Menu ▾ ▴

#5 chore(deps): bump the minor-and-patch group with 14 updates

closed
nobody
dependencies (40) javascript (44)
2026-06-19
2026-06-19
Anonymous
No

Originally created by: dependabot[bot]

Bumps the minor-and-patch group with 14 updates:

Package From To
@ai-sdk/anthropic 3.0.81 3.0.85
@ai-sdk/openai 3.0.68 3.0.73
@base-ui/react 1.5.0 1.6.0
@openrouter/ai-sdk-provider 2.9.0 2.9.1
@tailwindcss/vite 4.3.0 4.3.1
@tanstack/react-virtual 3.14.2 3.14.3
@tauri-apps/api 2.11.0 2.11.1
ai 6.0.198 6.0.208
dompurify 3.4.10 3.4.11
ollama-ai-provider-v2 3.5.1 3.6.0
posthog-js 1.386.8 1.390.2
tailwindcss 4.3.0 4.3.1
@biomejs/biome 2.4.16 2.5.0
astro 6.4.7 6.4.8

Updates @ai-sdk/anthropic from 3.0.81 to 3.0.85

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

3.0.85

Patch Changes

  • Updated dependencies [779f5cd]
    • @​ai-sdk/provider-utils@​4.0.30

3.0.84

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
    • @​ai-sdk/provider-utils@​4.0.29

3.0.83

Patch Changes

  • Updated dependencies [942f2f8]
    • @​ai-sdk/provider-utils@​4.0.28

3.0.82

Patch Changes

  • 2a91a17: feat(provider/anthropic): add support for claude-fable-5 and the fallbacks API parameter
Commits


Updates @ai-sdk/openai from 3.0.68 to 3.0.73

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​3.0.73

Patch Changes

  • 1274c07: fix(provider/openai): send client-executed tool calls as full function_call items in the Responses API so they pair with their function_call_output by call_id
Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.73

Patch Changes

  • 1274c07: fix(provider/openai): send client-executed tool calls as full function_call items in the Responses API so they pair with their function_call_output by call_id

3.0.72

Patch Changes

  • Updated dependencies [779f5cd]
    • @​ai-sdk/provider-utils@​4.0.30

3.0.71

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
    • @​ai-sdk/provider-utils@​4.0.29

3.0.70

Patch Changes

  • Updated dependencies [942f2f8]
    • @​ai-sdk/provider-utils@​4.0.28

3.0.69

Patch Changes

  • 9a55f6d: feat(openai): add namespaces for tool definitions
Commits


Updates @base-ui/react from 1.5.0 to 1.6.0

Release notes

Sourced from @​base-ui/react's releases.

v1.6.0

General changes

Accordion

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Collapsible

Combobox

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.6.0

Jun 18, 2026

General changes

Accordion

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Collapsible

Combobox

... (truncated)

Commits


Updates @openrouter/ai-sdk-provider from 2.9.0 to 2.9.1

Release notes

Sourced from @​openrouter/ai-sdk-provider's releases.

2.9.1

What's Changed

Full Changelog: https://github.com/OpenRouterTeam/ai-sdk-provider/compare/2.9.0...2.9.1

Changelog

Sourced from @​openrouter/ai-sdk-provider's changelog.

2.9.1

Patch Changes

Commits


Updates @tailwindcss/vite from 4.3.0 to 4.3.1

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.1

Added

Fixed

Changed

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.1] - 2026-06-12

Added

Fixed

Changed

Commits


Updates @tanstack/react-virtual from 3.14.2 to 3.14.3

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.3

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.3

Patch Changes

Commits


Updates @tauri-apps/api from 2.11.0 to 2.11.1

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.11.1

No known vulnerabilities found

[2.11.1]

Enhancements

> @tauri-apps/api@2.11.1 npm-publish /home/runner/work/tauri/tauri/packages/api
> pnpm build && cd ./dist && pnpm publish --access public --loglevel silly --no-git-checks

> @​tauri-apps/api@​2.11.1 build /home/runner/work/tauri/tauri/packages/api
> rollup -c --configPlugin typescript



./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts → ./dist, ./dist...
created ./dist, ./dist in 883ms

src/index.ts → ../../crates/tauri/scripts/bundle.global.js...
created ../../crates/tauri/scripts/bundle.global.js in 1.4s
npm verbose cli /opt/hostedtoolcache/node/24.16.0/x64/bin/node /opt/hostedtoolcache/node/24.16.0/x64/bin/npm
npm info using npm@11.13.0
npm info using node@v24.16.0
npm silly config load:file:/opt/hostedtoolcache/node/24.16.0/x64/lib/node_modules/npm/npmrc
npm silly config load:file:/tmp/286e8dee195254a4370e608b672019b0/.npmrc
npm silly config load:file:/home/runner/.npmrc
npm silly config load:file:/home/runner/.config/pnpm/rc
npm verbose title npm publish tauri-apps-api-2.11.1.tgz
npm verbose argv "publish" "--ignore-scripts" "tauri-apps-api-2.11.1.tgz" "--access" "public" "--loglevel" "silly"
npm verbose logfile logs-max:10 dir:/home/runner/.npm/_logs/2026-06-17T13_41_23_851Z-
npm verbose logfile /home/runner/.npm/_logs/2026-06-17T13_41_23_851Z-debug-0.log
npm warn Unknown env config "verify-deps-before-run". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown env config "npm-globalconfig". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown env config "overrides". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown env config "_jsr-registry". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm silly logfile done cleaning log files
npm verbose publish [ 'tauri-apps-api-2.11.1.tgz' ]
</tr></table>

... (truncated)

Commits


Updates ai from 6.0.198 to 6.0.208

Release notes

Sourced from ai's releases.

ai@6.0.208

Patch Changes

  • 8261640: fix(ai): handle partial unicode escapes in fixJson
  • f994df3: Serialize undefined tool output to null in UI message chunks

ai@6.0.207

Patch Changes

  • 779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leak

    When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

  • Updated dependencies [5bfde36]

  • Updated dependencies [779f5cd]

    • @​ai-sdk/gateway@​3.0.133
    • @​ai-sdk/provider-utils@​4.0.30
Changelog

Sourced from ai's changelog.

6.0.208

Patch Changes

  • 8261640: fix(ai): handle partial unicode escapes in fixJson
  • f994df3: Serialize undefined tool output to null in UI message chunks

6.0.207

Patch Changes

  • 779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leak

    When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

  • Updated dependencies [5bfde36]

  • Updated dependencies [779f5cd]

    • @​ai-sdk/gateway@​3.0.133
    • @​ai-sdk/provider-utils@​4.0.30

6.0.206

Patch Changes

  • Updated dependencies [e962dda]
    • @​ai-sdk/gateway@​3.0.132

6.0.205

Patch Changes

  • Updated dependencies [6160ced]
  • Updated dependencies [c9b8abd]
    • @​ai-sdk/gateway@​3.0.131

6.0.204

Patch Changes

  • Updated dependencies [c5d4716]
    • @​ai-sdk/gateway@​3.0.130

6.0.203

Patch Changes

  • f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

... (truncated)

Commits


Updates dompurify from 3.4.10 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits


Updates ollama-ai-provider-v2 from 3.5.1 to 3.6.0

Commits


Updates posthog-js from 1.386.8 to 1.390.2

Release notes

Sourced from posthog-js's releases.

posthog-js@1.390.2

1.390.2

Patch Changes

  • #3868](https://github.com/href="https://redirect.github.com/PostHog/posthog-js/pull/3868">/issues/3868) a5dd54a Thanks @​pauldambra! - fix(replay): scope the session-recording flushed-size tracker to the session

    $sdk_debug_replay_flushed_size was stored as a single device-global value in persistence and only reset on an in-page session rotation, so it leaked across page loads and tabs and over-counted on returning visitors. The tracker now keys the running total to the current session id, so a new session starts from zero and a fresh load reading an ongoing session sees the correct total.

    The internal persistence key backing this counter ($sess_rec_flush_size) was also unintentionally attached to every captured event as a super-property; it is now marked hidden so it no longer ships on events. The value remains available on session-replay debug events as $sdk_debug_replay_flushed_size. (2026-06-17)

posthog-js@1.390.1

1.390.1

Patch Changes

  • #3784](https://github.com/href="https://redirect.github.com/PostHog/posthog-js/pull/3784">/issues/3784) e25e629 Thanks @​lucasheriques! - Surveys: event-triggered surveys are now scoped to the page load the event fired in, and only persist across a page reload once they have actually been shown.

    Previously an event armed a survey by writing it to localStorage, where it stayed until shown. Because the activation survived reloads and the URL condition was only checked at display time, a survey armed by an exit-intent event (which fires as the user is leaving or reloading) could surface on a later page load with no event behind it. Activations now live in memory until the survey is shown, so an armed-but-unshown survey no longer reappears after a reload.

    Once a survey is shown it is promoted to persistence, so a non-repeatable survey survives a reload and re-displays until the user dismisses or answers it (instead of vanishing if they reload before interacting). Repeatable surveys (schedule: 'always' or "Show every time the event is captured") are still consumed when shown, so each captured trigger shows them once. Product tours follow the same model. Cross-page deferral (arm on one full page load, display on a later one) is no longer supported via event triggers; use audience targeting for that. (2026-06-17)

posthog-js@1.390.0

1.390.0

Minor Changes

  • #3869](https://github.com/href="https://redirect.github.com/PostHog/posthog-js/pull/3869">/issues/3869) 81b79fb Thanks @​turnipdabeets! - Add a beforeSend option to the logs config, so you can inspect, redact, or drop log records before they're sent:

    posthog.init('<token>', {
    logs: {
        beforeSend: (log) => {
            // return null to drop the log, or return the (optionally modified) log to keep it
            if (log.body.includes('password')) {
                return null
            }
            return log
        },
    },
})

    beforeSend accepts a single function or an array of functions (applied left to right); returning null from any of them drops the record. It runs for logs sent via both posthog.captureLog() and posthog.logger.*. (2026-06-17)

Patch Changes

  • Updated dependencies [81b79fb]:
    • @​posthog/types@​1.390.0

... (truncated)

Commits


Updates tailwindcss from 4.3.0 to 4.3.1

Release notes

Sourced from tailwindcss's releases.

v4.3.1

Added

Fixed

Related

Tickets: #110
Tickets: #148

Discussion

  • Anonymous

    Anonymous - 2026-06-19

    Originally posted by: dependabot[bot]

    Looks like these dependencies are no longer updatable, so this is no longer needed.

     

  • Anonymous

    Anonymous - 2026-06-19

    Ticket changed by: dependabot[bot]

    • status: open --> closed
     

Log in to post a comment.

MongoDB Logo MongoDB