…dates
Bumps the npm_and_yarn group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo) | `2.5.4` | `2.9.14` |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `3.0.7` | `4.0.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `3.2.6` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.7` | `7.3.5` |
| [next](https://github.com/vercel/next.js) | `15.3.8` | `15.5.18` |
Updates `turbo` from 2.5.4 to 2.9.14
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.5.4...v2.9.14)
Updates `@ai-sdk/provider-utils` from 3.0.7 to 4.0.0
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@4.0.0/packages/provider-utils)
Updates `vitest` from 3.2.4 to 3.2.6
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest)
Updates `vite` from 7.1.7 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite)
Updates `next` from 15.3.8 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.3.8...v15.5.18)
Updates `js-cookie` from 3.0.5 to 3.0.8
- [Release notes](https://github.com/js-cookie/js-cookie/releases)
- [Commits](js-cookie/js-cookie@v3.0.5...v3.0.8)
Updates `undici` from 6.21.3 to 6.27.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v6.27.0)
---
updated-dependencies:
- dependency-name: turbo
dependency-version: 2.9.14
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: "@ai-sdk/provider-utils"
dependency-version: 4.0.0
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: vitest
dependency-version: 3.2.6
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 7.3.5
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: next
dependency-version: 15.5.18
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: js-cookie
dependency-version: 3.0.8
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: undici
dependency-version: 6.27.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
github-actions
Bot
added
Dashboard
Bumps the npm_and_yarn group with 5 updates in the / directory:
2.5.42.9.143.0.74.0.03.2.43.2.67.1.77.3.515.3.815.5.18Updates
turbofrom 2.5.4 to 2.9.14Release notes
Sourced from turbo's releases.
... (truncated)
Commits
fc62fe0publish 2.9.14 to registryfb8c9aechore: Release 2.9.13 (#12803)e8e629dfix: Avoid project-local Yarn during detection (#12801)91c90cbfix: Harden VS Code extension command execution (#12800)84f4508fix: Validate auth callback state (#12802)1779ad7Removed unneeded import form hash creation script in docs (#12799)71f8c90test: Validate lockfiles without dependency downloads (#12789)5fcb960ci: Scope GitHub Actions caches by branch (#12788)4cf9fabci: Usepull_requestfor PR title linting (#12787)859c629fix: Restore docs mobile menu (#12782)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for turbo since your current version.
Updates
@ai-sdk/provider-utilsfrom 3.0.7 to 4.0.0Release notes
Sourced from @ai-sdk/provider-utils's releases.
Changelog
Sourced from @ai-sdk/provider-utils's changelog.
... (truncated)
Commits
e982ebdv6 release (#11379)6da20e2Version Packages (beta) (#11361)fa5af67Version Packages (beta) (#11343)351e68bVersion Packages (beta) (#11340)378302fVersion Packages (beta) (#11335)5d5ca67Version Packages (beta) (#11333)50b70d6feat(anthropic): add programmatic tool calling (#11262)0c034f4Version Packages (beta) (#11314)d427284feat: image editing (#10281)d8ae642Version Packages (beta) (#11231)Updates
vitestfrom 3.2.4 to 3.2.6Release notes
Sourced from vitest's releases.
Commits
b6d56f8chore: release v3.2.616f120dfix: pin last supported vite-node version2cbad0achore: release v3.2.5385a1aefix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...af88b1ffeat(api): addallowWriteandallowExecoptions toapi[backport to v3]...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.
Updates
vitefrom 7.1.7 to 7.3.5Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
077945crelease: v7.3.58a6a0c9chore: skip v7.3.4 release8c18556fix: backport #22572, reject windows alternate paths (#22574)f20d64bfix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...ca31424release: v7.3.35ab51c0fix: avoid destructure lowering for newer safari (#22346)cc383e0release: v7.3.209d8c90fix: avoid path traversal with optimize deps sourcemap handler (#22161)f8103ccfix: checkserver.fsafter stripping query as well (#22160)19db0f2fix: backport #22159, apply server.fs check to env transport (#22162)Updates
nextfrom 15.3.8 to 15.5.18Release notes
Sourced from next's releases.
Commits
9ff92cev15.5.1800ebe23[backport] Disable build caches for production/staging/force-preview deploys ...62c97abv15.5.17423623aTurbopack: Match proxy matchers with webpack implementation (#93594)fa78739Turbopack: Fix middleware matcher suffix (#93590)36e62c6[backport] Turbopack: more strict vergen setup (#93588)36589b5[backport][test] Pin package manager to patch versions (#93596)ad6fd4ev15.5.1679d7dffIgnore malformed CSP nonce headers (#103)c4f6908router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.
Updates
js-cookiefrom 3.0.5 to 3.0.8Release notes
Sourced from js-cookie's releases.
Commits
d7a1096Craft v3.0.8 release248e685Use existing Chrome with puppeteerfc04269Remove QUnit related workaround in Grunt config265a685Tidy up package lock file478e591Disable Node deprecation DEP0044 for release workflow331d524Fix node version config for E2E test job11d773dEnsure ECMAScript compatibilityd788646Removeenginesproperty from packagee7d9a4dFix typo in test assertion messageb5fca24Make credentials use explicit in release workflowMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.
Updates
undicifrom 6.21.3 to 6.27.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
551138cBumped v6.27.0 (#5431)b7f252eBackport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)25efa44fix(cookies): preserve values and parse SameSite strictlyf4c31d6fix: guard idle socket validation to skip fresh sockets (#5400)768beacBumped v6.26.0 (#5323)7917b25fix: validate EOF for chunked h1 responses (#5308)3420499Bumped v6.25.0 (#5029)d7a1e55feat: add configurable maxPayloadSize for WebSocket (#4955)a9d1848Do not mark v6.x releases as latest0126586Ignore local agent configuration filesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
PR-Codex overview
This PR focuses on updating various package dependencies across multiple projects to their latest versions, improving compatibility and possibly fixing bugs.
Detailed summary
vitefrom7.1.7to7.3.5in multiple packages.vitestfrom3.2.4to3.2.6in several packages.nextfrom15.3.8to15.5.18in several apps.turbofrom2.5.4to2.9.14.@ai-sdk/provider-utilsfrom3.0.7to4.0.0.zodfrom3.25.75to4.1.12in various dependencies.