Skip to content

build(deps): bump the minor-and-patch group with 9 updates - #570

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-7699a8a442
Open

build(deps): bump the minor-and-patch group with 9 updates#570
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-7699a8a442

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates:

Package From To
@j178/prek 0.4.13 0.4.14
@cloudflare/sandbox 0.12.6 0.12.7
better-auth 1.6.28 1.7.1
cloudflare 7.0.0 7.1.0
hono 4.13.2 4.13.3
wrangler 4.123.0 4.124.0
@assistant-ui/react 0.15.14 0.15.15
lucide-react 1.31.0 1.32.0
@ag-ui/core 0.0.57 0.0.58

Updates @j178/prek from 0.4.13 to 0.4.14

Release notes

Sourced from @​j178/prek's releases.

0.4.14

Release Notes

Released on 2026-08-17.

Enhancements

  • Support check-yaml unsafe mode (#2546)

Performance

  • Reuse allocations in common filters (#2548)

Bug fixes

  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)

Contributors

Install prek 0.4.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.4.14

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.4.14

Released on 2026-08-17.

Enhancements

  • Support check-yaml unsafe mode (#2546)

Performance

  • Reuse allocations in common filters (#2548)

Bug fixes

  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)

Contributors

Commits

Updates @cloudflare/sandbox from 0.12.6 to 0.12.7

Release notes

Sourced from @​cloudflare/sandbox's releases.

@​cloudflare/sandbox@​0.12.7

Patch Changes

  • 23a08e4 Thanks @​ghostwriternr! - Ensure stable releases advance npm's latest tag only after all release artifacts pass verification.
Commits

Updates better-auth from 1.6.28 to 1.7.1

Release notes

Sourced from better-auth's releases.

v1.7.1

better-auth

Bug Fixes

  • Added native database transaction support to test instances for PostgreSQL and MySQL.
  • Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.
  • Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
  • Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.
  • Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

  • Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.1

Patch Changes

  • #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

    getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

    auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

    A required field whose database column is still nullable logs a warning instead of blocking the migration.

    A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.1
    • @​better-auth/drizzle-adapter@​1.7.1
    • @​better-auth/kysely-adapter@​1.7.1
    • @​better-auth/memory-adapter@​1.7.1
    • @​better-auth/mongo-adapter@​1.7.1
    • @​better-auth/prisma-adapter@​1.7.1
    • @​better-auth/telemetry@​1.7.1

1.7.0

Minor Changes

  • #8733 4e8e4c7 Thanks @​bytaesu! - Add hydrateSession to seed the client with a server-fetched session so useSession returns data on the first render.

  • #9930 0cbaf81 Thanks @​gustavovalverde! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. onLinkAccount fires and the anonymous user is migrated; before, it was silently skipped.

    Plugins can now carry server-trusted data across an OAuth redirect with the new addOAuthServerContext API, read back on the callback via getOAuthState().serverContext. Unlike additionalData, it cannot be set from the request body, so it is the right place for values the server must trust.

    For @better-auth/oauth-provider, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through additionalData.

  • #10004 b36c38f Thanks @​bytaesu! - The captcha plugin now requires endpoint entries to match full auth paths unless they use wildcard patterns. This prevents requests like /sign-in//email from bypassing captcha while preserving trailing-slash matches like /sign-in/email/. To protect multiple routes, replace partial paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/**.

  • #10746 6782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

    The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

  • #10402 763a267 Thanks @​gustavovalverde! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.

  • #9766 bf39cbf Thanks @​GautamBytes! - Add a server-only auth.api.consumePhoneNumberOTP API for custom phone OTP flows that need to verify and consume a code without creating or updating users or sessions.

  • #10330 081d3c3 Thanks @​ping-maxwell! - Allow the username plugin's separate displayUsername field to be omitted by setting displayUsername: false on both the server and client plugins.

  • #10059 49b5cf6 Thanks @​GautamBytes! - Device Authorization now creates unique database indexes for deviceCode and userCode, so each generated code must be unique in its column. Existing installations on every adapter must resolve duplicate values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters before running it.

... (truncated)

Commits

Updates cloudflare from 7.0.0 to 7.1.0

Release notes

Sourced from cloudflare's releases.

v7.1.0

7.1.0 (2026-08-17)

Breaking Changes

Resource Restructuring

  • cloudforceOne.threatEvents.indicatorTypes has been renamed to cloudforceOne.threatEvents.indicators

Removed Methods

  • intel.attackSurfaceReport.issues.dismiss() -- removed along with IssueDismissResponse type
  • moq.relays.tokens.rotate() -- removed along with TokenRotateResponse type

Return Type Changes

Resource Method Old Return Type New Return Type
zones.ct.alerting edit() AlertingEditResponse CTAlertingSubscription
zones.ct.alerting get() AlertingGetResponse CTAlertingSubscription
mtlsCertificates list() MTLSCertificatesSinglePage MTLSCertificateListResponsesSinglePage
mtlsCertificates delete() MTLSCertificate MTLSCertificateDeleteResponse
mtlsCertificates get() MTLSCertificate MTLSCertificateGetResponse
hostnames.settings.tls get() TLSGetResponsesSinglePage Setting
hyperdrive.configs list() HyperdrivesSinglePage HyperdrivesV4PagePaginationArray

Removed Types

  • AlertingEditResponse, AlertingGetResponse (on zones.ct.alerting) -- replaced by CTAlertingSubscription
  • MTLSCertificate, MTLSCertificatesSinglePage (on mtlsCertificates) -- replaced by per-method response types
  • Host, Status, ValidationMethod (on ssl.certificatePacks)
  • CertificateAuthority (on acm.totalTLS)
  • HostnameAssociation (on certificateAuthorities.hostnameAssociations)
  • Status (on customCertificates)
  • TLSGetResponse, TLSGetResponsesSinglePage (on hostnames.settings.tls)

Endpoint Changes

Resource Method Old Endpoint New Endpoint
accounts.subscriptions create() POST /accounts/{account_id}/subscriptions POST /{accounts_or_zones}/{account_or_zone_id}/subscriptions
accounts.subscriptions get() GET /accounts/{account_id}/subscriptions GET /{accounts_or_zones}/{account_or_zone_id}/subscriptions
loadBalancers create(), update(), list(), delete(), edit(), get() /zones/{zone_id}/load_balancers/... /{accounts_or_zones}/{account_or_zone_id}/load_balancers/...
billing.usage paygo() GET /accounts/{account_id}/paygo-usage GET /accounts/{account_id}/billable-usage
hostnames.settings.tls get() GET /zones/{zone_id}/hostnames/settings/{setting_id} GET /zones/{zone_id}/hostnames/settings/{setting_id}/{hostname}

... (truncated)

Changelog

Sourced from cloudflare's changelog.

7.1.0 (2026-08-17)

Full Changelog: v7.0.0...v7.1.0

Breaking Changes

Resource Restructuring

  • cloudforceOne.threatEvents.indicatorTypes has been renamed to cloudforceOne.threatEvents.indicators

Removed Methods

  • intel.attackSurfaceReport.issues.dismiss() -- removed along with IssueDismissResponse type
  • moq.relays.tokens.rotate() -- removed along with TokenRotateResponse type

Return Type Changes

Resource Method Old Return Type New Return Type
zones.ct.alerting edit() AlertingEditResponse CTAlertingSubscription
zones.ct.alerting get() AlertingGetResponse CTAlertingSubscription
mtlsCertificates list() MTLSCertificatesSinglePage MTLSCertificateListResponsesSinglePage
mtlsCertificates delete() MTLSCertificate MTLSCertificateDeleteResponse
mtlsCertificates get() MTLSCertificate MTLSCertificateGetResponse
hostnames.settings.tls get() TLSGetResponsesSinglePage Setting
hyperdrive.configs list() HyperdrivesSinglePage HyperdrivesV4PagePaginationArray

Removed Types

  • AlertingEditResponse, AlertingGetResponse (on zones.ct.alerting) -- replaced by CTAlertingSubscription
  • MTLSCertificate, MTLSCertificatesSinglePage (on mtlsCertificates) -- replaced by per-method response types
  • Host, Status, ValidationMethod (on ssl.certificatePacks)
  • CertificateAuthority (on acm.totalTLS)
  • HostnameAssociation (on certificateAuthorities.hostnameAssociations)
  • Status (on customCertificates)
  • TLSGetResponse, TLSGetResponsesSinglePage (on hostnames.settings.tls)

Endpoint Changes

Resource Method Old Endpoint New Endpoint
accounts.subscriptions create() POST /accounts/{account_id}/subscriptions POST /{accounts_or_zones}/{account_or_zone_id}/subscriptions
accounts.subscriptions get() GET /accounts/{account_id}/subscriptions GET /{accounts_or_zones}/{account_or_zone_id}/subscriptions
loadBalancers create(), update(), list(), delete(), edit(), get() /zones/{zone_id}/load_balancers/... /{accounts_or_zones}/{account_or_zone_id}/load_balancers/...
billing.usage paygo() GET /accounts/{account_id}/paygo-usage GET /accounts/{account_id}/billable-usage
hostnames.settings.tls get() GET /zones/{zone_id}/hostnames/settings/{setting_id} GET /zones/{zone_id}/hostnames/settings/{setting_id}/{hostname}

... (truncated)

Commits
  • f41ff03 Merge pull request #2797 from cloudflare/release/v7.1.0
  • 8139442 chore: bump CI node version to 20 for build and lint jobs
  • a670e70 release: 7.1.0
  • 933ad59 Build SDK
  • 05c85e2 Build SDK
  • 8f5a5fa Build SDK
  • 2768a88 chore: revert api_version commit
  • a0799e9 chore: adjust formatting for test file
  • d5dbfd3 chore: update release-please version to generated
  • c07fe80 chore: update release-please version to generated
  • Additional commits viewable in compare view

Updates hono from 4.13.2 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236
  • fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
  • fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
  • fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
  • feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

Commits
  • 0293343 4.13.3
  • 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
  • c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
  • eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
  • a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
  • 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
  • ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
  • 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
  • 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
  • 7195c24 fix(etag): copy pending stream bytes (#5239)
  • Additional commits viewable in compare view

Updates wrangler from 4.123.0 to 4.124.0

Release notes

Sourced from wrangler's releases.

wrangler@4.124.0

Minor Changes

  • #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

    A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

    {
  "name": "my-worker",
  "main": "worker.js",
  "compatibility_date": "2026-07-01",
  "containers": [
    { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
  ],
  "exports": {
    "MyContainerDO": {
      "type": "durable-object",
      "storage": "sqlite",
      "container": "my-container"
    }
  }
}

    The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

    container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

    • a container reference names a container that does not exist
    • two Durable Object exports claim the same container
    • a container and a Durable Object export disagree about which one they are linked to
    • a container ends up linked to no Durable Object at all
    • two containers share a name
    • a container's class_name names a Durable Object whose storage is legacy-kv
    • two containers are attached to the same Durable Object

    That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #14999 ba54f0d Thanks @​mittalpk! - Fix .env loading on Windows leaking stale, differently-cased duplicate keys

    On Windows, wrangler loads .env values through a case-insensitive Proxy wrapper so lookups like env.PATH and env.Path resolve to the same value, and this object is assigned directly to process.env. When a key was set again under a different casing (e.g. a value in .env.local overriding one from .env with different casing), the previous casing was never removed from the underlying object. env.PATH/env.Path still returned the correct, latest value, but anything that enumerates process.env — Object.keys, for...in, JSON.stringify, object spread, or a spawned subprocess inheriting the environment — would see both the stale and current key.

    Duplicate entries no longer appear, so environment variables passed to subprocesses and any code that lists the environment now see only the latest value for each variable.

  • #15044 b7422b0 Thanks @​stareezy-1! - Normalize structural CRLF line endings before sending D1 commands to the remote query API

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • f431166 Prevent date-enabled Node.js compatibility from adding conflicting globals to...
  • 1552bce [wrangler] Quieten warnings and stray output in tests (#15209)
  • bc5726b Pass access.dev through to Miniflare via `unstable_getMiniflareWorkerOptions(...
  • e967c39 [wrangler] Skip container deploy e2e tests on non-Linux CI (#15233)
  • 265256a WC-5744 [previews] fix: wrangler preview base-config flag inheritance (#15153)
  • 75cf407 [wrangler] Enable new config for cf dev (#15082)
  • 8fb2b87 [wrangler] Use FedRAMP container registries (#15196)
  • ba54f0d [wrangler] Fix case-insensitive-env leaking stale duplicate keys on override ...
  • 7cee278 [wrangler] Let CLOUDFLARE_ACCOUNT_ID override the cached account id in pages ...
  • Additional commits viewable in compare view

Updates @assistant-ui/react from 0.15.14 to 0.15.15

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.15

Patch Changes

  • #6071 c3fd447 - feat: host assistant-cloud thread lists on AISDKThreads via RemoteThreadList (@​okisdev)

    AISDKThreads({ cloud }) uses RemoteThreadList and remounts each thread like useChatRuntime. Cloud history withFormat resolves persistence per call so one adapter can serve many threads. useExternalHistory waits for threadListItem.remoteId instead of latching on the first empty paint.

  • #5872 f9529bf - feat: move useAssistantTransportRuntime into core/react (@​okisdev)

  • #5872 f9529bf - fix: persist data message parts in aui/v0 cloud history (@​okisdev)

  • #5839 24a1af7 - fix: validate MCP App resource responses (@​Kinfe123)

  • #5817 dab7b7a - fix: dispose sandbox frames when bridge setup fails (@​Kinfe123)

  • #6005 4326079 - feat: move useCloudThreadListRuntime into core/react and drop the unused react copy of the aui/v0 codec (@​okisdev)

  • #5952 3e2fa6e - fix: await assistant transport response callbacks and cancel unfinished responses when they fail (@​Kinfe123)

  • #5990 f439663 - fix: keep bottom follow through a content-growth undershoot (@​okisdev)

  • #5891 a20c2ef - fix: refresh live completion results after their data source changes (@​Kinfe123)

  • #5406 f2c37ec - fix: keep MCP App error replies reliable when error callbacks throw (@​Kinfe123)

  • #5981 f28ffae - fix: isolate MCP App notification callback errors (@​rupic-app)

  • #5942 285392a - fix: isolate assistant transport lifecycle callback failures (@​Kinfe123)

  • #5959 9d920cc - fix: InMemoryThreadList restarts with a fresh thread when the last one is deleted, notifies the new onDelete callback, and applies deletes batch-safely; the export is now sourced from the core store entry (@​okisdev)

  • #5618 82e2bde - fix: top-anchor turn clears skip turns that are still valid (@​Yonom)

  • #6037 f5b39d4 - feat: add RemoteThreadListAdapter.unstable_useAdapters so the RemoteThreadList store entry can load per-thread history without rendering unstable_Provider (@​okisdev)

  • #6020 26f40c1 - feat: add a RemoteThreadList store entry so any AssistantClient host can run a remote thread list from a RemoteThreadListAdapter and a thread factory (@​okisdev)

  • #5992 adcfe01 - fix: preserve bottom follow through viewport clicks and cancel stale auto-scroll frames (@​rupic-app)

  • #5499 5dff06c - fix: keep Escape-to-stop-speaking active when message action bars are hidden by moving the shortcut to ThreadPrimitive.Root; custom compositions must mount the root to enable it (@​Kinfe123)

  • #6058 837ef1b - fix: render system messages safely when editing components are omitted (@​rupic-app)

  • #5914 0d2e23f - feat: new threads.selectionChanged event carrying threadId and previousThreadId; deprecate threadListItem.switchedTo/switchedAway in its favor. Un-deprecate the semantically meaningful events (thread.runStart, thread.runEnd, thread.initialize, composer.send, composer.attachmentAdd). (@​Yonom)

    The new event fires in situations where the deprecated pair did not, so the selection-driven defaults (scrollToBottomOnThreadSwitch, unstable_focusOnThreadSwitched) now engage there too: InMemoryThreadList emits on selection changes (it previously emitted no switch events at all), switchToNewThread() emits for the newly created thread, and runtimes that resolve a deep-linked threadId/initialThreadId after mount (useRemoteThreadListRuntime) emit when the deep link resolves, with the initial placeholder thread as previousThreadId.

  • #5838 2a512eb - fix: handle synchronous live completion failures (@​Kinfe123)

  • #5774 61d29f4 - chore: update dependencies (@​Yonom)

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.15

Patch Changes

  • #6071 c3fd447 - feat: host assistant-cloud thread lists on AISDKThreads via RemoteThreadList (@​okisdev)

    AISDKThreads({ cloud }) uses RemoteThreadList and remounts each thread like useChatRuntime. Cloud history withFormat resolves persistence per call so one adapter can serve many threads. useExternalHistory waits for threadListItem.remoteId instead of latching on the first empty paint.

  • #5872 f9529bf - feat: move useAssistantTransportRuntime into core/react (@​okisdev)

  • #5872 f9529bf - fix: persist data message parts in aui/v0 cloud history (@​okisdev)

  • #5839 24a1af7 - fix: validate MCP App resource responses (@​Kinfe123)

  • #5817 dab7b7a - fix: dispose sandbox frames when bridge setup fails (@​Kinfe123)

  • #6005 4326079 - feat: move useCloudThreadListRuntime into core/react and drop the unused react copy of the aui/v0 codec (@​okisdev)

  • #5952 3e2fa6e - fix: await assistant transport response callbacks and cancel unfinished responses when they fail (@​Kinfe123)

  • #5990 f439663 - fix: keep bottom follow through a content-growth undershoot (@​okisdev)

  • #5891 a20c2ef - fix: refresh live completion results after their data source changes (@​Kinfe123)

  • #5406 f2c37ec - fix: keep MCP App error replies reliable when error callbacks throw (@​Kinfe123)

  • #5981 f28ffae - fix: isolate MCP App notification callback errors (@​rupic-app)

  • #5942 285392a - fix: isolate assistant transport lifecycle callback failures (@​Kinfe123)

  • #5959 9d920cc - fix: InMemoryThreadList restarts with a fresh thread when the last one is deleted, notifies the new onDelete callback, and applies deletes batch-safely; the export is now sourced from the core store entry (@​okisdev)

  • #5618 82e2bde - fix: top-anchor turn clears skip turns that are still valid (@​Yonom)

  • #6037 f5b39d4 - feat: add RemoteThreadListAdapter.unstable_useAdapters so the RemoteThreadList store entry can load per-thread history without rendering unstable_Provider (@​okisdev)

  • #6020 26f40c1 - feat: add a RemoteThreadList store entry so any AssistantClient h...

    Description has been truncated

@dependabot
build(deps): bump the minor-and-patch group with 9 updates
f3ada6a 
Bumps the minor-and-patch group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@j178/prek](https://github.com/j178/prek) | `0.4.13` | `0.4.14` |
| [@cloudflare/sandbox](https://github.com/cloudflare/sandbox-sdk) | `0.12.6` | `0.12.7` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.28` | `1.7.1` |
| [cloudflare](https://github.com/cloudflare/cloudflare-typescript) | `7.0.0` | `7.1.0` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.3` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.123.0` | `4.124.0` |
| [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react) | `0.15.14` | `0.15.15` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.32.0` |
| [@ag-ui/core](https://github.com/ag-ui-protocol/ag-ui) | `0.0.57` | `0.0.58` |


Updates `@j178/prek` from 0.4.13 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.13...v0.4.14)

Updates `@cloudflare/sandbox` from 0.12.6 to 0.12.7
- [Release notes](https://github.com/cloudflare/sandbox-sdk/releases)
- [Changelog](https://github.com/cloudflare/sandbox-sdk/blob/main/docs/RELEASE.md)
- [Commits](https://github.com/cloudflare/sandbox-sdk/compare/@cloudflare/sandbox@0.12.6...@cloudflare/sandbox@0.12.7)

Updates `better-auth` from 1.6.28 to 1.7.1
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.1/packages/better-auth)

Updates `cloudflare` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/cloudflare/cloudflare-typescript/releases)
- [Changelog](https://github.com/cloudflare/cloudflare-typescript/blob/main/CHANGELOG.md)
- [Commits](cloudflare/cloudflare-typescript@v7.0.0...v7.1.0)

Updates `hono` from 4.13.2 to 4.13.3
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.3)

Updates `wrangler` from 4.123.0 to 4.124.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.124.0/packages/wrangler)

Updates `@assistant-ui/react` from 0.15.14 to 0.15.15
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react@0.15.15/packages/react)

Updates `lucide-react` from 1.31.0 to 1.32.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.32.0/packages/lucide-react)

Updates `@ag-ui/core` from 0.0.57 to 0.0.58
- [Release notes](https://github.com/ag-ui-protocol/ag-ui/releases)
- [Commits](https://github.com/ag-ui-protocol/ag-ui/commits)

---
updated-dependencies:
- dependency-name: "@j178/prek"
  dependency-version: 0.4.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/sandbox"
  dependency-version: 0.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cloudflare
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.124.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@ag-ui/core"
  dependency-version: 0.0.58
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 22, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Yevanchen Yevanchen Awaiting requested review from Yevanchen Yevanchen is a code owner
@KurosawaGeeker KurosawaGeeker Awaiting requested review from KurosawaGeeker KurosawaGeeker is a code owner
@samzong samzong Awaiting requested review from samzong samzong is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants