chore(deps): bump the minor-and-patch group across 1 directory with 28 updates

[dependabot]

Bumps the minor-and-patch group with 27 updates in the / directory:

Package	From	To
@ai-sdk/provider-utils	5.0.34	5.0.36
@astryxdesign/cli	0.5.2	0.5.4
@astryxdesign/core	0.5.2	0.5.4
@biomejs/biome	2.5.11	2.5.12
@types/node	26.4.0	26.5.0
knip	6.33.0	6.34.0
@ai-sdk/anthropic	4.0.46	4.0.49
@ai-sdk/code-mode	1.0.42	1.0.50
@ai-sdk/cohere	4.0.35	4.0.37
@ai-sdk/google	4.0.58	4.0.64
@ai-sdk/open-responses	2.0.36	2.0.39
@ai-sdk/openai	4.0.52	4.0.60
@ai-sdk/openai-compatible	3.0.41	3.0.44
@ai-sdk/provider	4.0.9	4.0.10
@larksuiteoapi/node-sdk	1.73.0	1.73.3
ai	7.0.85	7.0.93
socks	2.8.9	2.8.10
undici	8.10.1	8.10.2
systeminformation	5.33.8	5.33.9
@earendil-works/pi-tui	0.84.4	0.85.1
katex	0.18.5	0.18.7
lucide-react	1.38.0	1.42.0
@types/react-dom	19.2.5	19.2.7
@astryxdesign/theme-neutral	0.5.2	0.5.4
@playwright/test	1.62.1	1.63.0
@storybook/react-vite	10.5.10	10.6.0
simple-icons	16.29.0	16.30.0

Updates @ai-sdk/provider-utils from 5.0.34 to 5.0.36

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.36

Patch Changes

• 6bcc0f8: Update Undici to a version patched for CVE-2026-13697.

5.0.35

Patch Changes

• 5190b67: feat(provider): extend the FilesV4 interface with optional getFileMetadata, downloadFile (streaming), and deleteFile operations, plus abortSignal/headers call options and a { type: 'stream' } upload data variant; upload results now expose byteSize, createdAt, and expiresAt (also surfaced by the core uploadFile() helper, which now forwards abortSignal/headers); add postMultipartStreamToApi (streaming multipart uploads with deterministic part ordering and failure-path stream teardown), deleteFromApi, and createBinaryStreamResponseHandler to provider-utils
• Updated dependencies [5190b67]
  • @​ai-sdk/provider@​4.0.10

Commits

• 8a09c78 Version Packages (#20144)
• 6bcc0f8 fix(provider-utils): update undici for CVE-2026-13697 (#20165)
• 3bd0fcf Version Packages (#20126)
• 5190b67 feat(provider): add optional getFileMetadata/downloadFile/deleteFile to Files...
• See full diff in compare view

Updates @astryxdesign/cli from 0.5.2 to 0.5.4

Release notes

Sourced from @​astryxdesign/cli's releases.

Astryx v0.5.4

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape, and v0.5.4 does not repair that compatibility break. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.4 updates the fixed-version core package family.

npx astryx upgrade --apply

Fixes

• DropdownMenu keeps focus where it is when a controlled menu mounts already open. ArrowDown on the focused trigger enters an already-open menu without requiring a close and reopen. (#5976)
• DropdownMenuRadioGroup now renders a working, selectable menu in the docsite properties preview. (#5976)

CLI and docsite

• CLI integrations preserve block showcase metadata, letting packages ship their own docsite previews. Charts now includes its primary bar-chart showcase. (#5583)
• Stepper documentation now accurately describes the exported context surface while compatibility work continues. (#6088)

Contributors

Thanks to @​Kyujenius and @​cixzhang.

Full Changelog: facebook/astryx@v0.5.3...v0.5.4

Astryx v0.5.3

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.3 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Components

• Add built-in popover, bottom-sheet, and compact-touch adaptive presentation policies to DropdownMenu, MoreMenu, and ContextMenu. (#5395)
• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Add isReadOnly to Selector and MultiSelector so selected values remain focusable and form-submittable without exposing selection menus or editing affordances. (#5805)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)
• Add elevation prop to ToggleButton for floating (FAB-style) toggles, mirroring Button; retained inside a ToggleButtonGroup. (#6012)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)
• Banner: the header's supporting line now carries a stable theme target, astryx-banner-description. (#5483) Only the header, the status icon and the content panel were themeable before, so a theme restyling the description — its colour, its type, or the space between it and the title — had to reach in with a structural selector like .astryx-banner > div:nth-child(2) > div:nth-child(2). Purely additive: no existing class, data attribute, or style changes.

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.5.4

New Features

• Preserve block showcase metadata from CLI integrations so packages can ship their own docsite previews. Charts now includes its primary bar-chart showcase alongside the package.

Contributors

Thanks to everyone who contributed to this release:

• @​cixzhang

---

0.5.3

New Components

• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Reuse Neutral-owned local tokens for semantic status fills across badges, status dots, step indicators, and progress bars. (#5854)
• Add Neutral's reproducible, theme-owned OKLCH palette without changing its runtime token mappings. The request, receipt, generated result, and CLI template artifacts are committed together for review. (#5987)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)

• Add the checkout wizard page template. (#5660)

• CLI: record every command run and hand it to a function you supply. (#4812)

  // astryx.config.mjs
  export default {
    debug: event => appendFileSync('runs.ndjson', JSON.stringify(event) + '\n'),
  };

  That is the whole feature. Setting debug opts in; the function receives one DebugEvent per invocation and decides what happens to it. The CLI stores nothing.

  Each event carries the command, its arguments and flags (with their Commander source, so you can tell a typed flag from a default), the outcome, exit code, duration, error code, a coarse environment snapshot including which coding agent invoked the CLI, and — under output — everything the command printed to stdout and stderr. That last part is the answer the user actually got, which is what makes a record useful for improving the output rather than just counting invocations. Streams are captured separately with their true byte counts, and truncated past 32KB per stream so a command that prints a whole file does not dominate the record. Coverage is the point: handled errors, parse errors, --help, rejected invocations, uncaught throws, and Ctrl-C all report. The event is delivered from a process.on('exit') listener because the CLI's error path exits synchronously — anything hooked to normal completion would report successes and almost no failures — and the handler is loaded before parsing, because parse errors and --help short-circuit before any hook runs.

  event is a published contract: DebugEvent is exported from @astryxdesign/cli/debug with a sealed zod validator, parseDebugEvent, drift-locked to the type so the recorder cannot add a field without publishing it. schemaVersion is a literal, so widening it turns every consumer's branch into a compile error rather than a silent misread.

  The handler runs synchronously at exit — a returned promise is never awaited, so network delivery from inside it will not work; write a file or spawn a detached child. It receives a copy, so a handler that throws, or mutates what it was given, can neither fail the command nor affect anything else. Follow-up hardening keeps a handler from replacing the command's exit code and routes handler writes away from stdout so a --json envelope stays valid. (#5929)

  Nothing changes for a project that has not set debug. Startup is unmoved: the environment probe is deferred to delivery rather than run in begin, because its first Intl call initialises ICU and that alone was ~9% of the CLI's startup for everyone. Nor does the config run: Project.load evaluates the config module and loads its integrations, which most commands never did, so the file is read as text first and only loaded when the word debug appears in it. Measured across eight commands, no command evaluates a config that did not already.

  Values are scrubbed before delivery: home paths, absolute paths inside stack frames, email addresses, URL credentials, credential-shaped strings, and the value half of a sensitive assignment wherever it appears — including where an error message, a stack frame and the captured stderr all quote the flag that was rejected. Sensitive names are matched with - and _ stripped, so --api-key, --api_key and --apiKey are one rule; key, pat and pw are matched whole so they do not take --keyboard and --path with them. argv is scrubbed pairwise, so --token hunter2 loses its value the way --token=hunter2 does. Oversized values are clamped.

  Hardened against three adversarial chaos runs and an independent review, each finding mutation-tested before its fix landed: a __proto__ key silently reparenting the record that carried it, one oversized value discarding the whole event, an exit that bypassed cliError being indistinguishable from a classified failure, a signal-terminated run leaving no record at all, a sensitive --flag=value scrubbed in argv but written back out in full through the error message and captured stderr that quote it, absolute paths surviving inside stack frames — where nothing puts whitespace in front of them — and taking the machine's username with them, a graceful Ctrl-C recorded as a failure with an exit code the process never returned, --api-key and --token value reaching a handler intact, and the two startup costs above.

... (truncated)

Commits

• b92b076 chore: version packages for v0.5.4 (#6100)
• ea5705c feat(docsite): surface canary-only components (#5583)
• ad49392 chore: version packages for v0.5.3 (#6087)
• b2e6a1d fix(theme-neutral): tune destructive and non-semantic surfaces (#6049)
• cde73c7 fix(theme-neutral): map tokens to reviewed palette (#6034)
• b1fcbee feat(core): support custom Heading visual types (#6026)
• 5aca971 feat(templates): add the vertical wizard page template (#5672)
• 0ccad5b feat(theme-neutral): mute dark palette edge (#6069)
• 05b679c feat(templates): add the checkout wizard page template (#5660)
• b76e3c8 feat(templates): add the form wizard page template (#6072)
• Additional commits viewable in compare view

Updates @astryxdesign/core from 0.5.2 to 0.5.4

Release notes

Sourced from @​astryxdesign/core's releases.

Astryx v0.5.4

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape, and v0.5.4 does not repair that compatibility break. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.4 updates the fixed-version core package family.

npx astryx upgrade --apply

Fixes

• DropdownMenu keeps focus where it is when a controlled menu mounts already open. ArrowDown on the focused trigger enters an already-open menu without requiring a close and reopen. (#5976)
• DropdownMenuRadioGroup now renders a working, selectable menu in the docsite properties preview. (#5976)

CLI and docsite

• CLI integrations preserve block showcase metadata, letting packages ship their own docsite previews. Charts now includes its primary bar-chart showcase. (#5583)
• Stepper documentation now accurately describes the exported context surface while compatibility work continues. (#6088)

Contributors

Thanks to @​Kyujenius and @​cixzhang.

Full Changelog: facebook/astryx@v0.5.3...v0.5.4

Astryx v0.5.3

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.3 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Components

• Add built-in popover, bottom-sheet, and compact-touch adaptive presentation policies to DropdownMenu, MoreMenu, and ContextMenu. (#5395)
• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Add isReadOnly to Selector and MultiSelector so selected values remain focusable and form-submittable without exposing selection menus or editing affordances. (#5805)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)
• Add elevation prop to ToggleButton for floating (FAB-style) toggles, mirroring Button; retained inside a ToggleButtonGroup. (#6012)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)
• Banner: the header's supporting line now carries a stable theme target, astryx-banner-description. (#5483) Only the header, the status icon and the content panel were themeable before, so a theme restyling the description — its colour, its type, or the space between it and the title — had to reach in with a structural selector like .astryx-banner > div:nth-child(2) > div:nth-child(2). Purely additive: no existing class, data attribute, or style changes.

... (truncated)

Changelog

Sourced from @​astryxdesign/core's changelog.

0.5.4

Fixes

• DropdownMenu: keep focus where it is when a controlled menu mounts already open (#5976) Mounting with isMenuOpen true no longer moves focus into the first item; only an open that happens after mount does, per the input-modality rules. A page that renders a menu open on load no longer drops keyboard users into it, and ArrowDown on the focused trigger walks into an already-open menu instead of requiring a close and reopen.
• DropdownMenuRadioGroup: render a working menu in the docsite properties preview (#5976) Adds a DropdownMenu playground wrapper that opens on first load and two DropdownMenuRadioItem children, so the properties-tab preview shows selectable radio choices immediately instead of an empty container.

Contributors

Thanks to everyone who contributed to this release:

• @​Kyujenius

---

0.5.3

New Components

• Add built-in popover, bottom-sheet, and compact-touch adaptive presentation policies to DropdownMenu, MoreMenu, and ContextMenu. (#5395)
• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Add isReadOnly to Selector and MultiSelector so selected values remain focusable and form-submittable without exposing selection menus or editing affordances. (#5805)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)
• Add elevation prop to ToggleButton for floating (FAB-style) toggles, mirroring Button; retained inside a ToggleButtonGroup. (#6012)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)

• Banner: the header's supporting line now carries a stable theme target, astryx-banner-description. (#5483) Only the header, the status icon and the content panel were themeable before, so a theme restyling the description — its colour, its type, or the space between it and the title — had to reach in with a structural selector like .astryx-banner > div:nth-child(2) > div:nth-child(2). Purely additive: no existing class, data attribute, or style changes. Nothing else in the header becomes a target. The end area is a layout row — flex, wrap, and the edge compensation that lets its buttons overhang the header padding — not a painted surface, and a theme that wants the header to grow around its buttons instead of letting them overhang sets padding-block on the existing banner target, which reaches the same height without exposing a private margin. The title, the two controls and the text column are likewise left alone: the column paints nothing (display: flex; flex-direction: column; gap: 0) and the space it owns is expressible on banner-description, while the title and the controls already render the way the consuming theme wants them.

• Add nativePicker to DateTimeInput for browser and OS date/time pickers, with Astryx time fallbacks for seconds, custom increments, and preset options. Native fields follow DateInput's compact minimum sizing in fit-content layouts. (#5620)

• Let themes add typed Heading visual roles with a safe semantic-level fallback when the owning theme styles are unavailable. (#6026)

• RadioListItem and CheckboxListItem accept rich label and description (#5257) RadioListItem typed label and description as string while its sibling CheckboxListItem already typed label as ReactNode — so the same slot had two contracts, and an app whose option descriptions carry links could not type them on either component. Both now take ReactNode; the runtime already rendered it.

  RadioListItem gains the aria-label escape hatch CheckboxListItem established, with the same meaning: a plain-text accessible name for the control. The radio differs in one way worth knowing — it points at its visible label for its accessible name, so a rich label still names it from its own text, and aria-label is there to narrow a name that reads badly rather than to supply a missing one. aria-label now lands on the radio instead of the row <div>, where ARIA ignored it.

• Stepper: --step-connector-gap, so a theme can stop the on-track connector short of the indicator The on-track layouts draw the connector as one segment either side of the node. A theme that wants the track to leave a hole around the indicator had to reach the two segments separately, and they are only distinguishable by sibling position — which changes with indicator="none".

  One public var does it instead, declared on the Stepper root because component vars are root-owned: a theme writes stepper: {base: {'--step-connector-gap': '4px'}} and every connector inherits it. Astryx spends it on whichever side each segment faces the node from, so the pair leaves a symmetric hole and the caller never names the pieces. 0px by default: the shipped track still reads as one unbroken line.

  Measured in Chromium against a built theme override, reading painted pixels down a 12px segment:

  | value | clipped away | stepper height | | ------- | ------------- | -------------- | | 6px | 6px | unchanged | | -4px | 0 | unchanged | | 1rem | capped to 8px | unchanged | | 999px | capped to 8px | unchanged | | 10% | 1px (of 12px) | unchanged | | 50% | capped to 6px | unchanged |

  Four things that had to be true and are:

... (truncated)

Commits

• b92b076 chore: version packages for v0.5.4 (#6100)
• 8427807 fix(docsite): show DropdownMenuRadioGroup in properties preview (#5976)
• 5823b00 docs(Stepper): describe exported context accurately (#6088)
• ad49392 chore: version packages for v0.5.3 (#6087)
• e41e521 feat(core): add elevation prop to ToggleButton (#6037)
• b1fcbee feat(core): support custom Heading visual types (#6026)
• 18eec18 refactor(Popover): refine internal toggle API (#5793)
• 63a0bcd feat(core): let Stepper collapse itself in narrow containers (#5659)
• 8449e38 fix(core): add playground wrapper and defaults for LayoutPanel docsite previe...
• d305910 docs: gate theme-extensible axes on safe fallbacks (#6063)
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.11 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• See full diff in compare view

Updates @types/node from 26.4.0 to 26.5.0

Commits

• See full diff in compare view

Updates knip from 6.33.0 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Commits

• 4ffebb7 Release knip@6.34.0
• f0cf11d Assert counters in targeted regression tests
• 96ff2df Declare webpack directly instead of through @types/webpack
• c4e0f08 Update dependencies
• cc47061 Resolve Nuxt #shared imports from the shared directory (#1991)
• 462ae45 fix: compile files with workspace-scoped compilers (#1997)
• ab90e24 fix(cli): validate numeric options instead of passing NaN through (#1975)
• 964085d Set an explicit Bun test timeout
• 1c90b49 Make prop access consistent while at it
• f93ad09 Respect JSDoc tags on URL dependencies (resolve #1943)
• Additional commits viewable in compare view

Updates @ai-sdk/anthropic from 4.0.46 to 4.0.49

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.49

Patch Changes

• 65397d7: fix(anthropic): recognize dated Google Vertex Claude 4 model IDs when selecting model capabilities

4.0.48

Patch Changes

• 4d25a08: feat(anthropic): add fable 5.1 support
• Updated dependencies [6bcc0f8]
  • @​ai-sdk/provider-utils@​5.0.36

4.0.47

Patch Changes

• 5190b67: feat(provider): extend the FilesV4 interface with optional getFileMetadata, downloadFile (streaming), and deleteFile operations, plus abortSignal/headers call options and a { type: 'stream' } upload data variant; upload results now expose byteSize, createdAt, and expiresAt (also surfaced by the core uploadFile() helper, which now forwards abortSignal/headers); add postMultipartStreamToApi (streaming multipart uploads with deterministic part ordering and failure-path stream teardown), deleteFromApi, and createBinaryStreamResponseHandler to provider-utils
• Updated dependencies [5190b67]
  • @​ai-sdk/provider@​4.0.10
  • @​ai-sdk/provider-utils@​5.0.35

Commits

• 79b4ab8 Version Packages (#20192)
• 65397d7 fix(anthropic): recognize Vertex Claude 4 model IDs (#20233)
• 8a09c78 Version Packages (#20144)
• 4d25a08 feat(anthropic): add fable 5.1 support (#20141)
• 3bd0fcf Version Packages (#20126)
• 5190b67 feat(provider): add optional getFileMetadata/downloadFile/deleteFile to Files...
• See full diff in compare view

Updates @ai-sdk/code-mode from 1.0.42 to 1.0.50

Changelog

Sourced from @​ai-sdk/code-mode's changelog.

1.0.50

Patch Changes

• Updated dependencies [df6c009]
• Updated dependencies [6ee74a3]
• Updated dependencies [f13d371]
• Updated dependencies [d4485fe]
• Updated dependencies [4f201cc]
• Updated dependencies [8cdb2a7]
• Updated dependencies [0f2281e]
• Updated dependencies [fc8e8ac]
• Updated dependencies [ee8391e]
  • ai@7.0.93

1.0.49

Patch Changes

• Updated dependencies [a51cc94]
• Updated dependencies [d1904d3]
• Updated dependencies [84e5a79]
• Updated dependencies [a8e8ad0]
  • ai@7.0.92

1.0.48

Patch Changes

• Updated dependencies [802af1e]
  • ai@7.0.91

1.0.47

Patch Changes

• ai@7.0.90

1.0.46

Patch Changes

• Updated dependencies [5190b67]
  • ai@7.0.89

1.0.45

Patch Changes

• Updated dependencies [8b6b756]

... (truncated)

Commits

• 6359fd5 Version Packages (#20288)
• 34f3b79 Version Packages (#20250)
• 79b4ab8 Version Packages (#20192)
• 8a09c78 Version Packages (#20144)
• 3bd0fcf Version Packages (#20126)
• 70c2f4c Version Packages (#20059)
• 839575b Version Packages (#20044)
• acc9521 Version Packages (#20028)
• See full diff in compare view

Updates @ai-sdk/cohere from 4.0.35 to 4.0.37

Changelog

Sourced from @​ai-sdk/cohere's changelog.

4.0.37

Patch Changes

• Updated dependencies [6bcc0f8]
  • @​ai-sdk/provider-utils@​5.0.36

4.0.36

Patch Changes

• Updated dependencies [5190b67]
  • @​ai-sdk/provider@​4.0.10
  • @​ai-sdk/provider-utils@​5.0.35

Commits

• 8a09c78 Version Packages (#20144)
• 3bd0fcf Version Packages (#20126)
• See full diff in compare view

Updates @ai-sdk/google from 4...

Description has been truncated

[me2seeks]

PR 5176 Review

结论

APPROVE
28 个 minor/patch 依赖升级全部停留在声明的主线内（ai 7.0.85→7.0.93、@ai-sdk/* 各自 4.x/3.x/2.x 内、@astryxdesign 0.5.x、playwright 1.63、storybook 10.6），无意外大版本、无新增顶层包；lockfile 的增删均为 storybook 10.6 依赖重组（@storybook/csf-plugin、unplugin、webpack-virtual-modules、顶层 acorn 被移除或嵌套）与 @ai-sdk/provider 因 4.0.10 版本冲突产生的嵌套副本，属正常依赖解析结果。

发现

无

不确定性（不发到 GitHub 的疑虑）

• @ai-sdk/provider 从单一顶层 node_modules/@ai-sdk/provider 变成 9 个嵌套副本（node_modules/ai/node_modules/@ai-sdk/provider 等）。这是 npm 对 ai@7.0.93 与 @ai-sdk/*@4.0.x 声明的 @ai-sdk/provider@4.0.10 无法同时满足时的正常嵌套；未验证运行时会否同时加载多份 provider 代码（理论上嵌套各自独立、不互相 import），风险低。
• @types/node 26.4.0→26.5.0 为次版本内升级，但 Node 类型定义偶有破坏性小改；PR 未附 typecheck 结果，未本地复跑，风险低。
• lockfile 中 @storybook/react-vite 从 10.5.10 跳到 10.6.0 是 minor（10.x 内），但其移除的 unplugin/webpack-virtual-modules 是 storybook 内部依赖重构，未逐条核对 10.6.0 changelog，风险低。

---

✅ 对抗性审查（第一性原理 + 奥卡姆剃刀 + 证据核对）通过：未发现真实的 P0–P3 问题。@me2seeks 请把关是否 merge。