chore(deps): bump the production-deps group across 1 directory with 44 updates

[dependabot]

Bumps the production-deps group with 44 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.75.0	0.89.0
@biomejs/biome	1.9.4	2.4.12
@changesets/changelog-github	0.5.2	0.6.0
@changesets/cli	2.29.8	2.30.0
lint-staged	16.2.7	16.4.0
openai	6.22.0	6.34.0
turbo	2.8.3	2.9.6
typescript	5.9.3	6.0.2
@noble/hashes	1.8.0	2.2.0
@tanstack/react-query	5.90.20	5.99.0
lucide-react	0.563.0	1.8.0
react	18.3.1	19.2.5
react-dom	18.3.1	19.2.5
react-router-dom	7.13.0	7.14.1
tailwind-merge	3.4.0	3.5.0
viem	2.45.1	2.47.17
@vitejs/plugin-react	5.1.3	6.0.1
autoprefixer	10.4.24	10.5.0
postcss	8.5.6	8.5.9
tailwindcss	3.4.19	4.2.2
vite	7.3.1	8.0.8
@noble/curves	2.0.1	2.2.0
@simplewebauthn/browser	13.2.2	13.3.0
@simplewebauthn/server	13.2.2	13.3.0
@nestjs/common	10.4.22	11.1.19
@nestjs/core	10.4.22	11.1.19
@nestjs/platform-express	10.4.22	11.1.19
@supabase/supabase-js	2.95.3	2.103.0
class-validator	0.14.3	0.15.1
node-vault	0.10.9	0.12.0
resend	6.9.2	6.11.0
@nestjs/testing	10.4.22	11.1.19
@inquirer/prompts	8.2.1	8.4.1
@modelcontextprotocol/sdk	1.26.0	1.29.0
@x402/core	2.3.1	2.10.0
@x402/evm	2.3.1	2.10.0
commander	12.1.0	14.0.3
ora	8.2.0	9.3.0
zod	3.25.76	4.3.6
@anthropic-ai/claude-agent-sdk	0.1.77	0.2.108
@langchain/core	0.3.80	1.1.39
@langchain/openai	0.5.18	1.4.4
@ai-sdk/openai	1.3.24	3.0.53
ai	4.3.19	6.0.159

Updates @anthropic-ai/sdk from 0.75.0 to 0.89.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.89.0

0.89.0 (2026-04-14)

Full Changelog: sdk-v0.88.0...sdk-v0.89.0

Features

• api: manual updates (57c2a11)
• api: mark Sonnet and Opus 4 as deprecated (eff41b7)

Bug Fixes

• streaming: add missing events (4c52919)

sdk: v0.88.0

0.88.0 (2026-04-10)

Full Changelog: sdk-v0.87.0...sdk-v0.88.0

Features

• vertex eu region (#882) (1933857)

Documentation

• improve examples (de4f483)
• update examples (454e1c5)

sdk: v0.87.0

0.87.0 (2026-04-09)

Full Changelog: sdk-v0.86.1...sdk-v0.87.0

Features

• api: Add beta advisor tool (1e99a8d)

sdk: v0.86.1

0.86.1 (2026-04-08)

Full Changelog: sdk-v0.86.0...sdk-v0.86.1

Chores

• update @​anthropic-ai/sdk dependency version (#870) (036342b)

sdk: v0.86.0

0.86.0 (2026-04-08)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.89.0 (2026-04-14)

Full Changelog: sdk-v0.88.0...sdk-v0.89.0

Features

• api: manual updates (57c2a11)
• api: mark Sonnet and Opus 4 as deprecated (eff41b7)

Bug Fixes

• streaming: add missing events (4c52919)

0.88.0 (2026-04-10)

Full Changelog: sdk-v0.87.0...sdk-v0.88.0

Features

• vertex eu region (#882) (1933857)

Documentation

• improve examples (de4f483)
• update examples (454e1c5)

0.87.0 (2026-04-09)

Full Changelog: sdk-v0.86.1...sdk-v0.87.0

Features

• api: Add beta advisor tool (1e99a8d)

0.86.1 (2026-04-08)

Full Changelog: sdk-v0.86.0...sdk-v0.86.1

Chores

• update @​anthropic-ai/sdk dependency version (#870) (036342b)

0.86.0 (2026-04-08)

Full Changelog: sdk-v0.85.0...sdk-v0.86.0

Features

... (truncated)

Commits

• 39549e9 chore: release main (#993)
• 089fe05 chore: release main (#987)
• 73f128f chore: release main (#985)
• fd6cf54 chore: release main (#983)
• 79d1d73 chore: release main (#982)
• 4ade5b1 chore: release main (#979)
• 4368602 chore: release main (#978)
• 4105fd6 chore: release main (#973)
• 0b536ae chore: release main (#970)
• 6d72814 chore: release main (#967)
• Additional commits viewable in compare view

Updates @biomejs/biome from 1.9.4 to 2.4.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.12

2.4.12

Patch Changes

• #9376 9701a33 Thanks @​dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

  describe("foo", () => {});
  describe("foo", () => {
    // invalid: same title as previous describe block
    test("baz", () => {});
    test("baz", () => {}); // invalid: same title as previous test case
  });

• #9889 7ae83f2 Thanks @​dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

• #9916 27dd7b1 Thanks @​Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

  For example, the following snippets trigger the rule:

  function createComponent(label) {
    function MyComponent() {
      return <div>{label}</div>;
    }
    return MyComponent;
  }

  function Parent() {
    function Child() {
      return <div />;
    }
    return <Child />;
  }

• #9980 098f1ff Thanks @​ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.

• #9942 9956f1d Thanks @​dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.

• #9891 4d9ac51 Thanks @​dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.

• #9902 3f4d103 Thanks @​ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.

• #9891 4d9ac51 Thanks @​dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.12

Patch Changes

• #9376 9701a33 Thanks @​dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

  describe("foo", () => {});
  describe("foo", () => {
    // invalid: same title as previous describe block
    test("baz", () => {});
    test("baz", () => {}); // invalid: same title as previous test case
  });

• #9889 7ae83f2 Thanks @​dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

• #9916 27dd7b1 Thanks @​Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

  For example, the following snippets trigger the rule:

  function createComponent(label) {
    function MyComponent() {
      return <div>{label}</div>;
    }
    return MyComponent;
  }

  function Parent() {
    function Child() {
      return <div />;
    }
    return <Child />;
  }

• #9980 098f1ff Thanks @​ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.

• #9942 9956f1d Thanks @​dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.

• #9891 4d9ac51 Thanks @​dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.

• #9902 3f4d103 Thanks @​ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.

• #9891 4d9ac51 Thanks @​dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.

• #9966 322675e Thanks @​siketyan! - Fixed #9113: Biome now parses and formats @media and other conditional blocks correctly inside embedded CSS snippets.

... (truncated)

Commits

• baaacfc ci: release (#9890)
• e0ba71d feat: implement useIframeSandbox (#9949)
• 2cff700 feat(lint/js): add useVarsOnTop (#9861)
• 27dd7b1 feat(react/js): add noComponentHookFactories (#9916)
• 0d0e611 feat(js_analyze): implement useReactAsyncServerFunction (#9909)
• f1c1363 feat(lint/js): add useStringStartsEndsWith (#9796)
• d417803 feat(js_analyze): implement noJsxNamespace (#9913)
• 9701a33 feat(lint/js): add noIdenticalTestTitle (#9376)
• c499f46 feat(lint): implement useReduceTypeParameter nursery rule (#9577)
• 40bd180 feat(lint/js): add noExcessiveSelectorClasses (#9866)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​biomejs/biome since your current version.

Updates @changesets/changelog-github from 0.5.2 to 0.6.0

Release notes

Sourced from @​changesets/changelog-github's releases.

@​changesets/changelog-github@​0.6.0

Minor Changes

• #1850 fd0bc2e Thanks @​mixelburg! - Linkify issue references in changelog entries.

Patch Changes

• #1810 27fd8f4 Thanks @​hirasso! - Replace deprecated String.prototype.trimRight with String.prototype.trimEnd

• Updated dependencies [d4b8ad8, e462d89]:

  • @​changesets/get-github-info@​0.8.0

Commits

• 3ab4d89 Version Packages (#1817)
• 1772598 Fix changelog entry insertion when no package title is present in the `CHANGE...
• 6df3a5e Allow versioned private packages to depend on skipped packages without requir...
• 2a73025 Fix confusing 'Question-2' prompt label when using external editor (#1857)
• 667fe5a Support ESM for custom changelog and commit options (#1774)
• e462d89 Add scopes automatically in the GitHub new token link in the printed error me...
• 503fcaa Support absolute paths in status output flag (#1776)
• d4b8ad8 Improve error messages when fetching from GitHub api (#1781)
• ece0376 Improve baseBranch docs (#1778)
• 0e8e01e Allow Changesets to be executed from non-root directories (#1806)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​changesets/changelog-github since your current version.

Updates @changesets/cli from 2.29.8 to 2.30.0

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.30.0

Minor Changes

• #1840 057cca2 Thanks @​wotan-allfather! - Add --since flag to add command

  The add command now supports a --since flag that allows you to specify which branch, tag, or git ref to use when detecting changed packages. This is useful for gitflow workflows where you have multiple target branches and the baseBranch config option doesn't cover all use cases.

  Example: changeset add --since=develop

  If not provided, the command falls back to the baseBranch value in your .changeset/config.json.

• #1845 2b4a66a Thanks @​Andarist! - Delegate OTP prompting to the package manager instead of handling it in-process. This allows Changesets to use the package manager's native web auth support.

• #1774 667fe5a Thanks @​bluwy! - Support importing custom commit option ES module. Previously, it used require() which only worked for CJS modules, however now it uses import() which supports both CJS and ES modules.

• #1839 73b1809 Thanks @​leochiu-a! - Add a --message (-m) flag to changeset add (and default changeset) so the changeset summary can be provided from the command line. When --message is present, the summary prompt is skipped while the final confirmation step is kept.

• #1806 0e8e01e Thanks @​luisadame! - Changeset CLI can now be run from the nested directories in the project, where the .changeset directory has to be found in one of the parent directories

Patch Changes

• #1849 9dc3230 Thanks @​Andarist! - Compute the terminal's size lazily to avoid spurious stderr output in non-interactive mode

• #1857 2a73025 Thanks @​mixelburg! - Fix confusing prompt labels when entering changeset summary after external editor fallback

• #1842 6df3a5e Thanks @​RodrigoHamuy! - Allow private packages to depend on skipped packages without requiring them to also be skipped. Private packages are not published to npm, so it is safe for them to have dependencies on ignored or unversioned packages.

• #1776 503fcaa Thanks @​bluwy! - Support absolute paths in changeset status --output <path>

• Updated dependencies [667fe5a, 1772598, b6f4c74, 6df3a5e, 6df3a5e, 27fd8f4]:

  • @​changesets/apply-release-plan@​7.1.0
  • @​changesets/config@​3.1.3
  • @​changesets/get-release-plan@​4.0.15
  • @​changesets/read@​0.6.7

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​changesets/cli since your current version.

Updates lint-staged from 16.2.7 to 16.4.0

Release notes

Sourced from lint-staged's releases.

v16.4.0

Minor Changes

• #1739 687fc90 Thanks @​hyperz111! - Replace micromatch with picomatch to reduce dependencies.

v16.3.4

Patch Changes

• #1742 9d6e827 Thanks @​iiroj! - Update dependencies, including tinyexec@1.0.4 to make sure local node_modules/.bin are preferred to global locations (released in tinyexec@1.0.3).

v16.3.3

Patch Changes

• #1740 0109e8d Thanks @​iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

v16.3.2

Patch Changes

• #1735 2adaf6c Thanks @​iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

v16.3.1

Patch Changes

• #1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

v16.3.0

Minor Changes

• #1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

• #1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

• #1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

Changelog

Sourced from lint-staged's changelog.

16.4.0

Minor Changes

• #1739 687fc90 Thanks @​hyperz111! - Replace micromatch with picomatch to reduce dependencies.

16.3.4

Patch Changes

• #1742 9d6e827 Thanks @​iiroj! - Update dependencies, including tinyexec@1.0.4 to make sure local node_modules/.bin are preferred to global locations (released in tinyexec@1.0.3).

16.3.3

Patch Changes

• #1740 0109e8d Thanks @​iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

16.3.2

Patch Changes

• #1735 2adaf6c Thanks @​iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

16.3.1

Patch Changes

• #1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

16.3.0

Minor Changes

• #1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

• #1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

• #1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

Commits

• 445f9dd chore(changeset): release
• d91be60 docs: update readme to use picomatch
• b392a9f refactor: extract matchFiles and add unit tests
• 687fc90 refactor: replace micromatch with picomatch
• 26dadf9 chore(changeset): release
• 9d6e827 build(deps): update dependencies
• 8aea986 chore(changeset): release
• 0109e8d fix: strip Git CRLF warning from output
• dfd6a7a chore(changeset): release
• 2adaf6c fix(Windows): do not spawn tasks as detached since it opens a cmd window on ...
• Additional commits viewable in compare view

Updates openai from 6.22.0 to 6.34.0

Release notes

Sourced from openai's releases.

v6.34.0

6.34.0 (2026-04-08)

Full Changelog: v6.33.0...v6.34.0

Features

• api: add phase field to Message in conversations (eb7cbc1)
• client: add support for short-lived tokens (#839) (a72ebcf)

Bug Fixes

• api: remove web_search_call.results from ResponseIncludable in responses (1f6968e)

Chores

• internal: codegen related update (1081460)
• internal: update multipart form array serialization (3faee8d)
• tests: bump steady to v0.20.1 (b73cc6b)

Documentation

• api: add multi-file ingestion recommendations to vector-stores files/file-batches (1bc32a3)

v6.33.0

6.33.0 (2026-03-25)

Full Changelog: v6.32.0...v6.33.0

Features

• api: add keys field to computer action types (27a850e)
• client: add async iterator and stream() to WebSocket classes (e1c16ee)

Bug Fixes

• api: align SDK response types with expanded item schemas (491cd52)
• types: make type required in ResponseInputMessageItem (2012293)

Chores

• ci: skip lint on metadata-only changes (74a917f)
• internal: refactor imports (cfe9c60)
• internal: update gitignore (71bd114)
• tests: bump steady to v0.19.4 (f2e9dea)

... (truncated)

Changelog

Sourced from openai's changelog.

6.34.0 (2026-04-08)

Full Changelog: v6.33.0...v6.34.0

Features

• api: add phase field to Message in conversations (eb7cbc1)
• client: add support for short-lived tokens (#839) (a72ebcf)

Bug Fixes

• api: remove web_search_call.results from ResponseIncludable in responses (1f6968e)

Chores

• internal: codegen related update (1081460)
• internal: update multipart form array serialization (3faee8d)
• tests: bump steady to v0.20.1 (b73cc6b)

Documentation

• api: add multi-file ingestion recommendations to vector-stores files/file-batches (1bc32a3)

6.33.0 (2026-03-25)

Full Changelog: v6.32.0...v6.33.0

Features

• api: add keys field to computer action types (27a850e)
• client: add async iterator and stream() to WebSocket classes (e1c16ee)

Bug Fixes

• api: align SDK response types with expanded item schemas (491cd52)
• types: make type required in ResponseInputMessageItem (2012293)

Chores

• ci: skip lint on metadata-only changes (74a917f)
• internal: refactor imports (cfe9c60)
• internal: update gitignore (71bd114)
• tests: bump steady to v0.19.4 (f2e9dea)
• tests: bump steady to v0.19.5 (37c6cf4)
• tests: bump steady to v0.19.6 (496b3af)

... (truncated)

Commits

• 35feb53 Merge pull request #1797 from openai/release-please--branches--master--change...
• 398e589 release: 6.34.0
• a72ebcf feat(client): add support for short-lived tokens (#839)
• b73cc6b chore(tests): bump steady to v0.20.1
• eb7cbc1 feat(api): add phase field to Message in conversations
• 1f6968e fix(api): remove web_search_call.results from ResponseIncludable in responses
• 1081460 chore(internal): codegen related update
• 1bc32a3 docs(api): add multi-file ingestion recommendations to vector-stores files/fi...
• 3faee8d chore(internal): update multipart form array serialization
• be64904 Merge pull request #1798 from openai/codex/pin-github-workflow-refs-20260326-...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for openai since your current version.

Updates turbo from 2.8.3 to 2.9.6

Release notes

Sourced from turbo's releases.

Turborepo v2.9.6

What's Changed

create-turbo

• chore: Update dependencies found in audits by @​anthonyshew in vercel/turborepo#12586

Examples

• fix: Add missing @types/node to with-svelte example apps by @​anthonyshew in vercel/turborepo#12585

Changelog

• docs: Add Bun equivalent for updating dependencies by @​anthonyshew in vercel/turborepo#12580
• fix: Mention turbo.json in concurrency error message by @​anthonyshew in vercel/turborepo#12582
• fix: Surface actionable message when remote cache is requested but not linked by @​anthonyshew in vercel/turborepo#12584
• chore: Delete agents app by @​anthonyshew in vercel/turborepo#12587
• fix: Load custom CA certificates in fast webpki-only HTTP client by @​anthonyshew in vercel/turborepo#12591
• docs: Remove pre-release badges by @​anthonyshew in vercel/turborepo#12592

Full Changelog: vercel/turborepo@v2.9.5...v2.9.6

Turborepo v2.9.6-canary.3

What's Changed

Changelog

• chore: Delete agents app by @​anthonyshew in vercel/turborepo#12587
• fix: Load custom CA certificates in fast webpki-only HTTP client by @​anthonyshew in vercel/turborepo#12591

Full Changelog: vercel/turborepo@v2.9.6-canary.2...v2.9.6-canary.3

Turborepo v2.9.6-canary.2

What's Changed

create-turbo

• chore: Update dependencies found in audits by @​anthonyshew in vercel/turborepo#12586

Examples

• fix: Add missing @types/node to with-svelte example apps by @​anthonyshew in vercel/turborepo#12585

Changelog

• fix: Surface actionable message when remote cache is requested but not linked by @​anthonyshew in vercel/turborepo#12584

Full Changelog: vercel/turborepo@v2.9.6-canary.1...v2.9.6-canary.2

Turborepo v2.9.6-canary.1

What's Changed

@​turbo/telemetry

• fix: Suppress telemetry alert when running on Vercel by @​anthonyshew in vercel/turborepo#12576

... (truncated)

Commits

• 77bca2b publish 2.9.6 to registry
• 5a8f2e8 release(turborepo): 2.9.6-canary.3 (#12593)
• 861efa8 docs: Remove pre-release badges (#12592)
• 28db7d0 fix: Load custom CA certificates in fast webpki-only HTTP client (#12591)
• b412177 release(turborepo): 2.9.6-canary.2 (#12588)
• 9018c65 chore: Delete agents app (#12587)
• 5d19186 chore: Update dependencies found in audits (#12586)
• 8338f42 fi...

  Description has been truncated