Skip to content

chore(deps): bump the third-party group across 2 directories with 13 updates - #905

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/plugins/codex-security/skills/triage-finding/evals/third-party-260297238d
Closed

chore(deps): bump the third-party group across 2 directories with 13 updates#905
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/plugins/codex-security/skills/triage-finding/evals/third-party-260297238d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the third-party group with 2 updates in the /plugins/codex-security/skills/triage-finding/evals directory: @opencode-ai/sdk and promptfoo.
Bumps the third-party group with 11 updates in the /sdk/typescript directory:

Package From To
@agentclientprotocol/claude-agent-acp 0.70.0 0.78.0
@bex-co/muse-code-acp 0.6.0 0.6.1
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
yaml 2.9.0 2.9.1
zod 4.5.4 4.6.5
@types/node 26.5.0 26.6.1
@types/react 19.2.18 19.3.0
fast-check 4.9.0 4.10.1
prettier 3.9.6 3.9.7
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.7 19.3.0

Updates @opencode-ai/sdk from 1.18.29 to 1.18.31

Commits

Updates promptfoo from 0.122.2 to 0.123.0

Release notes

Sourced from promptfoo's releases.

0.123.0

0.123.0 (2026-09-10)

⚠ BREAKING CHANGES

  • providers: default GPT-5.6+ to Responses (#10803)

Features

Bug Fixes

  • assertions: parse multiline tool calls and clarify guides (#10789) (5f0324f)
  • assertions: recognize OpenAI Responses function_call items in tool-call-f1 (#10665) (028282c)
  • claude-agent-sdk: recognize documented model selectors (#10741) (c7e32f6)
  • claude-agent: preserve per-server env for stdio MCP servers (#10557) (6fd4c41)
  • cli: remove retired GitHub example downloads (#10876) (bf09397)
  • cloudflare: use the versioned Mistral gateway route (#10734) (ea6d6d3)
  • config: avoid stack traces for missing optional configs (#10523) (3d67680)
  • db: preserve writes after lock failures and during shutdown (#9009) (130389e)
  • deps: preserve browser production dependencies (#10755) (0b4ccbe)
  • deps: update anthropic packages (#10571) (93f963d)
  • deps: update anthropic packages (#10679) (152c423)
  • deps: update dependency @​inquirer/core to v12 (#10554) (90fa399)
  • deps: update dependency ai to ^6.0.264 (#10585) (da073db)
  • deps: update dependency js-yaml to v5.4.0 (#10629) (58fe7cc)
  • deps: update dependency zod to v4.5.4 (#10788) (03b0564)
  • deps: update Hono to v4.13.5 (#10815) (6a7568d)
  • deps: update js-yaml to 5.4.1 (#10680) (bd18712)
  • deps: update OpenCode SDK to v1.18.21 (#10565) (93b9f8c)
  • deps: update webpack to v5.110.3 (#10863) (fbfc5fb)
  • eval: keep the CLI alive while watch mode is watching (#10562) (89d4138)
  • eval: watch mode ignored scalar and generator tests references (#10169) (71499e3)
  • examples: honor framework model selection (#10781) (34cfb68)
  • examples: use selected CrewAI credentials (#10799) (e2cabfa)
  • go-provider: support importable packages (#10540) (10deb31)
  • google: route stable Omni through Interactions (#10737) (9ef3c96)
  • guard empty drift stats and clarify provider options (#10645) (bfcd067)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.123.0 (2026-09-10)

⚠ BREAKING CHANGES

  • providers: default GPT-5.6+ to Responses (#10803)

Features

Bug Fixes

  • assertions: parse multiline tool calls and clarify guides (#10789) (5f0324f)
  • assertions: recognize OpenAI Responses function_call items in tool-call-f1 (#10665) (028282c)
  • claude-agent-sdk: recognize documented model selectors (#10741) (c7e32f6)
  • claude-agent: preserve per-server env for stdio MCP servers (#10557) (6fd4c41)
  • cli: remove retired GitHub example downloads (#10876) (bf09397)
  • cloudflare: use the versioned Mistral gateway route (#10734) (ea6d6d3)
  • config: avoid stack traces for missing optional configs (#10523) (3d67680)
  • db: preserve writes after lock failures and during shutdown (#9009) (130389e)
  • deps: preserve browser production dependencies (#10755) (0b4ccbe)
  • deps: update anthropic packages (#10571) (93f963d)
  • deps: update anthropic packages (#10679) (152c423)
  • deps: update dependency @​inquirer/core to v12 (#10554) (90fa399)
  • deps: update dependency ai to ^6.0.264 (#10585) (da073db)
  • deps: update dependency js-yaml to v5.4.0 (#10629) (58fe7cc)
  • deps: update dependency zod to v4.5.4 (#10788) (03b0564)
  • deps: update Hono to v4.13.5 (#10815) (6a7568d)
  • deps: update js-yaml to 5.4.1 (#10680) (bd18712)
  • deps: update OpenCode SDK to v1.18.21 (#10565) (93b9f8c)
  • deps: update webpack to v5.110.3 (#10863) (fbfc5fb)
  • eval: keep the CLI alive while watch mode is watching (#10562) (89d4138)
  • eval: watch mode ignored scalar and generator tests references (#10169) (71499e3)
  • examples: honor framework model selection (#10781) (34cfb68)
  • examples: use selected CrewAI credentials (#10799) (e2cabfa)
  • go-provider: support importable packages (#10540) (10deb31)
  • google: route stable Omni through Interactions (#10737) (9ef3c96)
  • guard empty drift stats and clarify provider options (#10645) (bfcd067)
  • harden eval and provider edge cases (#10576) (1adb6e5)
  • http: clear error context when signature fails due to missing private key (#10586) (7abf349)
  • http: support Windows drive letter and file:// source paths in multipart (#10566) (22468f4)

... (truncated)

Commits
  • 3ec9740 chore(main): release 0.123.0 (#10532)
  • 01f9e87 fix(redteam): standardize target response attribution (#10862)
  • 3113c6f fix(providers): preserve WatsonX caller cancellation (#10861)
  • bf09397 fix(cli): remove retired GitHub example downloads (#10876)
  • 514769e chore(deps): update node.js to v24.21.0 (#10867)
  • 607c820 fix(providers): update OpenAI models and defaults (#10865)
  • 7e4e706 fix(providers): prevent duplicate Realtime prompts and correct transcription ...
  • 87f40dc docs(site): correct gateway starter requests (#10851)
  • b67f9e0 fix(providers): finish the GitHub Models retirement (#10849)
  • 38727b0 docs(blog): fix retired Claude model IDs in runnable configs (#10853)
  • Additional commits viewable in compare view

Updates @agentclientprotocol/claude-agent-acp from 0.70.0 to 0.78.0

Release notes

Sourced from @​agentclientprotocol/claude-agent-acp's releases.

v0.78.0

0.78.0 (2026-09-15)

Features

  • Add experimental ACP compaction update support (#1134) (543a9a2)

Bug Fixes

  • keep the picked option when AskUserQuestion custom text is also supplied (#1131) (8823ea6)

Performance Improvements

  • report file changes from Claude checkpoints (#1138) (91f1699)
  • supply AIR diff counts from Claude structured patches (#1122) (735950a)

v0.77.0

0.77.0 (2026-09-14)

⚠ BREAKING CHANGES

  • claudeCode.options.agent is no longer forwarded to Claude Code, and the agent-picker exports DEFAULT_AGENT_ID, AGENT_CONFIG_ID, BUILTIN_AGENT_NAMES, and discoverCustomAgents are removed. Consumers relying on main-thread agent selection must stop passing that option.

Features

  • Add tool names to tool calls (#1128) (67c7c9b)
  • deps: Bump @​anthropic-ai/claude-agent-sdk to 0.3.270 (#1123) (d3205ab)

Bug Fixes

  • honor host opt-out for allowDangerouslySkipPermissions (#1129) (3d99caf)
  • keep multi-select answers when a custom answer is typed (#1031) (1a4512c)
  • parse TaskList output without ambiguous regex (#1006) (b274923)
  • strip injected system reminders from replayed prompts (#1040) (15ba608)

Code Refactoring

v0.76.0

0.76.0 (2026-09-09)

Features

... (truncated)

Changelog

Sourced from @​agentclientprotocol/claude-agent-acp's changelog.

0.78.0 (2026-09-15)

Features

  • Add experimental ACP compaction update support (#1134) (543a9a2)

Bug Fixes

  • keep the picked option when AskUserQuestion custom text is also supplied (#1131) (8823ea6)

Performance Improvements

  • report file changes from Claude checkpoints (#1138) (91f1699)
  • supply AIR diff counts from Claude structured patches (#1122) (735950a)

0.77.0 (2026-09-14)

⚠ BREAKING CHANGES

  • claudeCode.options.agent is no longer forwarded to Claude Code, and the agent-picker exports DEFAULT_AGENT_ID, AGENT_CONFIG_ID, BUILTIN_AGENT_NAMES, and discoverCustomAgents are removed. Consumers relying on main-thread agent selection must stop passing that option.

Features

  • Add tool names to tool calls (#1128) (67c7c9b)
  • deps: Bump @​anthropic-ai/claude-agent-sdk to 0.3.270 (#1123) (d3205ab)

Bug Fixes

  • keep multi-select answers when a custom answer is typed (#1031) (1a4512c)
  • parse TaskList output without ambiguous regex (#1006) (b274923)
  • strip injected system reminders from replayed prompts (#1040) (15ba608)

Code Refactoring

0.76.0 (2026-09-09)

Features

... (truncated)

Commits
  • becd854 chore(main): release 0.78.0 (#1130)
  • 91f1699 perf: report file changes from Claude checkpoints (#1138)
  • 735950a perf: supply AIR diff counts from Claude structured patches (#1122)
  • 543a9a2 feat: Add experimental ACP compaction update support (#1134)
  • 8823ea6 fix: keep the picked option when AskUserQuestion custom text is also supplied...
  • dfe823b chore(main): release 0.77.0 (#1118)
  • 3d99caf fix: honor host opt-out for allowDangerouslySkipPermissions (#1129)
  • 1a4512c fix: keep multi-select answers when a custom answer is typed (#1031)
  • b274923 fix: parse TaskList output without ambiguous regex (#1006)
  • 15ba608 fix: strip injected system reminders from replayed prompts (#1040)
  • Additional commits viewable in compare view

Updates @bex-co/muse-code-acp from 0.6.0 to 0.6.1

Changelog

Sourced from @​bex-co/muse-code-acp's changelog.

0.6.1 (2026-09-16)

Fixes

  • Name modes, models and reasoning efforts for the narrow chips clients render them in, keeping muse's own vocabulary: SDK default reads as "On request" after muse --approval-mode on-request, bypassApprovals as "Auto-approve", rejectApprovals as "Reject prompts" because known-safe tools may still run, and exec yolo as "No approval, no sandbox" — muse --yolo disables both, and the name keeps the pair that muse's own safety section states together. Effort tiers are capitalized, and a model shows its provider only when that distinguishes two catalog entries.
  • Correct a stale live-test version gate that pinned the legacy :auto-review resume limitation to 1.2.1-R2847.1, so 1.3.0-R3057.1 was expected to continue successfully. Affected builds stay enumerated, which is how 1.3.0 was caught still reproducing the rejection rather than fixing it. Adapter behavior is unchanged; only the test expectation and its documentation moved.

Compatibility and upgrading

Display names only: mode IDs, config option IDs, model choices and effort values are unchanged, so stored selections and automated clients keying on IDs are unaffected. A client that matches on the previous display strings should key on the ID instead.

The legacy :auto-review resume limitation is now confirmed on 1.3.0-R3057.1 as well as 1.2.1-R2847.1. This is an observation about the Muse host, not a regression in this adapter, and the pinned 1.1.1 baseline is unchanged.

Commits
  • 9349855 chore: release 0.6.1
  • 4860db9 fix: align mode and model display names with the muse CLI
  • c34fec2 docs: record delegated-worker reassessment and file upstream issue
  • See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

@dependabot
chore(deps): bump the third-party group across 2 directories with 13 …
32bbdcb 
…updates

Bumps the third-party group with 2 updates in the /plugins/codex-security/skills/triage-finding/evals directory: [@opencode-ai/sdk](https://github.com/sst/opencode-sdk-js) and [promptfoo](https://github.com/promptfoo/promptfoo).
Bumps the third-party group with 11 updates in the /sdk/typescript directory:

| Package | From | To |
| --- | --- | --- |
| [@agentclientprotocol/claude-agent-acp](https://github.com/agentclientprotocol/claude-agent-acp) | `0.70.0` | `0.78.0` |
| [@bex-co/muse-code-acp](https://github.com/bex-co/muse-code-acp) | `0.6.0` | `0.6.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.1` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.7` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |



Updates `@opencode-ai/sdk` from 1.18.29 to 1.18.31
- [Release notes](https://github.com/sst/opencode-sdk-js/releases)
- [Changelog](https://github.com/anomalyco/opencode-sdk-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sst/opencode-sdk-js/commits)

Updates `promptfoo` from 0.122.2 to 0.123.0
- [Release notes](https://github.com/promptfoo/promptfoo/releases)
- [Changelog](https://github.com/promptfoo/promptfoo/blob/main/CHANGELOG.md)
- [Commits](promptfoo/promptfoo@0.122.2...0.123.0)

Updates `@agentclientprotocol/claude-agent-acp` from 0.70.0 to 0.78.0
- [Release notes](https://github.com/agentclientprotocol/claude-agent-acp/releases)
- [Changelog](https://github.com/agentclientprotocol/claude-agent-acp/blob/main/CHANGELOG.md)
- [Commits](agentclientprotocol/claude-agent-acp@v0.70.0...v0.78.0)

Updates `@bex-co/muse-code-acp` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/bex-co/muse-code-acp/releases)
- [Changelog](https://github.com/bex-co/muse-code-acp/blob/main/CHANGELOG.md)
- [Commits](bex-co/muse-code-acp@v0.6.0...v0.6.1)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `zod` from 4.5.4 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.4...v4.6.5)

Updates `@types/node` from 26.5.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `fast-check` from 4.9.0 to 4.10.1
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.1/packages/fast-check)

Updates `prettier` from 3.9.6 to 3.9.7
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.7)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

---
updated-dependencies:
- dependency-name: "@opencode-ai/sdk"
  dependency-version: 1.18.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: third-party
- dependency-name: promptfoo
  dependency-version: 0.123.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: "@agentclientprotocol/claude-agent-acp"
  dependency-version: 0.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: "@bex-co/muse-code-acp"
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: third-party
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: third-party
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: fast-check
  dependency-version: 4.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: prettier
  dependency-version: 3.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: third-party
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: third-party
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: third-party
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 28, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/plugins/codex-security/skills/triage-finding/evals/third-party-260297238d branch September 28, 2026 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants