[dependabot]

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.131.0	0.135.0
express	5.2.1	5.3.0
openai	7.27.0	7.34.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1

Updates @anthropic-ai/sdk from 0.131.0 to 0.135.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

sdk-v0.134.0

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start
• streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.135.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

0.134.0 (2026-10-14)

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start

... (truncated)

Commits

• 04a4c28 release: 0.135.0
• 69dbe62 Merge pull request #935 from anthropics/synced/published
• b61a531 feat(helpers): retry a rate-limited fast fallback at standard speed (#943)
• 38d0ab4 feat(api): add between_tools to thinking types in model capabilities
• 366b53b chore(docs): describe headers on Managed Agents and telemetry endpoints
• ca50812 docs(api): note that some models need a beta header to use speed
• 03f6012 fix(helpers): honor speed overrides from fallback entries when streaming (#942)
• 88bf034 docs(changelog): shorten the OpenTelemetry tracing note (#941)
• 7c807a0 fix(client): close streams dropped without being read to the end
• 64758f6 feat(api): add the speed parameter and usage.speed to Messages
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates openai from 7.27.0 to 7.34.0

Release notes

Sourced from openai's releases.

v7.34.0

7.34.0 (2026-10-14)

Features

• api: add regional processing residency options (#2942) (0f53768)

Bug Fixes

• deps-dev: bump @​cloudflare/workers-types from 5.20260927.1 to 5.20261005.1 in /ecosystem-tests/cloudflare-worker (#2928) (d8b450e)
• deps-dev: bump @​types/node from 26.4.1 to 26.6.4 (#2923) (55bfde2)
• deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs (#2931) (6f2c0ab)
• deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs-auto (#2932) (66c3d52)
• deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts4.5-jest28 (#2933) (1abf914)
• deps-dev: bump oxfmt from 0.70.0 to 0.72.0 (#2924) (ca86f0a)
• deps-dev: bump oxlint from 1.82.0 to 1.87.0 (#2927) (76563b3)
• deps-dev: bump vitest from 5.0.1 to 5.0.3 (#2925) (475db88)
• deps-dev: bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/cloudflare-worker (#2929) (6886675)
• deps: bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs (#2930) (233e488)
• deps: bump undici from 8.10.2 to 8.11.2 (#2926) (4c4aa8b)

Chores

• api: clarify Decisions request and response fields (#2940) (9f07cfc)

v7.33.0

7.33.0 (2026-10-14)

Features

• add browser and computer toolsets (1/4) (#2936) (3811840)
• api: add beta session spending limits (#2916) (f57c965)
• api: add billing_not_active session error code (#2911) (ee3f743)
• api: add OCI external-storage provider support (#2917) (80e210e)
• api: add organization Decisions usage reporting (#2919) (3f8753e)
• api: add shida to named Live voices (#2912) (d6d80a1)
• api: add vault updates and metadata filters (#2906) (1bbc425)
• api: align beta pagination limits and non-null parameters (#2915) (4ae463a)
• api: expose image tool error and moderation details (#2935) (0bf85e0)
• api: support image URLs and detailed safety alert explanations (#2918) (8297332)
• api: support updating project API key expiry (#2922) (467a082)

Chores

• api: clarify agent tool limits and environment pagination (#2920) (05b8763)

... (truncated)

Changelog

Sourced from openai's changelog.

7.34.0 (2026-10-14)

Features

• api: add regional processing residency options (#2942) (0f53768)

Bug Fixes

• deps-dev: bump @​cloudflare/workers-types from 5.20260927.1 to 5.20261005.1 in /ecosystem-tests/cloudflare-worker (#2928) (d8b450e)
• deps-dev: bump @​types/node from 26.4.1 to 26.6.4 (#2923) (55bfde2)
• deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs (#2931) (6f2c0ab)
• deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts-cjs-auto (#2932) (66c3d52)
• deps-dev: bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-ts4.5-jest28 (#2933) (1abf914)
• deps-dev: bump oxfmt from 0.70.0 to 0.72.0 (#2924) (ca86f0a)
• deps-dev: bump oxlint from 1.82.0 to 1.87.0 (#2927) (76563b3)
• deps-dev: bump vitest from 5.0.1 to 5.0.3 (#2925) (475db88)
• deps-dev: bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/cloudflare-worker (#2929) (6886675)
• deps: bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs (#2930) (233e488)
• deps: bump undici from 8.10.2 to 8.11.2 (#2926) (4c4aa8b)

Chores

• api: clarify Decisions request and response fields (#2940) (9f07cfc)

7.33.0 (2026-10-14)

Features

• add browser and computer toolsets (1/4) (#2936) (3811840)
• api: add beta session spending limits (#2916) (f57c965)
• api: add billing_not_active session error code (#2911) (ee3f743)
• api: add OCI external-storage provider support (#2917) (80e210e)
• api: add organization Decisions usage reporting (#2919) (3f8753e)
• api: add shida to named Live voices (#2912) (d6d80a1)
• api: add vault updates and metadata filters (#2906) (1bbc425)
• api: align beta pagination limits and non-null parameters (#2915) (4ae463a)
• api: expose image tool error and moderation details (#2935) (0bf85e0)
• api: support image URLs and detailed safety alert explanations (#2918) (8297332)
• api: support updating project API key expiry (#2922) (467a082)

Chores

• api: clarify agent tool limits and environment pagination (#2920) (05b8763)
• api: clarify decision creation documentation (#2913) (1c380ea)
• api: clarify Decisions question and answer descriptions (#2910) (b5c7300)

... (truncated)

Commits

• 85e528a release: 7.34.0 (#2941)
• 0f53768 feat(api): add regional processing residency options (#2942)
• 76563b3 fix(deps-dev): bump oxlint from 1.82.0 to 1.87.0 (#2927)
• 4c4aa8b fix(deps): bump undici from 8.10.2 to 8.11.2 (#2926)
• 55bfde2 fix(deps-dev): bump @​types/node from 26.4.1 to 26.6.4 (#2923)
• d8b450e fix(deps-dev): bump @​cloudflare/workers-types from 5.20260927.1 to 5.20261005...
• ca86f0a fix(deps-dev): bump oxfmt from 0.70.0 to 0.72.0 (#2924)
• 6886675 fix(deps-dev): bump wrangler from 4.142.0 to 4.147.0 in /ecosystem-tests/clou...
• 66c3d52 fix(deps-dev): bump @​types/ws from 8.18.1 to 8.18.2 in /ecosystem-tests/node-...
• 233e488 fix(deps): bump undici from 7.29.1 to 7.30.0 in /ecosystem-tests/node-ts-cjs ...
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions