chore(deps): bump the production-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: @anthropic-ai/sdk, express and openai.

Updates @anthropic-ai/sdk from 0.131.0 to 0.133.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.133.0

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

• internal: remove the next branch rule from CLAUDE.md

sdk-v0.132.1

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• ci: publish every package from the publish workflow
• docs: note that listing Claude Console spend limits is in early access

Documentation

• split CLAUDE.md into shared, TypeScript, and repository rules

sdk: v0.132.0

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
• api: add disabled to thinking types in model capabilities (2b75b49)
• api: add display_name to RBAC roles and deprecate name (7735ac3)
• api: add include_default parameter to list workspaces (c4019df)
• api: add lifecycle stage fields and filter to /v1/models (fe8a762)
• api: add line to model objects (018aed4)
• api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
• api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

• api: send the beta header by default when listing spend limits (8f58ca4)
• client: throw when a JSONL stream is iterated twice (a34266c)
• tools: keep a local edit made after a memory upload whose response was lost (#893) (2b75b49)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.133.0 (2026-10-09)

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

• internal: remove the next branch rule from CLAUDE.md

0.132.1 (2026-10-08)

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• ci: publish every package from the publish workflow
• docs: note that listing Claude Console spend limits is in early access

Documentation

• split CLAUDE.md into shared, TypeScript, and repository rules

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
• api: add disabled to thinking types in model capabilities (2b75b49)
• api: add display_name to RBAC roles and deprecate name (7735ac3)
• api: add include_default parameter to list workspaces (c4019df)
• api: add lifecycle stage fields and filter to /v1/models (fe8a762)
• api: add line to model objects (018aed4)
• api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
• api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

• api: send the beta header by default when listing spend limits (8f58ca4)
• client: throw when a JSONL stream is iterated twice (a34266c)

... (truncated)

Commits

• 2979ed5 release: . 0.133.0
• 8486d9b Merge pull request #908 from anthropics/synced/published
• e0995e4 feat(api): add workflows, multiagent configuration and thread status filterin...
• 31eb3be codegen metadata
• 5127b32 codegen metadata
• f702a46 codegen metadata
• d64e976 codegen metadata
• 9f75465 codegen metadata
• 6ec2ea1 chore(internal): remove the next branch rule from CLAUDE.md
• 373c33d codegen metadata
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates openai from 7.27.0 to 7.32.0

Release notes

Sourced from openai's releases.

v7.32.0

7.32.0 (2026-10-09)

Features

• api: add agent environment suspension and expiration (#2904) (6e4ed63)

Bug Fixes

• deps: bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge (#2896) (88b4c05)
• runners: preserve detailed token usage in totalUsage (#2900) (88bb984)

Documentation

• fix migration guide types troubleshooting link (#2901) (690e5d7)

v7.31.0

7.31.0 (2026-10-09)

Features

• api: add prewarmed hosted environments (#2898) (7a0be86)

v7.30.1

7.30.1 (2026-10-08)

Bug Fixes

• api: correct custom voice creation parameters (#2895) (3edaf0f)
• deps-dev: bump @​aws-sdk/credential-provider-node from 3.972.83 to 3.972.84 (#2877) (0878349)
• deps-dev: bump @​smithy/signature-v4 from 5.7.3 to 5.7.4 (#2870) (12ce5f2)
• deps-dev: bump jest from 30.5.1 to 30.5.2 (#2867) (48b5c2a)
• deps-dev: bump oxfmt from 0.67.0 to 0.70.0 (#2864) (91a226d)
• deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/browser-direct-import (#2863) (89ded6b)
• deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/ts-browser-webpack (#2876) (6ef1b6e)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/cloudflare-worker (#2865) (ef61ce0)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs (#2869) (5aab61c)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs-web (#2871) (285f879)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm (#2872) (3ea3374)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-auto (#2873) (34e0877)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-web (#2875) (03342c5)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/vercel-edge (#2878) (1149531)
• deps-dev: bump yargs from 18.1.0 to 18.2.0 (#2874) (b1916d4)
• deps: refresh development and ecosystem dependencies (#2889) (68d22b9)
• responses: parse structured text only in final message phases (#2893) (534e691)

... (truncated)

Changelog

Sourced from openai's changelog.

7.32.0 (2026-10-09)

Features

• api: add agent environment suspension and expiration (#2904) (6e4ed63)

Bug Fixes

• deps: bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge (#2896) (88b4c05)
• runners: preserve detailed token usage in totalUsage (#2900) (88bb984)

Documentation

• fix migration guide types troubleshooting link (#2901) (690e5d7)

7.31.0 (2026-10-09)

Features

• api: add prewarmed hosted environments (#2898) (7a0be86)

7.30.1 (2026-10-08)

Bug Fixes

• api: correct custom voice creation parameters (#2895) (3edaf0f)
• deps-dev: bump @​aws-sdk/credential-provider-node from 3.972.83 to 3.972.84 (#2877) (0878349)
• deps-dev: bump @​smithy/signature-v4 from 5.7.3 to 5.7.4 (#2870) (12ce5f2)
• deps-dev: bump jest from 30.5.1 to 30.5.2 (#2867) (48b5c2a)
• deps-dev: bump oxfmt from 0.67.0 to 0.70.0 (#2864) (91a226d)
• deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/browser-direct-import (#2863) (89ded6b)
• deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/ts-browser-webpack (#2876) (6ef1b6e)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/cloudflare-worker (#2865) (ef61ce0)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs (#2869) (5aab61c)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs-web (#2871) (285f879)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm (#2872) (3ea3374)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-auto (#2873) (34e0877)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-web (#2875) (03342c5)
• deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/vercel-edge (#2878) (1149531)
• deps-dev: bump yargs from 18.1.0 to 18.2.0 (#2874) (b1916d4)
• deps: refresh development and ecosystem dependencies (#2889) (68d22b9)
• responses: parse structured text only in final message phases (#2893) (534e691)
• uploads: decode inferred URL filenames safely (#2892) (30d50ab)

7.30.0 (2026-10-06)

... (truncated)

Commits

• 2b12eab release: 7.32.0 (#2903)
• 6e4ed63 feat(api): add agent environment suspension and expiration (#2904)
• 37af8fc test: wait for mock daemon exit before fixture cleanup (#2902)
• 690e5d7 docs: fix migration guide types troubleshooting link (#2901)
• 88bb984 fix(runners): preserve detailed token usage in totalUsage (#2900)
• 88b4c05 fix(deps): bump next from 15.5.25 to 15.5.27 in /ecosystem-tests/vercel-edge ...
• 5e70623 release: 7.31.0 (#2899)
• 7a0be86 feat(api): add prewarmed hosted environments (#2898)
• bc6c0bf release: 7.30.1 (#2890)
• 3edaf0f fix(api): correct custom voice creation parameters (#2895)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.