomOnThreadSwitch, unstable_focusOnThreadSwitched) now engage there too: InMemoryThreadList emits on selection changes (it previously emitted no switch events at all), switchToNewThread() emits for the newly created thread, and runtimes that resolve a deep-linked threadId/initialThreadId after mount (useRemoteThreadListRuntime) emit when the deep link resolves, with the initial placeholder thread as previousThreadId.

@​assistant-ui/store@​0.3.9

Patch Changes

  • #5829 4b75b8f - fix: scoped event listeners under a derived-only provider filter against the child's own bindings instead of the parent's, in both directions and through scope-less intermediate hosts (@​okisdev)

  • #5795 00a630a - fix: publish hosted scope rebinds before descendant layout effects (@​Gujiassh)

  • #5769 f59d24b - fix: deliver threadListItem.switchedTo to default-scope listeners (#5699). the thread list item client now emits the switch from its own observed selection transition, after the flush that rebinds the derived scopes, instead of relaying the runtime's synchronous notification. scoped listeners now resolve their scope against the host's current client at delivery time, so a listener subscribed before a structural swap follows the scope's present binding; the notification manager re-reads the listener set at flush time per the documented live-set semantics. listeners that need a pinned instance subscribe on an id-scoped client instead. (@​okisdev)

Changelog

Sourced from @​assistant-ui/store's changelog.

0.3.11

Patch Changes

  • #6305 e9...

    Description has been truncated

    [!NOTE]
    Medium Risk
    Broad bumps touch chat runtime (assistant-ui 0.3), LLM/sandbox/Daytona/NATS paths, shared zod validation, and a large @hono/swagger-ui jump—regression risk is integration/testing rather than obvious code edits in this diff.

    Overview
    This PR only updates dependency versions in packages/frontend, packages/trueforge-core, packages/trueforge-ui, and packages/trueforge, plus the matching pnpm-lock.yaml refresh. There are no application source changes.

    Chat UI stack: @assistant-ui/core, @assistant-ui/react, and @assistant-ui/store are bumped on frontend and trueforge-ui (0.2.x → 0.3.x / 0.14 → 0.15). Monaco moves from 0.52 to 0.56 on frontend; react-router-dom is patched to 7.18.3. trueforge-ui also upgrades @openuidev/react-*, lucide-react, and narrows react-router-dom from ^6 || ^7 to ^7 only.

    Agent / server stack: trueforge-core gets patch bumps across Vercel AI SDK provider packages, ai, openai, @daytona/sdk, @nats-io/nats-core (3.0.2 → 3.4.0), and zod (4.4.3 → 4.5.3). trueforge aligns zod, Daytona, @anthropic-ai/sandbox-runtime, and jumps @hono/swagger-ui from 0.2.2 to 0.6.1.

    Lockfile churn also drops unused esbuild@0.28.1 / monaco-editor@0.52 entries and pulls transitive updates (e.g. assistant-cloud, @openuidev/devtools).

    Reviewed by Cursor Bugbot for commit 3ffad09c89f92f88e5e225db99a7a40ab32d35cc. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 1, 2026
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Sep 1, 2026
@changeset-bot

changeset-bot Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 3ffad09

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor[bot]
cursor Bot reviewed Sep 1, 2026
View reviewed changes
Comment thread packages/frontend/package.json
Comment thread packages/trueforge-ui/package.json
"partial-json": "^0.1.7",
"react-markdown": "^10.1.0",
"react-router-dom": "^6 || ^7",
"react-router-dom": "^7",

@cursor cursor Bot Sep 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

React Router v6 support dropped

Medium Severity

@truefoundry/trueforge-ui narrowed react-router-dom from ^6 || ^7 to ^7. Hosts still on React Router 6 that previously satisfied the published range will no longer get a compatible install.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 904e34d. Configure here.

Comment thread packages/trueforge-ui/package.json Outdated
"tailwind-merge": "^3.6.0",
"truefoundry-gateway-sdk": "^0.4.2",
"zod": "^4.4.3"
"zod": "^4.5.2"

@cursor cursor Bot Sep 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Published packages missing a changeset

Low Severity

Shipped package manifests changed without a changeset. Run pnpm changeset for @truefoundry/trueforge-ui, @truefoundry/trueforge-core, and @truefoundry/trueforge (frontend is bundled into the server tarball).

Additional Locations (2)
Fix in Cursor Fix in Web

Triggered by project rule: TrueForge review rules

Reviewed by Cursor Bugbot for commit 904e34d. Configure here.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-6774037592 branch from 904e34d to c4c590e Compare September 1, 2026 09:37
cursor[bot]
cursor Bot reviewed Sep 1, 2026
View reviewed changes
Comment thread packages/trueforge-ui/package.json
Comment thread packages/trueforge-core/package.json Outdated
"winston": "^3.19.0",
"ws": "^8.21.3",
"zod": "^4.4.3"
"zod": "^4.5.2"

@cursor cursor Bot Sep 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Published packages lack a changeset

Low Severity

Runtime dependency versions changed in published packages without a new .changeset file. Run pnpm changeset and bump @truefoundry/trueforge-core, @truefoundry/trueforge, and @truefoundry/trueforge-ui.

Additional Locations (2)
Fix in Cursor Fix in Web

Triggered by project rule: TrueForge review rules

Reviewed by Cursor Bugbot for commit c4c590e. Configure here.

@dependabot
chore(deps): bump the npm-minor-and-patch group across 1 directory wi…
3ffad09 
…th 24 updates

Bumps the npm-minor-and-patch group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@assistant-ui/core](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/core) | `0.2.22` | `0.3.16` |
| [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react) | `0.14.27` | `0.15.17` |
| [@assistant-ui/store](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/store) | `0.2.21` | `0.3.11` |
| [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.52.2` | `0.56.0` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.2` | `7.18.3` |
| [@anthropic-ai/sandbox-runtime](https://github.com/anthropic-experimental/sandbox-runtime) | `0.0.71` | `0.0.74` |
| [@daytona/sdk](https://github.com/daytona/clients) | `0.204.1` | `0.207.0` |
| [@hono/swagger-ui](https://github.com/honojs/middleware/tree/HEAD/packages/swagger-ui) | `0.2.2` | `0.6.1` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.3` |
| [@ai-sdk/alibaba](https://github.com/vercel/ai/tree/HEAD/packages/alibaba) | `2.0.37` | `2.0.38` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `4.0.44` | `4.0.45` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `4.0.53` | `4.0.57` |
| [@ai-sdk/moonshotai](https://github.com/vercel/ai/tree/HEAD/packages/moonshotai) | `3.0.41` | `3.0.42` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.49` | `4.0.51` |
| [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `3.0.39` | `3.0.40` |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `5.0.32` | `5.0.33` |
| [@nats-io/nats-core](https://github.com/nats-io/nats.js) | `3.0.2` | `3.4.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.82` | `7.0.84` |
| [openai](https://github.com/openai/openai-node) | `7.5.0` | `7.8.0` |
| [@openuidev/react-headless](https://github.com/thesysdev/openui/tree/HEAD/packages/react-headless) | `0.9.4` | `0.9.13` |
| [@openuidev/react-lang](https://github.com/thesysdev/openui/tree/HEAD/packages/react-lang) | `0.2.9` | `0.2.15` |
| [@openuidev/react-ui](https://github.com/thesysdev/openui/tree/HEAD/packages/react-ui) | `0.13.3` | `0.13.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.562.0` | `0.577.0` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |



Updates `@assistant-ui/core` from 0.2.22 to 0.3.16
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/core@0.3.16/packages/core)

Updates `@assistant-ui/react` from 0.14.27 to 0.15.17
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react@0.15.17/packages/react)

Updates `@assistant-ui/store` from 0.2.21 to 0.3.11
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/store/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/store@0.3.11/packages/store)

Updates `monaco-editor` from 0.52.2 to 0.56.0
- [Release notes](https://github.com/microsoft/monaco-editor/releases)
- [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md)
- [Commits](microsoft/monaco-editor@v0.52.2...v0.56.0)

Updates `react-router-dom` from 7.18.2 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

Updates `@anthropic-ai/sandbox-runtime` from 0.0.71 to 0.0.74
- [Release notes](https://github.com/anthropic-experimental/sandbox-runtime/releases)
- [Commits](anthropics/sandbox-runtime@v0.0.71...v0.0.74)

Updates `@daytona/sdk` from 0.204.1 to 0.207.0
- [Release notes](https://github.com/daytona/clients/releases)
- [Commits](https://github.com/daytona/clients/commits/v0.207.0)

Updates `@hono/swagger-ui` from 0.2.2 to 0.6.1
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/swagger-ui/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/swagger-ui@0.6.1/packages/swagger-ui)

Updates `zod` from 4.4.3 to 4.5.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.3)

Updates `@ai-sdk/alibaba` from 2.0.37 to 2.0.38
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/alibaba/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/alibaba@2.0.38/packages/alibaba)

Updates `@ai-sdk/anthropic` from 4.0.44 to 4.0.45
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.45/packages/anthropic)

Updates `@ai-sdk/google` from 4.0.53 to 4.0.57
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.57/packages/google)

Updates `@ai-sdk/moonshotai` from 3.0.41 to 3.0.42
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/moonshotai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/moonshotai@3.0.42/packages/moonshotai)

Updates `@ai-sdk/openai` from 4.0.49 to 4.0.51
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.51/packages/openai)

Updates `@ai-sdk/openai-compatible` from 3.0.39 to 3.0.40
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai-compatible/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@3.0.40/packages/openai-compatible)

Updates `@ai-sdk/provider-utils` from 5.0.32 to 5.0.33
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@5.0.33/packages/provider-utils)

Updates `@nats-io/nats-core` from 3.0.2 to 3.4.0
- [Release notes](https://github.com/nats-io/nats.js/releases)
- [Commits](nats-io/nats.js@v3.0.2...v3.4.0)

Updates `ai` from 7.0.82 to 7.0.84
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.84/packages/ai)

Updates `openai` from 7.5.0 to 7.8.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.5.0...v7.8.0)

Updates `@openuidev/react-headless` from 0.9.4 to 0.9.13
- [Commits](https://github.com/thesysdev/openui/commits/HEAD/packages/react-headless)

Updates `@openuidev/react-lang` from 0.2.9 to 0.2.15
- [Commits](https://github.com/thesysdev/openui/commits/HEAD/packages/react-lang)

Updates `@openuidev/react-ui` from 0.13.3 to 0.13.10
- [Commits](https://github.com/thesysdev/openui/commits/HEAD/packages/react-ui)

Updates `lucide-react` from 0.562.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

---
updated-dependencies:
- dependency-name: "@ai-sdk/alibaba"
  dependency-version: 2.0.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.57
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/moonshotai"
  dependency-version: 3.0.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/openai-compatible"
  dependency-version: 3.0.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 5.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@anthropic-ai/sandbox-runtime"
  dependency-version: 0.0.74
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@assistant-ui/core"
  dependency-version: 0.3.16
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@assistant-ui/store"
  dependency-version: 0.3.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@daytona/sdk"
  dependency-version: 0.207.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@hono/swagger-ui"
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@nats-io/nats-core"
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@openuidev/react-headless"
  dependency-version: 0.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@openuidev/react-lang"
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@openuidev/react-ui"
  dependency-version: 0.13.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: ai
  dependency-version: 7.0.84
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: monaco-editor
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: openai
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: zod
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-6774037592 branch from c4c590e to 3ffad09 Compare September 1, 2026 18:00
cursor[bot]
cursor Bot reviewed Sep 1, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 3ffad09. Configure here.

Comment thread pnpm-lock.yaml
'@assistant-ui/core':
specifier: 0.2.22
version: 0.2.22(@assistant-ui/store@0.2.21(@assistant-ui/tap@0.9.5(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@assistant-ui/tap@0.9.5(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(assistant-cloud@0.1.41(redis@5.12.1(@opentelemetry/api@1.9.1)))(react@19.2.8)(redis@5.12.1(@opentelemetry/api@1.9.1))(zustand@5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)))
version: 0.2.22(@assistant-ui/store@0.2.21(@assistant-ui/tap@0.9.5(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@assistant-ui/tap@0.9.5(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(assistant-cloud@0.1.42(redis@5.12.1(@opentelemetry/api@1.9.1)))(react@19.2.8)(redis@5.12.1(@opentelemetry/api@1.9.1))(zustand@5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)))

@cursor cursor Bot Sep 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile misses assistant-ui upgrades

High Severity

package.json now pins @assistant-ui/core 0.3.16, @assistant-ui/react 0.15.17, and @assistant-ui/store 0.3.11, but pnpm-lock.yaml still records specifiers and resolved versions 0.2.22 / 0.14.27 / 0.2.21 for both frontend and @truefoundry/trueforge-ui. CI pnpm install --frozen-lockfile will fail, and the intended upgrades are not what gets installed.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3ffad09. Configure here.

@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-6774037592 branch September 2, 2026 06:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@govindavashishtha govindavashishtha Awaiting requested review from govindavashishtha govindavashishtha is a code owner
@sayan-truefoundry sayan-truefoundry Awaiting requested review from sayan-truefoundry sayan-truefoundry is a code owner
@qaifi-tf qaifi-tf Awaiting requested review from qaifi-tf qaifi-tf is a code owner
@vinit-truefoundry vinit-truefoundry Awaiting requested review from vinit-truefoundry vinit-truefoundry is a code owner
@kumarsks619 kumarsks619 Awaiting requested review from kumarsks619 kumarsks619 is a code owner
@sajal-truefoundry sajal-truefoundry Awaiting requested review from sajal-truefoundry sajal-truefoundry is a code owner
@debajyoti-truefoundry debajyoti-truefoundry Awaiting requested review from debajyoti-truefoundry debajyoti-truefoundry is a code owner
@chiragjn chiragjn Awaiting requested review from chiragjn chiragjn is a code owner
@heerambavi1998 heerambavi1998 Awaiting requested review from heerambavi1998 heerambavi1998 is a code owner
@sr07asthana sr07asthana Awaiting requested review from sr07asthana sr07asthana is a code owner
@bhaveshpatel640 bhaveshpatel640 Awaiting requested review from bhaveshpatel640 bhaveshpatel640 is a code owner
@thesujai thesujai Awaiting requested review from thesujai thesujai is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants