chore(deps): bump the npm-minor-patch group across 1 directory with 29 updates

[dependabot]

Bumps the npm-minor-patch group with 29 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.11	2.5.13
fallow	3.21.0	3.25.0
@better-auth/redis-storage	1.7.2	1.7.4
ai	7.0.84	7.0.99
better-auth	1.7.2	1.7.4
eve	0.47.7	0.54.3
next	16.3.3	16.3.5
zod	4.5.4	4.6.2
@types/node	26.4.0	26.5.1
@flags-sdk/vercel	1.4.7	1.4.8
@tiptap/core	3.31.0	3.31.3
@tiptap/pm	3.31.0	3.31.3
@tiptap/react	3.31.0	3.31.3
@tiptap/starter-kit	3.31.0	3.31.3
flags	4.3.0	4.3.1
radix-ui	1.6.0	1.6.7
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.5	19.3.0
react-email	6.9.3	6.9.5
resend	6.25.0	6.28.0
shadcn	4.19.1	4.21.0
@next/playwright	16.3.3	16.3.5
@playwright/test	1.62.1	1.63.0
@tailwindcss/postcss	4.3.1	4.3.3
@testing-library/user-event	14.6.6	14.6.7
playwright	1.62.1	1.63.0
tailwindcss	4.3.1	4.3.3

Updates @biomejs/biome from 2.5.11 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• Additional commits viewable in compare view

Updates fallow from 3.21.0 to 3.25.0

Release notes

Sourced from fallow's releases.

v3.25.0: positional path scope, runtime coverage joins callbacks and object members

Scope any file command to a path

Bare fallow, check, dupes, health, audit, security, fix, list and similar-code now take an optional positional path:

npx fallow src/components
npx fallow health src/api/client.ts
npx fallow fix src/legacy

The whole-project graph is still built, so every cross-file fact stays sound. Only the reported findings narrow, and fix plans and applies only the fixes that touch scoped files.

Resolution is root-first for a bare relative path, ./ and ../ are honoured as current-directory claims, and a missing or outside-root path is rejected with an actionable exit-2 error rather than silently analysing the whole project. The scope composes with --workspace as one more workspace root and intersects with --changed-since and --diff-file. audit narrows its changed-file universe so verdict and base attribution stay coherent, while its base pass stays unscoped because it runs in another worktree.

Runtime coverage joins far more of your code

fallow coverage analyze --cloud joins cloud runtime rows against a static index that was built from the health and complexity pass, which enumerates declarations and bindings only. Everything else the runtime instrumenter names, an arrow passed to a call and named after its callee (rows.map(...), sqliteTable("t", {}, (table) => [...]), .references(() => ...)), an object-literal method, a getter or setter, and a function assigned to a member, had nothing to join against. Those rows landed in cloud_functions_unmatched instead of reaching findings and hot_paths, and in a typical service those are exactly the highest-traffic functions, so the hot-path list was led by whichever declaration happened to be enumerated.

The index now carries every function the instrumenter would name, resolved through the same walker the static inventory upload uses, so the identity matches the stable_id the cloud stores. A function known only by the callee it was passed to is flagged as a callback and its verdict copy names the call site ("Callback passed to map; ...") instead of pointing at a declaration that does not exist.

The static function inventory was fixed on the same terms: an object-literal method, a function-valued property, a getter or setter, a function assigned to a member expression, and an anonymous export default were left at their (anonymous_N) placeholder while the instrumenter names them run, execute, get closed, rollback and default. Both sides now agree, so an uploaded inventory entry and the runtime row for the same function share one identity.

... (truncated)

Commits

• 30167b4 chore: release v3.25.0
• 03aad8c fix(cli): print forward slashes in the check and health human output
• 423ce06 fix(coverage): index instrumenter-named callbacks and object members for the ...
• b7722af feat(coverage): report the caller-edge size guard in the inventory blob
• 69d8d81 feat: support positional PATH scope across file commands
• 4b8d691 chore: advance the schema policy baseline to v3.24.1
• 594fccb chore(docker): pin FALLOW_VERSION 3.24.1 with refreshed checksums
• 59ce79f chore(napi): sync package.json / package-lock / index.js to v3.24.1
• c2da9fc chore: release v3.24.1
• 3628395 ci: stop a third-party apt source failing the cross-compile jobs
• Additional commits viewable in compare view

Updates @better-auth/redis-storage from 1.7.2 to 1.7.4

Release notes

Sourced from @​better-auth/redis-storage's releases.

v1.7.4

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
• Added support for additional session fields in testUtils auth helpers. (#11217)
• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore. (#11238)
• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from @​better-auth/redis-storage's changelog.

1.7.4

1.7.3

Commits

• 735008f chore: release v1.7.4 (#11216)
• 597d39c chore: release v1.7.3 (#11032)
• 9e0c514 fix: isolate redis storage vitest project (#11025)
• See full diff in compare view

Updates ai from 7.0.84 to 7.0.99

Release notes

Sourced from ai's releases.

ai@7.0.99

Patch Changes

• 615ac89: feat(ai): use InvalidArgumentError for utility input validation
• Updated dependencies [7f76d83]
  • @​ai-sdk/gateway@​4.0.80

Changelog

Sourced from ai's changelog.

7.0.99

Patch Changes

• 615ac89: feat(ai): use InvalidArgumentError for utility input validation
• Updated dependencies [7f76d83]
  • @​ai-sdk/gateway@​4.0.80

7.0.98

Patch Changes

• 5ec21a6: fix: reject unsupported batch request types
• db59d78: feat(ai): add runtime context attribution to embed, embedMany and rerank
• 7469a3b: feat: support image generation requests in batches
• f87bf07: fix(ai): reject invalid reranking provider indices
• bc5cb7a: fix(ai): accept inferred tools in validateUIMessages
• a5f449a: feat(ai): add a stable UI message type and type guard for tool output errors
• Updated dependencies [5ec21a6]
• Updated dependencies [7469a3b]
• Updated dependencies [dbd83a3]
• Updated dependencies [813bb36]
• Updated dependencies [c43e4b7]
• Updated dependencies [03f4e59]
  • @​ai-sdk/gateway@​4.0.79
  • @​ai-sdk/provider@​4.0.14
  • @​ai-sdk/provider-utils@​5.0.40

7.0.97

Patch Changes

• ef3bac4: Observe video webhook receiver rejections before generation starts to prevent unhandled rejections during or after a failed start. Preserve start error precedence and assimilate custom receivers only once.
• 9942196: feat: add batch cancel and list APIs
• Updated dependencies [9942196]
  • @​ai-sdk/provider@​4.0.13
  • @​ai-sdk/gateway@​4.0.78
  • @​ai-sdk/provider-utils@​5.0.39

7.0.96

Patch Changes

• 912fb01: feat: add batch cancel and list APIs
• c595e6e: fix(ai): call atob without a receiver for Cloudflare Workers compatibility
• Updated dependencies [912fb01]
• Updated dependencies [aa4cc14]
• Updated dependencies [f102e41]
  • @​ai-sdk/provider@​4.0.12
  • @​ai-sdk/gateway@​4.0.77

... (truncated)

Commits

• 6c6c221 Version Packages (#20670)
• 615ac89 feat: use InvalidArgumentError for utility input validation (#20304)
• 9ed46d2 Version Packages (#20569)
• a5f449a feat: add a stable UI message type and type guard for tool output errors (#20...
• bc5cb7a fix(ai): accept inferred tools in validateUIMessages (#20660)
• db59d78 feat(ai): add runtime context attribution to embed, embedMany and rerank (#20...
• 7469a3b feat: support image generation requests in batches (#20594)
• f87bf07 fix: rerank() returns undefined documents for invalid provider ranking indice...
• 5ec21a6 fix: reject unsupported batch request types (#20562)
• e9795ab Version Packages (#20555)
• Additional commits viewable in compare view

Updates better-auth from 1.7.2 to 1.7.4

Release notes

Sourced from better-auth's releases.

v1.7.4

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
• Added support for additional session fields in testUtils auth helpers. (#11217)
• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore. (#11238)
• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.4

Patch Changes

• #11205 3f890eb Thanks @​bytaesu! - Support Vitest 5 in the testing utilities while retaining support for previously supported Vitest versions.

• #11224 c1756a2 Thanks @​bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

• #11217 9b9638e Thanks @​onmax! - Allow testUtils auth helpers to accept additional session fields through the session option, including required fields without defaults and per-session overrides of configured defaults.

• Updated dependencies [3ff842a, b905bfe, c1756a2]:

  • @​better-auth/core@​1.7.4
  • @​better-auth/drizzle-adapter@​1.7.4
  • @​better-auth/kysely-adapter@​1.7.4
  • @​better-auth/memory-adapter@​1.7.4
  • @​better-auth/mongo-adapter@​1.7.4
  • @​better-auth/prisma-adapter@​1.7.4
  • @​better-auth/telemetry@​1.7.4

1.7.3

Patch Changes

• #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

• #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

• #11120 7ec7146 Thanks @​onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

• #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

• #11188 c47b765 Thanks @​bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

• #11084 2d5c63d Thanks @​bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

• #11147 a9d8c12 Thanks @​bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

• #10988 9fc7498 Thanks @​bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

• #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

  Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

• #11069 0bb0dbf Thanks @​bytaesu! - Improve dynamic organization role permission check performance.

• #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

  If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

• #10978 5fe5bc2 Thanks @​BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

... (truncated)

Commits

• 735008f chore: release v1.7.4 (#11216)
• 80b1d64 chore(deps): bump next (#11226)
• 9b9638e feat(test-utils): accept additional session fields in auth helpers (#11217)
• eb8b6fd test: adopt Vitest 5 features (#11211)
• 3f890eb feat(test): support Vitest 5 (#11205)
• c1756a2 feat(instrumentation): add option to disable tracing (#11224)
• 874752f test(open-api): lock in requestBody for /phone-number/verify (#11208)
• cfedf97 docs: update CLI references to auth (#11214)
• 597d39c chore: release v1.7.3 (#11032)
• 1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
• Additional commits viewable in compare view

Updates eve from 0.47.7 to 0.54.3

Release notes

Sourced from eve's releases.

eve@0.54.3

Patch Changes

• 6cb22a4: Store ChatGPT refresh credentials in the OS credential store using vendored just-secrets, with access tokens kept in memory. Existing users must sign in once through eve; a successful save removes the old plaintext session file. ChatGPT sign-in now remains inside the model setup panel while browser authentication is in progress.
• c5bb66f: fix(eve): align internal AI SDK step lifecycle hooks with the current onStepStart and onStepEnd callback names
• fb6750f: Resume sessions whose history predates user-message provenance instead of failing with a missing-kind error. Existing unclassified messages retain their content and are marked legacy.unknown, without treating unknown framework input as a new human request after compaction.
• eaf8895: Add defineWorkspaceAgent() for delegating to a workspace peer by name. It selects Vercel routing and OIDC automatically on Vercel, accepts explicit transport overrides elsewhere, and uses the peer agent's description by default.

eve@0.54.2

Patch Changes

• 15e18d6: Treat recalled memory records as model input content when applying instrumentation trace policies.
• 47b7a38: Emit OpenTelemetry GenAI invoke_workflow spans when a defineWorkflowTool run coordinates nested agents, using the path-derived tool name as gen_ai.workflow.name. Durable workflow tools without agent operations remain ordinary actions.

eve@0.54.0

Minor Changes

• 879d4e5: Advance agent.trace.schema.version from 3 to 4 and remove agent.session and agent.channel.delivery: update dashboards to use per-activation invoke_agent spans, linked to callers and grouped by gen_ai.conversation.id. Single turn-bound channel deliveries annotate their activation and link it to the active upstream request or function span; traceChannelRequests only adds an eve-owned server span as the link target. Other delivery lifecycles do not emit agent spans. Dispatch uses agent.action and execute_tool, preserves standard GenAI usage totals and trace-content restrictions, and rejects baggage overflow; settlement materializes spans without draining exporters, and conversation IDs remain available without instrumentation.

Patch Changes

• f60c64b: Brand every user-role model message in gen_ai.input.messages. Real user input is user; framework-authored messages use namespaced provenance such as context.instruction and execution.background_task.
• 84c9604: Make self-modification source edits more efficient by clarifying file and documentation discovery, guarded reads, edit selection, contract preservation, outbound request safety, registry scope, and concise completion reports. Memory providers can now be selected as a registry search category.
• dea8cd8: The local dev TUI now reconnects idle session streams, so approvals and questions from long-running background tasks still interrupt the prompt after an earlier transport stream closes.
• 47bd3d7: Preserve one observability conversation ID across local and remote agent dispatch, accepting incoming correlation only on callback-marked remote session creation. Apply the live delivery's trace-content ceiling to the selected caller context, including fallback when its action span is unavailable.
• 6d0485b: Expose current and initiating principals in Agent Runs turn metadata, including channel-driven and resumed activations. Principal types remain bounded; IDs require a content-visible audience and a resolved trace policy permitting both input and output content, including any forwarded ceiling, and oversized IDs are omitted.
• 9381078: Keep agent.action spans for background tools and subagents open until their tasks complete, fail, or are cancelled, and record the task's final outcome and policy-controlled error details instead of treating its receipt as completion.

eve@0.53.1

Patch Changes

• 8c00b8e: Upload Slack responses longer than the native Markdown limit as Markdown snippets. Preserve upload errors for channel error logging instead of replacing them with a generic notice.
• 11320e1: Enable the built-in Vercel Agent Runs instrumentation for Preview deployments as well as Production deployments.
• 8c8888e: Normalize mixed provider-executed and local tool calls into replay-safe history so Gemini conversations can continue after the tool results are persisted.
• 09df32c: Adds experimental.workflow.retention to defineAgent, which forwards a run's data-retention preference to the durable runtime. Set it to 0 to have a run's payloads, streams, and event log deleted as soon as the run finishes instead of kept for the world's default period.
• 05d2047: Keep Vercel sandbox template records persistent and replace session sandboxes whose saved filesystem snapshot is no longer available. Ambiguous session creation failures no longer delete the shared template record.

eve@0.53.0

Minor Changes

• 0f8caf4: Simplify workflow-tool delegation to ctx.agent(target, input). eve now derives replay-stable invocation identities, so workflow authors no longer provide separate key and target fields, and inline output schemas infer the structured result type.

Patch Changes

• 7090a95: chore(eve): update AI SDK dependencies
• 67ee820: Fix loading eve-owned authored modules, including the self-modification extension, from workspace-linked installations. Package builds now also preserve eve self-imports without unresolved-import warnings.
• 8c1430c: Allow Ctrl+C to interrupt a pending dev TUI turn cancellation and arm the next press to exit.
• 2b2ad19: Add an experimental workflow.modelCallsPerStep agent option for batching sequential model and inline tool cycles into fewer Workflow checkpoints. Raising it above one reduces checkpoint overhead while widening the retry and replay unit.
• 86e13ff: Update Workflow packages to use released Windows read retries while preserving session inbox metadata negotiation.

... (truncated)

Changelog

Sourced from eve's changelog.

0.54.3

Patch Changes

• 6cb22a4: Store ChatGPT refresh credentials in the OS credential store using vendored just-secrets, with access tokens kept in memory. Existing users must sign in once through eve; a successful save removes the old plaintext session file. ChatGPT sign-in now remains inside the model setup panel while browser authentication is in progress.
• c5bb66f: fix(eve): align internal AI SDK step lifecycle hooks with the current onStepStart and onStepEnd callback names
• fb6750f: Resume sessions whose history predates user-message provenance instead of failing with a missing-kind error. Existing unclassified messages retain their content and are marked legacy.unknown, without treating unknown framework input as a new human request after compaction.
• eaf8895: Add defineWorkspaceAgent() for delegating to a workspace peer by name. It selects Vercel routing and OIDC automatically on Vercel, accepts explicit transport overrides elsewhere, and uses the peer agent's description by default.

0.54.2

Patch Changes

• 15e18d6: Treat recalled memory records as model input content when applying instrumentation trace policies.
• 47b7a38: Emit OpenTelemetry GenAI invoke_workflow spans when a defineWorkflowTool run coordinates nested agents, using the path-derived tool name as gen_ai.workflow.name. Durable workflow tools without agent operations remain ordinary actions.

0.54.1

Patch Changes

• ee11c23: Record model input once using the OpenTelemetry gen_ai.input.messages schema. Local traces no longer serialize the duplicate ai.prompt.messages payload, avoiding binary attachment traversal.
• b27e9f2: Remove the task_update tool and its child-to-parent progress callbacks; use the child session's stream to follow progress. Successful results from overlapping background tasks now reach the parent together across launch turns, after child settlement updates usage and handles; user input, failures, and cancellation remain responsive.
• b27e9f2: Report content-filtered model responses distinctly, including their finish reason and Gateway generation ID when available, instead of retrying them as empty responses. Filtered partial text is no longer delivered as a completed reply.
• 0e2912f: Add OpenTelemetry GenAI spans for memory provider recall and capture operations.
• b27e9f2: Fix eve dev silently stopping session updates during long periods of background work. The terminal now keeps listening while the prompt is open, so completion reports appear without another user message.

0.54.0

Minor Changes

• 879d4e5: Advance agent.trace.schema.version from 3 to 4 and remove agent.session and agent.channel.delivery: update dashboards to use per-activation invoke_agent spans, linked to callers and grouped by gen_ai.conversation.id. Single turn-bound channel deliveries annotate their activation and link it to the active upstream request or function span; traceChannelRequests only adds an eve-owned server span as the link target. Other delivery lifecycles do not emit agent spans. Dispatch uses agent.action and execute_tool, preserves standard GenAI usage totals and trace-content restrictions, and rejects baggage overflow; settlement materializes spans without draining exporters, and conversation IDs remain available without instrumentation.

Patch Changes

• f60c64b: Brand every user-role model message in gen_ai.input.messages. Real user input is user; framework-authored messages use namespaced provenance such as context.instruction and execution.background_task.
• 84c9604: Make self-modification source edits more efficient by clarifying file and documentation discovery, guarded reads, edit selection, contract preservation, outbound request safety, registry scope, and concise completion reports. Memory providers can now be selected as a registry search category.
• dea8cd8: The local dev TUI now reconnects idle session streams, so approvals and questions from long-running background tasks still interrupt the prompt after an earlier transport stream closes.
• 47bd3d7: Preserve one observability conversation ID across local and remote agent dispatch, accepting incoming correlation only on callback-marked remote session creation. Apply the live delivery's trace-content ceiling to the selected caller context, including fallback when its action span is unavailable.
• 6d0485b: Expose current and initiating principals in Agent Runs turn metadata, including channel-driven and resumed activations. Principal types remain bounded; IDs require a content-visible audience and a resolved trace policy permitting both input and output content, including any forwarded ceiling, and oversized IDs are omitted.
• 9381078: Keep agent.action spans for background tools and subagents open until their tasks complete, fail, or are cancelled, and record the task's final outcome and policy-controlled error details instead of treating its receipt as completion.

0.53.1

Patch Changes

• 8c00b8e: Upload Slack responses longer than the native Markdown limit as Markdown snippets. Preserve upload errors for channel error logging instead of replacing them with a generic notice.
• 11320e1: Enable the built-in Vercel Agent Runs instrumentation for Preview deployments as well as Production deployments.
• 8c8888e: Normalize mixed provider-executed and local tool calls into replay-safe history so Gemini conversations can continue after the tool results are persisted.
• 09df32c: Adds experimental.workflow.retention to defineAgent, which forwards a run's data-retention preference to the durable runtime. Set it to 0 to have a run's payloads, streams, and event log deleted as soon as the run finishes instead of kept for the world's default period.
• 05d2047: Keep Vercel sandbox template records persistent and replace session sandboxes whose saved filesystem snapshot is no longer available. Ambiguous session creation failures no longer delete the shared template record.

... (truncated)

Commits

• 543c345 Version Packages (#3298)
• fb6750f fix(eve): restore legacy session history (#3303)
• c5bb66f fix(eve): align internal AI SDK step lifecycle hooks with the current `onStep...
• eaf8895 feat(eve): add name-addressed workspace agents (#3175)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tendnote-web	Error		Sep 15, 2026 12:52pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e33cd3f3-05d2-4ff7-bd8c-67a30a86bf10

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}