Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 29 updates#172

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-2f6fe01375
Closed

chore(deps): bump the production-dependencies group across 1 directory with 29 updates#172
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-2f6fe01375

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown

Bumps the production-dependencies group with 29 updates in the / directory:

Package From To
@ai-sdk/google-vertex 3.0.142 4.0.145
@ai-sdk/react 2.0.204 3.0.207
@anthropic-ai/sdk 0.71.2 0.104.1
@azure/arm-compute 23.3.0 24.0.0
@azure/arm-imagebuilder 4.1.1 5.0.0
@clerk/nextjs 6.39.5 7.5.2
@daytonaio/sdk 0.123.0 0.187.0
@google-cloud/aiplatform 5.14.0 6.8.1
@google/genai 1.52.0 2.8.0
@mastra/core 0.24.9 1.42.0
@mediar-ai/terminator 0.23.51 0.24.32
ai 5.0.202 6.0.205
diff 8.0.4 9.0.0
inngest 3.54.2 4.5.1
jspdf 3.0.4 4.2.1
lucide-react 0.556.0 1.18.0
modal 0.5.6 0.8.0
next 15.5.9 16.2.9
react-day-picker 9.14.0 10.0.1
react-resizable-panels 3.0.6 4.11.2
redis 5.12.1 6.0.0
streamdown 1.6.11 2.5.0
stripe 20.4.1 22.2.1
uuid 13.0.2 14.0.0
@tauri-apps/api 2.10.1 2.11.0
@opentelemetry/sdk-node 0.213.0 0.219.0
@opentelemetry/exporter-trace-otlp-http 0.213.0 0.219.0
@opentelemetry/exporter-logs-otlp-http 0.213.0 0.219.0
commander 14.0.3 15.0.0

Updates @ai-sdk/google-vertex from 3.0.142 to 4.0.145

Release notes

Sourced from @​ai-sdk/google-vertex's releases.

@​ai-sdk/provider-utils@​4.0.29

Patch Changes

  • bfa5864: fix: only send provider credentials to same-origin response-supplied URLs

    Several provider clients followed a URL taken from the provider's API response (a polling/status URL or a final media URL such as polling_url, urls.get, result_url, result.sample, or video.uri) and reused the authenticated headers — or appended ?key=<API_KEY> — on that request. Because the host of the response-supplied URL was never validated, the long-lived API key was sent to whatever host the response named (a CDN in the benign case, or an attacker-chosen host if the provider response was tampered with), allowing credential exfiltration.

    A new isSameOrigin helper is added to @ai-sdk/provider-utils, and the affected fetches in @ai-sdk/black-forest-labs, @ai-sdk/fireworks, @ai-sdk/replicate, @ai-sdk/gladia, @ai-sdk/fal, and @ai-sdk/google now attach credentials only when the followed URL is same-origin with the provider's configured API origin. Requests to a foreign origin are made without the credential.

  • f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

    • A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
    • IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
    • Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
    • Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).

    The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.

@​ai-sdk/react@​4.0.0-canary.178

Patch Changes

  • ai@7.0.0-canary.174

@​ai-sdk/vue@​4.0.0-canary.174

Patch Changes

  • ai@7.0.0-canary.174

@​ai-sdk/gateway@​4.0.0-canary.106

Patch Changes

  • ca2cf45: fix(provider/gateway): map forbidden error responses to GatewayForbiddenError instead of GatewayInternalServerError

@​ai-sdk/react@​3.0.207

Patch Changes

  • ai@6.0.205

@​ai-sdk/react@​3.0.205

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
  • Updated dependencies [5291f7e]
  • Updated dependencies [b4b575a]
    • @​ai-sdk/provider-utils@​4.0.29
    • ai@6.0.203

... (truncated)

Changelog

Sourced from @​ai-sdk/google-vertex's changelog.

4.0.145

Patch Changes

  • Updated dependencies [3258f22]
  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
    • @​ai-sdk/google@​3.0.82
    • @​ai-sdk/provider-utils@​4.0.29
    • @​ai-sdk/anthropic@​3.0.84
    • @​ai-sdk/openai-compatible@​2.0.50

4.0.144

Patch Changes

  • Updated dependencies [942f2f8]
    • @​ai-sdk/provider-utils@​4.0.28
    • @​ai-sdk/anthropic@​3.0.83
    • @​ai-sdk/google@​3.0.81
    • @​ai-sdk/openai-compatible@​2.0.49

4.0.143

Patch Changes

  • 2a91a17: feat(provider/anthropic): add support for claude-fable-5 and the fallbacks API parameter
  • Updated dependencies [2a91a17]
    • @​ai-sdk/anthropic@​3.0.82

4.0.142

Patch Changes

  • 099de46: fix(google-vertex): support regional endpoints for vertex MaaS

4.0.141

Patch Changes

  • 8584f2e: fix(vertex-anthropic): support eu/us multi-region anthropic endpoints
  • e96b286: fix(google-vertex): support for eu/us multi region gemini endpoints

4.0.140

Patch Changes

  • 4084fcd: feat(provider/anthropic): add support for claude-opus-4-8
  • Updated dependencies [4084fcd]
    • @​ai-sdk/anthropic@​3.0.81

... (truncated)

Commits
  • bae9bab Version Packages (#16026)
  • 9ef2c3c Version Packages (#15998)
  • f6e5881 Version Packages (#15902)
  • 2a91a17 backport: feat(provider/anthropic): add support for claude-fable-5 and the ...
  • 7aca1fc backport: chore: update TypeScript references and fix `pnpm update-references...
  • 00ca39c Version Packages (#15786)
  • 099de46 Backport: fix(google-vertex): support regional endpoints for vertex MaaS (#15...
  • e98e3bb Version Packages (#15782)
  • 8584f2e Backport: fix(vertex-anthropic): support eu/us multi-region anthropic endpoin...
  • e96b286 Backport: fix(google-vertex): support for eu/us multi region gemini endpoints...
  • Additional commits viewable in compare view

Updates @ai-sdk/react from 2.0.204 to 3.0.207

Release notes

Sourced from @​ai-sdk/react's releases.

@​ai-sdk/react@​3.0.207

Patch Changes

  • ai@6.0.205

@​ai-sdk/react@​3.0.205

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
  • Updated dependencies [5291f7e]
  • Updated dependencies [b4b575a]
    • @​ai-sdk/provider-utils@​4.0.29
    • ai@6.0.203
Changelog

Sourced from @​ai-sdk/react's changelog.

3.0.207

Patch Changes

  • ai@6.0.205

3.0.206

Patch Changes

  • ai@6.0.204

3.0.205

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
  • Updated dependencies [5291f7e]
  • Updated dependencies [b4b575a]
    • @​ai-sdk/provider-utils@​4.0.29
    • ai@6.0.203

3.0.204

Patch Changes

  • Updated dependencies [942f2f8]
    • ai@6.0.202
    • @​ai-sdk/provider-utils@​4.0.28

3.0.203

Patch Changes

  • Updated dependencies [0c8c0ed]
    • ai@6.0.201

3.0.202

Patch Changes

  • Updated dependencies [14098e7]
  • Updated dependencies [2cabe9c]
    • ai@6.0.200

3.0.201

Patch Changes

... (truncated)

Commits

Updates @anthropic-ai/sdk from 0.71.2 to 0.104.1

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.104.1

0.104.1 (2026-06-09)

Full Changelog: sdk-v0.104.0...sdk-v0.104.1

Bug Fixes

  • api: add frontier_llm refusal category (465e686)

sdk: v0.104.0

0.104.0 (2026-06-09)

Full Changelog: sdk-v0.103.0...sdk-v0.104.0

Features

  • api: add support for Managed Agents deployments and environment variable credentials (d01e38b)

sdk: v0.103.0

0.103.0 (2026-06-09)

Full Changelog: sdk-v0.102.0...sdk-v0.103.0

Features

  • api: add support for claude-mythos-5 and claude-fable-5, with support for server-side fallbacks on refusal (cc337f7)
  • client: adds client-side fallbacks middleware for API providers that do not support server-side fallbacks (cc337f7)
  • middleware: add ctx.logger (#55) (edd1454)

Bug Fixes

sdk: v0.102.0

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

  • api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

  • client: run middleware before request signing (#45) (95f1a4a)

sdk: v0.101.0

0.101.0 (2026-06-05)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.104.1 (2026-06-09)

Full Changelog: sdk-v0.104.0...sdk-v0.104.1

Bug Fixes

  • api: add frontier_llm refusal category (465e686)

0.104.0 (2026-06-09)

Full Changelog: sdk-v0.103.0...sdk-v0.104.0

Features

  • api: add support for Managed Agents deployments and environment variable credentials (d01e38b)

0.103.0 (2026-06-09)

Full Changelog: sdk-v0.102.0...sdk-v0.103.0

Features

  • api: add support for claude-mythos-5 and claude-fable-5, with support for server-side fallbacks on refusal (cc337f7)
  • client: adds client-side fallbacks middleware for API providers that do not support server-side fallbacks (cc337f7)
  • middleware: add ctx.logger (#55) (edd1454)

Bug Fixes

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

  • api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

  • client: run middleware before request signing (#45) (95f1a4a)

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

... (truncated)

Commits
  • 9a0442d chore: release main
  • 1ccd401 fix(api): add frontier_llm refusal category
  • 8be0232 chore: release main
  • 813af32 feat(api): add support for Managed Agents deployments and environment variabl...
  • 589eed1 chore: release main
  • a785874 feat(api): add support for claude-mythos-5 and claude-fable-5, with support f...
  • 6322a4f fix(client): 3p middleware ordering (#53)
  • c2e94fc feat(middleware): add ctx.logger (#55)
  • f7dfb97 chore: release main
  • a3f3c97 feat(api): small updates to Managed Agents types
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates @azure/arm-compute from 23.3.0 to 24.0.0

Changelog

Sourced from @​azure/arm-compute's changelog.

24.0.0 (2026-04-28)

Features Added

  • Added operation group VirtualMachineScaleSetLifeCycleHookEventsOperations
  • Added operation AvailabilitySetsOperations.convertToVirtualMachineScaleSet
  • Added operation CapacityReservationsOperations.createOrUpdate
  • Added operation CapacityReservationsOperations.delete
  • Added operation CapacityReservationsOperations.update
  • Added operation DedicatedHostsOperations.createOrUpdate
  • Added operation DedicatedHostsOperations.delete
  • Added operation DedicatedHostsOperations.redeploy
  • Added operation DedicatedHostsOperations.restart
  • Added operation DedicatedHostsOperations.update
  • Added operation DiskAccessesOperations.createOrUpdate
  • Added operation DiskAccessesOperations.delete
  • Added operation DiskAccessesOperations.deleteAPrivateEndpointConnection
  • Added operation DiskAccessesOperations.update
  • Added operation DiskAccessesOperations.updateAPrivateEndpointConnection
  • Added operation DiskEncryptionSetsOperations.createOrUpdate
  • Added operation DiskEncryptionSetsOperations.delete
  • Added operation DiskEncryptionSetsOperations.update
  • Added operation DiskRestorePointOperations.grantAccess
  • Added operation DiskRestorePointOperations.revokeAccess
  • Added operation DisksOperations.createOrUpdate
  • Added operation DisksOperations.delete
  • Added operation DisksOperations.grantAccess
  • Added operation DisksOperations.revokeAccess
  • Added operation DisksOperations.update
  • Added operation GalleriesOperations.createOrUpdate
  • Added operation GalleriesOperations.delete
  • Added operation GalleriesOperations.update
  • Added operation GalleryApplicationsOperations.createOrUpdate
  • Added operation GalleryApplicationsOperations.delete
  • Added operation GalleryApplicationsOperations.update
  • Added operation GalleryApplicationVersionsOperations.createOrUpdate
  • Added operation GalleryApplicationVersionsOperations.delete
  • Added operation GalleryApplicationVersionsOperations.update
  • Added operation GalleryImagesOperations.createOrUpdate
  • Added operation GalleryImagesOperations.delete
  • Added operation GalleryImagesOperations.update
  • Added operation GalleryImageVersionsOperations.createOrUpdate
  • Added operation GalleryImageVersionsOperations.delete
  • Added operation GalleryImageVersionsOperations.update
  • Added operation GalleryInVMAccessControlProfilesOperations.createOrUpdate
  • Added operation GalleryInVMAccessControlProfilesOperations.delete
  • Added operation GalleryInVMAccessControlProfilesOperations.update
  • Added operation GalleryInVMAccessControlProfileVersionsOperations.createOrUpdate
  • Added operation GalleryInVMAccessControlProfileVersionsOperations.delete
  • Added operation GalleryInVMAccessControlProfileVersionsOperations.update
  • Added operation GalleryScriptsOperations.createOrUpdate

... (truncated)

Commits

Updates @azure/arm-imagebuilder from 4.1.1 to 5.0.0

Changelog

Sourced from @​azure/arm-imagebuilder's changelog.

5.0.0 (2026-06-12)

Features Added

  • Added operation TriggersOperations.createOrUpdate
  • Added operation TriggersOperations.delete
  • Added operation VirtualMachineImageTemplatesOperations.cancel
  • Added operation VirtualMachineImageTemplatesOperations.createOrUpdate
  • Added operation VirtualMachineImageTemplatesOperations.delete
  • Added operation VirtualMachineImageTemplatesOperations.run
  • Added operation VirtualMachineImageTemplatesOperations.update
  • Added Interface DataDisk
  • Added Interface ImageTemplateProperties
  • Added Interface ImageTemplatePropertiesOptimizeWorkload
  • Added Interface PagedAsyncIterableIterator
  • Added Interface PageSettings
  • Added Interface RestorePollerOptions
  • Added Interface RunOutputProperties
  • Added Interface SimplePollerLike
  • Interface ImageTemplate has a new optional parameter additionalDataDisks
  • Interface ImageTemplatePropertiesOptimize has a new optional parameter workload
  • Interface ImageTemplateSharedImageDistributor has a new optional parameter replicationMode
  • Interface Trigger has a new optional parameter properties
  • Added Type Alias AzureSupportedClouds
  • Added Type Alias ReplicationMode
  • Added Type Alias WorkloadOptimizationState
  • Added Enum AzureClouds
  • Added Enum KnownReplicationMode
  • Added Enum KnownVersions

Breaking Changes

  • Operation Triggers.beginDeleteAndWait has a new signature
  • Operation VirtualMachineImageTemplates.beginCreateOrUpdate has a new signature
  • Operation VirtualMachineImageTemplates.beginCreateOrUpdateAndWait has a new signature
  • Operation VirtualMachineImageTemplates.beginDeleteAndWait has a new signature
  • Operation VirtualMachineImageTemplates.beginUpdate has a new signature
  • Operation VirtualMachineImageTemplates.beginUpdateAndWait has a new signature
  • Operation VirtualMachineImageTemplates.get has a new signature
  • Removed Interface RunOutputCollection
  • Removed Interface TriggerCollection
  • Type of parameter scheme of interface DistributeVersioner is changed from "Latest" | "Source" to string
  • Type of parameter type of interface ImageTemplateCustomizer is changed from "Shell" | "WindowsRestart" | "WindowsUpdate" | "PowerShell" | "File" to string
  • Type of parameter type of interface ImageTemplateDistributor is changed from "ManagedImage" | "SharedImage" | "VHD" to string
  • Type of parameter type of interface ImageTemplateInVMValidator is changed from "Shell" | "PowerShell" | "File" to string
  • Type of parameter type of interface ImageTemplateSource is changed from "PlatformImage" | "ManagedImage" | "SharedImageVersion" to string
  • Type of parameter kind of interface TriggerProperties is changed from "SourceImage" to string
  • Interface Trigger no longer has parameter kind
  • Interface Trigger no longer has parameter provisioningState
  • Interface Trigger no longer has parameter status
  • Type alias "DistributeVersionerUnion" has been changed
  • Type alias "ImageTemplateCustomizerUnion" has been changed

... (truncated)

Commits
  • 8c47294 update changelog data for unreleased mgmt packages (#38939)
  • 190ecd0 [AutoPR @​azure-arm-imagebuilder]-generated-from-SDK Generation - JS-6324647 (...
  • 7c40099 [Engsys] remove vitest.esm.config and update vitest.browser.config for arm li...
  • c32abb9 [EngSys] restore browser target to top in warp config (#38580)
  • 0806413 [Engsys] migrate package to use tsconfig from package level config/ directory...
  • 3de1abe Add imports field to all warp-built packages (#38391)
  • 0aa0f0f Add react-native devDependency to packages with RN targets (#38392)
  • e8f0055 chore: Update registry for all package.json and adjust check rules (#38281)
  • 6a0d0d7 feat(warp): add extends support for config inheritance (#37937)
  • c0f19b7 Migrate libs with no polyfills to warp (#37372)
  • Additional commits viewable in compare view

Updates @clerk/nextjs from 6.39.5 to 7.5.2

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.5.2

Patch Changes

@​clerk/nextjs@​7.5.1

Patch Changes

  • Updated dependencies [a5c7bc7]:
    • @​clerk/shared@​4.17.0
    • @​clerk/react@​6.9.0
    • @​clerk/backend@​3.6.1

@​clerk/nextjs@​7.5.0

Minor Changes

  • Remove the <ConfigureSSO /> component from the public API in favor of usage within OrganizationProfile (#8779) by @​LauraBeatris

    Removing these exports has no breaking changes impact on production applications, as was never released as a GA component

Patch Changes

  • Harden middleware debug log output: the formatter now recursively truncates known credential keys (sessionToken, tokenInHeader, sessionTokenInCookie, secretKey, jwtKey) at any nesting depth, so a bearer token can no longer reach the logs even if a debug producer nests one. This is a defense-in-depth backstop alongside the source-level redaction in @clerk/backend. (#8744) by @​jacekradko

  • Add and improve JSDoc comments across public types and methods to support generated reference documentation for the /objects docs section. Exports a few previously-internal types (OnEventListener, OffEventListener, ClerkOptionsNavigation) so they can be referenced from the generated docs. (#8276) by @​alexisintech

  • Updated dependencies [83f50f6, 2d6670c, e7cb503, 83f50f6, af706e3, 48b187d, 27c4d75, 955e998, 032632c, 0fece6f, b295af3, 0c854c3, 27c4d75, 8e1bd48]:

    • @​clerk/react@​6.8.0
    • @​clerk/shared@​4.16.0
    • @​clerk/backend@​3.6.0

@​clerk/nextjs@​7.4.3

Patch Changes

@​clerk/nextjs@​7.4.2

Patch Changes

... (truncated)

Changelog

Sourced from @​clerk/nextjs's changelog.

7.5.2

Patch Changes

7.5.1

Patch Changes

  • Updated dependencies [a5c7bc7]:
    • @​clerk/shared@​4.17.0
    • @​clerk/react@​6.9.0
    • @​clerk/backend@​3.6.1

7.5.0

Minor Changes

  • Remove the <ConfigureSSO /> component from the public API in favor of usage within OrganizationProfile (#8779) by @​LauraBeatris

    Removing these exports has no breaking changes impact on production applications, as was never released as a GA component

Patch Changes

  • Harden middleware debug log output: the formatter now recursively truncates known credential keys (sessionToken, tokenInHeader, sessionTokenInCookie, secretKey, jwtKey) at any nesting depth, so a bearer token can no longer reach the logs even if a debug producer nests one. This is a defense-in-depth backstop alongside the source-level redaction in @clerk/backend. (#8744) by @​jacekradko

  • Add and improve JSDoc comments across public types and methods to support generated reference documentation for the /objects docs section. Exports a few previously-internal types (OnEventListener, OffEventListener, ClerkOptionsNavigation) so they can be referenced from the generated docs. (#8276) by @​alexisintech

  • Updated dependencies [83f50f6, 2d6670c, e7cb503, 83f50f6, af706e3, 48b187d, 27c4d75, 955e998, 032632c, 0fece6f, b295af3, 0c854c3, 27c4d75, 8e1bd48]:

    • @​clerk/react@​6.8.0
    • @​clerk/shared@​4.16.0
    • @​clerk/backend@​3.6.0

7.4.3

Patch Changes

... (truncated)

Commits
  • 5ebed8b ci(repo): Version packages (#8810)
  • f046c49 chore(repo): Upgrade to TypeScript 6.0 (#8177)
  • 7cfd510 ci(repo): Version packages (#8803)
  • 1028d82 ci(repo): Version packages (#8735)
  • 2d6670c chore(ui,clerk-js,shared): Remove public export of ConfigureSSO (#8779)
  • 27c4d75 fix(backend): harden machine-token verification and redact debug-logged token...
  • 8e1bd48 docs(repo): Add typedoc comments; generate typedoc output for /objects docs (...
  • c9d9e6a ci(repo): Version packages (#8679)
  • 86fd38f fix(repo): harden keyless accountless requests (#8676)
  • bbbe654 ci(repo): Version packages (#8635)
  • Additional commits viewable in compare view

Updates @daytonaio/sdk from 0.123.0 to 0.187.0

Release notes

Sourced from @​daytonaio/sdk's releases.

v0.187.0

0.187.0 (2026-06-11)

🚀 Features

  • dashboard: limits classes tabs (#4978)
  • docs: add android and linked sandboxes (#4614)
  • proxy: expose debug metrics server (#5012)

🩹 Fixes

  • ⚠️ api: require a write permission for temporary push access endpoints (#4971)
  • api: redirect root requests to /dashboard (#4977)
  • cli: drop redundant BucketExists probes in minio client (#5013, #5014)

Chores

  • sync go.sum for v0.186.0 (#4975)
  • split publish jobs per project (#5011)
  • sdk-go: bump to v0.187.0 (#5015)

⚠️ Breaking Changes

  • api: GET /object-storage/push-access and GET /docker-registry/registry-push-access now require the caller to hold either write:snapshots or write:sandboxes (previously no specific permission was required). Migration: grant write: snapshots or write:sandboxes to API keys that push snapshots or build declarative images with a local context.

❤️ Thank You

v0.186.0

0.186.0 (2026-06-10)

🚀 Features

  • api: windows sandbox snapshot and fork (#4911)
  • dashboard: show warning for missing permissions instead of redirect (#4950)
  • dashboard: upgrade react-router to v7 (#4972)
  • docs: sandboxes lifecycle ttl (#4965)
  • guides: CopilotKit guide (#4960)

🩹 Fixes

  • api: close usage period on desired state destroyed (#4962)
  • api: cache dns lookups on global http(s) agents to prevent eai_again errors (#4964)
  • api: scope object-storage push-access ListBucket to caller org prefix (#4966)
  • api: volumeid path traversal bug fix (#4959)

... (truncated)

Commits

Updates @google-cloud/aiplatform from 5.14.0 to 6.8.1

Release notes

Sourced from @​google-cloud/aiplatform's releases<...

Description has been truncated

…y with 29 updates

Bumps the production-dependencies group with 29 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/google-vertex](https://github.com/vercel/ai/tree/HEAD/packages/google-vertex) | `3.0.142` | `4.0.145` |
| [@ai-sdk/react](https://github.com/vercel/ai/tree/HEAD/packages/react) | `2.0.204` | `3.0.207` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.71.2` | `0.104.1` |
| [@azure/arm-compute](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/compute/arm-compute) | `23.3.0` | `24.0.0` |
| [@azure/arm-imagebuilder](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/imagebuilder/arm-imagebuilder) | `4.1.1` | `5.0.0` |
| [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `6.39.5` | `7.5.2` |
| [@daytonaio/sdk](https://github.com/daytonaio/daytona) | `0.123.0` | `0.187.0` |
| [@google-cloud/aiplatform](https://github.com/googleapis/google-cloud-node/tree/HEAD/packages/google-cloud-aiplatform) | `5.14.0` | `6.8.1` |
| [@google/genai](https://github.com/googleapis/js-genai) | `1.52.0` | `2.8.0` |
| [@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core) | `0.24.9` | `1.42.0` |
| [@mediar-ai/terminator](https://github.com/mediar-ai/terminator) | `0.23.51` | `0.24.32` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.202` | `6.0.205` |
| [diff](https://github.com/kpdecker/jsdiff) | `8.0.4` | `9.0.0` |
| [inngest](https://github.com/inngest/inngest-js/tree/HEAD/packages/inngest) | `3.54.2` | `4.5.1` |
| [jspdf](https://github.com/parallax/jsPDF) | `3.0.4` | `4.2.1` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.556.0` | `1.18.0` |
| [modal](https://github.com/modal-labs/modal-client) | `0.5.6` | `0.8.0` |
| [next](https://github.com/vercel/next.js) | `15.5.9` | `16.2.9` |
| [react-day-picker](https://github.com/gpbl/react-day-picker/tree/HEAD/packages/react-day-picker) | `9.14.0` | `10.0.1` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `3.0.6` | `4.11.2` |
| [redis](https://github.com/redis/node-redis) | `5.12.1` | `6.0.0` |
| [streamdown](https://github.com/vercel/streamdown/tree/HEAD/packages/streamdown) | `1.6.11` | `2.5.0` |
| [stripe](https://github.com/stripe/stripe-node) | `20.4.1` | `22.2.1` |
| [uuid](https://github.com/uuidjs/uuid) | `13.0.2` | `14.0.0` |
| [@tauri-apps/api](https://github.com/tauri-apps/tauri) | `2.10.1` | `2.11.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.213.0` | `0.219.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.213.0` | `0.219.0` |
| [@opentelemetry/exporter-logs-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.213.0` | `0.219.0` |
| [commander](https://github.com/tj/commander.js) | `14.0.3` | `15.0.0` |



Updates `@ai-sdk/google-vertex` from 3.0.142 to 4.0.145
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/google-vertex@4.0.145/packages/google-vertex/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google-vertex@4.0.145/packages/google-vertex)

Updates `@ai-sdk/react` from 2.0.204 to 3.0.207
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/react@3.0.207/packages/react/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/react@3.0.207/packages/react)

Updates `@anthropic-ai/sdk` from 0.71.2 to 0.104.1
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.71.2...sdk-v0.104.1)

Updates `@azure/arm-compute` from 23.3.0 to 24.0.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/compute/arm-compute/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/arm-compute_24.0.0/sdk/compute/arm-compute)

Updates `@azure/arm-imagebuilder` from 4.1.1 to 5.0.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/imagebuilder/arm-imagebuilder/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/arm-imagebuilder_5.0.0/sdk/imagebuilder/arm-imagebuilder)

Updates `@clerk/nextjs` from 6.39.5 to 7.5.2
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.5.2/packages/nextjs)

Updates `@daytonaio/sdk` from 0.123.0 to 0.187.0
- [Release notes](https://github.com/daytonaio/daytona/releases)
- [Commits](daytonaio/daytona@v0.123.0...v0.187.0)

Updates `@google-cloud/aiplatform` from 5.14.0 to 6.8.1
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-aiplatform/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/aiplatform-v6.8.1/packages/google-cloud-aiplatform)

Updates `@google/genai` from 1.52.0 to 2.8.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v1.52.0...v2.8.0)

Updates `@mastra/core` from 0.24.9 to 1.42.0
- [Release notes](https://github.com/mastra-ai/mastra/releases)
- [Changelog](https://github.com/mastra-ai/mastra/blob/main/docs/CHANGELOG.md)
- [Commits](https://github.com/mastra-ai/mastra/commits/@mastra/core@1.42.0/packages/core)

Updates `@mediar-ai/terminator` from 0.23.51 to 0.24.32
- [Release notes](https://github.com/mediar-ai/terminator/releases)
- [Changelog](https://github.com/mediar-ai/terminator/blob/main/CHANGELOG.md)
- [Commits](mediar-ai/terminator@v0.23.51...v0.24.32)

