chore(deps): bump the third-party group across 2 directories with 14 updates by dependabot[bot] · Pull Request #906 · bex-co/bex-security

dependabot · 2026-09-28T09:32:37Z

Bumps the third-party group with 2 updates in the /plugins/codex-security/skills/triage-finding/evals directory: @opencode-ai/sdk and promptfoo.
Bumps the third-party group with 12 updates in the /sdk/typescript directory:

Package	From	To
@agentclientprotocol/claude-agent-acp	`0.70.0`	`0.79.0`
@agentclientprotocol/sdk	`1.4.0`	`1.5.0`
@bex-co/muse-code-acp	`0.6.0`	`0.6.1`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
yaml	`2.9.0`	`2.9.1`
zod	`4.5.4`	`4.6.5`
@types/node	`26.5.0`	`26.6.2`
@types/react	`19.2.18`	`19.3.0`
fast-check	`4.9.0`	`4.10.2`
prettier	`3.9.6`	`3.9.8`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.7`	`19.3.0`

Updates @opencode-ai/sdk from 1.18.29 to 1.18.31

Commits

See full diff in compare view

Updates promptfoo from 0.122.2 to 0.123.1

Release notes

Sourced from promptfoo's releases.

0.123.1

0.123.1 (2026-09-18)

Features

bedrock: refresh auth across HTTP adapters (#10123) (9d3f063)

providers: add Gemini 3.8 and Vertex Live (#10956) (1417f22)

providers: add GPT-Live voice sessions (#10891) (316a334)

providers: add OpenAI Agents API (#10892) (ad3bee3)

providers: add portable HTTP config schemas (#10968) (fcd0604)

providers: add portable MCP config schemas (#10965) (f5ccb3c)

providers: support Ollama 0.34 features and refresh model docs (#10964) (ac01a4f)

providers: surface Ollama thinking output and finish reason (#10954) (27d4c22)

providers: update Gemini tools and media support (#10172) (627bdd0)

Bug Fixes

assertions: bound embedded tool call parsing (#10877) (78202a3)

assertions: bound tool-call parser state (#10887) (15290b4)

assertions: default RAG assertion thresholds to 0.5 (#10202) (4831b60), closes #9910 #9848

assertions: invert score along with pass for search-rubric (#10103) (26e8f2f)

assertions: never invert grader failures on not-classifier and not-search-rubric (#10904) (e049702)

assertions: reject malformed webhook results (#10955) (fc57736)

assertions: reject non-string search rubrics (#10934) (7bbb79e)

auth: harden custom header requests (#10524) (5325084)

cli: handle large values during result export (#10884) (be798f4)

cli: preserve in-memory results for extensions (#10885) (60483d9)

code-scan: extractValidLineRanges off-by-one on trailing newline (#10107) (2cbabdb)

config: preserve discovery in paths containing quotes (#10549) (d9b3927)

db: preserve shared blobs after persistence errors (#10897) (3b353fb)

deps: update dependency @anthropic-ai/sdk to v0.123.0 (#10901) (14f7c06)

deps: update dependency @anthropic-ai/sdk to v0.124.0 (#10940) (29a15d1)

deps: update engine.io to v6.6.10 (#10915) (e54a968)

deps: update opentelemetry (#10886) (280bc5e)

deps: update type definitions (#10924) (01c6397)

drain database writes and preserve provider options (#10911) (32bfa9e)

eval: keep concurrent derived metrics consistent (#10873) (2a3a3bd)

eval: preserve audio grading results and order (#10822) (395d21e)

eval: preserve cloud UUID config semantics (#7732) (8544fed)

fetch: decode URL credentials and match Authorization case-insensitively (#10909) (b8aa6ff)

fetch: treat credit_balance_exhausted as a hard quota error (#10881) (7f21bb2)

honor SDK options and load AVIF/TIFF images (#10902) (15bba21)

integrations: honor --env-file and config env for Helicone key and Langfuse base URL (#10942) (8bd9f37)

integrations: read Langfuse env at fetch time (#10937) (033080c)

integrations: share Langfuse prompt fetches and surface real SDK load errors (#10943) (379ecd0)

matchers: tag context-faithfulness grader failures (#9907) (77bc3ba)

matchers: tag RAG grader failures so inverse assertions cannot pass (#10494) (b3d21d2)

mcp: accept fine-tuned model identifiers (#10847) (9442129)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.123.1 (2026-09-18)

Features

bedrock: refresh auth across HTTP adapters (#10123) (9d3f063)

providers: add Gemini 3.8 and Vertex Live (#10956) (1417f22)

providers: add GPT-Live voice sessions (#10891) (316a334)

providers: add OpenAI Agents API (#10892) (ad3bee3)

providers: add portable HTTP config schemas (#10968) (fcd0604)

providers: add portable MCP config schemas (#10965) (f5ccb3c)

providers: support Ollama 0.34 features and refresh model docs (#10964) (ac01a4f)

providers: surface Ollama thinking output and finish reason (#10954) (27d4c22)

providers: update Gemini tools and media support (#10172) (627bdd0)

Bug Fixes

assertions: bound embedded tool call parsing (#10877) (78202a3)

assertions: bound tool-call parser state (#10887) (15290b4)

assertions: default RAG assertion thresholds to 0.5 (#10202) (4831b60), closes #9910 #9848

assertions: invert score along with pass for search-rubric (#10103) (26e8f2f)

assertions: never invert grader failures on not-classifier and not-search-rubric (#10904) (e049702)

assertions: reject malformed webhook results (#10955) (fc57736)

assertions: reject non-string search rubrics (#10934) (7bbb79e)

auth: harden custom header requests (#10524) (5325084)

cli: handle large values during result export (#10884) (be798f4)

cli: preserve in-memory results for extensions (#10885) (60483d9)

code-scan: extractValidLineRanges off-by-one on trailing newline (#10107) (2cbabdb)

config: preserve discovery in paths containing quotes (#10549) (d9b3927)

db: preserve shared blobs after persistence errors (#10897) (3b353fb)

deps: update dependency @anthropic-ai/sdk to v0.123.0 (#10901) (14f7c06)

deps: update dependency @anthropic-ai/sdk to v0.124.0 (#10940) (29a15d1)

deps: update engine.io to v6.6.10 (#10915) (e54a968)

deps: update opentelemetry (#10886) (280bc5e)

deps: update type definitions (#10924) (01c6397)

drain database writes and preserve provider options (#10911) (32bfa9e)

eval: keep concurrent derived metrics consistent (#10873) (2a3a3bd)

eval: preserve audio grading results and order (#10822) (395d21e)

eval: preserve cloud UUID config semantics (#7732) (8544fed)

fetch: decode URL credentials and match Authorization case-insensitively (#10909) (b8aa6ff)

fetch: treat credit_balance_exhausted as a hard quota error (#10881) (7f21bb2)

honor SDK options and load AVIF/TIFF images (#10902) (15bba21)

integrations: honor --env-file and config env for Helicone key and Langfuse base URL (#10942) (8bd9f37)

integrations: read Langfuse env at fetch time (#10937) (033080c)

integrations: share Langfuse prompt fetches and surface real SDK load errors (#10943) (379ecd0)

matchers: tag context-faithfulness grader failures (#9907) (77bc3ba)

matchers: tag RAG grader failures so inverse assertions cannot pass (#10494) (b3d21d2)

mcp: accept fine-tuned model identifiers (#10847) (9442129)

opencode: capture skill calls from full session history (#10011) (290973d)

prompts: CSV rows collapse to duplicate labels/IDs when basePrompt.label is set (#10102) (25963c3)

providers: align ElevenLabs requests and audio inputs (#10736) (de12341)

... (truncated)

Commits

34f74d3 chore(main): release 0.123.1 (#10879)
9d3f063 feat(bedrock): refresh auth across HTTP adapters (#10123)
5325084 fix(auth): harden custom header requests (#10524)
f385d96 fix(providers): isolate Agents endpoint credentials (#10951)
ba0eeb4 fix(providers): preserve patterned OpenCode skill history (#10971)
288e26c chore(deps): update dependency oxc-parser to ^0.149.0 (#10975)
fc57736 fix(assertions): reject malformed webhook results (#10955)
52ce503 chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#...
1417f22 feat(providers): add Gemini 3.8 and Vertex Live (#10956)
08e91da fix(redteam): preserve strategy grading context (#10969)
Additional commits viewable in compare view

Updates @agentclientprotocol/claude-agent-acp from 0.70.0 to 0.79.0

Release notes

Sourced from @agentclientprotocol/claude-agent-acp's releases.

v0.79.0

0.79.0 (2026-09-17)

Features

Update to claude agent sdk 0.3.274 (#1143) (d0fa8e0)

Bug Fixes

show shell commands in permission prompts (#1070) (bbae5c2)

v0.78.0

0.78.0 (2026-09-15)

Features

Add experimental ACP compaction update support (#1134) (543a9a2)

Bug Fixes

keep the picked option when AskUserQuestion custom text is also supplied (#1131) (8823ea6)

Performance Improvements

report file changes from Claude checkpoints (#1138) (91f1699)

supply AIR diff counts from Claude structured patches (#1122) (735950a)

v0.77.0

0.77.0 (2026-09-14)

⚠ BREAKING CHANGES

claudeCode.options.agent is no longer forwarded to Claude Code, and the agent-picker exports DEFAULT_AGENT_ID, AGENT_CONFIG_ID, BUILTIN_AGENT_NAMES, and discoverCustomAgents are removed. Consumers relying on main-thread agent selection must stop passing that option.

Features

Add tool names to tool calls (#1128) (67c7c9b)

deps: Bump @anthropic-ai/claude-agent-sdk to 0.3.270 (#1123) (d3205ab)

Bug Fixes

honor host opt-out for allowDangerouslySkipPermissions (#1129) (3d99caf)

keep multi-select answers when a custom answer is typed (#1031) (1a4512c)

... (truncated)

Changelog

Sourced from @agentclientprotocol/claude-agent-acp's changelog.

0.79.0 (2026-09-17)

Features

Update to claude agent sdk 0.3.274 (#1143) (d0fa8e0)

Bug Fixes

show shell commands in permission prompts (#1070) (bbae5c2)

0.78.0 (2026-09-15)

Features

Add experimental ACP compaction update support (#1134) (543a9a2)

Bug Fixes

keep the picked option when AskUserQuestion custom text is also supplied (#1131) (8823ea6)

Performance Improvements

report file changes from Claude checkpoints (#1138) (91f1699)

supply AIR diff counts from Claude structured patches (#1122) (735950a)

0.77.0 (2026-09-14)

⚠ BREAKING CHANGES

claudeCode.options.agent is no longer forwarded to Claude Code, and the agent-picker exports DEFAULT_AGENT_ID, AGENT_CONFIG_ID, BUILTIN_AGENT_NAMES, and discoverCustomAgents are removed. Consumers relying on main-thread agent selection must stop passing that option.

Features

Add tool names to tool calls (#1128) (67c7c9b)

deps: Bump @anthropic-ai/claude-agent-sdk to 0.3.270 (#1123) (d3205ab)

Bug Fixes

keep multi-select answers when a custom answer is typed (#1031) (1a4512c)

parse TaskList output without ambiguous regex (#1006) (b274923)

strip injected system reminders from replayed prompts (#1040) (15ba608)

... (truncated)

Commits

d421f56 chore(main): release 0.79.0 (#1142)
d0fa8e0 feat: Update to claude agent sdk 0.3.274 (#1143)
bbae5c2 fix: show shell commands in permission prompts (#1070)
becd854 chore(main): release 0.78.0 (#1130)
91f1699 perf: report file changes from Claude checkpoints (#1138)
735950a perf: supply AIR diff counts from Claude structured patches (#1122)
543a9a2 feat: Add experimental ACP compaction update support (#1134)
8823ea6 fix: keep the picked option when AskUserQuestion custom text is also supplied...
dfe823b chore(main): release 0.77.0 (#1118)
3d99caf fix: honor host opt-out for allowDangerouslySkipPermissions (#1129)
Additional commits viewable in compare view

Updates @agentclientprotocol/sdk from 1.4.0 to 1.5.0

Release notes

Sourced from @agentclientprotocol/sdk's releases.

v1.5.0

1.5.0 (2026-09-21)

Features

update schemas to v1.22.0 and v2.0.0-alpha.4 (#253) (a9f08bd)

update schemas to v1.23.0 and v2.0.0-alpha.5 (#255) (f7941e7)

Changelog

Sourced from @agentclientprotocol/sdk's changelog.

1.5.0 (2026-09-21)

Features

update schemas to v1.22.0 and v2.0.0-alpha.4 (#253) (a9f08bd)

update schemas to v1.23.0 and v2.0.0-alpha.5 (#255) (f7941e7)

Commits

f1ba3a9 chore(main): release 1.5.0 (#254)
20daeb7 chore(deps): bump crate-ci/typos from 1.50.1 to 1.50.2 (#256)
2aadf1c chore(deps): bump the minor group with 11 updates (#257)
d031138 chore(deps-dev): bump markdown-it from 14.3.1 to 14.3.2 (#258)
f7941e7 feat: update schemas to v1.23.0 and v2.0.0-alpha.5 (#255)
a9f08bd feat: update schemas to v1.22.0 and v2.0.0-alpha.4 (#253)
9b31e1a chore: Fix lockfile (#252)
9fc07f3 chore(deps): bump the minor group with 22 updates (#249)
8ff4e9a chore(deps-dev): bump obug from 2.1.4 to 2.2.1 (#250)
002e355 chore(deps-dev): bump vitest from 4.1.11 to 5.0.0 (#251)
Additional commits viewable in compare view

Updates @bex-co/muse-code-acp from 0.6.0 to 0.6.1

Changelog

Sourced from @bex-co/muse-code-acp's changelog.

0.6.1 (2026-09-16)

Fixes

Name modes, models and reasoning efforts for the narrow chips clients render them in, keeping muse's own vocabulary: SDK default reads as "On request" after muse --approval-mode on-request, bypassApprovals as "Auto-approve", rejectApprovals as "Reject prompts" because known-safe tools may still run, and exec yolo as "No approval, no sandbox" — muse --yolo disables both, and the name keeps the pair that muse's own safety section states together. Effort tiers are capitalized, and a model shows its provider only when that distinguishes two catalog entries.

Correct a stale live-test version gate that pinned the legacy :auto-review resume limitation to 1.2.1-R2847.1, so 1.3.0-R3057.1 was expected to continue successfully. Affected builds stay enumerated, which is how 1.3.0 was caught still reproducing the rejection rather than fixing it. Adapter behavior is unchanged; only the test expectation and its documentation moved.

Compatibility and upgrading

Display names only: mode IDs, config option IDs, model choices and effort values are unchanged, so stored selections and automated clients keying on IDs are unaffected. A client that matches on the previous display strings should key on the ID instead.

The legacy :auto-review resume limitation is now confirmed on 1.3.0-R3057.1 as well as 1.2.1-R2847.1. This is an observation about the Muse host, not a regression in this adapter, and the pinned 1.1.1 baseline is unchanged.

Commits

9349855 chore: release 0.6.1
4860db9 fix: align mode and model display names with the muse CLI
c34fec2 docs: record delegated-worker reassessment and file upstream issue
See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (trunca...

Description has been truncated

…updates Bumps the third-party group with 2 updates in the /plugins/codex-security/skills/triage-finding/evals directory: [@opencode-ai/sdk](https://github.com/sst/opencode-sdk-js) and [promptfoo](https://github.com/promptfoo/promptfoo). Bumps the third-party group with 12 updates in the /sdk/typescript directory: | Package | From | To | | --- | --- | --- | | [@agentclientprotocol/claude-agent-acp](https://github.com/agentclientprotocol/claude-agent-acp) | `0.70.0` | `0.79.0` | | [@agentclientprotocol/sdk](https://github.com/agentclientprotocol/typescript-sdk) | `1.4.0` | `1.5.0` | | [@bex-co/muse-code-acp](https://github.com/bex-co/muse-code-acp) | `0.6.0` | `0.6.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | | [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.2` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | Updates `@opencode-ai/sdk` from 1.18.29 to 1.18.31 - [Release notes](https://github.com/sst/opencode-sdk-js/releases) - [Changelog](https://github.com/anomalyco/opencode-sdk-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/sst/opencode-sdk-js/commits) Updates `promptfoo` from 0.122.2 to 0.123.1 - [Release notes](https://github.com/promptfoo/promptfoo/releases) - [Changelog](https://github.com/promptfoo/promptfoo/blob/main/CHANGELOG.md) - [Commits](promptfoo/promptfoo@0.122.2...0.123.1) Updates `@agentclientprotocol/claude-agent-acp` from 0.70.0 to 0.79.0 - [Release notes](https://github.com/agentclientprotocol/claude-agent-acp/releases) - [Changelog](https://github.com/agentclientprotocol/claude-agent-acp/blob/main/CHANGELOG.md) - [Commits](agentclientprotocol/claude-agent-acp@v0.70.0...v0.79.0) Updates `@agentclientprotocol/sdk` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/agentclientprotocol/typescript-sdk/releases) - [Changelog](https://github.com/agentclientprotocol/typescript-sdk/blob/main/CHANGELOG.md) - [Commits](agentclientprotocol/typescript-sdk@v1.4.0...v1.5.0) Updates `@bex-co/muse-code-acp` from 0.6.0 to 0.6.1 - [Release notes](https://github.com/bex-co/muse-code-acp/releases) - [Changelog](https://github.com/bex-co/muse-code-acp/blob/main/CHANGELOG.md) - [Commits](bex-co/muse-code-acp@v0.6.0...v0.6.1) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) Updates `zod` from 4.5.4 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.5.4...v4.6.5) Updates `@types/node` from 26.5.0 to 26.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `fast-check` from 4.9.0 to 4.10.2 - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check) Updates `prettier` from 3.9.6 to 3.9.8 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.8) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) --- updated-dependencies: - dependency-name: "@opencode-ai/sdk" dependency-version: 1.18.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: third-party - dependency-name: promptfoo dependency-version: 0.123.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@agentclientprotocol/claude-agent-acp" dependency-version: 0.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@agentclientprotocol/sdk" dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@bex-co/muse-code-acp" dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: third-party - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: third-party - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: third-party - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: third-party - dependency-name: fast-check dependency-version: 4.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: third-party - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: third-party - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: third-party - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: third-party ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 28, 2026

Navigation Menu

chore(deps): bump the third-party group across 2 directories with 14 updates - #906

chore(deps): bump the third-party group across 2 directories with 14 updates#906
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/plugins/codex-security/skills/triage-finding/evals/third-party-b942698cfc

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 28, 2026

0.123.1

0.123.1 (2026-09-18)

Features

Bug Fixes

0.123.1 (2026-09-18)

Features

Bug Fixes

v0.79.0

0.79.0 (2026-09-17)

Features

Bug Fixes

v0.78.0

0.78.0 (2026-09-15)

Features

Bug Fixes

Performance Improvements

v0.77.0

0.77.0 (2026-09-14)

⚠ BREAKING CHANGES

Features

Bug Fixes

0.79.0 (2026-09-17)

Features

Bug Fixes

0.78.0 (2026-09-15)

Features

Bug Fixes

Performance Improvements

0.77.0 (2026-09-14)

⚠ BREAKING CHANGES

Features

Bug Fixes

v1.5.0

1.5.0 (2026-09-21)

Features

1.5.0 (2026-09-21)

Features

0.6.1 (2026-09-16)

Fixes

Compatibility and upgrading

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants