chore(deps): bump the bun-minor-patch group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1006 · bounded-systems/prx

dependabot · 2026-07-25T22:03:26Z

Bumps the bun-minor-patch group with 6 updates in the / directory:

Package	From	To
@anthropic-ai/claude-agent-sdk	`0.3.195`	`0.3.220`
xstate	`5.32.2`	`5.32.5`
@biomejs/biome	`2.5.1`	`2.5.5`
knip	`6.22.0`	`6.29.0`
marked	`18.0.5`	`18.0.7`
type-coverage	`2.29.7`	`2.30.0`

Updates @anthropic-ai/claude-agent-sdk from 0.3.195 to 0.3.220

Release notes

Sourced from @anthropic-ai/claude-agent-sdk's releases.

v0.3.220

What's changed

Updated to parity with Claude Code v2.1.220

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.220
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.220
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.220
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.220
v0.3.219

What's changed

Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort

Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off

Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session

Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch

Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands

Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.219
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.219
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.219
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.219
v0.3.218

What's changed

SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent

Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529

Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.218
</tr></table> 

... (truncated)

Changelog

Sourced from @anthropic-ai/claude-agent-sdk's changelog.

0.3.220

Updated to parity with Claude Code v2.1.220

0.3.219

Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort

Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off

Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session

Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch

Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands

Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

0.3.218

SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent

Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529

Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

0.3.217

Changed subagents to no longer spawn nested subagents by default (depth cap lowered from 5 to 1); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting

Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS)

Fixed Remote Control sessions not re-sending pending permission prompts to clients that connect after the prompt appeared

0.3.216

Added optional skippedLinks count to rewindFiles responses for paths the rewind safety guards refused to restore or delete

Added tool_result_meta sidecar to user messages (non_execution_kind, user_feedback) so consumers can classify denied, interrupted, or cancelled tool calls without string-matching result prose

Added optional user_message_uuid and request_sent_wall_ms fields to the success result message for cross-host request-latency correlation

0.3.215

Updated to parity with Claude Code v2.1.215

0.3.214

set_permission_mode now rejects unrecognized permission modes with an error instead of silently adopting them; the 'manual' alias is accepted at every ingress

Added optional subkind: 'scheduled-trigger' to the task-notification member of SDKMessageOrigin, marking deliveries that are the fired prompt of a user-configured scheduled task

applyFlagSettings({effortLevel}) now accepts 'max' in its TypeScript type (runtime already supported it)

Assistant messages truncated by interrupt() now carry aborted: true, so consumers can distinguish a mid-stream partial from a completed message

Added optional subagent_type and subagent_retry fields to tool_progress messages so clients can show a subagent waiting out an API rate-limit retry

The system/init message's plugins entries and the reload_plugins response now include each plugin's manifest version

SessionStart hooks now report source "fork" instead of "resume" when the session begins as a fork

0.3.213

Updated to parity with Claude Code v2.1.213

0.3.212

... (truncated)

Commits

71c804d chore: Update CHANGELOG.md
c74106a chore: Update CHANGELOG.md
dc71e7c chore: Update CHANGELOG.md
2997b3d chore: Update CHANGELOG.md
e77c325 chore: Update CHANGELOG.md
cf5a442 chore: Update CHANGELOG.md
a4acbcd chore: Update CHANGELOG.md
f1206af chore: Update CHANGELOG.md
d7f244a chore: Update CHANGELOG.md
018efaa chore: Update CHANGELOG.md
Additional commits viewable in compare view

Updates xstate from 5.32.2 to 5.32.5

Release notes

Sourced from xstate's releases.

xstate@5.32.5

Patch Changes

#5603 345e04c Thanks @xianjianlf2! - Sending an event to a stopped actor no longer throws when the event contains unserializable data (e.g. circular references). Previously, the development-only warning that an event was sent to a stopped actor used JSON.stringify on the event, which could throw and mask the intended warning. The warning is now emitted safely regardless of the event's contents.

xstate@5.32.4

Patch Changes
#5589 e913eeb Thanks @spokodev! - Fixed a bug where targeting a history state that is a direct child of a parallel state would silently do nothing when that parallel state had not been visited yet and the history state had no default target. The machine now enters the parallel state's initial configuration, matching the behavior of history states inside compound states.
const machine = createMachine({
  initial: 'off',
  states: {
    off: { on: { GO: 'on.hist' } },
    on: {
      type: 'parallel',
      states: {
        regA: { initial: 'a1', states: { a1: {}, a2: {} } },
        regB: { initial: 'b1', states: { b1: {}, b2: {} } },
        hist: { type: 'history', history: 'deep' }
      }
    }
  }
});
const actor = createActor(machine).start();
actor.send({ type: 'GO' });
actor.getSnapshot().value; // { on: { regA: 'a1', regB: 'b1' } }
xstate@5.32.3

Patch Changes
#5575 830db8b Thanks @JSap0914! - Fixed initialTransition (and transition) throwing "Actor with system ID '...' already exists" when the machine contains an invoke with a systemId.

Root cause: createInertActorScope used createActor(logic) internally, which eagerly ran getInitialSnapshot during construction and registered any systemId-carrying child actors in the system. When the caller then ran getInitialSnapshot (or transition) via the returned scope, the same system was reused, causing the duplicate-registration error.

Fix: After creating the internal actor, createInertActorScope now replaces the actor's system reference with a freshly-created system. Child actors spawned by the subsequent caller-driven getInitialSnapshot / transition invocation therefore register into a clean system with no pre-existing entries.
const machine = createMachine({
  initial: 'idle',
  states: {
    idle: {
      invoke: {
        src: fromPromise(async () => 42),
        systemId: 'myActor' // previously caused: "Actor with system ID 'myActor' already exists"
      }
    }

... (truncated)

Commits

c25dba0 Version Packages (#5604)
b669e95 fix(xstate-vue): correct vitest include glob so tests are discovered (#5607)
345e04c fix(core): don't throw when warning about unserializable event sent to stoppe...
9297fa8 Version Packages (#5590)
e913eeb fix(core): enter parallel default when targeting an unvisited history child (...
ab5aa56 Version Packages (#5586)
830db8b fix(core): prevent 'systemId already exists' in pure transition functions (#5...
a551a2b docs: add missing https protocol to Stately Studio link (#5585)
cc087bf ci: pin Node to 24.16.0 (#5577)
806ae91 Version Packages
Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.1 to 2.5.5

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.5

2.5.5

Patch Changes
#10972 ab8c21b Thanks @ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:
declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:
type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";
#10977 0bf7486 Thanks @ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

#10957 cf263c4 Thanks @dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

#10983 edc0ed7 Thanks @ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.
#10889 89526e3 Thanks @denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.
- A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }
#10964 794ccd0 Thanks @denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.
-a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.5

Patch Changes
#10972 ab8c21b Thanks @ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:
declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:
type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";
#10977 0bf7486 Thanks @ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

#10957 cf263c4 Thanks @dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

#10983 edc0ed7 Thanks @ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.
#10889 89526e3 Thanks @denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.
- A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }
#10964 794ccd0 Thanks @denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.
-a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Commits

412a0e9 ci: release (#10948)
b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
9a66bc7 chore: add latitude to sponsors (#10947)
bfc3f3d ci: release (#10887)
9e1999f chore: revert the revert
0b0fd8d chore: revert
0afa35a ci: release (#10817)
3447b2f feat(useDomQuerySelector): add ignore option (#10835)
e649198 ci: release (#10747)
4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
Additional commits viewable in compare view

Updates knip from 6.22.0 to 6.29.0

Release notes

Sourced from knip's releases.

Release 6.29.0

fix(glob): do not follow symbolic links in async glob (#1900) (b7d5ce2f545d91953a97733aa1567e8728b20644) - thanks @mogelbrod!

Add built-in compiler for tsrx (db05e0142a41fad2ad45d62ba5106e0d97c92b45)

Fix -u shortcut for --duration (932b9262af275d209923a5efab1b6f23067bb006)

Release 6.28.0

Update oxc-resolver (resolve #1889) (1444f6aaf04d42ad07ee0b88da4dfae0e116043a)

Keep entry-exported members public (resolve #1890) (94967c13a589a7e83408b1495c31323ac126fcab)

Don't un-ignore sibling paths on unrelated gitignore negations (resolve #1891) (5c026ba50c1e89804fc5094a52dc4c4c37d92bc2)

Memoize the gitignore shadowed-pattern check (a5fa3b0ebb7f84c107dba1c1ca9a9b73995f668f)

Ignore nested files under a gitignore dir/* pattern (404a53e3e49fa7c1f51b60bcb30ea50450f75aab)

Track types referenced by JSDoc imports (resolve #1888) (6ae48aadbe03952690c8608e6df42bd039cf6624)

Update oxc-parser (02ca17a72c3f0afa7df32297d2dd2f5463ac6e00)

feat: markdownlint-cli2 (#1887) (323b96f55b38b53f5e4648d72fecd968fae35147) - thanks @Zamiell!

Update rolldown snapshot (009e509dee6a5013fd3937abb4ec81684601b023)

Resolve $GITHUB_ACTION_PATH in GHA composite actions (ead489f066733f701acfe5b81eac0a6c813fb5c5)

Don't report node: specifiers as unlisted dependencies (1a7114f0a159fe82328041e11fc61c5c1730cc01)

Discover tsdown CLI entries (0d47a45bfc518a7bf73a4b4878aeab236d6f9791)

Discover Convex function modules (e01f21c44773186e7ad74e7badf9fc81b82edfb5)

Ignore common system binaries (cd003065fda5422550a412bba07ebbb1f9bae126)

Add OpenClaw plugin (73a2d7dd45f65ea312fde38cb4fa4f5a4fc34bf2)

Discover Tailwind CLI input stylesheet (resolve #1551) (9ae5feed922ecb7e8c436545e9b45125bd73b457)

Discover Angular global stylesheets from angular.json (fb9e0488f6f21284714d0651fcf1dd2de02d425a)

Hint when project patterns exclude a compiled extension (74de516d3d73839536fc2a43c2c0ec38a6299631)

Ignore common global binaries (a99a206015fe414a4de12016cc62499910afaf6f)

Run multiple preprocessors in sequence (844358367e9d1939bbf47f8dcb97d810741f56c1)

fix(nuxt): resolve nuxt module paths (#1896) (3c8594f5ffc641b00575b6d7455990db1277ac75) - thanks @danielroe!

Report unused re-exports when ignoreExportsUsedInFile is set (#1895) (a113a5f4eedc81ef56b00a3e488cc94febefede5) - thanks @mlm20!

Pass -w to pnpm add in sentry ecosystem test (ea8c8ac6fe9519f00ca6a61131b345f5de521704)

Update sentry snapshot (b75768d544d9f869ebce8f8c6dd8490f3db87023)

Record all traversed dirs in glob cache (resolve #1897) (81be1d436eae15518df764cbcb443899e11a9569)

Invalidate glob cache when .gitignore changes (baff301f2dceda97bf8bf73809d811cc44c72c8c)

Improve Nuxt and Nitro plugin resolution (86ffab7bcdd095631d6b0b17254e8acd6b5022bc)

fix: don't treat [-]-c[heck] as config flag for prettier (#1902) (b7266ee8240a9b8686e91a44a4706d3605d094c4) - thanks @davidkna-sap!

Use Entra ID to publish VS Code extension (4236253482f884d92cfde2ccf85c7fb9aca17f7e)

Remove obsolete trust policy exclusions (630d5f9835f4303ec9aa7d090ad40a177808c4fb)

Update dependencies (810147b5aa21bb57ad103fd19ba92844e42cd84c)

Migrate from typescript/native-preview to typescript (140a25a577a64273a7a77f2ff2c8f224118ac298)

Release 6.27.0

Add Temporal plugin (98191a04aad0572bead191b101bfecef75067b0c)

Handle -d alias for react-email dir argument (53d1fec3213db8d6a84dfa7a82050b122782e065)

Expand pnpm script references with forwarded arguments (33e9799df39450033061b9c4c07daf22f5d15721)

Treat path-shaped script tokens as file references, extend known global binaries (d9508c282ab81351beda4b2f859435b49f142c51)

Mark tsdown neverBundle dependencies as referenced (5fd863ba12e68842f91ab1a94e7e30d1e571da92)

Support TanStack Start in tanstack-router plugin (bd63cd8af88dac03a98aa17f1add322f7bdf4a94)

Mark vite ssr.external dependencies as referenced (91de938032062cb667bced0eadef9e67d1e20b1f)

Expand bun, npm, and yarn script references with forwarded arguments (b5a31767a83e2cec3fb20c3b146d94c0412a4fd6)

Add Latitude as sponsor (42676759cad5fb10ac96fd7c0457037e906f4b68)

Regenerate plugin list in docs (1d2cdffb4d4151f848c44e066eff43e9efbf44fe)

... (truncated)

Commits

d9a6fe0 Release knip@6.29.0
932b926 Fix -u shortcut for --duration
db05e01 Add built-in compiler for tsrx
b7d5ce2 fix(glob): do not follow symbolic links in async glob (#1900)
fc16b38 Release knip@6.28.0
140a25a Migrate from typescript/native-preview to typescript
810147b Update dependencies
b7266ee fix: don't treat [-]-c[heck] as config flag for prettier (#1902)
86ffab7 Improve Nuxt and Nitro plugin resolution
baff301 Invalidate glob cache when .gitignore changes
Additional commits viewable in compare view

Updates marked from 18.0.5 to 18.0.7

Release notes

Sourced from marked's releases.

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991

Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)

keep empty list after blockquote as a sibling block (#4004) (3f144a0)

preserve code spans adjacent to tildes (#4012) (0de7188)

Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1

treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)

Fix ordered lists after blockquotes (#4003) (33928d0)

keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

Commits

a8971a1 chore(release): 18.0.7 [skip ci]
d899c2e chore(deps): bump actions/setup-node from 6 to 7 (#4025)
7fbf82e chore(deps-dev): bump semantic-release from 25.0.7 to 25.0.8 (#4026)
738edf2 chore(deps-dev): bump brace-expansion from 5.0.2 to 5.0.6 (#4027)
9154f8f fix: Avoid O(n^2) masked source rebuild in inline tokenizer (#4017)
f945fc5 fix: Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexe...
3f144a0 fix: keep empty list after blockquote as a sibling block (#4004)
0de7188 fix: preserve code spans adjacent to tildes (#4012)
f056437 fix: Recognize setext headings whose first line starts with # (#4015)
12bfa94 chore(deps-dev): bump semantic-release from 25.0.5 to 25.0.7 (#4020)
Additional commits viewable in compare view

Updates type-coverage from 2.29.7 to 2.30.0

Changelog

Sourced from type-coverage's changelog.

2.30.0 (2026-07-25)

feat: add typescript 6 and 7 as peerDependencies (d7d4c96)

chore: update dependencies (4af1c3d)

Commits

ac161d3 2.30.0
d7d4c96 feat: add typescript 6 and 7 as peerDependencies
4af1c3d chore: update dependencies
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

… updates Bumps the bun-minor-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.195` | `0.3.220` | | [xstate](https://github.com/statelyai/xstate) | `5.32.2` | `5.32.5` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.1` | `2.5.5` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.22.0` | `6.29.0` | | [marked](https://github.com/markedjs/marked) | `18.0.5` | `18.0.7` | | [type-coverage](https://github.com/plantain-00/type-coverage) | `2.29.7` | `2.30.0` | Updates `@anthropic-ai/claude-agent-sdk` from 0.3.195 to 0.3.220 - [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-typescript@v0.3.195...v0.3.220) Updates `xstate` from 5.32.2 to 5.32.5 - [Release notes](https://github.com/statelyai/xstate/releases) - [Commits](https://github.com/statelyai/xstate/compare/xstate@5.32.2...xstate@5.32.5) Updates `@biomejs/biome` from 2.5.1 to 2.5.5 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.5/packages/@biomejs/biome) Updates `knip` from 6.22.0 to 6.29.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.29.0/packages/knip) Updates `marked` from 18.0.5 to 18.0.7 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.0.5...v18.0.7) Updates `type-coverage` from 2.29.7 to 2.30.0 - [Changelog](https://github.com/plantain-00/type-coverage/blob/master/CHANGELOG.md) - [Commits](plantain-00/type-coverage@v2.29.7...v2.30.0) --- updated-dependencies: - dependency-name: "@anthropic-ai/claude-agent-sdk" dependency-version: 0.3.220 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-patch - dependency-name: xstate dependency-version: 5.32.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-minor-patch - dependency-name: "@biomejs/biome" dependency-version: 2.5.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-patch - dependency-name: knip dependency-version: 6.29.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-minor-patch - dependency-name: marked dependency-version: 18.0.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-minor-patch - dependency-name: type-coverage dependency-version: 2.30.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-25T22:03:44Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
type-coverage@2.29.7 ⏵ 2.30.0			⁺⁷
@anthropic-ai/claude-agent-sdk@0.3.195 ⏵ 0.3.220	⁺⁷	⁺¹
marked@18.0.5 ⏵ 18.0.7			^-2
knip@6.22.0 ⏵ 6.29.0	^-2	⁺¹
xstate@5.32.2 ⏵ 5.32.5	⁺¹		⁺¹
@biomejs/biome@2.5.1 ⏵ 2.5.5	⁺¹	⁺¹

View full report

socket-security · 2026-07-25T22:03:46Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `@anthropic-ai/claude-agent-sdk` under MPL-2.0 License: The package entry has license metadata, but it could not be parsed - This license was not allowed or given any lesser classification by the applicable policy (npm metadata) License: SEE LICENSE IN README.md - This license classifier is not allowed by the applicable policy (package/package.json) From: package.json → `npm/@anthropic-ai/claude-agent-sdk@0.3.220` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@anthropic-ai/claude-agent-sdk@0.3.220`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-code-quality · 2026-07-25T22:05:16Z

Code Coverage Overview

Languages: TypeScript

TypeScript / unit

The overall coverage in commit 13af179 in the dependabot/bun/bun-m... branch remains at 88%, unchanged from commit efb4376 in the main branch.

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 25, 2026

dependabot Bot requested a review from a team as a code owner July 25, 2026 22:03

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 25, 2026

bounded-systems-front-desk Bot added this to Front Desk Jul 25, 2026

github-project-automation Bot moved this to Todo in Front Desk Jul 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the bun-minor-patch group across 1 directory with 6 updates - #1006

chore(deps): bump the bun-minor-patch group across 1 directory with 6 updates#1006
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/bun-minor-patch-31e7b6c586

dependabot Bot commented on behalf of github Jul 25, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

socket-security Bot commented Jul 25, 2026

Uh oh!

socket-security Bot commented Jul 25, 2026

Uh oh!

github-code-quality Bot commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 25, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.3.220

What's changed

Update

v0.3.219

What's changed

Update

v0.3.218

What's changed

Update

0.3.220

0.3.219

0.3.218

0.3.217

0.3.216

0.3.215

0.3.214

0.3.213

0.3.212

xstate@5.32.5

Patch Changes

xstate@5.32.4

Patch Changes

xstate@5.32.3

Patch Changes

Biome CLI v2.5.5

2.5.5

Patch Changes

2.5.5

Patch Changes

Release 6.29.0

Release 6.28.0

Release 6.27.0

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

2.30.0 (2026-07-25)

Uh oh!

socket-security Bot commented Jul 25, 2026

Uh oh!

socket-security Bot commented Jul 25, 2026

Uh oh!

github-code-quality Bot commented Jul 25, 2026

Code Coverage Overview

TypeScript / unit

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 25, 2026 •

edited by blacksmith-sh Bot

Loading