Updates `ai` from 5.0.202 to 6.0.205
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.205/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.205/packages/ai)

Updates `diff` from 8.0.4 to 9.0.0
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@8.0.4...v9.0.0)

Updates `inngest` from 3.54.2 to 4.5.1
- [Release notes](https://github.com/inngest/inngest-js/releases)
- [Changelog](https://github.com/inngest/inngest-js/blob/main/packages/inngest/CHANGELOG.md)
- [Commits](https://github.com/inngest/inngest-js/commits/inngest@4.5.1/packages/inngest)

Updates `jspdf` from 3.0.4 to 4.2.1
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v3.0.4...v4.2.1)

Updates `lucide-react` from 0.556.0 to 1.18.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.18.0/packages/lucide-react)

Updates `modal` from 0.5.6 to 0.8.0
- [Changelog](https://github.com/modal-labs/modal-client/blob/main/CHANGELOG_GO_JS.md)
- [Commits](https://github.com/modal-labs/modal-client/commits/go/v0.8.0)

Updates `next` from 15.5.9 to 16.2.9
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.9...v16.2.9)

Updates `react-day-picker` from 9.14.0 to 10.0.1
- [Release notes](https://github.com/gpbl/react-day-picker/releases)
- [Changelog](https://github.com/gpbl/react-day-picker/blob/main/packages/react-day-picker/CHANGELOG.md)
- [Commits](https://github.com/gpbl/react-day-picker/commits/v10.0.1/packages/react-day-picker)

Updates `react-resizable-panels` from 3.0.6 to 4.11.2
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bvaughn/react-resizable-panels/commits)

Updates `redis` from 5.12.1 to 6.0.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@5.12.1...redis@6.0.0)

Updates `streamdown` from 1.6.11 to 2.5.0
- [Release notes](https://github.com/vercel/streamdown/releases)
- [Changelog](https://github.com/vercel/streamdown/blob/main/packages/streamdown/CHANGELOG.md)
- [Commits](https://github.com/vercel/streamdown/commits/streamdown@2.5.0/packages/streamdown)

Updates `stripe` from 20.4.1 to 22.2.1
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v20.4.1...v22.2.1)

Updates `uuid` from 13.0.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v13.0.2...v14.0.0)

Updates `@tauri-apps/api` from 2.10.1 to 2.11.0
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/api-v2.10.1...@tauri-apps/api-v2.11.0)

Updates `@opentelemetry/sdk-node` from 0.213.0 to 0.219.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.213.0...experimental/v0.219.0)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.213.0 to 0.219.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.213.0...experimental/v0.219.0)

Updates `@opentelemetry/exporter-logs-otlp-http` from 0.213.0 to 0.219.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.213.0...experimental/v0.219.0)

Updates `commander` from 14.0.3 to 15.0.0
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v14.0.3...v15.0.0)

---
updated-dependencies:
- dependency-name: "@ai-sdk/google-vertex"
  dependency-version: 4.0.145
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/react"
  dependency-version: 3.0.207
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.104.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@azure/arm-compute"
  dependency-version: 24.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@azure/arm-imagebuilder"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@clerk/nextjs"
  dependency-version: 7.5.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@daytonaio/sdk"
  dependency-version: 0.187.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@google-cloud/aiplatform"
  dependency-version: 6.8.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@google/genai"
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@mastra/core"
  dependency-version: 1.42.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@mediar-ai/terminator"
  dependency-version: 0.24.32
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 6.0.205
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: diff
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: inngest
  dependency-version: 4.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: jspdf
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: modal
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.2.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: react-day-picker
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: react-resizable-panels
  dependency-version: 4.11.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: redis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: streamdown
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: stripe
  dependency-version: 22.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@tauri-apps/api"
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.219.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.219.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-logs-otlp-http"
  dependency-version: 0.219.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: commander
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@vercel

vercel Bot commented Jun 15, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
mediar-web-app Error Error Jun 15, 2026 4:13pm

Request Review

@dependabot @github

dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 22, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-2f6fe01375 branch June 22, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants