Bump the npm_and_yarn group across 8 directories with 6 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the npm_and_yarn group with 3 updates in the / directory: @anthropic-ai/sdk, undici and ip-address.
Bumps the npm_and_yarn group with 1 update in the /build directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /build/npm/gyp directory: ip-address.
Bumps the npm_and_yarn group with 5 updates in the /extensions/copilot directory:

Package	From	To
@anthropic-ai/sdk	0.82.0	0.91.1
undici	7.29.0	7.30.0
uuid	8.3.2	removed
ip-address	10.5.0	10.7.2
@anthropic-ai/sdk	0.82.0	0.91.1
ip-address	10.5.0	10.7.2
ip-address	10.5.0	10.7.2
@anthropic-ai/sdk	0.82.0	0.91.1
undici	7.29.0	7.30.0
@opentelemetry/core	1.30.1	2.11.0
ip-address	10.5.0	10.7.2
undici	7.29.0	7.30.0
@anthropic-ai/sdk	0.82.0	0.91.1
@opentelemetry/core	1.30.1	2.8.0
ip-address	10.5.0	10.7.2
undici	7.29.0	7.30.0
ip-address	10.5.0	10.7.2

Bumps the npm_and_yarn group with 2 updates in the /extensions/copilot/chat-lib directory: undici and @opentelemetry/core.
Bumps the npm_and_yarn group with 1 update in the /extensions/copilot/test/simulation/fixtures/generate/issue-6163 directory: esbuild.
Bumps the npm_and_yarn group with 2 updates in the /remote directory: undici and ip-address.
Bumps the npm_and_yarn group with 1 update in the /test/mcp directory: ip-address.

Updates @anthropic-ai/sdk from 0.82.0 to 0.129.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.129.0

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

sdk: v0.128.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

0.128.0 (2026-09-22)

... (truncated)

Commits

• bf20586 Merge pull request #1218 from anthropics/release-please--branches--main--chan...
• da41a5a chore: release main
• 3a79b93 codegen metadata
• 4e77366 feat(api): add claude-sonnet-5-5
• 2c1d2d7 feat(api): add ClientToolUnion type for client-executed tools
• f9d3e98 fix(client): send upload filenames as given, with no placeholder
• 8ac4a26 feat(api): add typed event type values to the Managed Agents events list filter
• 083969b feat(tools): optionally start tool calls while the reply streams
• 9505bf3 codegen metadata
• b84783b fix(client): also send X-Stainless-Timeout for client-level timeouts
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.

Updates undici from 7.29.0 to 7.30.0

Release notes

Sourced from undici's releases.

v7.30.0

What's Changed

• [Backport v7.x] fix: selectively re-enable SIMD for ppc64 by @​github-actions[bot] in nodejs/undici#5794
• Backport upgrade diagnostics lifecycle fixes to v7.x by @​BridgeAR in nodejs/undici#5783
• [Backport v7.x] fix: honor backpressure in decompression interceptor by @​mcollina in nodejs/undici#5837
• fix: close rejected HTTP/2 WebSocket streams on v7.x by @​mcollina in nodejs/undici#5876
• test(fetch): make pull-dont-push exceed any socket buffer by @​mcollina in nodejs/undici#5889

Full Changelog: nodejs/undici@v7.29.1...v7.30.0

v7.29.1

⚠️ Security fixes

High severity

• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
• GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
• GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

• GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
• GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

• [v7.x] drop: remove Node.js 26 from shared-builtin CI build by @​mcollina in nodejs/undici#5592
• fix(h2): honour headersTimeout by @​mcollina in nodejs/undici#5604
• fix(h2): keep the connection ref'd while requests are outstanding by @​mcollina in nodejs/undici#5605
• ci: increase Windows workflow timeout on v7.x by @​mcollina in nodejs/undici#5621
• fix(h2): retire the request that completed, not the head of the queue by @​mcollina in nodejs/undici#5618
• fix(h2): settle a request whose stream is cancelled by @​mcollina in nodejs/undici#5607
• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5646
• fix(h2): handle GOAWAY for CONNECT streams by @​mcollina in nodejs/undici#5640
• [v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5769

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

Commits

• 6741f66 Bumped v7.30.0 (#5887)
• 8d2f2f0 test(fetch): make pull-dont-push exceed any socket buffer (#5889)
• fad98ae fix: close rejected HTTP/2 WebSocket streams on v7.x (#5876)
• 369058e fix: honor backpressure in decompression interceptor (#5829) (#5837)
• a7914e5 Backport upgrade diagnostics lifecycle fixes to v7.x (#5783)
• 48367af fix: selectively re-enable SIMD for ppc64 (#5776) (#5794)
• d39a83e Bumped v7.29.1 (#5772)
• 0d88464 fix(test): remove unused EventEmitter import
• f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
• 3c67265 fix(retry): settle exposed body on terminal failure
• Additional commits viewable in compare view

Updates ip-address from 10.5.0 to 10.7.2

Release notes

Sourced from ip-address's releases.

v10.7.2

What's Changed

• Accept an arpa suffix in any case and without the root dot in fromArpa by @​beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

• Bump js-yaml and brace-expansion in the lockfile by @​beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits

• 974b48d 10.7.2
• 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
• f0c25df 10.7.1
• 8b34a21 Merge commit from fork
• 13b6155 Merge commit from fork
• 469ead1 Reject an address longer than the family allows before parsing it
• 1343629 Report an address of the other family as not contained
• 4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.82.0 to 0.129.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.129.0

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

sdk: v0.128.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

0.128.0 (2026-09-22)

... (truncated)

Commits

• bf20586 Merge pull request #1218 from anthropics/release-please--branches--main--chan...
• da41a5a chore: release main
• 3a79b93 codegen metadata
• 4e77366 feat(api): add claude-sonnet-5-5
• 2c1d2d7 feat(api): add ClientToolUnion type for client-executed tools
• f9d3e98 fix(client): send upload filenames as given, with no placeholder
• 8ac4a26 feat(api): add typed event type values to the Managed Agents events list filter
• 083969b feat(tools): optionally start tool calls while the reply streams
• 9505bf3 codegen metadata
• b84783b fix(client): also send X-Stainless-Timeout for client-level timeouts
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.

Updates ip-address from 10.5.0 to 10.7.2

Release notes

Sourced from ip-address's releases.

v10.7.2

What's Changed

• Accept an arpa suffix in any case and without the root dot in fromArpa by @​beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

• Bump js-yaml and brace-expansion in the lockfile by @​beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits

• 974b48d 10.7.2
• 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
• f0c25df 10.7.1
• 8b34a21 Merge commit from fork
• 13b6155 Merge commit from fork
• 469ead1 Reject an address longer than the family allows before parsing it
• 1343629 Report an address of the other family as not contained
• 4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• Additional commits viewable in compare view

Updates ip-address from 10.5.0 to 10.7.2

Release notes

Sourced from ip-address's releases.

v10.7.2

What's Changed

• Accept an arpa suffix in any case and without the root dot in fromArpa by @​beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

• Bump js-yaml and brace-expansion in the lockfile by @​beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits

• 974b48d 10.7.2
• 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
• f0c25df 10.7.1
• 8b34a21 Merge commit from fork
• 13b6155 Merge commit from fork
• 469ead1 Reject an address longer than the family allows before parsing it
• 1343629 Report an address of the other family as not contained
• 4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.82.0 to 0.129.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.129.0

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

sdk: v0.128.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...

Description has been truncated

[Taxperia]

Closed as stale/superseded by bb6734b. This old-base branch would roll back validated dependency and telemetry fixes. Remaining patch updates will be handled separately against current main.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml