chore(deps): update npm minor and patch dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-agent-sdk	^0.3.218 → ^0.3.224
@cloudflare/puppeteer (source)	^1.1.0 → ^1.3.0
@cloudflare/vitest-pool-workers (source)	^0.18.8 → ^0.20.3
@cloudflare/workers-types	^5.20260724.1 → ^5.20260804.1
@hono/node-server	^2.0.11 → ^2.1.0
@lovable.dev/vite-plugin-dev-server-bridge (source)	1.2.1 → 1.3.0
@lovable.dev/vite-plugin-hmr-gate (source)	1.1.4 → 1.5.0
@lovable.dev/vite-tanstack-config (source)	2.7.7 → 2.9.1
@modelcontextprotocol/sdk (source)	1.29.0 → 1.30.0
@octokit/core	^7.0.6 → ^7.0.7
@posthog/cli (source)	0.9.1 → 0.10.0
@radix-ui/react-accordion (source)	^1.2.18 → ^1.2.20
@radix-ui/react-alert-dialog (source)	^1.1.21 → ^1.1.23
@radix-ui/react-aspect-ratio (source)	^1.1.13 → ^1.1.15
@radix-ui/react-avatar (source)	^1.2.4 → ^1.2.6
@radix-ui/react-checkbox (source)	^1.3.9 → ^1.3.11
@radix-ui/react-collapsible (source)	^1.1.18 → ^1.1.20
@radix-ui/react-context-menu (source)	^2.3.5 → ^2.3.7
@radix-ui/react-dialog (source)	^1.1.21 → ^1.1.23
@radix-ui/react-dropdown-menu (source)	^2.1.22 → ^2.1.24
@radix-ui/react-hover-card (source)	^1.1.21 → ^1.1.23
@radix-ui/react-label (source)	^2.1.13 → ^2.1.15
@radix-ui/react-menubar (source)	^1.1.22 → ^1.1.24
@radix-ui/react-navigation-menu (source)	^1.2.20 → ^1.2.22
@radix-ui/react-popover (source)	^1.1.21 → ^1.1.23
@radix-ui/react-progress (source)	^1.1.14 → ^1.1.16
@radix-ui/react-radio-group (source)	^1.4.5 → ^1.4.7
@radix-ui/react-scroll-area (source)	^1.2.16 → ^1.2.18
@radix-ui/react-select (source)	^2.3.5 → ^2.3.7
@radix-ui/react-separator (source)	^1.1.13 → ^1.1.15
@radix-ui/react-slider (source)	^1.4.5 → ^1.4.7
@radix-ui/react-slot (source)	^1.3.1 → ^1.3.3
@radix-ui/react-switch (source)	^1.3.5 → ^1.3.7
@radix-ui/react-tabs (source)	^1.1.19 → ^1.1.21
@radix-ui/react-toggle (source)	^1.1.16 → ^1.1.18
@radix-ui/react-toggle-group (source)	^1.1.17 → ^1.1.19
@radix-ui/react-tooltip (source)	^1.2.14 → ^1.2.16
@scalar/api-reference-react (source)	^0.9.59 → ^0.9.61
@sentry/node (source)	^10.67.0 → ^10.69.0
@sentry/react (source)	^10.67.0 → ^10.69.0
@tanstack/react-router (source)	^1.170.18 → ^1.170.22
@tanstack/react-start (source)	^1.168.32 → ^1.168.39
@tanstack/router-plugin (source)	^1.168.23 → ^1.168.27
@types/pg (source)	^8.20.0 → ^8.20.4
@types/react (source)	^19.2.17 → ^19.2.18
@types/react-dom (source)	^19.2.3 → ^19.2.4
@types/semver (source)	^7.7.1 → ^7.8.0
agents (source)	^0.19.0 → ^0.20.1
fumadocs-core	^16.12.1 → ^16.14.2
fumadocs-mdx	^15.2.0 → ^15.2.2
globals	^17.7.0 → ^17.9.0
hono (source)	^4.12.31 → ^4.13.1
hono (source)	^4.12.34 → ^4.13.1
js-yaml	^4.3.0 → ^4.3.1
motion	^12.42.2 → ^12.43.0
node-addon-api	^8.9.0 → ^8.9.1
npm (source)	10.9.8 → 10.9.9
playwright (source)	^1.61.1 → ^1.62.1
posthog-js (source)	^1.409.3 → ^1.414.0
posthog-node (source)	^5.46.1 → ^5.48.1
react-hook-form (source)	^7.82.0 → ^7.84.0
tar	^7.5.21 → ^7.5.22
tsx (source)	4.22.5 → 4.23.11
tsx (source)	^4.23.1 → ^4.23.11
turbo (source)	^2.10.6 → ^2.10.8
typescript-eslint (source)	^8.65.0 → ^8.66.0
vite (source)	^8.1.5 → ^8.2.1
web-tree-sitter (source)	^0.20.8 → ^0.26.11
wrangler (source)	^4.115.0 → ^4.120.0
wrangler (source)	^4.114.0 → ^4.120.0
ws	^8.21.1 → ^8.21.3

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.224

Compare Source

• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
• Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
• Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
• Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

v0.3.223

Compare Source

• Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
• Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
• Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
• Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

v0.3.222

Compare Source

• Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

v0.3.221

Compare Source

• Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
• Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

v0.3.220

Compare Source

• Updated to parity with Claude Code v2.1.220

v0.3.219

Compare Source

• Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
• Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
• Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
• Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
• Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
• Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

cloudflare/puppeteer (@​cloudflare/puppeteer)

v1.3.0

Compare Source

What's Changed

• Enable trusted publishing of packages by @​meddulla in #​231
• feat(cloudflare): add browser launch option by @​meddulla in #​232

Full Changelog: cloudflare/puppeteer@v1.2.0...v1.3.0

v1.2.0

Compare Source

What's Changed

• Rename Browser Rendering to Browser Run in README and package.json by @​jonnyparris in #​200
• feat(cloudflare): typed Cloudflare.* CDP commands (handoff, session, live view) by @​jonnyparris and @​meddulla in #​223

Full Changelog: cloudflare/puppeteer@v1.1.0...v1.2.0

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.20.3

Compare Source

Patch Changes

• #​15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

• Updated dependencies [35c87e9, b4f0c97, 8cf78c8, a60ff4d, 99eb50c, 35c87e9]:

  • wrangler@​4.120.0
  • miniflare@5.20260801.1-alpha

v0.20.2

Compare Source

Patch Changes

• Updated dependencies [20470fa, 9c74538, 266172b, a88d169, a88d169, daf65f2, a9e5abb]:
  • wrangler@​4.119.0
  • miniflare@5.20260801.0-alpha

v0.20.1

Compare Source

Patch Changes

• Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:
  • wrangler@​4.118.0

v0.20.0

Compare Source

Minor Changes

• #​14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

  The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

  • wrappedBindings
  • cacheWarnUsage
  • fetchMock: you should use outboundService instead
  • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

  Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

• #​14586 5a56dda Thanks @​emily-shen! - Preserve the deprecated Miniflare cache option

  Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.

• #​14586 5a56dda Thanks @​emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option

  The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha
  • wrangler@​4.117.0

v0.19.1

Compare Source

Patch Changes

• Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:
  • miniflare@​4.20260730.0
  • wrangler@​4.116.0

v0.19.0

Compare Source

Minor Changes

• #​14879 e6480e3 Thanks @​dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

  Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

• #​14821 edc203e Thanks @​mishushakov! - Ignore workerd's disconnected: peer disconnected without gracefully ending TLS session exception logs

  When tests make real fetch() calls to external TLS endpoints, servers and load balancers routinely close idle keepalive connections without sending a TLS close_notify. No request fails — the connection is idle — but workerd logs a kj/compat/tls.c++ exception with a full stack trace each time, flooding otherwise green test runs. This is the TLS sibling of the disconnected: ... messages already in the ignore list, so filter it the same way.

• Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

  • wrangler@​4.115.0
  • miniflare@​4.20260722.1

cloudflare/workerd (@​cloudflare/workers-types)

v5.20260804.1

Compare Source

v5.20260801.1

Compare Source

v5.20260731.1

Compare Source

v5.20260730.1

Compare Source

v5.20260729.1

Compare Source

v5.20260728.1

Compare Source

v5.20260727.1

Compare Source

v5.20260726.1

Compare Source

honojs/node-server (@​hono/node-server)

v2.1.0

Compare Source

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in #​378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in #​383

New Contributors

• @​bilal-azam made their first contribution in #​378
• @​mohamedramadan14 made their first contribution in #​383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

Compare Source

What's Changed

• test: replace supertest by @​BlankParticle in #​379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in #​382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

lovablelabs/lovable (@​lovable.dev/vite-tanstack-config)

v2.7.0

Compare Source

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.0

[Compare Source](https://redirect.github.com/modelcontextprotocol/typesc

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	2b9cf39	Aug 10 2026, 06:03 PM

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.