chore(deps): update npm minor and patch dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-agent-sdk	^0.3.218 → ^0.3.237
@cloudflare/puppeteer (source)	^1.1.0 → ^1.4.0
@cloudflare/vitest-pool-workers (source)	^0.18.8 → ^0.22.0
@cloudflare/workers-types	^5.20260724.1 → ^5.20260820.1
@hono/node-server	^2.0.11 → ^2.1.1
@lovable.dev/vite-plugin-dev-server-bridge (source)	1.2.1 → 1.3.2
@lovable.dev/vite-plugin-hmr-gate (source)	1.1.4 → 1.8.0
@lovable.dev/vite-tanstack-config (source)	2.7.7 → 2.15.1
@modelcontextprotocol/sdk (source)	1.29.0 → 1.30.0
@octokit/core	^7.0.6 → ^7.0.7
@posthog/cli (source)	0.9.1 → 0.13.0
@radix-ui/react-accordion (source)	^1.2.18 → ^1.2.20
@radix-ui/react-alert-dialog (source)	^1.1.21 → ^1.1.23
@radix-ui/react-aspect-ratio (source)	^1.1.13 → ^1.1.15
@radix-ui/react-avatar (source)	^1.2.4 → ^1.2.6
@radix-ui/react-checkbox (source)	^1.3.9 → ^1.3.11
@radix-ui/react-collapsible (source)	^1.1.18 → ^1.1.20
@radix-ui/react-context-menu (source)	^2.3.5 → ^2.3.7
@radix-ui/react-dialog (source)	^1.1.21 → ^1.1.23
@radix-ui/react-dropdown-menu (source)	^2.1.22 → ^2.1.24
@radix-ui/react-hover-card (source)	^1.1.21 → ^1.1.23
@radix-ui/react-label (source)	^2.1.13 → ^2.1.15
@radix-ui/react-menubar (source)	^1.1.22 → ^1.1.24
@radix-ui/react-navigation-menu (source)	^1.2.20 → ^1.2.22
@radix-ui/react-popover (source)	^1.1.21 → ^1.1.23
@radix-ui/react-progress (source)	^1.1.14 → ^1.1.16
@radix-ui/react-radio-group (source)	^1.4.5 → ^1.4.7
@radix-ui/react-scroll-area (source)	^1.2.16 → ^1.2.18
@radix-ui/react-select (source)	^2.3.5 → ^2.3.7
@radix-ui/react-separator (source)	^1.1.13 → ^1.1.15
@radix-ui/react-slider (source)	^1.4.5 → ^1.4.7
@radix-ui/react-slot (source)	^1.3.1 → ^1.3.3
@radix-ui/react-switch (source)	^1.3.5 → ^1.3.7
@radix-ui/react-tabs (source)	^1.1.19 → ^1.1.21
@radix-ui/react-toggle (source)	^1.1.16 → ^1.1.18
@radix-ui/react-toggle-group (source)	^1.1.17 → ^1.1.19
@radix-ui/react-tooltip (source)	^1.2.14 → ^1.2.16
@scalar/api-reference-react (source)	^0.9.59 → ^0.9.63
@sentry/node (source)	^10.67.0 → ^10.70.0
@sentry/react (source)	^10.67.0 → ^10.70.0
@tanstack/react-router (source)	^1.170.18 → ^1.170.31
@tanstack/react-start (source)	^1.168.32 → ^1.168.48
@tanstack/router-plugin (source)	^1.168.23 → ^1.168.34
@types/pg (source)	^8.20.0 → ^8.23.1
@types/react (source)	^19.2.17 → ^19.2.18
@types/react-dom (source)	^19.2.3 → ^19.2.4
@types/semver (source)	^7.7.1 → ^7.8.0
@vitest/coverage-v8 (source)	^4.1.10 → ^4.1.11
agents (source)	^0.19.0 → ^0.21.0
esbuild	^0.28.1 → ^0.28.2
eslint (source)	^10.8.0 → ^10.8.1
eslint-plugin-react-refresh	^0.5.3 → ^0.5.4
fumadocs-core	^16.12.1 → ^16.14.5
fumadocs-mdx	^15.2.0 → ^15.3.0
globals	^17.7.0 → ^17.11.0
hono (source)	^4.12.31 → ^4.13.3
hono (source)	^4.12.34 → ^4.13.3
input-otp (source)	^1.4.2 → ^1.5.0
motion	^12.42.2 → ^12.43.0
node-addon-api	^8.9.0 → ^8.9.2
npm (source)	10.9.8 → 10.9.9
pg (source)	^8.22.0 → ^8.23.0
playwright (source)	^1.61.1 → ^1.62.1
posthog-js (source)	^1.409.3 → ^1.418.5
posthog-node (source)	^5.46.1 → ^5.49.1
react-hook-form (source)	^7.82.0 → ^7.85.0
react-resizable-panels (source)	^4.12.2 → ^4.12.3
sonner (source)	^2.0.7 → ^2.0.8
tar	^7.5.21 → ^7.5.22
tsx (source)	4.22.5 → 4.23.12
tsx (source)	^4.23.1 → ^4.23.12
turbo (source)	^2.10.6 → ^2.10.11
typescript-eslint (source)	^8.65.0 → ^8.67.0
vite (source)	^8.1.5 → ^8.2.2
vitest (source)	^4.1.10 → ^4.1.11
web-tree-sitter (source)	^0.20.8 → ^0.26.12
wrangler (source)	^4.115.0 → ^4.124.0
wrangler (source)	^4.114.0 → ^4.124.0
ws	^8.21.1 → ^8.21.3

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.237

Compare Source

• Updated to parity with Claude Code v2.1.237

v0.3.236

Compare Source

• PostToolUse hooks can return hookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that result

v0.3.235

Compare Source

• Updated to parity with Claude Code v2.1.235

v0.3.234

Compare Source

• Removed unused bypass_permissions_disabled from ExitReason type; the value was never emitted — TypeScript consumers with an explicit case branch get a compile error on upgrade (runtime unaffected)
• Updated the ApiKeySource type to include the values system/init actually reports (ANTHROPIC_API_KEY, apiKeyHelper, /login managed key, none)
• vcs_state_changed events report the directory the shell finished in (an inner cd is reflected)
• A peer origin injected by the host may declare the sending session's permission class (fromMode) so a same-class message is delivered to a recipient that runs without asking
• SDKSystemMessage (system/init) gains an optional effort field: the session's applied effort level, or null when none is sent. Set on Remote Control bridge init frames

v0.3.233

Compare Source

• Notification hooks now fire for pending permission prompts on the SDK path, matching the interactive REPL behavior
• Todo/task-tracking tools (TaskCreate/TaskGet/TaskUpdate/TaskList, TodoWrite) are no longer in the default tool surface on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in the tools option or reference them in allowedTools (or set CLAUDE_CODE_ENABLE_TODO_TOOLS=1) to keep them

v0.3.232

Compare Source

• Subagent MCP tool_result frames whose result carries _meta now emit tool_use_result as { content, _meta } (matching main-loop frames) instead of a bare value
• /context result messages now carry a structured context_usage payload (new SDKContextUsage type), so consumers can render the context-usage card without parsing the markdown table
• vcs_state_changed events now populate the branch field for push operations, sourced from the pushed ref

v0.3.231

Compare Source

• Updated to parity with Claude Code v2.1.231

v0.3.229

Compare Source

• Added terminal_slash_commands to the system init message so Remote Control clients can hide terminal-oriented commands
• Changed conversations whose messages alone exceed the API's 32 MB limit to end the turn with terminal_reason "api_error" instead of "image_error"; StopFailure error_details is "request_body_over_limit: …"

v0.3.228

Compare Source

• Agent tool results (AgentOutput): usage.output_tokens_details is now carried through

v0.3.227

Compare Source

• Updated to parity with Claude Code v2.1.227

v0.3.226

Compare Source

• Updated to parity with Claude Code v2.1.226

v0.3.225

Compare Source

• Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

v0.3.224

Compare Source

• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
• Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
• Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
• Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

v0.3.223

Compare Source

• Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
• Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
• Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
• Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

v0.3.222

Compare Source

• Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

v0.3.221

Compare Source

• Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
• Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

v0.3.220

Compare Source

• Updated to parity with Claude Code v2.1.220

v0.3.219

Compare Source

• Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
• Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
• Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
• Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
• Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
• Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

cloudflare/puppeteer (@​cloudflare/puppeteer)

v1.4.0

Compare Source

v1.3.0

Compare Source

What's Changed

• Enable trusted publishing of packages by @​meddulla in #​231
• feat(cloudflare): add browser launch option by @​meddulla in #​232

Full Changelog: cloudflare/puppeteer@v1.2.0...v1.3.0

v1.2.0

Compare Source

What's Changed

• Rename Browser Rendering to Browser Run in README and package.json by @​jonnyparris in #​200
• feat(cloudflare): typed Cloudflare.* CDP commands (handoff, session, live view) by @​jonnyparris and @​meddulla in #​223

Full Changelog: cloudflare/puppeteer@v1.1.0...v1.2.0

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.22.0

Compare Source

Minor Changes

• #​13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

  @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

  If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

• #​15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

• #​15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

  When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

• #​15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

  inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

• #​15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

• #​15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

  • wrangler@​4.124.0
  • miniflare@5.20260815.0-alpha

v0.21.3

Compare Source

Patch Changes

• Updated dependencies [b8fd112, f0f2054, 339509d]:
  • miniflare@5.20260811.1-alpha
  • wrangler@​4.123.0

v0.21.2

Compare Source

Patch Changes

• #​15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

  Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

• #​15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

  workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

  The redundant nodejs_compat and nodejs_compat_v2 flags are now dropped when starting the runtime, which has no effect on the resulting Worker because the compatibility date enables both anyway. no_nodejs_compat and no_nodejs_compat_v2 still switch Node.js compatibility off, and a flag specified alongside its own opt-out is left alone so that workerd still reports those as contradictory.

• #​15123 [d0c976c](https://redirect.githu

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	5bcb4d4	Aug 23 2026, 10:37 AM

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.