JD Davis
34a5517562
chore: release 0.36.5 ( #3214 )
...
🤖 I have created a release *beep* *boop*
---
##
[0.36.5](https://github.com/headroomlabs-ai/headroom/compare/v0.36.4...v0.36.5 )
(2026-08-22)
### Bug Fixes
* **codex:** detect ChatGPT auth from id_token claims so wrap/init emit
requires_openai_auth
([#3212 ](https://github.com/headroomlabs-ai/headroom/issues/3212 ))
([2f81fa52f81fa5931#3213 ](https://github.com/headroomlabs-ai/headroom/issues/3213 ))
([8f3e33a8f3e33a00ehttps://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-22 16:22:48 -07:00
JD Davis
91186b40d8
chore: release 0.36.4 ( #3189 )
...
🤖 I have created a release *beep* *boop*
---
##
[0.36.4](https://github.com/headroomlabs-ai/headroom/compare/v0.36.3...v0.36.4 )
(2026-08-22)
### Bug Fixes
* **dashboard:** pin MIME types for the vendored static assets
([#3193 ](https://github.com/headroomlabs-ai/headroom/issues/3193 ))
([b485768b4857685ff#3194 ](https://github.com/headroomlabs-ai/headroom/issues/3194 ))
([1617f831617f839a1#3195 ](https://github.com/headroomlabs-ai/headroom/issues/3195 ))
([3e3c4093e3c409436#3191 ](https://github.com/headroomlabs-ai/headroom/issues/3191 ))
([9c30b629c30b62962#3183 ](https://github.com/headroomlabs-ai/headroom/issues/3183 ))
([202c189202c1895e1https://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-21 23:29:15 -07:00
JD Davis
87e71dd100
chore: release 0.36.3 ( #3188 )
...
🤖 I have created a release *beep* *boop*
---
##
[0.36.3](https://github.com/headroomlabs-ai/headroom/compare/v0.36.2...v0.36.3 )
(2026-08-21)
### Bug Fixes
* **proxy/responses:** lift Codex >= 0.149.0 additional_tools into
top-level tools
([#3186 ](https://github.com/headroomlabs-ai/headroom/issues/3186 ))
([25ca58025ca580825https://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-21 14:57:44 -07:00
JD Davis
5e0ce242e9
chore: release 0.36.2 ( #3157 )
...
🤖 I have created a release *beep* *boop*
---
##
[0.36.2](https://github.com/headroomlabs-ai/headroom/compare/v0.36.1...v0.36.2 )
(2026-08-21)
### Bug Fixes
* **copilot:** bind the minted token to the integration ID we forward
([#3164 ](https://github.com/headroomlabs-ai/headroom/issues/3164 ))
([397803a397803a942#3162 ](https://github.com/headroomlabs-ai/headroom/issues/3162 ))
([45cb1b945cb1b9c48#3163 ](https://github.com/headroomlabs-ai/headroom/issues/3163 ))
([40069644006964a03#2281 ](https://github.com/headroomlabs-ai/headroom/issues/2281 ))
([089106208910624fb#2277 ](https://github.com/headroomlabs-ai/headroom/issues/2277 ))
([f7e5d37f7e5d37f52#3146 ](https://github.com/headroomlabs-ai/headroom/issues/3146 ))
([c6dd823c6dd823384#3143 ](https://github.com/headroomlabs-ai/headroom/issues/3143 ))
([c8db13dc8db13d5ad#3145 ](https://github.com/headroomlabs-ai/headroom/issues/3145 ))
([9c14e3a9c14e3aa95#3147 ](https://github.com/headroomlabs-ai/headroom/issues/3147 ))
([a307c11a307c11109#3149 ](https://github.com/headroomlabs-ai/headroom/issues/3149 ))
([6e2e10f6e2e10f67a#2279 ](https://github.com/headroomlabs-ai/headroom/issues/2279 ))
([85774fc85774fcb70#2280 ](https://github.com/headroomlabs-ai/headroom/issues/2280 ))
([a382137a382137844#3144 ](https://github.com/headroomlabs-ai/headroom/issues/3144 ))
([6928d196928d1932chttps://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-20 23:09:18 -07:00
dependabot[bot]
a382137844
deps: bump typescript from 5.9.3 to 7.0.2 in /plugins/opencode ( #2280 )
...
Bumps [typescript](https://github.com/microsoft/TypeScript ) from 5.9.3
to 7.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/TypeScript/releases ">typescript's
releases</a>.</em></p>
<blockquote>
<h2>TypeScript 6.0.3</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/ ">release
announcement blog post</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22 ">fixed
issues query for TypeScript 6.0.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.1%22 ">fixed
issues query for TypeScript 6.0.1 (RC)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.2%22 ">fixed
issues query for TypeScript 6.0.2 (Stable)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.3%22 ">fixed
issues query for TypeScript 6.0.3 (Stable)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript ">npm</a></li>
</ul>
<h2>TypeScript 6.0</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/ ">release
announcement blog post</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22 ">fixed
issues query for TypeScript 6.0.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.1%22 ">fixed
issues query for TypeScript 6.0.1 (RC)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.2%22 ">fixed
issues query for TypeScript 6.0.2 (Stable)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript ">npm</a></li>
</ul>
<h2>TypeScript 6.0.1 RC</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0-rc/ ">release
announcement blog post</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22 ">fixed
issues query for TypeScript 6.0.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.1%22 ">fixed
issues query for TypeScript 6.0.1 (RC)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript ">npm</a></li>
</ul>
<h2>TypeScript 6.0 Beta</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0-beta/ ">release
announcement</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22+is%3Aclosed+ ">fixed
issues query for Typescript 6.0.0 (Beta)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript ">npm</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/microsoft/TypeScript/commits ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~microsoft1es ">microsoft1es</a>, a new
releaser for typescript since your current version.</p>
</details>
<br />
> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JerrettDavis <mxjerrett@gmail.com>
2026-08-20 22:12:03 -05:00
JD Davis
37faf2f247
chore: release 0.36.1 ( #3152 )
...
## Description
Release 0.36.1, generated by Release Please, containing the security
fixes from #2207 (WEB-01–07). This updates the changelog and keeps
Python, TypeScript SDK, plugin package, marketplace, server, and release
metadata versions aligned at 0.36.1.
## Type of Change
- [x] Release / version metadata
## Changes Made
- Updated the release manifest and generated changelog for 0.36.1.
- Synchronized `pyproject.toml`, TypeScript SDK, OpenClaw, OpenCode,
agent-hook plugin, marketplace, server, and release metadata versions.
- Included the 0.36.1 changelog entry for the security assessment fixes
merged in #2207 .
## Testing
- [x] CI and release validation pass
### Test Output
All current required checks are complete and passing, including version
sync, package builds, wheel smoke imports, security scans, Python test
shards, native wrapper checks, and devcontainer validation.
## Real Behavior Proof
- Environment: GitHub Actions release and CI workflows for commit
`52c0a0c61dce0af81af3ff73a34efe8b451501cb`.
- Observed result: all generated version-bearing files report 0.36.1;
build and smoke-import jobs produced and validated the release
artifacts.
- Not exercised: publishing jobs are intentionally skipped for a pull
request and run only after the release receives final human approval and
is merged.
## Runtime Rollout Safety
- Rollout-managed features: none; this PR packages already-merged
behavior.
- Stable/default behavior changed: no additional runtime behavior beyond
the included, already-reviewed security fixes.
- Kill switch / disable path: not applicable to generated release
metadata.
- Qualification impact: release artifact construction and smoke-import
validation are green.
- Rollback path: do not merge the release PR, or revert the release
commit before publishing.
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Release Notes
### Bug Fixes
- **security:** address u9up assessment findings (WEB-01–07) (#2207 )
This PR was generated with Release Please and then its description was
expanded to document review and qualification evidence. It still
requires final human review; no publishing or merge has been performed.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-20 17:20:18 -07:00
JD Davis
b88b9078d8
chore: release 0.36.0 ( #3067 )
...
🤖 I have created a release *beep* *boop*
---
##
[0.36.0](https://github.com/headroomlabs-ai/headroom/compare/v0.35.0...v0.36.0 )
(2026-08-20)
### Features
* add deterministic runtime rollout controls
([#1490 ](https://github.com/headroomlabs-ai/headroom/issues/1490 ))
([3077ac83077ac81e8#3051 ](https://github.com/headroomlabs-ai/headroom/issues/3051 ))
([f9807fdf9807fd69e1b0b0b81b0b0b89a4#2976 ](https://github.com/headroomlabs-ai/headroom/issues/2976 )
* **wrap/claude:** make the --1m fallback model configurable via
HEADROOM_1M_MODEL
([#2983 ](https://github.com/headroomlabs-ai/headroom/issues/2983 ))
([2a847252a8472525d#3073 ](https://github.com/headroomlabs-ai/headroom/issues/3073 ))
([6d2254d6d2254dfb5#3101 ](https://github.com/headroomlabs-ai/headroom/issues/3101 ))
([131b119131b119c05#3082 ](https://github.com/headroomlabs-ai/headroom/issues/3082 )
* **ccr:** make StreamingCCRHandler work on OpenAI streams
([#3069 ](https://github.com/headroomlabs-ai/headroom/issues/3069 ))
([7ef736f7ef736fb1a#3092 ](https://github.com/headroomlabs-ai/headroom/issues/3092 ))
([c502087c502087db7942af56942af56f11#3094 ](https://github.com/headroomlabs-ai/headroom/issues/3094 ))
([0ec73fa0ec73faa28#3102 ](https://github.com/headroomlabs-ai/headroom/issues/3102 ))
([139c7cb139c7cbdde#3078 ](https://github.com/headroomlabs-ai/headroom/issues/3078 )
* **ccr:** verify a scanned marker's hash before advertising it
([#2908 ](https://github.com/headroomlabs-ai/headroom/issues/2908 ))
([41dab2d41dab2d099#2996 ](https://github.com/headroomlabs-ai/headroom/issues/2996 ))
([a708c05a708c0571e#3062 ](https://github.com/headroomlabs-ai/headroom/issues/3062 ))
([ac8646aac8646aa3c#2958 ](https://github.com/headroomlabs-ai/headroom/issues/2958 ))
([e269afbe269afb935#2993 ](https://github.com/headroomlabs-ai/headroom/issues/2993 ))
([2d88e312d88e31a40#2832 ](https://github.com/headroomlabs-ai/headroom/issues/2832 ))
([825261982526191a1#3064 ](https://github.com/headroomlabs-ai/headroom/issues/3064 ))
([96c25f596c25f5181#3077 ](https://github.com/headroomlabs-ai/headroom/issues/3077 ))
([204e751204e751d2f#3112 ](https://github.com/headroomlabs-ai/headroom/issues/3112 ))
([b77d612b77d612913#3136 ](https://github.com/headroomlabs-ai/headroom/issues/3136 ))
([df6ff6bdf6ff6bd5b#3121 ](https://github.com/headroomlabs-ai/headroom/issues/3121 ))
([93c474e93c474e84b#3120 ](https://github.com/headroomlabs-ai/headroom/issues/3120 ))
([8156d4d8156d4dc3a#3061 ](https://github.com/headroomlabs-ai/headroom/issues/3061 ))
([481e0b8481e0b83d5#2982 ](https://github.com/headroomlabs-ai/headroom/issues/2982 ))
([eafdf11eafdf11a2c#2987 ](https://github.com/headroomlabs-ai/headroom/issues/2987 ))
([be5b26dbe5b26d807#2980 ](https://github.com/headroomlabs-ai/headroom/issues/2980 ))
([ddd2a25ddd2a259ec#3085 ](https://github.com/headroomlabs-ai/headroom/issues/3085 ))
([58f28dc58f28dc7a6#2985 ](https://github.com/headroomlabs-ai/headroom/issues/2985 ))
([ddd9f76ddd9f76729#3080 ](https://github.com/headroomlabs-ai/headroom/issues/3080 ))
([c5563d3c5563d3a7d#2978 ](https://github.com/headroomlabs-ai/headroom/issues/2978 ))
([6077e5a6077e5a149#2951 ](https://github.com/headroomlabs-ai/headroom/issues/2951 ))
([2d1e96b2d1e96b85c#2979 ](https://github.com/headroomlabs-ai/headroom/issues/2979 ))
([a3fe5cba3fe5cb65b#639 ](https://github.com/headroomlabs-ai/headroom/issues/639 ))
([6576ef66576ef639c#2868 ](https://github.com/headroomlabs-ai/headroom/issues/2868 ))
([eeb038beeb038bc0c#2780 ](https://github.com/headroomlabs-ai/headroom/issues/2780 ))
([ef7e07eef7e07e0f5#3089 ](https://github.com/headroomlabs-ai/headroom/issues/3089 ))
([3ed8f763ed8f76019#2953 ](https://github.com/headroomlabs-ai/headroom/issues/2953 ))
([f1c34d3f1c34d336c#3026 ](https://github.com/headroomlabs-ai/headroom/issues/3026 ))
([#3052 ](https://github.com/headroomlabs-ai/headroom/issues/3052 ))
([c16be9bc16be9bbbe#2876 ](https://github.com/headroomlabs-ai/headroom/issues/2876 ))
([7de35737de35739c6#3142 ](https://github.com/headroomlabs-ai/headroom/issues/3142 ))
([0e26fb80e26fb80de#3086 ](https://github.com/headroomlabs-ai/headroom/issues/3086 ))
([2cae0f82cae0f8eaf#3035 ](https://github.com/headroomlabs-ai/headroom/issues/3035 ))
([a01897ca01897c791#2988 ](https://github.com/headroomlabs-ai/headroom/issues/2988 ))
([536c949536c949a69#2622 ](https://github.com/headroomlabs-ai/headroom/issues/2622 ))
([d76fce0d76fce04a3#3015 ](https://github.com/headroomlabs-ai/headroom/issues/3015 ))
([b3f4436b3f443636d#2997 ](https://github.com/headroomlabs-ai/headroom/issues/2997 ))
([8a1d38b8a1d38bc5d#3060 ](https://github.com/headroomlabs-ai/headroom/issues/3060 ))
([a6ab359a6ab359a5d#3046 ](https://github.com/headroomlabs-ai/headroom/issues/3046 ))
([2f4d0012f4d001c9f#3029 ](https://github.com/headroomlabs-ai/headroom/issues/3029 ))
([a06a51ea06a51eca6#765 ](https://github.com/headroomlabs-ai/headroom/issues/765 ))
([#1357 ](https://github.com/headroomlabs-ai/headroom/issues/1357 ))
([9fde1279fde127534#3091 ](https://github.com/headroomlabs-ai/headroom/issues/3091 ))
([a29d201a29d2015e5#3124 ](https://github.com/headroomlabs-ai/headroom/issues/3124 ))
([17522fb17522fb0a1#3134 ](https://github.com/headroomlabs-ai/headroom/issues/3134 ))
([284ff31284ff31947#3024 ](https://github.com/headroomlabs-ai/headroom/issues/3024 ))
([9d370599d370592b0#3122 ](https://github.com/headroomlabs-ai/headroom/issues/3122 ))
([05f5ef405f5ef47cb#2879 ](https://github.com/headroomlabs-ai/headroom/issues/2879 ))
([6d878256d87825f62#3123 ](https://github.com/headroomlabs-ai/headroom/issues/3123 ))
([250ede2250ede2f7f#2971 ](https://github.com/headroomlabs-ai/headroom/issues/2971 ))
([8ea87e78ea87e7804#2986 ](https://github.com/headroomlabs-ai/headroom/issues/2986 ))
([1aa701a1aa701adaa#2772 ](https://github.com/headroomlabs-ai/headroom/issues/2772 ))
([c831081c8310819a4#2945 ](https://github.com/headroomlabs-ai/headroom/issues/2945 ))
([61478836147883d5e#1628 ](https://github.com/headroomlabs-ai/headroom/issues/1628 ))
([b7f342cb7f342c153#3081 ](https://github.com/headroomlabs-ai/headroom/issues/3081 ))
([6c9f41e6c9f41e08c#2966 ](https://github.com/headroomlabs-ai/headroom/issues/2966 ))
([5731be75731be7e68#2965 ](https://github.com/headroomlabs-ai/headroom/issues/2965 ))
([b30f339b30f339d69#2962 ](https://github.com/headroomlabs-ai/headroom/issues/2962 ))
([ff17961ff17961cd7#2288 ](https://github.com/headroomlabs-ai/headroom/issues/2288 ))
([322425c322425c43b#2964 ](https://github.com/headroomlabs-ai/headroom/issues/2964 ))
([888a9f4888a9f4e14#2967 ](https://github.com/headroomlabs-ai/headroom/issues/2967 ))
([bbe9013bbe901319d#2963 ](https://github.com/headroomlabs-ai/headroom/issues/2963 ))
([d6fb536d6fb5365f6https://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-19 21:14:59 -07:00
Tejas Chopra
93f2d7a2da
chore: release main ( #2792 )
...
🤖 I have created a release *beep* *boop*
---
<details><summary>0.35.0</summary>
##
[0.35.0](https://github.com/headroomlabs-ai/headroom/compare/v0.34.0...v0.35.0 )
(2026-08-12)
### Features
* **beacon:** allowlist the routing summary key
([#2818 ](https://github.com/headroomlabs-ai/headroom/issues/2818 ))
([7940c057940c05ebf#2853 ](https://github.com/headroomlabs-ai/headroom/issues/2853 ))
([e0870efe0870ef931#2802 ](https://github.com/headroomlabs-ai/headroom/issues/2802 ))
([6ec3e346ec3e3478a#2539 ](https://github.com/headroomlabs-ai/headroom/issues/2539 ))
([7f6950b7f6950be340d6866b0d6866b91ae4904e2e4904e23a6#2324 ](https://github.com/headroomlabs-ai/headroom/issues/2324 ))
([12f9f5812f9f58cb3#2796 ](https://github.com/headroomlabs-ai/headroom/issues/2796 ))
([e9a24f3e9a24f3ec1#2815 ](https://github.com/headroomlabs-ai/headroom/issues/2815 ))
([2954e372954e370480ae948c0ae948c151#2941 ](https://github.com/headroomlabs-ai/headroom/issues/2941 ))
([37524583752458022def3d76def3d76e5a#2917 ](https://github.com/headroomlabs-ai/headroom/issues/2917 ))
([1a04c951a04c957f5d0c1f5bd0c1f5b8ad#2669 ](https://github.com/headroomlabs-ai/headroom/issues/2669 ))
([d0a86d4d0a86d409f#717 ](https://github.com/headroomlabs-ai/headroom/issues/717 ))
([685ebe4685ebe457d#2512 ](https://github.com/headroomlabs-ai/headroom/issues/2512 ))
([ce8ce83ce8ce8313f#2467 ](https://github.com/headroomlabs-ai/headroom/issues/2467 ))
([e583e08e583e082d8#2252 ](https://github.com/headroomlabs-ai/headroom/issues/2252 ))
([5568d735568d738af#2477 ](https://github.com/headroomlabs-ai/headroom/issues/2477 ))
([7981396798139608c#2830 ](https://github.com/headroomlabs-ai/headroom/issues/2830 ))
([7092b537092b53c46#2538 ](https://github.com/headroomlabs-ai/headroom/issues/2538 ))
([a540eb2a540eb2c61d7bc1e2d7bc1e275f#2839 ](https://github.com/headroomlabs-ai/headroom/issues/2839 ))
([564e0a8564e0a8d0f#2791 ](https://github.com/headroomlabs-ai/headroom/issues/2791 ))
([64e203964e203931b#2566 ](https://github.com/headroomlabs-ai/headroom/issues/2566 ))
([7f24d697f24d695ee#902 ](https://github.com/headroomlabs-ai/headroom/issues/902 ))
([#1080 ](https://github.com/headroomlabs-ai/headroom/issues/1080 ))
([4dab2544dab254d52#2253 ](https://github.com/headroomlabs-ai/headroom/issues/2253 ))
([2483f572483f57002#2865 ](https://github.com/headroomlabs-ai/headroom/issues/2865 ))
([894937189493714d2#2513 ](https://github.com/headroomlabs-ai/headroom/issues/2513 ))
([#2537 ](https://github.com/headroomlabs-ai/headroom/issues/2537 ))
([d7cf981d7cf981093#2453 ](https://github.com/headroomlabs-ai/headroom/issues/2453 ))
([#2459 ](https://github.com/headroomlabs-ai/headroom/issues/2459 ))
([1edaeb81edaeb8b76#2469 ](https://github.com/headroomlabs-ai/headroom/issues/2469 ))
([fc5c4e2fc5c4e239ce044139e044139001#2846 ](https://github.com/headroomlabs-ai/headroom/issues/2846 ))
([3488f8d3488f8d4b5#2230 ](https://github.com/headroomlabs-ai/headroom/issues/2230 ))
([29d8a5e29d8a5e563#2283 ](https://github.com/headroomlabs-ai/headroom/issues/2283 ))
([e240df2e240df2b69#2289 ](https://github.com/headroomlabs-ai/headroom/issues/2289 ))
([a24fe7da24fe7dcbf#1322 ](https://github.com/headroomlabs-ai/headroom/issues/1322 ))
([31079943107994aed#2883 ](https://github.com/headroomlabs-ai/headroom/issues/2883 ))
([2f2950a2f2950a626#2579 ](https://github.com/headroomlabs-ai/headroom/issues/2579 ))
([1f5feff1f5fefffd3659618265961827cf4bd8ecd4bd8ecd1e3#2470 ](https://github.com/headroomlabs-ai/headroom/issues/2470 ))
([e00c6ffe00c6ff81c#2295 ](https://github.com/headroomlabs-ai/headroom/issues/2295 ))
([c471800c471800e8e#2231 ](https://github.com/headroomlabs-ai/headroom/issues/2231 ))
([f840d5ff840d5f2fe#2195 ](https://github.com/headroomlabs-ai/headroom/issues/2195 ))
([#2541 ](https://github.com/headroomlabs-ai/headroom/issues/2541 ))
([4e5a67a4e5a67a342fd4628dfd4628d821c85abf7c85abf7a87#2936 ](https://github.com/headroomlabs-ai/headroom/issues/2936 ))
([941c25d941c25d31e#2495 ](https://github.com/headroomlabs-ai/headroom/issues/2495 ))
([#2540 ](https://github.com/headroomlabs-ai/headroom/issues/2540 ))
([5c561bd5c561bd913#2696 ](https://github.com/headroomlabs-ai/headroom/issues/2696 ))
([54ea28d54ea28d983702dbc5702dbc5902#2472 ](https://github.com/headroomlabs-ai/headroom/issues/2472 ))
([08466f308466f3cae#2554 ](https://github.com/headroomlabs-ai/headroom/issues/2554 ))
([0805e8e0805e8e410#2848 ](https://github.com/headroomlabs-ai/headroom/issues/2848 ))
([3808f603808f60ca6#2434 ](https://github.com/headroomlabs-ai/headroom/issues/2434 ))
([2b5ee7c2b5ee7cde8c6f9948c6f99482e1#2316 ](https://github.com/headroomlabs-ai/headroom/issues/2316 ))
([1f2c6811f2c681c0b#2318 ](https://github.com/headroomlabs-ai/headroom/issues/2318 ))
([c19e412c19e412b33#2824 ](https://github.com/headroomlabs-ai/headroom/issues/2824 ))
([b97c7c6b97c7c6e99#2480 ](https://github.com/headroomlabs-ai/headroom/issues/2480 ))
([e24a7e6e24a7e66b9#2463 ](https://github.com/headroomlabs-ai/headroom/issues/2463 ))
([6a538616a53861063#2273 ](https://github.com/headroomlabs-ai/headroom/issues/2273 ))
([a30db2ca30db2cae4#2334 ](https://github.com/headroomlabs-ai/headroom/issues/2334 ))
([f669149f669149769#2872 ](https://github.com/headroomlabs-ai/headroom/issues/2872 ))
([675d13f675d13f08d#2491 ](https://github.com/headroomlabs-ai/headroom/issues/2491 ))
([a5b0a8fa5b0a8f4cc99f07e799f07e7bbd739fdef739fdef42309516630951663562#2365 ](https://github.com/headroomlabs-ai/headroom/issues/2365 ))
([aaeba0aaaeba0a319620028f620028fa18#2807 ](https://github.com/headroomlabs-ai/headroom/issues/2807 ))
([0237cbf0237cbffbb#1643 ](https://github.com/headroomlabs-ai/headroom/issues/1643 ))
([a4bd2e6a4bd2e62a5#2164 ](https://github.com/headroomlabs-ai/headroom/issues/2164 ))
([d02df10d02df10758#621 ](https://github.com/headroomlabs-ai/headroom/issues/621 ))
([17cdb1817cdb185bccde1513cde1513c9112149f712149f7446#2330 ](https://github.com/headroomlabs-ai/headroom/issues/2330 ))
([64cb46e64cb46e24b#2381 ](https://github.com/headroomlabs-ai/headroom/issues/2381 ))
([f6398a6f6398a6476#2943 ](https://github.com/headroomlabs-ai/headroom/issues/2943 ))
([039cd24039cd2431a#2254 ](https://github.com/headroomlabs-ai/headroom/issues/2254 ))
([dc163bcdc163bcd1c#2823 ](https://github.com/headroomlabs-ai/headroom/issues/2823 ))
([4ec416d4ec416df88#2360 ](https://github.com/headroomlabs-ai/headroom/issues/2360 ))
([#2412 ](https://github.com/headroomlabs-ai/headroom/issues/2412 ))
([c5a08d2c5a08d22e0#2717 ](https://github.com/headroomlabs-ai/headroom/issues/2717 ))
([a97b824a97b82413b#2372 ](https://github.com/headroomlabs-ai/headroom/issues/2372 ))
([785915478591545ce#2833 ](https://github.com/headroomlabs-ai/headroom/issues/2833 ))
([de9e052de9e0523da#2340 ](https://github.com/headroomlabs-ai/headroom/issues/2340 ) token
inflation)
([#2408 ](https://github.com/headroomlabs-ai/headroom/issues/2408 ))
([74275b774275b7c3e8cd13808cd138039e#2801 ](https://github.com/headroomlabs-ai/headroom/issues/2801 ))
([b6f9877b6f9877c78#2260 ](https://github.com/headroomlabs-ai/headroom/issues/2260 ))
([68401536840153473#2319 ](https://github.com/headroomlabs-ai/headroom/issues/2319 ))
([8a905238a90523209#2232 ](https://github.com/headroomlabs-ai/headroom/issues/2232 ))
([3bb02f83bb02f8f75#2517 ](https://github.com/headroomlabs-ai/headroom/issues/2517 ))
([eb5b5e4eb5b5e4198c093bf1c093bf11ebae38486ae384862a4d7b25aed7b25ae3bb#2387 ](https://github.com/headroomlabs-ai/headroom/issues/2387 ))
([1db6d881db6d88ab4#2946 ](https://github.com/headroomlabs-ai/headroom/issues/2946 ))
([e540d64e540d64feb#2843 ](https://github.com/headroomlabs-ai/headroom/issues/2843 ))
([c49be26c49be269a1#2838 ](https://github.com/headroomlabs-ai/headroom/issues/2838 ))
([53af90d53af90d68c#2852 ](https://github.com/headroomlabs-ai/headroom/issues/2852 ))
([f624d3af624d3a00a#2861 ](https://github.com/headroomlabs-ai/headroom/issues/2861 ))
([91d6bf391d6bf33cd#2751 ](https://github.com/headroomlabs-ai/headroom/issues/2751 ))
([56ee57b56ee57be98#2286 ](https://github.com/headroomlabs-ai/headroom/issues/2286 ))
([64485456448545a7f#2285 ](https://github.com/headroomlabs-ai/headroom/issues/2285 ))
([4925bf64925bf6a82#2750 ](https://github.com/headroomlabs-ai/headroom/issues/2750 ))
([0fd0b990fd0b996a4#2749 ](https://github.com/headroomlabs-ai/headroom/issues/2749 ))
([cd60ee9cd60ee9ae8#2748 ](https://github.com/headroomlabs-ai/headroom/issues/2748 ))
([ff4e016ff4e0167bb#2747 ](https://github.com/headroomlabs-ai/headroom/issues/2747 ))
([267c2bd267c2bdcb5#2881 ](https://github.com/headroomlabs-ai/headroom/issues/2881 ))
([e6e5826e6e5826423#2501 ](https://github.com/headroomlabs-ai/headroom/issues/2501 ))
([ecf130decf130d3ac#2287 ](https://github.com/headroomlabs-ai/headroom/issues/2287 ))
([522faa1522faa1a59#2916 ](https://github.com/headroomlabs-ai/headroom/issues/2916 ))
([148d860148d8605e2https://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
---------
Co-authored-by: JD Davis <mxjerrett@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-12 19:02:51 -05:00
Rod Boev
78591545ce
fix: publish headroom-opencode in release workflow ( #2372 )
...
## Description
`headroom-opencode` is documented as an npm package, but the release
workflow never published it, so installs failed with a registry 404 even
though the plugin source already lived under `plugins/opencode`. This
wires the existing package into the npm release path, keeps its version
synced with root releases, and adds release guards for the new package.
Closes #76 .
## Type of Change
- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
- added `headroom-opencode` to the npm release workflow, including
release-version stamping and `headroom-ai` dependency rewrite before
publish
- added `plugins/opencode/package.json` to release-please and local
version-sync guards
- synced the source opencode package version to the current release line
and documented the new npm package in the release docs
- added focused release workflow and version-sync tests for the opencode
package
- aligned the two failing dashboard Playwright tests with the current
Session/Lifetime split and `/stats-lifetime` fixture contract
## Testing
- [x] Unit tests pass (`uv run pytest scripts/tests/test_version_sync.py
-q`, `uv run pytest tests/test_release_workflows.py -q -k
'publish_npm_rewrites_opencode_dependency_after_version_and_before_publish
or opencode_source_dependency_matches_lockfile_registry_range or
release_please_manifest_config_consistency'`)
- [x] Unit tests pass (`uv run pytest
tests/test_dashboard_cache_lifetime_playwright.py
tests/test_dashboard_cache_ttl_playwright.py -q`)
- [x] Linting passes (`uv run ruff check scripts/verify-versions.py
scripts/version-sync.py scripts/tests/test_version_sync.py
tests/test_release_workflows.py`)
- [ ] Type checking passes (`uv run mypy headroom`)
- [x] New tests added for new functionality when applicable
- [x] Manual testing performed
### Test Output
```text
$ uv run pytest scripts/tests/test_version_sync.py -q
8 passed, 1 warning in 0.51s
$ uv run pytest tests/test_release_workflows.py -q -k 'publish_npm_rewrites_opencode_dependency_after_version_and_before_publish or opencode_source_dependency_matches_lockfile_registry_range or release_please_manifest_config_consistency'
2 passed, 38 deselected, 1 warning in 0.07s
$ uv run pytest tests/test_dashboard_cache_lifetime_playwright.py tests/test_dashboard_cache_ttl_playwright.py -q
4 passed, 1 warning in 4.04s
$ uv run ruff check scripts/verify-versions.py scripts/version-sync.py scripts/tests/test_version_sync.py tests/test_release_workflows.py
All checks passed!
$ npm ci && npm run build (plugins/opencode)
Build success; dist/index.js, dist/entry.opencode.js, and DTS outputs emitted
```
## Real Behavior Proof
- Environment: Windows, Python 3.11.15, Node v24.15.0, npm 11.16.0
- Exact command / steps: inspected `.github/workflows/release.yml`,
updated the npm publish path for `plugins/opencode`, aligned the two
failing dashboard Playwright tests with the current Session/Lifetime
split, then ran the focused pytest commands above plus `npm ci && npm
run build` in `plugins/opencode`
- Observed result: the release workflow now versions and publishes
`headroom-opencode`, release-please and version-sync track
`plugins/opencode/package.json`, the dashboard tests now fetch durable
cache and setup-url data from the Lifetime view, and the opencode
package still builds locally from source
- Not tested: GitHub Package Registry publish
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Checklist
- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [x] I have updated the CHANGELOG.md if applicable
## Additional Notes
`CHANGELOG.md` is unchanged because release-please owns changelog
generation here.
---------
Co-authored-by: JD Davis <mxjerrett@gmail.com>
2026-08-11 23:56:40 -05:00
gglucass
f54f04f5bf
feat(opencode): ship the transport plugin in pip installs ( #2601 )
...
## Description
The OpenCode transport plugin - the piece that gives `wrap opencode`
all-provider routing by tagging each request with `x-headroom-base-url`
- only exists in repo checkouts today. `headroom_opencode_plugin_path()`
resolves `plugins/opencode/dist/entry.opencode.js`, which pip wheels do
not ship, so every pip install silently degrades to the two-provider
(anthropic/openai) baseURL fallback. The function's own docstring
documents the gap ("a pip-only install that does not ship `plugins/`").
Shipping the existing build output is not enough: the regular tsup build
leaves `headroom-ai` and `@opencode-ai/plugin` as bare external imports,
which only resolve next to the checkout's `node_modules`. Copied into
site-packages, the file fails to load. This PR ships a self-contained
bundle inside the wheel instead.
Closes #
## Type of Change
- [ ] Bug fix (non-breaking change that fixes an issue)
- [x] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
- `plugins/opencode/tsup.standalone.config.ts` + `npm run
build:standalone`: a second build of the loader entry with `noExternal:
[/.*/]` and `splitting: false` - a single self-contained file whose only
imports are node builtins.
- `headroom/providers/opencode/_dist/entry.opencode.js`: the committed
standalone bundle (452 KB). It sits inside the package directory, so
maturin's `python-source = "."` packaging picks it up into the wheel
with no build-system changes.
- `headroom_opencode_plugin_path()`: falls back to the packaged bundle.
Precedence otherwise unchanged: `HEADROOM_OPENCODE_PLUGIN_PATH` env
override, then a repo-checkout build (fresher during development), then
the packaged bundle.
- CI (`opencode-plugin.yml`): rebuilds the standalone bundle and fails
the run if the committed artifact drifted from source, with a one-line
fix instruction; workflow path triggers extended to
`headroom/providers/opencode/_dist/**`.
- `tests/test_providers_opencode_plugin_path.py`: packaged bundle exists
and is self-contained (no bare npm imports), env override wins, fallback
resolution order.
## Testing
- [x] Unit tests pass (`pytest`)
- [x] Linting passes (`ruff check .`)
- [x] Type checking passes (`mypy headroom`)
- [x] New tests added for new functionality
- [x] Manual testing performed
### Test Output
```text
$ uv run --frozen --extra dev pytest tests/test_providers_opencode_plugin_path.py \
tests/test_providers_opencode_config.py tests/test_providers_opencode_install.py
============================== 49 passed in 0.31s ==============================
$ uvx ruff check headroom/providers/opencode/runtime.py tests/test_providers_opencode_plugin_path.py
All checks passed!
$ uvx ruff format --check headroom/providers/opencode/runtime.py tests/test_providers_opencode_plugin_path.py
2 files already formatted
$ uv run --frozen --extra dev mypy headroom/providers/opencode/runtime.py
Success: no issues found in 1 source file
$ cd plugins/opencode && npm run build:standalone
ESM dist-standalone/entry.opencode.js 452.28 KB
ESM Build success in 28ms
```
## Real Behavior Proof
- Environment: macOS 15 (arm64), opencode 1.18.5 (Homebrew), node 22 /
npm 10, isolated `XDG_*` dirs so no real user config was touched.
- Exact command / steps:
1. `npm run build:standalone` in `plugins/opencode`.
2. Started a local header-logging HTTP listener on `127.0.0.1:9977`
(stands in for the proxy; logs method, path, headers, returns 401).
3. Registered the standalone bundle by absolute path in a scratch
`opencode.json` (`"plugin":
["<abs>/dist-standalone/entry.opencode.js"]`) with a `google` provider
entry and a fake API key. Note: the bundle's directory has **no**
`node_modules` - this is exactly the site-packages situation.
4. `HEADROOM_PROXY_URL=http://127.0.0.1:9977 opencode run -m
google/gemini-2.5-flash "say hi"`.
- Observed result: the listener received `POST
/v1beta/models/gemini-2.5-flash:streamGenerateContent?alt=sse` with
`User-Agent: opencode/1.18.5 ...` - i.e. the plugin loaded standalone
and rerouted a provider that the baseURL fallback cannot cover (native
Gemini wire format) to the proxy URL from `HEADROOM_PROXY_URL`.
- Not tested: Windows path resolution (pure `pathlib`, no platform
branches); wheel-build byte-determinism of the tsup output across OSes
(the CI drift check will surface it on the first divergent build).
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Checklist
- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [x] I did **not** edit `CHANGELOG.md` — it is generated by
release-please from my Conventional Commit PR title (a CI guard enforces
this)
## Screenshots (if applicable)
Not applicable - CLI/packaging change.
## Additional Notes
- Documentation checklist item: unchecked because the only doc surface I
found is the `headroom_opencode_plugin_path()` docstring, which this PR
rewrites to describe the three-step resolution order. Happy to add a
line to `docs/content/docs/` if there is a preferred page.
- A committed build artifact is not free: the CI drift check keeps it
honest, and the byte-compare relies on tsup/esbuild determinism under
`npm ci` (pinned lockfile). If you'd rather avoid the committed artifact
entirely, the alternative is publishing `headroom-opencode` to npm (its
`package.json` is publish-ready) and registering the plugin by package
name - happy to rework in that direction; the wheel-bundled path has the
advantage of version-locking the plugin to the backend it ships with.
- Downstream motivation: Headroom Desktop manages a long-lived shared
proxy (no `wrap` launcher) and wants to register this plugin from the
installed wheel path so OpenCode users get all-provider routing there
too.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-27 06:40:43 -07:00
dependabot[bot]
961866ba7c
deps: bump the npm-minor-patch group across 3 directories with 7 updates ( #2276 )
...
Bumps the npm-minor-patch group with 6 updates in the /docs directory:
| Package | From | To |
| --- | --- | --- |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs ) | `16.11.1` |
`16.11.5` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs ) | `15.1.0` |
`15.2.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs ) | `16.11.1` |
`16.11.5` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript )
| `0.106.0` | `0.111.0` |
| [openai](https://github.com/openai/openai-node ) | `6.33.0` | `6.47.0`
|
| [postcss](https://github.com/postcss/postcss ) | `8.5.16` | `8.5.19` |
Bumps the npm-minor-patch group with 1 update in the /plugins/opencode
directory: @opencode-ai/plugin.
Bumps the npm-minor-patch group with 1 update in the /sdk/typescript
directory:
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript ).
Updates `fumadocs-core` from 16.11.1 to 16.11.5
<details>
<summary>Commits</summary>
<ul>
<li><a
href="52af6cf292https://redirect.github.com/fuma-nama/fumadocs/issues/3416 ">#3416</a>
from fuma-nama/tegami/version-packages</li>
<li><a
href="efc9d18402368a92e3a213dfdbc22463623320b5126a74d995430254caab1862822aa5d3710a9614ba78b0177bhttps://github.com/fuma-nama/fumadocs/compare/fumadocs@16.11.1...fumadocs@16.11.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-mdx` from 15.1.0 to 15.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases ">fumadocs-mdx's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-mdx@15.2.0</h2>
<h3>Support Macro API</h3>
<p>Use <code>fumadocs-mdx/macro</code> to define collections, and enable
the macro-style API from bundler plugin (e.g. <code>createMDX</code>)
using the <code>include</code> option.</p>
<h2>fumadocs-mdx@15.1.1</h2>
<h3>Migrate from <code>js-yaml</code> to <code>yaml</code></h3>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="52af6cf292https://redirect.github.com/fuma-nama/fumadocs/issues/3416 ">#3416</a>
from fuma-nama/tegami/version-packages</li>
<li><a
href="efc9d18402368a92e3a213dfdbc22463623320b5126a74d995430254caab1862822aa5d3710a9614ba78b0177bhttps://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.1.0...fumadocs-mdx@15.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-ui` from 16.11.1 to 16.11.5
<details>
<summary>Commits</summary>
<ul>
<li><a
href="52af6cf292https://redirect.github.com/fuma-nama/fumadocs/issues/3416 ">#3416</a>
from fuma-nama/tegami/version-packages</li>
<li><a
href="efc9d18402368a92e3a213dfdbc22463623320b5126a74d995430254caab1862822aa5d3710a9614ba78b0177bhttps://github.com/fuma-nama/fumadocs/compare/fumadocs@16.11.1...fumadocs@16.11.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/sdk` from 0.106.0 to 0.111.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases ">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.111.0</h2>
<h2>0.111.0 (2026-07-10)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0 ">sdk-v0.110.0...sdk-v0.111.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for dreaming (<a
href="77b28a647268a6d7b92ae25b885eaca33f3f0b7ceac4bace32https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0 ">sdk-v0.109.1...sdk-v0.110.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add agent-memory-2026-07-22 beta header (<a
href="a470e10aaahttps://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.0...sdk-v0.109.1 ">sdk-v0.109.0...sdk-v0.109.1</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove some nonfunctional types from the SDKs
(<a
href="cc4dd4e257https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.108.0...sdk-v0.109.0 ">sdk-v0.108.0...sdk-v0.109.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents event delta
streaming, agent overrides, reverse pagination, vault credential
injection scoping, and agent and deployment webhook events (<a
href="7f3211b488https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.107.0...sdk-v0.108.0 ">sdk-v0.107.0...sdk-v0.108.0</a></p>
<h3>Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md ">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.111.0 (2026-07-10)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0 ">sdk-v0.110.0...sdk-v0.111.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for dreaming (<a
href="77b28a647268a6d7b92ae25b885eaca33f3f0b7ceac4bace32https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0 ">sdk-v0.109.1...sdk-v0.110.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add agent-memory-2026-07-22 beta header (<a
href="a470e10aaahttps://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.0...sdk-v0.109.1 ">sdk-v0.109.0...sdk-v0.109.1</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove some nonfunctional types from the SDKs
(<a
href="cc4dd4e257https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.108.0...sdk-v0.109.0 ">sdk-v0.108.0...sdk-v0.109.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents event delta
streaming, agent overrides, reverse pagination, vault credential
injection scoping, and agent and deployment webhook events (<a
href="7f3211b488https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.107.0...sdk-v0.108.0 ">sdk-v0.107.0...sdk-v0.108.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for claude-sonnet-5 (<a
href="4588db01ec9e467606888d461ea9629436e291590aec1e748bac2fc6779dc8af65d6af2a3a9042ab57c56c91724f2eb80719https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1107 ">#1107</a>)</li>
<li><a
href="96d1a991b6https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1106 ">#1106</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.106.0...sdk-v0.111.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `openai` from 6.33.0 to 6.47.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/openai/openai-node/releases ">openai's
releases</a>.</em></p>
<blockquote>
<h2>v6.47.0</h2>
<h2>6.47.0 (2026-07-14)</h2>
<p>Full Changelog: <a
href="https://github.com/openai/openai-node/compare/v6.46.0...v6.47.0 ">v6.46.0...v6.47.0</a></p>
<h3>Features</h3>
<ul>
<li>add async event iterators (<a
href="https://redirect.github.com/openai/openai-node/issues/1977 ">#1977</a>)
(<a
href="2ece8aa848https://redirect.github.com/openai/openai-node/issues/1987 ">#1987</a>)
(<a
href="5984f442e07bfce973a1https://redirect.github.com/openai/openai-node/issues/1973 ">#1973</a>)
(<a
href="a6f01e53dehttps://redirect.github.com/openai/openai-node/issues/1970 ">#1970</a>)
(<a
href="a86f1fde30https://redirect.github.com/openai/openai-node/issues/1994 ">#1994</a>)
(<a
href="1cdc0196b4https://redirect.github.com/openai/openai-node/issues/1980 ">#1980</a>)
(<a
href="ae17127effhttps://redirect.github.com/openai/openai-node/issues/984 ">#984</a></li>
<li><strong>ci:</strong> bump <code>@arethetypeswrong/cli</code> to
^0.18.0 and run CI workflows on Node 24 (<a
href="baa0b2ad90https://redirect.github.com/openai/openai-node/issues/1972 ">#1972</a>)
(<a
href="9555b71ab8https://redirect.github.com/openai/openai-node/issues/1982 ">#1982</a>)
(<a
href="c1c5c28267https://redirect.github.com/openai/openai-node/issues/1015 ">#1015</a></li>
<li><strong>zod:</strong> support zod v4 mini schemas (<a
href="https://redirect.github.com/openai/openai-node/issues/1985 ">#1985</a>)
(<a
href="2df10fc19ahttps://redirect.github.com/openai/openai-node/issues/1988 ">#1988</a>)
(<a
href="373b08ac3bhttps://github.com/openai/openai-node/compare/v6.45.0...v6.46.0 ">v6.45.0...v6.46.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> gpt-5.6-sol updates (<a
href="6c397d5d28https://redirect.github.com/openai/openai-node/issues/1963 ">#1963</a>)
(<a
href="0e18d30a31https://redirect.github.com/openai/openai-node/issues/1958 ">#1958</a>)
(<a
href="6371623aadhttps://redirect.github.com/openai/openai-node/issues/1967 ">#1967</a>)
(<a
href="95b54e5894https://redirect.github.com/openai/openai-node/issues/1975 ">#1975</a>)
(<a
href="90a72e5345https://redirect.github.com/openai/openai-node/issues/701 ">#701</a></li>
<li>document assistant stream failures (<a
href="https://redirect.github.com/openai/openai-node/issues/1979 ">#1979</a>)
(<a
href="d93fbe5bc5https://redirect.github.com/openai/openai-node/issues/959 ">#959</a></li>
<li>document file search result limits (<a
href="https://redirect.github.com/openai/openai-node/issues/1981 ">#1981</a>)
(<a
href="e9dc283dcehttps://redirect.github.com/openai/openai-node/issues/1004 ">#1004</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/openai/openai-node/blob/main/CHANGELOG.md ">openai's
changelog</a>.</em></p>
<blockquote>
<h2>6.47.0 (2026-07-14)</h2>
<p>Full Changelog: <a
href="https://github.com/openai/openai-node/compare/v6.46.0...v6.47.0 ">v6.46.0...v6.47.0</a></p>
<h3>Features</h3>
<ul>
<li>add async event iterators (<a
href="https://redirect.github.com/openai/openai-node/issues/1977 ">#1977</a>)
(<a
href="2ece8aa848https://redirect.github.com/openai/openai-node/issues/1987 ">#1987</a>)
(<a
href="5984f442e07bfce973a1https://redirect.github.com/openai/openai-node/issues/1973 ">#1973</a>)
(<a
href="a6f01e53dehttps://redirect.github.com/openai/openai-node/issues/1970 ">#1970</a>)
(<a
href="a86f1fde30https://redirect.github.com/openai/openai-node/issues/1994 ">#1994</a>)
(<a
href="1cdc0196b4https://redirect.github.com/openai/openai-node/issues/1980 ">#1980</a>)
(<a
href="ae17127effhttps://redirect.github.com/openai/openai-node/issues/984 ">#984</a></li>
<li><strong>ci:</strong> bump <code>@arethetypeswrong/cli</code> to
^0.18.0 and run CI workflows on Node 24 (<a
href="baa0b2ad90https://redirect.github.com/openai/openai-node/issues/1972 ">#1972</a>)
(<a
href="9555b71ab8https://redirect.github.com/openai/openai-node/issues/1982 ">#1982</a>)
(<a
href="c1c5c28267https://redirect.github.com/openai/openai-node/issues/1015 ">#1015</a></li>
<li><strong>zod:</strong> support zod v4 mini schemas (<a
href="https://redirect.github.com/openai/openai-node/issues/1985 ">#1985</a>)
(<a
href="2df10fc19ahttps://redirect.github.com/openai/openai-node/issues/1988 ">#1988</a>)
(<a
href="373b08ac3bhttps://github.com/openai/openai-node/compare/v6.45.0...v6.46.0 ">v6.45.0...v6.46.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> gpt-5.6-sol updates (<a
href="6c397d5d28https://redirect.github.com/openai/openai-node/issues/1963 ">#1963</a>)
(<a
href="0e18d30a31https://redirect.github.com/openai/openai-node/issues/1958 ">#1958</a>)
(<a
href="6371623aadhttps://redirect.github.com/openai/openai-node/issues/1967 ">#1967</a>)
(<a
href="95b54e5894https://redirect.github.com/openai/openai-node/issues/1975 ">#1975</a>)
(<a
href="90a72e5345https://redirect.github.com/openai/openai-node/issues/701 ">#701</a></li>
<li>document assistant stream failures (<a
href="https://redirect.github.com/openai/openai-node/issues/1979 ">#1979</a>)
(<a
href="d93fbe5bc5https://redirect.github.com/openai/openai-node/issues/959 ">#959</a></li>
<li>document file search result limits (<a
href="https://redirect.github.com/openai/openai-node/issues/1981 ">#1981</a>)
(<a
href="e9dc283dcehttps://redirect.github.com/openai/openai-node/issues/1004 ">#1004</a></li>
</ul>
<h2>6.45.0 (2026-06-24)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6255405380https://redirect.github.com/openai/openai-node/issues/1989 ">#1989</a>)</li>
<li><a
href="1cdc0196b4https://redirect.github.com/openai/openai-node/issues/1994 ">#1994</a>)</li>
<li><a
href="ec2f57fd0dhttps://redirect.github.com/openai/openai-node/issues/1984 ">#1984</a>)</li>
<li><a
href="2df10fc19ahttps://redirect.github.com/openai/openai-node/issues/1985 ">#1985</a>)</li>
<li><a
href="ebb649811dhttps://redirect.github.com/openai/openai-node/issues/1986 ">#1986</a>)</li>
<li><a
href="5984f442e0https://redirect.github.com/openai/openai-node/issues/1987 ">#1987</a>)</li>
<li><a
href="373b08ac3bhttps://redirect.github.com/openai/openai-node/issues/1988 ">#1988</a>)</li>
<li><a
href="a6f01e53dehttps://redirect.github.com/openai/openai-node/issues/1973 ">#1973</a>)</li>
<li><a
href="53e580efb6https://redirect.github.com/openai/openai-node/issues/1976 ">#1976</a>)</li>
<li><a
href="a86f1fde30https://redirect.github.com/openai/openai-node/issues/1970 ">#1970</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/openai/openai-node/compare/v6.33.0...v6.47.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `postcss` from 8.5.16 to 8.5.19
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases ">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.19</h2>
<ul>
<li>Fixed cleaning <code>before</code> for new nodes inserted to
<code>Root</code> (by <a
href="https://github.com/MahinAnowar "><code>@MahinAnowar</code></a>).</li>
</ul>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media "><code>@chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md ">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.19</h2>
<ul>
<li>Fixed cleaning <code>before</code> for new nodes inserted to
<code>Root</code> (by <a
href="https://github.com/MahinAnowar "><code>@MahinAnowar</code></a>).</li>
</ul>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media "><code>@chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9543b227693d13bf936000d0dd2322https://redirect.github.com/postcss/postcss/issues/2111 ">#2111</a>)</li>
<li><a
href="7a05b33e7a4c0d194c1392b4e7891e95663d3eb774e25ae9f4d1518afd5a2421312ffehttps://github.com/postcss/postcss/compare/8.5.16...8.5.19 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@opencode-ai/plugin` from 1.17.16 to 1.18.2
Updates `@anthropic-ai/sdk` from 0.110.0 to 0.111.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases ">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.111.0</h2>
<h2>0.111.0 (2026-07-10)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0 ">sdk-v0.110.0...sdk-v0.111.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for dreaming (<a
href="77b28a647268a6d7b92ae25b885eaca33f3f0b7ceac4bace32https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0 ">sdk-v0.109.1...sdk-v0.110.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add agent-memory-2026-07-22 beta header (<a
href="a470e10aaahttps://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.0...sdk-v0.109.1 ">sdk-v0.109.0...sdk-v0.109.1</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove some nonfunctional types from the SDKs
(<a
href="cc4dd4e257https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.108.0...sdk-v0.109.0 ">sdk-v0.108.0...sdk-v0.109.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents event delta
streaming, agent overrides, reverse pagination, vault credential
injection scoping, and agent and deployment webhook events (<a
href="7f3211b488https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.107.0...sdk-v0.108.0 ">sdk-v0.107.0...sdk-v0.108.0</a></p>
<h3>Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md ">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.111.0 (2026-07-10)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0 ">sdk-v0.110.0...sdk-v0.111.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for dreaming (<a
href="77b28a647268a6d7b92ae25b885eaca33f3f0b7ceac4bace32https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0 ">sdk-v0.109.1...sdk-v0.110.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add agent-memory-2026-07-22 beta header (<a
href="a470e10aaahttps://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.0...sdk-v0.109.1 ">sdk-v0.109.0...sdk-v0.109.1</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove some nonfunctional types from the SDKs
(<a
href="cc4dd4e257https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.108.0...sdk-v0.109.0 ">sdk-v0.108.0...sdk-v0.109.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents event delta
streaming, agent overrides, reverse pagination, vault credential
injection scoping, and agent and deployment webhook events (<a
href="7f3211b488https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.107.0...sdk-v0.108.0 ">sdk-v0.107.0...sdk-v0.108.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for claude-sonnet-5 (<a
href="4588db01ec9e467606888d461ea9629436e291590aec1e748bac2fc6779dc8af65d6af2a3a9042ab57c56c91724f2eb80719https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1107 ">#1107</a>)</li>
<li><a
href="96d1a991b6https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1106 ">#1106</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.106.0...sdk-v0.111.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 11:21:14 -05:00
JD Davis
ea3d5a86b7
fix(deps): clear Dependabot lockfile alerts ( #2175 )
...
## Description
Clears the current dependency/security-audit blockers that are making
unrelated PRs red:
- `transformers 5.3.0` / `CVE-2026-5241`, fixed by requiring
`transformers>=5.5.0` in the locked optional dependency set.
- `sqlitedict <=2.1.0` via the optional `benchmark` extra's
`lm-eval[api]` dependency. There is no patched `sqlitedict` release, so
this PR removes the published/locked `benchmark` extra instead of
shipping a known-vulnerable transitive dependency.
- `esbuild >=0.27.3,<0.28.1` in the OpenCode plugin lockfile, fixed by
forcing `esbuild@0.28.1` through the OpenCode npm override and
regenerated lockfile.
The benchmark code still invokes `python -m lm_eval`; researchers who
need that harness should install `lm-eval[api]` in their benchmark
environment until its transitive vulnerability has a patched release.
## Type of Change
- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
- `pyproject.toml`: remove the `benchmark` optional extra, document
external `lm-eval[api]` installation guidance, and require
`transformers>=5.5.0`.
- `uv.lock`: regenerate without the `benchmark` extra, removing
`lm-eval` and `sqlitedict` lock entries and locking the patched
transformers floor.
- `plugins/opencode/package.json`: add an `overrides` entry for
`esbuild@0.28.1`.
- `plugins/opencode/package-lock.json`: regenerate the OpenCode lockfile
with `esbuild@0.28.1`.
## Testing
- [x] Unit tests pass (`pytest`)
- [x] Linting passes (`ruff check .`)
- [ ] Type checking passes (`mypy headroom`)
- [ ] New tests added for new functionality
- [x] Manual testing performed
### Test Output
```text
uv lock --check
rg -n -F 'sqlitedict' uv.lock # no matches
rg -n -F 'name = "lm-eval"' uv.lock # no matches
rg -n -F "extra == 'benchmark'" uv.lock # no matches
rg -n -F '0.27.7' plugins/opencode/package-lock.json plugins/opencode/package.json # no matches
npm ls esbuild --package-lock-only
npm audit --package-lock-only # found 0 vulnerabilities
git diff --check
```
Previous GitHub checks were green. After merging current `main`, fresh
GitHub checks are running again; local targeted validation still passes.
## Real Behavior Proof
- Environment: Windows 11, Python 3.13.3, uv, npm in `plugins/opencode`,
Dependabot/pip-audit alert metadata from the failing PR jobs.
- Exact command / steps: inspected the regenerated Python and npm
lockfiles with `rg`, checked the uv lock with `uv lock --check`, checked
OpenCode's dependency tree with `npm ls esbuild --package-lock-only`,
and ran `npm audit --package-lock-only`.
- Observed result: `uv.lock` no longer contains `sqlitedict`, `lm-eval`,
or a `benchmark` extra marker; `transformers` resolves at the patched
`>=5.5.0` floor; OpenCode's lock resolves `esbuild@0.28.1`; `npm audit
--package-lock-only` reports 0 vulnerabilities; GitHub `Dependency audit
(pip-audit)` passes.
- Not tested: running the external `lm-eval` harness after installing it
separately.
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Checklist
- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [x] I have updated the CHANGELOG.md if applicable
## Screenshots (if applicable)
N/A - dependency and lockfile security fix.
## Additional Notes
The `benchmark` extra can be restored once the upstream `lm-eval[api]`
dependency chain stops pulling a vulnerable `sqlitedict` release.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-14 20:40:28 -07:00
dependabot[bot]
87151952ee
deps: bump @types/node from 22.20.0 to 26.1.1 in /plugins/opencode ( #1688 )
...
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node )
from 22.20.0 to 26.1.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node ">compare
view</a></li>
</ul>
</details>
<br />
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 17:02:04 -05:00
dependabot[bot]
8872bbc6a2
deps: bump the npm-minor-patch group across 4 directories with 18 updates ( #1907 )
...
Bumps the npm-minor-patch group with 12 updates in the /docs directory:
| Package | From | To |
| --- | --- | --- |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs ) | `16.10.3` |
`16.11.1` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs ) | `15.0.12` |
`15.1.0` |
| [fumadocs-twoslash](https://github.com/fuma-nama/fumadocs ) | `3.1.15`
| `3.3.0` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs ) | `16.10.3` |
`16.11.1` |
| [next](https://github.com/vercel/next.js ) | `16.2.6` | `16.2.10` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react ) |
`19.2.4` | `19.2.7` |
|
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react )
| `19.2.14` | `19.2.17` |
|
[react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom )
| `19.2.4` | `19.2.7` |
| [recharts](https://github.com/recharts/recharts ) | `3.8.1` | `3.9.2` |
|
[@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss )
| `4.2.2` | `4.3.2` |
|
[@types/mdx](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/mdx )
| `2.0.13` | `2.0.14` |
| [postcss](https://github.com/postcss/postcss ) | `8.5.15` | `8.5.16` |
Bumps the npm-minor-patch group with 1 update in the /plugins/openclaw
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Bumps the npm-minor-patch group with 2 updates in the /plugins/opencode
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest )
and @opencode-ai/plugin.
Bumps the npm-minor-patch group with 3 updates in the /sdk/typescript
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ),
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript )
and [dotenv](https://github.com/motdotla/dotenv ).
Updates `fumadocs-core` from 16.10.3 to 16.11.1
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ab09f500cbhttps://redirect.github.com/fuma-nama/fumadocs/issues/3405 ">#3405</a>)</li>
<li><a
href="889a296d06a5c081d0c69a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e25477https://github.com/fuma-nama/fumadocs/compare/fumadocs-core@16.10.3...fumadocs@16.11.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-mdx` from 15.0.12 to 15.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases ">fumadocs-mdx's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-mdx@15.1.0</h2>
<h3>Default to Base UI</h3>
<p>Internal packages & templates now use Base UI rather than Radix
UI.</p>
<h2>fumadocs-mdx@15.0.13</h2>
<h3>Require <code>collection</code> query param at regex matching</h3>
<p>Instead of passing through all JSON/YAML files, the meta loader now
requires <code>collection</code> query param to be triggered.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e2547702c242b0da3d80b8b2420ec19af868https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.0.12...fumadocs-mdx@15.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-twoslash` from 3.1.15 to 3.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases ">fumadocs-twoslash's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-twoslash@3.3.0</h2>
<h3>Default to Base UI</h3>
<p>Internal packages & templates now use Base UI rather than Radix
UI.</p>
<h2>fumadocs-twoslash@3.2.1</h2>
<h3>Migrate to <code>cnfast</code></h3>
<p>Drop <code>tailwind-merge</code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e2547702c242b0da3d80b8b2420ec19af868https://github.com/fuma-nama/fumadocs/compare/fumadocs-twoslash@3.1.15...fumadocs-twoslash@3.3.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `fumadocs-ui` from 16.10.3 to 16.11.1
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ab09f500cbhttps://redirect.github.com/fuma-nama/fumadocs/issues/3405 ">#3405</a>)</li>
<li><a
href="889a296d06a5c081d0c69a269030df3e33f4362f3597c9d1e60f389cf3de4611f97d49d0953007600297e25477https://github.com/fuma-nama/fumadocs/compare/fumadocs-ui@16.10.3...fumadocs@16.11.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `lucide-react` from 1.20.0 to 1.23.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lucide-icons/lucide/releases ">lucide-react's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.23.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(docs): prevent scrollbar layout shift on icons page by <a
href="https://github.com/g30r93g "><code>@g30r93g</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4500 ">lucide-icons/lucide#4500</a></li>
<li>chore(docs): Remove certificates banner by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4504 ">lucide-icons/lucide#4504</a></li>
<li>ci(repo-journal.yml): GH copilot repo summary by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4505 ">lucide-icons/lucide#4505</a></li>
<li>ci(repo-journal.yml): Small fix in the workflow by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4508 ">lucide-icons/lucide#4508</a></li>
<li>ci(repo-journal.yml): Switch to token by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4509 ">lucide-icons/lucide#4509</a></li>
<li>feat(icons): added <code>paper-bag</code> icon by <a
href="https://github.com/dkast "><code>@dkast</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4023 ">lucide-icons/lucide#4023</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/g30r93g "><code>@g30r93g</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4500 ">lucide-icons/lucide#4500</a></li>
<li><a href="https://github.com/dkast "><code>@dkast</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4023 ">lucide-icons/lucide#4023</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.22.0...1.23.0 ">https://github.com/lucide-icons/lucide/compare/1.22.0...1.23.0 </a></p>
<h2>Version 1.22.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(icons): add 6 database variant icons by <a
href="https://github.com/Barakudum "><code>@Barakudum</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4336 ">lucide-icons/lucide#4336</a></li>
<li>ci(release.yml): Remove concurrency field to prevent release mess by
<a href="https://github.com/ericfennis "><code>@ericfennis</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4485 ">lucide-icons/lucide#4485</a></li>
<li>fix(docs): fix color input clipping by <a
href="https://github.com/Hsiii "><code>@Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4488 ">lucide-icons/lucide#4488</a></li>
<li>docs(site): add Deno to installation instructions by <a
href="https://github.com/bartlomieju "><code>@bartlomieju</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4486 ">lucide-icons/lucide#4486</a></li>
<li>chore(deps): bump esbuild from 0.25.12 to 0.28.1 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4459 ">lucide-icons/lucide#4459</a></li>
<li>fix(docs): prevent private analytics token from blocking local dev
by <a href="https://github.com/Hsiii "><code>@Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4481 ">lucide-icons/lucide#4481</a></li>
<li>docs(installation.md): Remove outdate next tag in installation by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4495 ">lucide-icons/lucide#4495</a></li>
<li>fix(lucide-react-native): Fix context provider export by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4497 ">lucide-icons/lucide#4497</a></li>
<li>fix(astro): add Astro v7 compatibility by <a
href="https://github.com/iseraph-dev "><code>@iseraph-dev</code></a> in
<a
href="https://redirect.github.com/lucide-icons/lucide/pull/4491 ">lucide-icons/lucide#4491</a></li>
<li>fix(icons): changed <code>carrot</code> icon by <a
href="https://github.com/jguddas "><code>@jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4010 ">lucide-icons/lucide#4010</a></li>
<li>fix(icons): changed <code>ungroup</code> icon by <a
href="https://github.com/jguddas "><code>@jguddas</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/3969 ">lucide-icons/lucide#3969</a></li>
<li>feat(icons): added <code>phi</code> icon also used as
<code>golden-ratio</code> by <a
href="https://github.com/whoisBugsbunny "><code>@whoisBugsbunny</code></a>
in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4218 ">lucide-icons/lucide#4218</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/bartlomieju "><code>@bartlomieju</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4486 ">lucide-icons/lucide#4486</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.21.0...1.22.0 ">https://github.com/lucide-icons/lucide/compare/1.21.0...1.22.0 </a></p>
<h2>Version 1.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci(release.yml): Remove new-version in release flow by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4478 ">lucide-icons/lucide#4478</a></li>
<li>ci(release.yml): Fix workflow and remove <code>version</code>
scripts in package scripts by <a
href="https://github.com/ericfennis "><code>@ericfennis</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4479 ">lucide-icons/lucide#4479</a></li>
<li>fix(docs): rename navigation category label by <a
href="https://github.com/Hsiii "><code>@Hsiii</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4483 ">lucide-icons/lucide#4483</a></li>
<li>feat(icons): added <code>broken-bone</code> icon by <a
href="https://github.com/Patolord "><code>@Patolord</code></a> in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4131 ">lucide-icons/lucide#4131</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Hsiii "><code>@Hsiii</code></a> made
their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4483 ">lucide-icons/lucide#4483</a></li>
<li><a href="https://github.com/Patolord "><code>@Patolord</code></a>
made their first contribution in <a
href="https://redirect.github.com/lucide-icons/lucide/pull/4131 ">lucide-icons/lucide#4131</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0 ">https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5ff536e139https://github.com/lucide-icons/lucide/commits/1.23.0/packages/lucide-react ">compare
view</a></li>
</ul>
</details>
<br />
Updates `next` from 16.2.6 to 16.2.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases ">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.2.10</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 16.2.4.</p>
<h2>v16.2.9</h2>
<p>Empty release to ensure <code>next@latest</code> points at a stable
release. Next.js only allows publishing with Trusted Publishing enabled.
In order to fix NPM dist-tags, we have to release a new version.
Updating dist-tags is not possible with Trusted Publishing.</p>
<h2>v16.2.8</h2>
<p>Release with no changes in an attempt to fix <code>next@latest</code>
pointing at a prerelease version.</p>
<h2>v16.2.7</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Backport documentation fixes for v16.2 (<a
href="https://redirect.github.com/vercel/next.js/issues/93804 ">#93804</a>)</li>
<li>[backport] Patch <code>playwright-core</code> to resolve
<code>_finishedPromise</code> on <code>requestFailed</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93920 ">#93920</a>)</li>
<li>[backport] Fix dev mode hydration failure when page is served from
HTTP cache (<a
href="https://redirect.github.com/vercel/next.js/issues/93492 ">#93492</a>)</li>
<li>[backport] Fix catch-all <code>router.query</code> corruption with
<code>basePath</code> + <code>rewrites</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93917 ">#93917</a>)</li>
<li>[backport] Encode non-ASCII characters in cache tags at construction
(<a
href="https://redirect.github.com/vercel/next.js/issues/93918 ">#93918</a>)</li>
<li>[backport] Fix server action forwarding loop with middleware
rewrites (<a
href="https://redirect.github.com/vercel/next.js/issues/93919 ">#93919</a>)</li>
<li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a
href="https://redirect.github.com/vercel/next.js/issues/93932 ">#93932</a>)</li>
<li>[ci] Disable hanging node 24 typescript tests on 16.2 backport
branch (<a
href="https://redirect.github.com/vercel/next.js/issues/94164 ">#94164</a>)</li>
<li>[backport] Fix "type: module" in project dir when using
standalone or adapters (<a
href="https://redirect.github.com/vercel/next.js/issues/94050 ">#94050</a>)</li>
<li>[backport] Propagate adapter preferred regions (<a
href="https://redirect.github.com/vercel/next.js/issues/94200 ">#94200</a>)</li>
<li>[16.2.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94240 ">#94240</a>)</li>
<li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS
config resolution (<a
href="https://redirect.github.com/vercel/next.js/issues/94284 ">#94284</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/icyJoseph "><code>@icyJoseph</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>, <a
href="https://github.com/mischnic "><code>@mischnic</code></a>, <a
href="https://github.com/bgw "><code>@bgw</code></a>, <a
href="https://github.com/timneutkens "><code>@timneutkens</code></a>,
and <a
href="https://github.com/lukesandberg "><code>@lukesandberg</code></a>
for helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9dadfd693c534d9c144chttps://redirect.github.com/vercel/next.js/issues/95160 ">#95160</a>)</li>
<li><a
href="98941fc427https://redirect.github.com/vercel/next.js/issues/94935 ">#94935</a>)</li>
<li><a
href="6e1a94de7chttps://redirect.github.com/vercel/next.js/issues/94640 ">#94640</a>)</li>
<li><a
href="f37fad9405d9aaaedfd8https://redirect.github.com/vercel/next.js/issues/94627 ">#94627</a>)</li>
<li><a
href="6f1680448c0dbc1d5c86https://redirect.github.com/vercel/next.js/issues/94598 ">#94598</a>)</li>
<li><a
href="90e3c811e7https://redirect.github.com/vercel/next.js/issues/94339 ">#94339</a>)</li>
<li><a
href="83f402c69dhttps://redirect.github.com/vercel/next.js/issues/94334 ">#94334</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.2.6...v16.2.10 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `react` from 19.2.4 to 19.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases ">react's
releases</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6
(<a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>
by <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.6 (May 6th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Type hardening and performance improvements
(<a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.5 (April 8th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Add more cycle protections (<a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/blob/main/CHANGELOG.md ">react's
changelog</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6 (<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>)</li>
</ul>
<h2>19.2.6 (May 6, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Type hardening and performance improvements (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>)</li>
</ul>
<h2>19.2.5 (March 18, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Add more cycle protections (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6117d7cca4https://github.com/facebook/react/tree/HEAD/packages/react/issues/36591 ">#36591</a>)</li>
<li><a
href="eaf3e95ca923f4f9f30dhttps://github.com/facebook/react/commits/v19.2.7/packages/react ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for react since your current version.</p>
</details>
<br />
Updates `@types/react` from 19.2.14 to 19.2.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react ">compare
view</a></li>
</ul>
</details>
<br />
Updates `react-dom` from 19.2.4 to 19.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases ">react-dom's
releases</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6
(<a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>
by <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.6 (May 6th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Type hardening and performance improvements
(<a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
<h2>19.2.5 (April 8th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Add more cycle protections (<a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>
by <a href="https://github.com/eps1lon "><code>@eps1lon</code></a> and
<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/blob/main/CHANGELOG.md ">react-dom's
changelog</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6 (<a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36566 ">#36566</a>)</li>
</ul>
<h2>19.2.6 (May 6, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Type hardening and performance improvements (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36425 ">#36425</a>)</li>
</ul>
<h2>19.2.5 (March 18, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Add more cycle protections (<a
href="https://github.com/eps1lon "><code>@eps1lon</code></a>, <a
href="https://github.com/unstubbable "><code>@unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36236 ">#36236</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6117d7cca4https://github.com/facebook/react/tree/HEAD/packages/react-dom/issues/36591 ">#36591</a>)</li>
<li><a
href="eaf3e95ca923f4f9f30dhttps://github.com/facebook/react/commits/v19.2.7/packages/react-dom ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for react-dom since your current version.</p>
</details>
<br />
Updates `recharts` from 3.8.1 to 3.9.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/recharts/recharts/releases ">recharts's
releases</a>.</em></p>
<blockquote>
<h2>v3.9.2</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: clarify custom labels and ticks need SVG elements by <a
href="https://github.com/ishaanlabs-gg "><code>@ishaanlabs-gg</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7524 ">recharts/recharts#7524</a></li>
<li>chore(deps): bump immer from 11.1.8 to 11.1.9 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/recharts/recharts/pull/7526 ">recharts/recharts#7526</a></li>
<li>fix(Sankey): avoid exponential depth traversal on dense graphs by <a
href="https://github.com/dm-gthb "><code>@dm-gthb</code></a> in <a
href="https://redirect.github.com/recharts/recharts/pull/7479 ">recharts/recharts#7479</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ishaanlabs-gg "><code>@ishaanlabs-gg</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7524 ">recharts/recharts#7524</a></li>
<li><a href="https://github.com/dm-gthb "><code>@dm-gthb</code></a> made
their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7479 ">recharts/recharts#7479</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/recharts/recharts/compare/v3.9.1...v3.9.2 ">https://github.com/recharts/recharts/compare/v3.9.1...v3.9.2 </a></p>
<h2>v3.9.1</h2>
<h2>What's Changed</h2>
<ul>
<li>perf: optimize ScatterChart hover by reducing re-renders from O(n)
to O(1) by <a href="https://github.com/roy7 "><code>@roy7</code></a> in
<a
href="https://redirect.github.com/recharts/recharts/pull/7133 ">recharts/recharts#7133</a></li>
<li>fix(YAxis): render explicit ticks when a non-literal domain can't
resolve on empty data (<a
href="https://redirect.github.com/recharts/recharts/issues/7362 ">#7362</a>)
by <a href="https://github.com/nlenepveu "><code>@nlenepveu</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7393 ">recharts/recharts#7393</a></li>
<li>fix: avoid Sankey nodes overlapping skipped-depth links by <a
href="https://github.com/pupuking723 "><code>@pupuking723</code></a> in
<a
href="https://redirect.github.com/recharts/recharts/pull/7471 ">recharts/recharts#7471</a></li>
<li>Add stacked bar chart with horizontal threshold line example by <a
href="https://github.com/nijuse "><code>@nijuse</code></a> in <a
href="https://redirect.github.com/recharts/recharts/pull/7495 ">recharts/recharts#7495</a></li>
<li>fix(DefaultLegendContent): omit empty value from legend icon
aria-label by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a> in
<a
href="https://redirect.github.com/recharts/recharts/pull/7501 ">recharts/recharts#7501</a></li>
<li>chore(deps): bump immer from 10.2.0 to 11.1.8 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/recharts/recharts/pull/7452 ">recharts/recharts#7452</a></li>
<li>fix(getNiceTickValues): remove trailing duplicate tick when
allowDecimals=false by <a
href="https://github.com/JSap0914 "><code>@JSap0914</code></a> in <a
href="https://redirect.github.com/recharts/recharts/pull/7482 ">recharts/recharts#7482</a></li>
<li>Fix/per graphical item formatter prop by <a
href="https://github.com/shreedharbhat98 "><code>@shreedharbhat98</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7287 ">recharts/recharts#7287</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/pupuking723 "><code>@pupuking723</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7471 ">recharts/recharts#7471</a></li>
<li><a href="https://github.com/nijuse "><code>@nijuse</code></a> made
their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7495 ">recharts/recharts#7495</a></li>
<li><a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7501 ">recharts/recharts#7501</a></li>
<li><a href="https://github.com/JSap0914 "><code>@JSap0914</code></a>
made their first contribution in <a
href="https://redirect.github.com/recharts/recharts/pull/7482 ">recharts/recharts#7482</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/recharts/recharts/compare/v3.9.0...v3.9.1 ">https://github.com/recharts/recharts/compare/v3.9.0...v3.9.1 </a></p>
<h2>v3.9.0</h2>
<h2>What's Changed</h2>
<h3>Animations</h3>
<p>3.9 comes with new animations! There are several bug fixes and what's
best, all animations are now fully customizable.</p>
<p>See the animations guide on <a
href="https://recharts.github.io/en-US/guide/animations/ ">https://recharts.github.io/en-US/guide/animations/ </a></p>
<ul>
<li>Animation guide by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7179 ">recharts/recharts#7179</a></li>
<li>Animation tests by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7255 ">recharts/recharts#7255</a></li>
<li>New animation props by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7215 ">recharts/recharts#7215</a></li>
<li>test: cover legacy animation length changes by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7283 ">recharts/recharts#7283</a></li>
<li>test: add sparse animation path tests for Line component by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7295 ">recharts/recharts#7295</a></li>
<li>Export and document interpolate function by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7293 ">recharts/recharts#7293</a></li>
<li>test: enhance line animation tests for ComposedChart and responsive
by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7289 ">recharts/recharts#7289</a></li>
<li>Manual animations on website by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7483 ">recharts/recharts#7483</a></li>
<li>Add new example where chart animates by scroll by <a
href="https://github.com/PavelVanecek "><code>@PavelVanecek</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7484 ">recharts/recharts#7484</a></li>
<li>fix: preserve single-value line dash gaps during animation by <a
href="https://github.com/puneetdixit200 "><code>@puneetdixit200</code></a>
in <a
href="https://redirect.github.com/recharts/recharts/pull/7405 ">recharts/recharts#7405</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b3451050c0f27779c04885f9369f40https://redirect.github.com/recharts/recharts/issues/7520 ">#7520</a>)</li>
<li><a
href="52a2a896cfhttps://redirect.github.com/recharts/recharts/issues/7479 ">#7479</a>)</li>
<li><a
href="8a056c1018https://redirect.github.com/recharts/recharts/issues/7527 ">#7527</a>)</li>
<li><a
href="2af6ec6f0fhttps://redirect.github.com/recharts/recharts/issues/7526 ">#7526</a>)</li>
<li><a
href="6f10d53cf6https://redirect.github.com/recharts/recharts/issues/7524 ">#7524</a>)</li>
<li><a
href="c04f1a7678https://redirect.github.com/recharts/recharts/issues/7521 ">#7521</a>)</li>
<li><a
href="69c7a9630ahttps://redirect.github.com/recharts/recharts/issues/7522 ">#7522</a>)</li>
<li><a
href="6efaf16a1ahttps://redirect.github.com/recharts/recharts/issues/7515 ">#7515</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/recharts/recharts/compare/v3.8.1...v3.9.2 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for recharts since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />
Updates `@tailwindcss/postcss` from 4.2.2 to 4.3.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases ">@tailwindcss/postcss's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.2</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229 ">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242 ">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245 ">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246 ">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247 ">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259 ">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260 ">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263 ">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277 ">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287 ">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289 ">#20289</a>)</li>
</ul>
<h2>v4.3.1</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100 ">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028 ">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052 ">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427 ">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059 ">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080 ">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103 ">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027 ">#20027</a>)</li>
<li>Canonicalization: don't suggest invalid <code>calc(…)</code>
expressions (e.g. <code>px-[calc(1rem+0px)]</code> →
<code>px-[calc(1rem+0)]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20127 ">#20127</a>)</li>
<li>Canonicalization: avoid suggesting large spacing-scale values for
arbitrary lengths (e.g. <code>left-[99999px]</code> →
<code>left-[99999px]</code>, not <code>left-24999.75</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20130 ">#20130</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
recovers when a tracked dependency is deleted and restored (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20137 ">#20137</a>)</li>
<li>Ensure standalone <code>@tailwindcss/cli</code> binaries are ignored
when scanning for class candidates (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20139 ">#20139</a>)</li>
<li>Ensure class candidates are extracted from Twig
<code>addClass(…)</code> and <code>removeClass(…)</code> calls (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20198 ">#20198</a>)</li>
<li>Don't crash in the Ruby or Vue preprocessors when scanning files
containing invalid UTF-8 bytes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19588 ">#19588</a>)</li>
<li>Allow <code>@variant</code> to be used inside <code>addBase</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19480 ">#19480</a>)</li>
<li>Ensure <code>@source</code> globs with symlinks are preserved (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Ensure later <code>@source</code> rules can re-include files
excluded by earlier <code>@source not</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Upgrade: don't migrate empty class rules to invalid
<code>@utility</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20205 ">#20205</a>)</li>
<li>Ensure transitions between <code>inset-shadow-none</code> and other
inset shadows work correctly (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20208 ">#20208</a>)</li>
<li>Ensure explicitly referenced <code>@source</code> directories are
scanned even when ignored by git (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20214 ">#20214</a>)</li>
<li>Ensure <code>@source</code> globs ending in <code>**/*</code>
preserve dynamic path segments to avoid scanning too many files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20217 ">#20217</a>)</li>
<li>Canonicalization: don't fold <code>calc(…)</code> divisions when the
result would require high precision (e.g.
<code>w-[calc(100%/3.5)]</code> → <code>w-[calc(100%/3.5)]</code>, not
<code>w-[28.571428571428573%]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20221 ">#20221</a>)</li>
<li>Serve ESM type declarations to ESM importers of
<code>@tailwindcss/postcss</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20228 ">#20228</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Generate <code>0</code> instead of <code>calc(var(--spacing) *
0)</code> for spacing utilities like <code>m-0</code> and
<code>left-0</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20196 ">#20196</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md ">@tailwindcss/postcss's
changelog</a>.</em></p>
<blockquote>
<h2>[4.3.2] - 2026-06-26</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229 ">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242 ">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245 ">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246 ">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247 ">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259 ">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260 ">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263 ">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269 ">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277 ">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287 ">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289 ">#20289</a>)</li>
</ul>
<h2>[4.3.1] - 2026-06-12</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100 ">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028 ">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052 ">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427 ">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059 ">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080 ">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103 ">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027 ">#20027</a>)</li>
<li>Canonicalization: don't suggest invalid <code>calc(…)</code>
expressions (e.g. <code>px-[calc(1rem+0px)]</code> →
<code>px-[calc(1rem+0)]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20127 ">#20127</a>)</li>
<li>Canonicalization: avoid suggesting large spacing-scale values for
arbitrary lengths (e.g. <code>left-[99999px]</code> →
<code>left-[99999px]</code>, not <code>left-24999.75</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20130 ">#20130</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
recovers when a tracked dependency is deleted and restored (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20137 ">#20137</a>)</li>
<li>Ensure standalone <code>@tailwindcss/cli</code> binaries are ignored
when scanning for class candidates (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20139 ">#20139</a>)</li>
<li>Ensure class candidates are extracted from Twig
<code>addClass(…)</code> and <code>removeClass(…)</code> calls (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20198 ">#20198</a>)</li>
<li>Don't crash in the Ruby or Vue preprocessors when scanning files
containing invalid UTF-8 bytes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19588 ">#19588</a>)</li>
<li>Allow <code>@variant</code> to be used inside <code>addBase</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19480 ">#19480</a>)</li>
<li>Ensure <code>@source</code> globs with symlinks are preserved (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Ensure later <code>@source</code> rules can re-include files
excluded by earlier <code>@source not</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203 ">#20203</a>)</li>
<li>Upgrade: don't migrate empty class rules to invalid
<code>@utility</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20205 ">#20205</a>)</li>
<li>Ensure transitions between <code>inset-shadow-none</code> and other
inset shadows work correctly (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20208 ">#20208</a>)</li>
<li>Ensure explicitly referenced <code>@source</code> directories are
scanned even when ignored by git (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20214 ">#20214</a>)</li>
<li>Ensure <code>@source</code> globs ending in <code>**/*</code>
preserve dynamic path segments to avoid scanning too many files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20217 ">#20217</a>)</li>
<li>Canonicalization: don't fold <code>calc(…)</code> divisions when the
result would require high precision (e.g.
<code>w-[calc(100%/3.5)]</code> → <code>w-[calc(100%/3.5)]</code>, not
<code>w-[28.571428571428573%]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20221 ">#20221</a>)</li>
<li>Serve ESM type declarations to ESM importers of
<code>@tailwindcss/postcss</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20228 ">#20228</a>)</li>
</ul>
<h3>Changed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="056a155072https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20281 ">#20281</a>)</li>
<li><a
href="8a14a71010https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20226 ">#20226</a>)</li>
<li><a
href="522288ca08https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20228 ">#20228</a>)</li>
<li><a
href="8dcdb66e8ahttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20095 ">#20095</a>)</li>
<li><a
href="588bd7371fhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20023 ">#20023</a>)</li>
<li><a
href="12eb5ae7b6https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20015 ">#20015</a>)</li>
<li><a
href="4255671c5fhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20013 ">#20013</a>)</li>
<li><a
href="52f94c74bbhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19999 ">#19999</a>)</li>
<li><a
href="d194d4c3e6https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19878 ">#19878</a>)</li>
<li><a
href="bfb5732b0bhttps://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19980 ">#19980</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/@tailwindcss-postcss ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for <code>@tailwindcss/postcss</code> since your current
version.</p>
</details>
<br />
Updates `@types/mdx` from 2.0.13 to 2.0.14
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/mdx ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/react` from 19.2.14 to 19.2.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react ">compare
view</a></li>
</ul>
</details>
<br />
Updates `postcss` from 8.5.15 to 8.5.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases ">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra "><code>@mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar "><code>@MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md ">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra "><code>@mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar "><code>@MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90 "><code>@sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="92ccc93ff1818bdd604346e451068ehttps://redirect.github.com/postcss/postcss/issues/2036 ">#2036</a>)</li>
<li><a
href="34942ce76cd4feed6453https://redirect.github.com/postcss/postcss/issues/2097 ">#2097</a>)</li>
<li><a
href="da323fc8d388633691943828982213https://redirect.github.com/postcss/postcss/issues/2100 ">#2100</a>)</li>
<li><a
href="d1e80b8303https://redirect.github.com/postcss/postcss/issues/2091 ">#2091</a>)</li>
<li><a
href="b91e4a6390https://github.com/postcss/postcss/compare/8.5.15...8.5.16 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npm ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-09 09:38:37 -04:00
Rudimar Ronsoni
b4571cc346
feat: headroom wrap opencode / unwrap opencode CLI ( #1105 )
...
## Summary
This PR implements transparent `headroom wrap opencode` support without
asking users to edit OpenCode provider URLs, choose an extra CLI flag,
or maintain a static provider list.
The wrapper now lives at the runtime transport boundary: OpenCode keeps
its user/provider config, while Headroom intercepts outbound provider
traffic in-process and routes it through the local Headroom proxy.
## What changed
### Transparent OpenCode wrapping
- `headroom wrap opencode` injects the `headroom-opencode` plugin
through `OPENCODE_CONFIG_CONTENT`.
- Existing OpenCode provider URLs are preserved. We do not rewrite user
config URLs to point at Headroom.
- Existing `OPENAI_BASE_URL` and `ANTHROPIC_BASE_URL` env vars are
preserved.
- Local OpenCode traffic, localhost traffic, and Headroom proxy traffic
bypass the shim to avoid loops.
### Runtime transport interception
- Added an OpenCode plugin transport shim that wraps:
- `globalThis.fetch`
- `http.request` / `http.get`
- `https.request` / `https.get`
- External provider calls are routed to the local Headroom proxy.
- The original upstream origin is passed through `x-headroom-base-url`,
so the proxy can forward to the real provider without changing OpenCode
config.
- External `http2.connect` is blocked loudly instead of allowing direct
provider traffic to leak outside Headroom.
### Live provider additions
Provider coverage is no longer based on a static config scan. Because
routing happens at outbound request time, providers added mid-session
are routed through Headroom automatically as long as they use the
covered Node transport paths.
### Subagent and child-process coverage
- The parent OpenCode plugin sets a packaged Node preload shim through
`NODE_OPTIONS=--import=.../hook-shim/handler.js`.
- The transport shim patches `child_process.spawn`, `exec`, `execFile`,
and `fork` so child Node processes receive the Headroom preload even
when OpenCode passes a custom `env`.
- The child-process shim fails closed if it loads without
`HEADROOM_OPENCODE_TRANSPORT_PROXY_URL`.
- This closes the subagent leak path where a child Node process could
otherwise start without Headroom transport interception.
## Why this goes beyond PR #1089
PR #1089 improves OpenCode provider registration, but it still focuses
on provider config shape. This PR moves the enforcement boundary to
runtime transport interception.
This PR goes further because:
- No provider URL rewriting is required.
- New providers added mid-session are covered automatically.
- Subagents and child Node processes inherit the Headroom transport
shim.
- Direct external HTTP/2 paths fail loudly instead of leaking.
- The wrap remains transparent to the user's OpenCode provider config.
- The wrapper is fail-closed for unsupported child-process preload
state.
## Additional robustness fixes
While validating the change in Docker, the full Python suite exposed
unrelated Linux/container robustness issues. These are fixed in this PR
so the suite is green:
- Binary cache handling now treats cache paths under a non-writable
existing parent as unavailable, including when tests run as root in
Docker.
- `release_version.py` honors `MANUAL_VER` before git calls so direct
script execution works outside a `.git` checkout.
- Test logger isolation now resets relevant Headroom child loggers so
proxy logging setup cannot poison later `caplog` tests.
- The scanner missing-path test now uses a guaranteed missing `tmp_path`
child instead of relying on `/nonexistent/path`.
## Validation
All implementation validation was run inside Docker.
- Full Python suite from a fresh Docker copy: `6605 passed, 523
skipped`.
- Ruff on changed Python/OpenCode paths: passed.
- OpenCode plugin typecheck: passed.
- OpenCode plugin tests: `9 passed`.
- OpenCode plugin build: passed.
- Hook shim preload smoke test: passed.
## Notes
This PR intentionally does not add a CLI option. `headroom wrap
opencode` means full wrap. Either Headroom wraps OpenCode transparently,
or the path fails loudly instead of silently leaking provider traffic.
---------
Co-authored-by: Rudimar Ronsoni <6081613+rudironsoni@users.noreply.github.com>
2026-06-22 11:07:12 -05:00
JD Davis