[dependabot]

Bumps the production-dependencies group with 9 updates in the / directory:

Package	From	To
playwright	1.62.0	1.63.0
@ai-sdk/anthropic	2.0.92	2.0.106
@ai-sdk/openai	2.0.117	2.0.130
@langchain/core	1.2.3	1.2.12
@langchain/langgraph	1.4.8	1.4.18
@modelcontextprotocol/sdk	1.30.0	1.30.1
ai	5.0.223	5.0.267
undici	6.28.0	6.29.0
yaml	2.9.0	2.9.1

Updates playwright from 1.62.0 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 2.0.92 to 2.0.106

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

2.0.106

Patch Changes

• 214d440: Preserve effort updates on empty system messages at the beginning of a conversation, including consecutive updates.

2.0.105

Patch Changes

• bf29419: chore: enable dead code lint rules
• Updated dependencies [bf29419]
  • @​ai-sdk/provider-utils@​3.0.39

2.0.104

Patch Changes

• dc710c5: fix(amazon-bedrock): avoid forced structured-output tools for incompatible Claude models
• Updated dependencies [594787e]
  • @​ai-sdk/provider@​2.0.5
  • @​ai-sdk/provider-utils@​3.0.38

2.0.103

Patch Changes

• 79c34cc: feat(anthropic): add Claude Opus 5.5 support

  • add the claude-opus-5-5 model ID to @ai-sdk/anthropic and anthropic/claude-opus-5.5 to @ai-sdk/gateway
  • models that always use adaptive thinking (claude-opus-5-5, claude-fable-5, claude-fable-5-1) no longer receive thinking: { type: 'disabled' } or budget-based thinking; the provider drops the unsupported setting and emits a warning
  • models that reject forced tool use (claude-opus-5-5, claude-fable-5-1) fall back to auto tool choice for required and named tool choices, and to native structured outputs when structuredOutputMode: 'jsonTool' is requested, each with a warning
  • add the computerToolset_20260801 computer use tool (computer_toolset_20260801), which is required for computer use on claude-opus-5-5
  • use the documented mid-conversation-output-config-2026-07-01 beta header for per-message effort

2.0.102

Patch Changes

• Updated dependencies [c2089a9]
• Updated dependencies [ab3990f]
  • @​ai-sdk/provider@​2.0.4
  • @​ai-sdk/provider-utils@​3.0.37

2.0.101

Patch Changes

• 78a29c2: feat(anthropic): add fable 5.1 support

... (truncated)

Commits

• 1876009 Version Packages (#21512)
• 214d440 [v5] fix(anthropic): preserve initial effort updates (#21511)
• 239ea3a Version Packages (#21371)
• bf29419 [v5] chore: enable dead code lint rules (#21394)
• 9a1ec38 Version Packages (#21309)
• dc710c5 [v5.0] fix: Amazon Bedrock Claude Opus 5.5 structured output forces unsupport...
• 4ef8fac Version Packages (#21293)
• 79c34cc Backport: feat(provider/anthropic): add Claude Opus 5.5 support v5 (#21288)
• bceba9f Version Packages (#20525)
• e3b73c3 Version Packages (#20146)
• Additional commits viewable in compare view

Updates @ai-sdk/openai from 2.0.117 to 2.0.130

Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.130

Patch Changes

• f912d4a: The OpenAI Responses provider now accepts providerOptions.openai.reasoningEffortUpdate on empty system messages and sends each update at its position in the conversation. This lets applications change reasoning effort during a conversation while preserving the prompt prefix for caching.

2.0.129

Patch Changes

• 1c05ff4: fix(openai): expose Chat Completions audio transcripts as generated text
• bf29419: chore: enable dead code lint rules
• Updated dependencies [bf29419]
  • @​ai-sdk/provider-utils@​3.0.39

2.0.128

Patch Changes

• 0f8e4fe: fix(openai): accept incomplete function_call items on the Responses stream, so a call truncated by max_output_tokens finishes with length instead of a TypeValidationError
• 391ad4a: feat: GPT-6 Sol and Luna model IDs
• Updated dependencies [594787e]
  • @​ai-sdk/provider@​2.0.5
  • @​ai-sdk/provider-utils@​3.0.38

2.0.127

Patch Changes

• fd889a3: fix(openai): return an AI SDK error for empty chat completion choices
• Updated dependencies [c2089a9]
• Updated dependencies [ab3990f]
  • @​ai-sdk/provider@​2.0.4
  • @​ai-sdk/provider-utils@​3.0.37

2.0.126

Patch Changes

• 022f24b: Include explicit message item types in Azure AI Foundry Responses requests.
• a15b75a: Add async function tool calling support for OpenAI Responses models.

2.0.125

Patch Changes

• e0d0bd1: feat(openai): add GPT-6 reasoning configuration updates

2.0.124

... (truncated)

Commits

• 0aab411 Version Packages (#21438)
• f912d4a Backport: Backport: feat(openai): support message-level reasoning effort upda...
• 239ea3a Version Packages (#21371)
• bf29419 [v5] chore: enable dead code lint rules (#21394)
• 1c05ff4 [v5.0] fix: OpenAI chat audio completions lose message.audio transcripts (#21...
• 9a1ec38 Version Packages (#21309)
• 0f8e4fe [v5.0] fix(openai): accept incomplete function_call items truncated by max_ou...
• 391ad4a [v5] feat: GPT-6 Sol and Luna model IDs (#21306)
• bceba9f Version Packages (#20525)
• fd889a3 [v5.0] fix: surface empty chat completion choices as AI SDK response errors (...
• Additional commits viewable in compare view

Updates @langchain/core from 1.2.3 to 1.2.12

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.12

Patch Changes

• #11675 030a726 Thanks @​hntrl! - Preserve structured tool arguments in tracer run inputs.

@​langchain/core@​1.2.11

Patch Changes

• #11603 fec9cd8 Thanks @​thushanth-bengre-langchain! - fix(core): build streaming llmOutput.tokenUsage from the fully-accumulated chunk instead of whichever individual chunk's usage_metadata arrived last

  Affects both core streaming paths — .stream()/.streamEvents() (_streamIterator) and .invoke()/.generate() when a streaming-preferring callback is attached (_generateWithCache's hasStreamingHandler branch). Previously, llmOutput.tokenUsage was overwritten by each chunk in turn, so only the last chunk carrying usage_metadata won — correct for providers that emit one cumulative total on a final chunk, but wrong for providers (e.g. @langchain/google, @langchain/anthropic) that emit usage_metadata as a per-chunk delta across multiple chunks, where the values must be summed.

  Note for provider authors: this assumes each streamed chunk's usage_metadata is either a per-chunk delta or appears only on a single final chunk. A provider that instead repeats a cumulative total on every chunk will now see it summed (and inflated) in llmOutput.tokenUsage, matching the existing behavior of the correctly-working message.usage_metadata field.

  Also fixes @langchain/google's invoke({streaming: true}) path (no streaming-preferring callback attached), where llmOutput was never populated at all.

• #11590 ffebdc2 Thanks @​thushanth-bengre-langchain! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses response_metadata.output directly, preserving every reasoning item's id/encrypted_content in original order. In v1, AIMessage.contentBlocks (outputVersion: "v1") is fixed the same way. additional_kwargs.reasoning is unchanged.

@​langchain/core@​1.2.10

Patch Changes

• #10047 ff1248f Thanks @​afirstenberg! - fix(core): BaseMessage.text use contentBlocks

@​langchain/core@​1.2.9

Patch Changes

• #11402 43e4396 Thanks @​thushanth-bengre-langchain! - Fix ChatVertexAI/ChatGoogle content blocks: include tool_call blocks from message.tool_calls and skip spurious empty text blocks in contentBlocks.

Commits

• bd44054 chore: version packages (#11674)
• 030a726 fix(core): preserve structured tool inputs in traces (#11675)
• 8837c7a feat(typesafe): add model-router and auto-mode agent middleware (#11670)
• 206d8b9 chore: version packages (#11668)
• 70c42ac feat(typesafe): add TypeSafe System One classifier package (#11666)
• 778566e chore: version packages (#11607)
• 18b71af feat(google-genai): add outputDimensionality parameter to GoogleGenerativeAIE...
• 35368db fix(google): surface groundingMetadata/citationMetadata on streaming path (#1...
• 78b2923 fix(google): preserve tool call id and thoughtSignature in native streaming (...
• ffebdc2 fix(openai): correctly handle multiple reasoning items in v1 content blocks (...
• Additional commits viewable in compare view

Updates @langchain/langgraph from 1.4.8 to 1.4.18

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.4.18

Patch Changes

• Updated dependencies [7a12289]:
  • @​langchain/langgraph-sdk@​1.12.0

@​langchain/langgraph@​1.4.18-rc.0

Patch Changes

• Updated dependencies [7a12289]:
  • @​langchain/langgraph-sdk@​1.12.0-rc.0

@​langchain/langgraph@​1.4.17

Patch Changes

• #2861 7639085 Thanks @​casparb! - Add GraphCallbackHandler with typed handleInterrupt and handleResume events through normal callback configuration, matching Python graph lifecycle behavior. Lifecycle callbacks are awaited before terminal chain callbacks and work independently of stream mode.

@​langchain/langgraph@​1.4.16

Patch Changes

• #2824 e75f6a0 Thanks @​eliornl! - feat(langgraph): add responseSchema option to interrupt()

  interrupt(value, { responseSchema }) lets a graph declare the shape of the value it expects on resume. A Zod schema validates the resume value and the parsed result is what interrupt() returns; a raw JSON Schema object is passed through as-is. The schema is surfaced on Interrupt.response_schema so clients such as Studio can render a typed form instead of a free-form JSON editor. Omitting the option keeps today's behavior.

• Updated dependencies [e75f6a0]:

  • @​langchain/langgraph-sdk@​1.11.1

@​langchain/langgraph@​1.4.15

Patch Changes

• #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

  Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

  Matches Python's callback-level behavior: transforms also affect chain events and message streaming, so omitting outputs can suppress messages returned directly by nodes and omitting inputs can affect message deduplication.

• Updated dependencies [3234c69, 3234c69, 11a4535, 2fab6fd, 4fc118f, db4bdad, 55fa26b]:

  • @​langchain/langgraph-sdk@​1.11.0

@​langchain/langgraph@​1.4.15-rc.0

Patch Changes

• #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

  Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

• Updated dependencies [2fab6fd]:

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.4.18

Patch Changes

• Updated dependencies [7a12289]:
  • @​langchain/langgraph-sdk@​1.12.0

1.4.18-rc.0

Patch Changes

• Updated dependencies [7a12289]:
  • @​langchain/langgraph-sdk@​1.12.0-rc.0

1.4.17

Patch Changes

• #2861 7639085 Thanks @​casparb! - Add GraphCallbackHandler with typed handleInterrupt and handleResume events through normal callback configuration, matching Python graph lifecycle behavior. Lifecycle callbacks are awaited before terminal chain callbacks and work independently of stream mode.

1.4.16

Patch Changes

• #2824 e75f6a0 Thanks @​eliornl! - feat(langgraph): add responseSchema option to interrupt()

  interrupt(value, { responseSchema }) lets a graph declare the shape of the value it expects on resume. A Zod schema validates the resume value and the parsed result is what interrupt() returns; a raw JSON Schema object is passed through as-is. The schema is surfaced on Interrupt.response_schema so clients such as Studio can render a typed form instead of a free-form JSON editor. Omitting the option keeps today's behavior.

• Updated dependencies [e75f6a0]:

  • @​langchain/langgraph-sdk@​1.11.1

1.4.15

Patch Changes

• #2794 83a4b62 Thanks @​hntrl! - feat(langgraph): add per-node tracePolicy input/output processors and omitPayload

  Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.

  Matches Python's callback-level behavior: transforms also affect chain events and message streaming, so omitting outputs can suppress messages returned directly by nodes and omitting inputs can affect message deduplication.

• Updated dependencies [3234c69, 3234c69, 11a4535, 2fab6fd, 4fc118f, db4bdad, 55fa26b]:

  • @​langchain/langgraph-sdk@​1.11.0

1.4.15-rc.0

Patch Changes

... (truncated)

Commits

• ec8cb37 chore: version packages (#2870)
• 285ed3d chore: version packages (rc) (#2868)
• 3dd35b6 chore: version packages (#2862)
• 7639085 feat(langgraph): add graph lifecycle callbacks (#2861)
• ec67d5d chore: version packages (#2852)
• e75f6a0 feat(langgraph): add responseSchema option to interrupt() (#2824)
• 592fd0c chore: version packages (#2832)
• a3172e0 revert(langgraph): tracePolicy (#2834)
• a97e6f4 chore(deps): patch vulnerable browser and example dependencies (#2822)
• 6fb9a3f chore(deps): bump vitest from 4.1.10 to 4.1.11 (#2818)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.30.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.1

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in modelcontextprotocol/typescript-sdk#2717
• fix(auth): preserve resource URI without trailing slash (#1968) by @​MukundaKatta in modelcontextprotocol/typescript-sdk#1972
• chore: bump version to 1.30.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

• @​MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

• 289ac2c chore: bump version to 1.30.1 (#2848)
• 12b4256 fix(auth): preserve resource URI without trailing slash (#1968) (#1972)
• a9f6eb7 [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...
• See full diff in compare view

Updates ai from 5.0.223 to 5.0.267

Changelog

Sourced from ai's changelog.

5.0.267

Patch Changes

• Updated dependencies [3569298]
  • @​ai-sdk/gateway@​2.0.159

5.0.266

Patch Changes

• Updated dependencies [cd9b333]
  • @​ai-sdk/gateway@​2.0.158

5.0.265

Patch Changes

• bf29419: chore: enable dead code lint rules
• 0519802: fix(ai): preserve parsed metadata and data values when validating UI messages
• Updated dependencies [0430ee6]
• Updated dependencies [bf29419]
• Updated dependencies [14ecfdc]
  • @​ai-sdk/gateway@​2.0.157
  • @​ai-sdk/provider-utils@​3.0.39

5.0.264

Patch Changes

• 594787e: fix(provider): preserve opaque file URI strings for provider serialization
• 7b19d17: fix(ai): prevent duplicate content types in chat transport requests
• 907e4c9: Fix streamed tool input callbacks firing out of order on newer Node.js versions by awaiting start and delta callbacks before invoking onInputAvailable.
• Updated dependencies [594787e]
• Updated dependencies [391ad4a]
  • @​ai-sdk/provider@​2.0.5
  • @​ai-sdk/gateway@​2.0.156
  • @​ai-sdk/provider-utils@​3.0.38

5.0.263

Patch Changes

• Updated dependencies [79c34cc]
  • @​ai-sdk/gateway@​2.0.155

5.0.262

Patch Changes

... (truncated)

Commits

• ff8463c Version Packages (#21472)
• 0aab411 Version Packages (#21438)
• 2bb1b52 [v5] fix(ai): skip validation for provider-executed tools (#21455)
• f912d4a Backport: Backport: feat(openai): support message-level reasoning effort upda...
• 239ea3a Version Packages (#21371)
• bf29419 [v5] chore: enable dead code lint rules (#21394)
• 1c05ff4 [v5.0] fix: OpenAI chat audio completions lose message.audio transcripts (#21...
• 0519802 [v5.0] fix: preserve schema defaults and transformations in validated UI mess...
• 9a1ec38 Version Packages (#21309)
• 594787e [v5.0] fix: Google Vertex percent-encoding literal characters in gs:// object...
• Additional commits viewable in compare view

Updates undici from 6.28.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• 2a91fc8 fix(retry): settle exposed body on terminal failure (#5778)
• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• See full diff in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions