Skip to content

build(deps): bump the production group across 1 directory with 6 updates - #124

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-d85a1572e6
Open

build(deps): bump the production group across 1 directory with 6 updates#124
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-d85a1572e6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown

Bumps the production group with 5 updates in the / directory:

Package From To
typescript 5.9.3 7.0.2
next 16.2.12 16.3.4
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
zod 4.4.3 4.6.1

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @mastra/core from 1.55.0 to 1.66.0

Release notes

Sourced from @​mastra/core's releases.

September 10, 2026

Highlights

Deploy-scoped worker provisioning for Mastra Cloud

@mastra/deployer can now statically emit a versioned workers.json manifest (when shared storage + PubSub are configured) to provision dedicated orchestration/scheduler/background/custom workers, and runtime workers expose an authenticated endpoint so Cloud can compare live topology vs build-time.

Advanced trace queries: richer filtering across span fields, metadata, feedback, and scores (with DB support)

Trace querying gains high-power predicates for same-span properties (model/provider, duration, outcome, identity, lineage), portable top-level metadata.* predicates, and richer feedback / scores filters—supported end-to-end in @mastra/server plus @mastra/pg, @mastra/clickhouse, and @mastra/duckdb.

Observability signal deletion (feedback + scores) across storage, server, and client

Core observability storage adds idempotent batch deleteFeedback() / deleteScores() (with optional org/resource scoping), with corresponding DELETE /api/observability/* routes in @mastra/server and client methods in @mastra/client-js; ClickHouse/DuckDB/Postgres (and others) implement backend handling.

Observational Memory transform hooks

@mastra/memory adds async transform hooks (beforeObservation, afterObservation, beforeReflection, afterReflection) so apps can filter/redact/reshape messages and generated observations/reflections before model calls or persistence.

Streaming reliability: first-chunk timeout + lower tracing overhead

modelSettings.timeout.firstChunkMs lets you fail fast if a streaming model doesn’t produce its first real content chunk in time (with fallback-model behavior preserved), and Agent.stream() no longer rebuilds observability contexts per chunk, preventing tracing overhead from scaling with response length.

Breaking Changes

  • None called out in this changelog.

Changelog

@​mastra/core@1.66.0

Minor Changes

  • Added trace filters for span names, model providers, timing, outcomes, identity, and version lineage. (#23018)

    await mastraClient.queryTraces({
      timeRange: { from: '2026-08-01T00:00:00.000Z', to: '2026-08-08T00:00:00.000Z' },
      where: { spans: { some: { op: 'eq', left: { path: 'name' }, right: { literal: 'medication_lookup' } } } },
    });
  • Added deleteFeedback() and deleteScores() to observability storage. Both accept a batch of ids and optional organizationId / resourceId tenant scope, are idempotent, and are implemented by the in-memory store. Storage adapters that don't implement them throw a not-implemented error. (#22558)

    await observability.deleteFeedback({ feedbackIds: ['feedback-1'] });
    await observability.deleteScores({ scoreIds: ['score-1'], organizationId: 'org-1' });
  • Added typed input and output payloads for the spans Mastra records itself: AGENT_RUN, MODEL_GENERATION, MODEL_STEP and MODEL_INFERENCE. Every other span type keeps any. Stored spans narrow the same way with isSpanRecordOfType, which types attributes, input and output without a cast: (#23141)

    import { SpanType, isSpanRecordOfType } from '@mastra/core/observability';
    if (isSpanRecordOfType(span, SpanType.MODEL_GENERATION)) {
    span.attributes?.usage; // UsageStats | undefined
    span.input?.messages; // MessageListInput

... (truncated)

Commits
  • cbd18af chore: version - exit prerelease mode
  • ca24bc4 chore: version packages
  • 0d56f39 feat(observability): support feedback trace predicates (#23033)
  • 119d2aa feat(deploy): autoprovision deploy-scoped workers (#22394)
  • 0096d5c fix(core): preserve tool failures and identity in trajectories (#23511)
  • cf9cd79 refactor(core): fold text and reasoning spans through one shared unit (#23310)
  • 3da908f feat(agent-controller): paginate stored thread messages (#22977)
  • 4fbca45 chore: version packages (alpha) (#23394)
  • 4cbb201 fix(core): bound snapshot batches during suspended-run discovery (#23506)
  • 8263b76 chore: regenerate providers and docs [skip ci]
  • Additional commits viewable in compare view

Updates next from 16.2.12 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

... (truncated)

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Commits

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

Bumps the production group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [next](https://github.com/vercel/next.js) | `16.2.12` | `16.3.4` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.1` |



Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

Updates `@mastra/core` from 1.55.0 to 1.66.0
- [Release notes](https://github.com/mastra-ai/mastra/releases)
- [Changelog](https://github.com/mastra-ai/mastra/blob/main/docs/CHANGELOG.md)
- [Commits](https://github.com/mastra-ai/mastra/commits/@mastra/core@1.66.0/packages/core)

Updates `next` from 16.2.12 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.4)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `zod` from 4.4.3 to 4.6.1
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.1)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production
- dependency-name: "@mastra/core"
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: zod
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 13, 2026
@coderabbitai

coderabbitai Bot commented Sep 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b318054e-4cbe-4c3c-8ac9-43f13fdf56be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants