Skip to content

deps: bump the production-dependencies group with 6 updates - #147

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-c3f1560b3f
Sep 28, 2026
Merged

deps: bump the production-dependencies group with 6 updates#147
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-c3f1560b3f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 6 updates:

Package From To
@assistant-ui/react 0.15.21 0.15.22
@assistant-ui/react-markdown 0.14.16 0.14.17
@supabase/supabase-js 2.116.0 2.117.2
@tanstack/react-query 5.103.1 5.103.2
@tauri-apps/plugin-log 2.9.1 2.9.2
@tauri-apps/plugin-updater 2.11.0 2.12.0

Updates @assistant-ui/react from 0.15.21 to 0.15.22

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.22

Patch Changes

  • #8032 d096801 - fix: type the assistant transport request body that prepareSendCommandsRequest receives; its fields are no longer unknown in @assistant-ui/react, and threadId is an optional string, absent when a resume has no remote id, instead of string | null (@​rupic-app)

  • #8342 aa0f338 - feat: useAssistantTransportRuntime accepts cloud: Assistant Cloud backs the thread list and every request carries the cloud thread id; without cloud, NEXT_PUBLIC_ASSISTANT_BASE_URL selects Assistant Cloud, as it does for useLocalRuntime. adapters.history, which this runtime never read, is deprecated (@​okisdev)

  • #7731 455e2ac - fix: lock the current scroll container after reasoning content or its ancestor chain changes (@​Kinfe123)

  • #7730 af49e91 - fix: prevent stale message hover updates after unmount (@​Kinfe123)

  • #7737 6cc0bee - fix: scope selection toolbars to their owning thread (@​Kinfe123)

  • #8339 967de5d - feat: CloudRendererHost draws a stored conversation in the Assistant Cloud dashboard's As shown view with the app's own components; a read only thread now reports itself disabled, so its composer renders disabled, and ignores composer input instead of throwing (@​okisdev)

  • #8030 e8fac8d - feat: show a message with uploading attachments in the thread while it is being sent (@​okisdev)

    MessagePrimitive.Attachments now hands its render function Attachment rather than CompleteAttachment, because the row of a message that is still being sent shows attachments that are still uploading. a render function that reads attachment.content should check attachment.status.type === "complete" first.

  • #7877 83f5354 - fix: honor registered data-part fallbacks on native MessageContent and grouped parts (@​Kinfe123)

  • #7760 84e0cf4 - fix: emit declarations from one TypeScript program so two builds of the same commit produce the same .d.ts (@​okisdev)

    aui-build now emits the unbundled .d.ts output in one TypeScript pass over the whole package, so two builds of the same commit produce identical declarations; the per-module emit it replaced followed the bundler's load order and let union member order, alias visibility and import specifiers move between builds. Declarations import barrels as the source does and keep import type; the exported types are unchanged. A /// <reference> directive that must reach the published declarations now carries preserve="true" in the source.

  • #7838 3d01501 - fix: every distribution re-exports the same shared surface from @assistant-ui/core. @assistant-ui/react-ink gains ReadonlyThreadProvider, ToolCallMessagePartStatus, groupPartByType, GroupByContext, VoiceSessionState, the external store runtime (useExternalStoreRuntime, useExternalMessageConverter, their adapters and options), the message queue, the tool approval types, the generative UI renderer and the cloud thread list hooks; @assistant-ui/react-native gains VoiceSessionState, the cloud thread list hooks, the generative UI renderer and the runtime state and adapter types the web package already carried; @assistant-ui/react gains MessageRole, RunConfig, RuntimeCapabilities, RemoteThreadListOptions, ThreadsState, JoinStrategy, TitleGenerationAdapter, createSimpleTitleAdapter and ChainOfThoughtPartByIndexProvider. (@​okisdev)

  • #7520 2171a8e - fix(react): attach the ExportMarkdown download anchor to the document so Firefox starts the download (@​Kinfe123)

  • #8010 1c86c4c - fix: prevent disabled attachment dropzones from navigating to dropped files. (@​Kinfe123)

  • #7733 e2f1306 - fix: clear attachment drag state when the dropzone is disabled (@​Kinfe123)

  • #7897 16ef5b3 - fix(react): stop a pending bottom scroll from hijacking keyboard-driven content growth (@​Kinfe123)

  • #7762 4928364 - fix: resolve component registries by own keys only, so a component, tool or data part name that only Object.prototype has (toString, constructor, __proto__) takes the Fallback or GenerativeUIRenderError path instead of rendering the inherited built-in (@​okisdev)

  • #7725 258ad13 - fix: expose feedback submission state to assistive technology (@​rupic-app)

  • #7981 0252c69 - feat: name the runtime state types ThreadRuntimeState, MessageRuntimeState, ComposerRuntimeState, AttachmentRuntimeState and ThreadListItemRuntimeState (@​okisdev)

    these are the states ThreadRuntime, MessageRuntime, ComposerRuntime, AttachmentRuntime and ThreadListItemRuntime return from getState(), now exported by all three distributions; @assistant-ui/react-native and @assistant-ui/react-ink had no name for them. in @assistant-ui/react, ThreadState, MessageState, ComposerState, AttachmentState and ThreadListItemState still name these runtime states but are deprecated: from 0.16 they name the store states useAuiState reads, as they already do in @assistant-ui/react-native and @assistant-ui/react-ink. code that annotates a runtime's getState() result should move to the new names.

  • #8149 1b1ff55 - fix(react): keep the selection toolbar in sync after a right-click, so a context menu that swallows the mouseup no longer leaves it showing (and quoting) the previous selection (@​samdickson22)

  • #8065 2caacad - feat: a tool UI can record what the user did on its tool call with unstable_recordInteraction, kept on the part as unstable_interactions and stored in cloud history; the answer to a human input request is recorded once the runtime accepts it, the local runtime persists records and keeps them out of model input, external stores receive them through unstable_onRecordToolInteraction, and readonly threads ignore them (@​okisdev)

  • #7068 4b069f9 - fix: Use successful Standard Schema output for tool execution and model output. Keep the original arguments for validation errors and stored tool calls. (@​ephraimduncan)

  • #7777 c51ba8f - feat(core): let typed text enter a connected voice session through sendText (@​okisdev)

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.22

Patch Changes

  • #8032 d096801 - fix: type the assistant transport request body that prepareSendCommandsRequest receives; its fields are no longer unknown in @assistant-ui/react, and threadId is an optional string, absent when a resume has no remote id, instead of string | null (@​rupic-app)

  • #8342 aa0f338 - feat: useAssistantTransportRuntime accepts cloud: Assistant Cloud backs the thread list and every request carries the cloud thread id; without cloud, NEXT_PUBLIC_ASSISTANT_BASE_URL selects Assistant Cloud, as it does for useLocalRuntime. adapters.history, which this runtime never read, is deprecated (@​okisdev)

  • #7731 455e2ac - fix: lock the current scroll container after reasoning content or its ancestor chain changes (@​Kinfe123)

  • #7730 af49e91 - fix: prevent stale message hover updates after unmount (@​Kinfe123)

  • #7737 6cc0bee - fix: scope selection toolbars to their owning thread (@​Kinfe123)

  • #8339 967de5d - feat: CloudRendererHost draws a stored conversation in the Assistant Cloud dashboard's As shown view with the app's own components; a read only thread now reports itself disabled, so its composer renders disabled, and ignores composer input instead of throwing (@​okisdev)

  • #8030 e8fac8d - feat: show a message with uploading attachments in the thread while it is being sent (@​okisdev)

    MessagePrimitive.Attachments now hands its render function Attachment rather than CompleteAttachment, because the row of a message that is still being sent shows attachments that are still uploading. a render function that reads attachment.content should check attachment.status.type === "complete" first.

  • #7877 83f5354 - fix: honor registered data-part fallbacks on native MessageContent and grouped parts (@​Kinfe123)

  • #7760 84e0cf4 - fix: emit declarations from one TypeScript program so two builds of the same commit produce the same .d.ts (@​okisdev)

    aui-build now emits the unbundled .d.ts output in one TypeScript pass over the whole package, so two builds of the same commit produce identical declarations; the per-module emit it replaced followed the bundler's load order and let union member order, alias visibility and import specifiers move between builds. Declarations import barrels as the source does and keep import type; the exported types are unchanged. A /// <reference> directive that must reach the published declarations now carries preserve="true" in the source.

  • #7838 3d01501 - fix: every distribution re-exports the same shared surface from @assistant-ui/core. @assistant-ui/react-ink gains ReadonlyThreadProvider, ToolCallMessagePartStatus, groupPartByType, GroupByContext, VoiceSessionState, the external store runtime (useExternalStoreRuntime, useExternalMessageConverter, their adapters and options), the message queue, the tool approval types, the generative UI renderer and the cloud thread list hooks; @assistant-ui/react-native gains VoiceSessionState, the cloud thread list hooks, the generative UI renderer and the runtime state and adapter types the web package already carried; @assistant-ui/react gains MessageRole, RunConfig, RuntimeCapabilities, RemoteThreadListOptions, ThreadsState, JoinStrategy, TitleGenerationAdapter, createSimpleTitleAdapter and ChainOfThoughtPartByIndexProvider. (@​okisdev)

  • #7520 2171a8e - fix(react): attach the ExportMarkdown download anchor to the document so Firefox starts the download (@​Kinfe123)

  • #8010 1c86c4c - fix: prevent disabled attachment dropzones from navigating to dropped files. (@​Kinfe123)

  • #7733 e2f1306 - fix: clear attachment drag state when the dropzone is disabled (@​Kinfe123)

  • #7897 16ef5b3 - fix(react): stop a pending bottom scroll from hijacking keyboard-driven content growth (@​Kinfe123)

  • #7762 4928364 - fix: resolve component registries by own keys only, so a component, tool or data part name that only Object.prototype has (toString, constructor, __proto__) takes the Fallback or GenerativeUIRenderError path instead of rendering the inherited built-in (@​okisdev)

  • #7725 258ad13 - fix: expose feedback submission state to assistive technology (@​rupic-app)

  • #7981 0252c69 - feat: name the runtime state types ThreadRuntimeState, MessageRuntimeState, ComposerRuntimeState, AttachmentRuntimeState and ThreadListItemRuntimeState (@​okisdev)

    these are the states ThreadRuntime, MessageRuntime, ComposerRuntime, AttachmentRuntime and ThreadListItemRuntime return from getState(), now exported by all three distributions; @assistant-ui/react-native and @assistant-ui/react-ink had no name for them. in @assistant-ui/react, ThreadState, MessageState, ComposerState, AttachmentState and ThreadListItemState still name these runtime states but are deprecated: from 0.16 they name the store states useAuiState reads, as they already do in @assistant-ui/react-native and @assistant-ui/react-ink. code that annotates a runtime's getState() result should move to the new names.

  • #8149 1b1ff55 - fix(react): keep the selection toolbar in sync after a right-click, so a context menu that swallows the mouseup no longer leaves it showing (and quoting) the previous selection (@​samdickson22)

  • #8065 2caacad - feat: a tool UI can record what the user did on its tool call with unstable_recordInteraction, kept on the part as unstable_interactions and stored in cloud history; the answer to a human input request is recorded once the runtime accepts it, the local runtime persists records and keeps them out of model input, external stores receive them through unstable_onRecordToolInteraction, and readonly threads ignore them (@​okisdev)

  • #7068 4b069f9 - fix: Use successful Standard Schema output for tool execution and model output. Keep the original arguments for validation errors and stored tool calls. (@​ephraimduncan)

... (truncated)

Commits
  • f008537 chore: update versions (#7724)
  • 967de5d feat(react): CloudRendererHost draws a stored conversation in the dashboard's...
  • 1b1ff55 fix(react): keep the selection toolbar quoting what is selected after a right...
  • 2caacad feat(core): record the user's interactions with a tool ui on its tool call (#...
  • e8fac8d feat(core): show a message with uploading attachments while it is sent (#8030)
  • d096801 fix: type the assistant transport body that prepareSendCommandsRequest receiv...
  • 1c86c4c fix(react): claim file drops when attachment dropzone is disabled (#8010)
  • 0252c69 feat: name the runtime state types and deprecate their old names (#7981)
  • 15937b8 test(react): skip the initial viewport scroll in the MessageRoot hover test (...
  • 16ef5b3 fix(react): cancel pending bottom scroll on a keyboard gesture (#7897)
  • Additional commits viewable in compare view

Updates @assistant-ui/react-markdown from 0.14.16 to 0.14.17

Release notes

Sourced from @​assistant-ui/react-markdown's releases.

@​assistant-ui/react-markdown@​0.14.17

Patch Changes

  • #8039 41ec387 - fix(markdown): end quoted code fences and $$ blocks where their own blockquote ends, so a deeper > line no longer closes one early and a blank or shallower line no longer leaves one open (@​rupic-app)
Changelog

Sourced from @​assistant-ui/react-markdown's changelog.

0.14.17

Patch Changes

  • #8039 41ec387 - fix(markdown): end quoted code fences and $$ blocks where their own blockquote ends, so a deeper > line no longer closes one early and a blank or shallower line no longer leaves one open (@​rupic-app)
Commits

Updates @supabase/supabase-js from 2.116.0 to 2.117.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.117.2

2.117.2 (2026-09-25)

🩹 Fixes

  • postgrest: avoid instantiation depth errors for large relationship unions (#2701)

❤️ Thank You

v2.117.2-canary.0

2.117.2-canary.0 (2026-09-24)

🩹 Fixes

  • postgrest: avoid instantiation depth errors for large relationship unions (#2701)

❤️ Thank You

v2.117.1

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

v2.117.1-canary.0

2.117.1-canary.0 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

v2.117.0

2.117.0 (2026-09-22)

🚀 Features

  • auth: forward options.mediation to navigator.credentials.get in signInWithPasskey (#2675)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

  • auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

  • fadymak
Commits
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
  • c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
  • 84af33f chore(release): version 2.116.0 changelogs (#2679)
  • See full diff in compare view

Updates @tanstack/react-query from 5.103.1 to 5.103.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.103.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.103.2
    • @​tanstack/react-query@​5.103.2

@​tanstack/react-query-next-experimental@​5.103.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.103.2

@​tanstack/react-query-persist-client@​5.103.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.103.2
    • @​tanstack/react-query@​5.103.2

@​tanstack/react-query@​5.103.2

Patch Changes

  • Updated dependencies [8a28904]:
    • @​tanstack/query-core@​5.103.2
Changelog

Sourced from @​tanstack/react-query's changelog.

5.103.2

Patch Changes

  • Updated dependencies [8a28904]:
    • @​tanstack/query-core@​5.103.2
Commits

Updates @tauri-apps/plugin-log from 2.9.1 to 2.9.2

Commits

Updates @tauri-apps/plugin-updater from 2.11.0 to 2.12.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the production-dependencies group with 6 updates
28e614b 
Bumps the production-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react) | `0.15.21` | `0.15.22` |
| [@assistant-ui/react-markdown](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react-markdown) | `0.14.16` | `0.14.17` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.116.0` | `2.117.2` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.103.1` | `5.103.2` |
| [@tauri-apps/plugin-log](https://github.com/tauri-apps/plugins-workspace) | `2.9.1` | `2.9.2` |
| [@tauri-apps/plugin-updater](https://github.com/tauri-apps/plugins-workspace) | `2.11.0` | `2.12.0` |


Updates `@assistant-ui/react` from 0.15.21 to 0.15.22
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react@0.15.22/packages/react)

Updates `@assistant-ui/react-markdown` from 0.14.16 to 0.14.17
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react-markdown/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react-markdown@0.14.17/packages/react-markdown)

Updates `@supabase/supabase-js` from 2.116.0 to 2.117.2
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.117.2/packages/core/supabase-js)

Updates `@tanstack/react-query` from 5.103.1 to 5.103.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.103.2/packages/react-query)

Updates `@tauri-apps/plugin-log` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@log-v2.9.1...log-v2.9.2)

Updates `@tauri-apps/plugin-updater` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@updater-v2.11.0...updater-v2.12.0)

---
updated-dependencies:
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@assistant-ui/react-markdown"
  dependency-version: 0.14.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.117.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.103.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@tauri-apps/plugin-log"
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@tauri-apps/plugin-updater"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
github-actions Bot merged commit 60c4eb2 into main Sep 28, 2026
4 of 8 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-c3f1560b3f branch September 28, 2026 20:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants