chore(deps): update all non-major dependencies

.github/workflows/autofix.yml

@@ -22,11 +22,11 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
       - name: Fix formatting
         run: pnpm format
       - name: Apply fixes

.github/workflows/e2e.yml

@@ -22,13 +22,13 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
 
       - name: Cache Playwright Browsers
         id: playwright-cache

.github/workflows/pr.yml

@@ -19,12 +19,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
       - name: Get base and head commits for `nx affected`
         uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
         with:
@@ -39,11 +39,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
       - name: Build Packages
         run: pnpm run build:all
       - name: Publish Previews
@@ -56,10 +56,10 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
       - name: Changeset Preview
-        uses: TanStack/config/.github/changeset-preview@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/changeset-preview@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main

.github/workflows/release.yml

@@ -21,12 +21,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
       - name: Run Tests
         run: pnpm run test:ci
 
@@ -41,20 +41,20 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: true
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
       - name: Build packages
         # Fresh, cache-bypassing build so dist/ is on disk when changeset
         # publish packs tarballs. A cached build can report success without
         # materializing dist/, shipping src-only packages (see 0.33.0-0.36.0).
         run: pnpm exec nx run-many --targets=build --exclude=examples/**,testing/** --skip-nx-cache
       - name: Run Changesets (version or publish)
         id: changesets
-        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           version: pnpm run changeset:version
           publish: pnpm run changeset:publish
@@ -80,6 +80,6 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Comment on PRs about release
         if: steps.changesets.outputs.published == 'true'
-        uses: TanStack/config/.github/comment-on-release@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/comment-on-release@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
         with:
           published-packages: ${{ steps.changesets.outputs.publishedPackages }}

.github/workflows/sync-models.yml

@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: true # sync job pushes generated model updates
 
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@190f659075ff0845850e330883eb26d7ffd0671f # main
+        uses: TanStack/config/.github/setup@bfa16483f70e69805e1ea4eee29988b133d2aa46 # main
 
       - name: Fetch and sync model metadata
         run: pnpm generate:models

.github/workflows/zizmor.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
         with:
           advanced-security: false
           annotations: true

codemods/package.json

@@ -14,7 +14,7 @@
   "devDependencies": {
     "@types/jscodeshift": "^17.1.1",
     "@types/node": "^24.10.1",
-    "jscodeshift": "^17.1.1",
+    "jscodeshift": "^17.4.0",
     "prettier": "^3.7.4",
     "typescript": "5.9.3",
     "vitest": "^4.1.10"

examples/ag-ui/package.json

@@ -30,8 +30,8 @@
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.2",
-    "concurrently": "^9.1.2",
-    "dotenv": "^17.2.3",
+    "concurrently": "^9.2.4",
+    "dotenv": "^17.4.2",
     "tailwindcss": "^4.1.18",
     "typescript": "5.9.3",
     "vite": "^7.3.3"

examples/ag-ui/servers/go/go.mod

@@ -1,3 +1,3 @@
 module github.com/tanstack/ai/examples/ag-ui/servers/go
 
-go 1.22
+go 1.26.5

examples/ag-ui/servers/rust/Cargo.toml

@@ -4,15 +4,15 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
-async-stream = "0.3"
-axum = "0.8"
-futures-util = "0.3"
-reqwest = { version = "0.12", default-features = false, features = [
+async-stream = "0.3.6"
+axum = "0.8.9"
+futures-util = "0.3.33"
+reqwest = { version = "0.13.4", default-features = false, features = [
   "json",
   "rustls-tls",
   "stream",
 ] }
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
-tokio-stream = "0.1"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
+tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
+tokio-stream = "0.1.19"

examples/sandbox-cloudflare/Dockerfile

@@ -10,7 +10,7 @@
 #
 # Pin the base tag to the @cloudflare/sandbox version in package.json so the
 # control-server protocol matches the SDK the Worker is built against.
-FROM docker.io/cloudflare/sandbox:0.12.1
+FROM docker.io/cloudflare/sandbox:0.12.4
 
 # Claude Code CLI (HARNESS=claude-code). `node` + `npm` are already on the base
 # image. `--include=optional` is required: the CLI's native binary ships as a

examples/sandbox-cloudflare/package.json

@@ -13,7 +13,7 @@
     "cf-typegen": "wrangler types"
   },
   "dependencies": {
-    "@cloudflare/sandbox": "^0.12.1",
+    "@cloudflare/sandbox": "^0.12.4",
     "@tanstack/ai": "workspace:*",
     "@tanstack/ai-claude-code": "workspace:*",
     "@tanstack/ai-codex": "workspace:*",
@@ -22,8 +22,8 @@
     "@tanstack/ai-sandbox": "workspace:*",
     "@tanstack/ai-sandbox-cloudflare": "workspace:*",
     "@tanstack/ai-sandbox-local-process": "workspace:*",
-    "@tanstack/react-router": "^1.158.4",
-    "@tanstack/react-start": "^1.159.0",
+    "@tanstack/react-router": "^1.170.18",
+    "@tanstack/react-start": "^1.168.32",
     "lucide-react": "^0.561.0",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
@@ -32,19 +32,19 @@
     "rehype-raw": "^7.0.0",
     "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
-    "zod": "^4.2.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cloudflare/vite-plugin": "^1.42.1",
+    "@cloudflare/vite-plugin": "^1.46.0",
     "@tailwindcss/vite": "^4.1.18",
-    "@tanstack/router-plugin": "^1.158.4",
+    "@tanstack/router-plugin": "^1.168.23",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.2",
     "tailwindcss": "^4.1.18",
     "typescript": "5.9.3",
     "vite": "^7.3.3",
-    "wrangler": "^4.103.0"
+    "wrangler": "^4.113.0"
   }
 }

examples/sandbox-web/package.json

@@ -23,8 +23,8 @@
     "@tanstack/ai-sandbox-docker": "workspace:*",
     "@tanstack/ai-sandbox-local-process": "workspace:*",
     "@tanstack/ai-sandbox-vercel": "workspace:*",
-    "@tanstack/react-router": "^1.158.4",
-    "@tanstack/react-start": "^1.159.0",
+    "@tanstack/react-router": "^1.170.18",
+    "@tanstack/react-start": "^1.168.32",
     "lucide-react": "^0.561.0",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
@@ -33,16 +33,16 @@
     "rehype-raw": "^7.0.0",
     "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
-    "zod": "^4.2.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.1.18",
-    "@tanstack/router-plugin": "^1.158.4",
+    "@tanstack/router-plugin": "^1.168.23",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.2",
-    "dotenv": "^17.2.3",
+    "dotenv": "^17.4.2",
     "nitro": "3.0.260610-beta",
     "tailwindcss": "^4.1.18",
     "typescript": "5.9.3",

examples/ts-angular-chat/package.json

@@ -19,16 +19,16 @@
     "@tanstack/ai-angular": "workspace:*",
     "@tanstack/ai-client": "workspace:*",
     "@tanstack/ai-openai": "workspace:*",
-    "rxjs": "^7.8.0",
-    "zod": "^4.2.0",
-    "zone.js": "^0.15.0"
+    "rxjs": "^7.8.2",
+    "zod": "^4.4.3",
+    "zone.js": "^0.16.2"
   },
   "devDependencies": {
-    "@analogjs/vite-plugin-angular": "^2.6.2",
+    "@analogjs/vite-plugin-angular": "^2.6.3",
     "@angular/build": "^21.2.0",
     "@tailwindcss/vite": "^4.1.18",
     "@types/node": "^24.10.1",
-    "dotenv": "^17.2.3",
+    "dotenv": "^17.4.2",
     "typescript": "5.9.3",
     "vite": "^7.3.3"
   }

examples/ts-code-mode-web/package.json

@@ -10,11 +10,11 @@
     "test:types": "tsc --noEmit"
   },
   "dependencies": {
-    "@jitl/quickjs-wasmfile-debug-asyncify": "^0.31.0",
-    "@jitl/quickjs-wasmfile-debug-sync": "^0.31.0",
-    "@jitl/quickjs-wasmfile-release-asyncify": "^0.31.0",
-    "@jitl/quickjs-wasmfile-release-sync": "^0.31.0",
-    "@radix-ui/react-collapsible": "^1.1.2",
+    "@jitl/quickjs-wasmfile-debug-asyncify": "^0.32.0",
+    "@jitl/quickjs-wasmfile-debug-sync": "^0.32.0",
+    "@jitl/quickjs-wasmfile-release-asyncify": "^0.32.0",
+    "@jitl/quickjs-wasmfile-release-sync": "^0.32.0",
+    "@radix-ui/react-collapsible": "^1.1.18",
     "@tailwindcss/vite": "^4.1.18",
     "@tanstack/ai": "workspace:*",
     "@tanstack/ai-anthropic": "workspace:*",
@@ -28,32 +28,32 @@
     "@tanstack/ai-ollama": "workspace:*",
     "@tanstack/ai-openai": "workspace:*",
     "@tanstack/ai-react": "workspace:*",
-    "@tanstack/react-router": "^1.158.4",
-    "@tanstack/react-start": "^1.159.0",
-    "@tanstack/router-plugin": "^1.158.4",
-    "@tanstack/store": "^0.8.0",
-    "framer-motion": "^11.15.0",
+    "@tanstack/react-router": "^1.170.18",
+    "@tanstack/react-start": "^1.168.32",
+    "@tanstack/router-plugin": "^1.168.23",
+    "@tanstack/store": "^0.11.0",
+    "framer-motion": "^11.18.2",
     "highlight.js": "^11.11.1",
-    "isolated-vm": "^6.0.2",
+    "isolated-vm": "^6.1.2",
     "lucide-react": "^0.561.0",
     "marked": "^15.0.6",
     "nitro": "3.0.260610-beta",
-    "puppeteer": "^24.34.0",
-    "quickjs-emscripten": "^0.31.0",
-    "quickjs-emscripten-core": "^0.31.0",
+    "puppeteer": "^24.43.1",
+    "quickjs-emscripten": "^0.32.0",
+    "quickjs-emscripten-core": "^0.32.0",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
     "react-markdown": "^10.1.0",
-    "recharts": "^2.15.0",
+    "recharts": "^2.15.4",
     "rehype-highlight": "^7.0.2",
     "rehype-raw": "^7.0.0",
     "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
     "tailwindcss": "^4.1.18",
-    "zod": "^4.2.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tanstack/devtools-vite": "^0.5.3",
+    "@tanstack/devtools-vite": "^0.8.3",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",