chore(deps): bump the production-dependencies group across 1 directory with 17 updates by dependabot[bot] · Pull Request #127 · vectorMindsAI/vectorMindsAI-v0

dependabot · 2026-09-07T09:15:38Z

Bumps the production-dependencies group with 17 updates in the / directory:

Package	From	To
@hookform/resolvers	`5.8.0`	`5.9.1`
@langchain/core	`1.2.7`	`1.2.9`
@langchain/openai	`1.5.7`	`1.5.11`
@sentry/nextjs	`10.70.0`	`10.73.0`
@tavily/core	`0.7.7`	`0.7.9`
express-rate-limit	`8.6.2`	`8.7.0`
inngest	`4.18.1`	`4.19.0`
input-otp	`1.4.2`	`1.5.0`
langchain	`1.5.8`	`1.5.10`
lucide-react	`1.31.0`	`1.40.0`
mongoose	`9.9.2`	`9.9.4`
next	`16.3.1`	`16.3.4`
posthog-js	`1.417.0`	`1.426.4`
react-hook-form	`7.85.0`	`7.87.0`
react-resizable-panels	`4.12.2`	`4.12.3`
uuid	`14.0.1`	`14.0.2`
zod	`4.4.3`	`4.5.4`

Updates @hookform/resolvers from 5.8.0 to 5.9.1

Release notes

Sourced from @hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

update joi to v18 (#873) (c8159ae)

Commits

f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
c8159ae feat: update joi to v18 (#873)
See full diff in compare view

Updates @langchain/core from 1.2.7 to 1.2.9

Release notes

Sourced from @langchain/core's releases.

@langchain/core@1.2.9

Patch Changes

#11402 43e4396 Thanks @thushanth-bengre-langchain! - Fix ChatVertexAI/ChatGoogle content blocks: include tool_call blocks from message.tool_calls and skip spurious empty text blocks in contentBlocks.

@langchain/core@1.2.8

Patch Changes

#11369 d6ad973 Thanks @hntrl! - fix(langchain): use unified endpoint for gateway

#11342 3b0e4c4 Thanks @thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

@langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

Commits

e493ed6 chore: version packages (#11393)
8384848 fix(google-common): release endpoint routing fix as patch (#11413)
8cfff4d feat(google): add gateway support for genai (#11405)
7df258c chore(langchain): update langgraph deps (#11412)
3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
Additional commits viewable in compare view

Updates @langchain/openai from 1.5.7 to 1.5.11

Release notes

Sourced from @langchain/openai's releases.

@langchain/openai@1.5.11

Patch Changes

#11448 53dbfc2 Thanks @hntrl! - fix(openai): resolve encrypted content with zdr when streaming

OpenAI recently changed the disposition of encrypted_content to contain the canonical payload on the final done event. Encrypted content also does not need to be a parameter in the include call options in order to propagate.

@langchain/openai@1.5.10

Patch Changes

#11419 c26c87e Thanks @chiliec! - fix(openai): send content null (not []) for tool-call-only v1 assistant messages

@langchain/openai@1.5.9

Patch Changes

#11399 5c9fdf2 Thanks @gethin-langchain! - update to v7 openai sdk

#11403 fe8eec1 Thanks @thushanth-bengre-langchain! - Drop Gemini-native functionCall content blocks (already carried in tool_calls) when converting messages to Chat Completions API params, fixing requests that fail when a ChatGoogleGenerativeAI message is passed to ChatOpenAI (e.g. a cross-provider handoff in LangGraph).

#11399 5c9fdf2 Thanks @gethin-langchain! - Map OpenAI's cache_write_tokens to cache_creation in usage_metadata.input_token_details, mirroring the existing cached_tokens -> cache_read mapping across the Chat Completions and Responses APIs. Previously, prompt cache-write token counts were silently dropped.

@langchain/openai@1.5.8

Patch Changes

#11342 3b0e4c4 Thanks @thushanth-bengre-langchain! - feat(openai): mark OpenAI provider errors as retryable or not

Builds on stampRetryable in @langchain/core so the retry middleware can tell a transient failure from a deterministic one. Timeouts and rate limits are marked retryable; aborts, context overflow, invalid tool results, bad credentials, and unknown models non-retryable. Anything else stays unmarked and retries as before.

Also forwards a per-call maxRetries to the retry loop, so a surrounding retry loop such as modelRetryMiddleware can take over instead of the two multiplying against each other.

Errors keep their original class, so instanceof against the openai SDK error types is unaffected.

Commits

21fff39 chore: version packages (#11517)
6b613fe fix(infra): add oxfmt formatter
b522160 chore(infra): update to changesets 3 (#11516)
ba81a3c chore: version packages (#11462)
e927605 fix(aws): recognize claude 5 models in supportedToolChoiceValuesForModel (#11...
ffadf85 chore(deps): bump the minor-and-patch group across 1 directory with 39 update...
679f79b chore(deps): bump the aws group across 1 directory with 7 updates (#11484)
0f54ed6 chore(deps): bump the build-and-test group across 1 directory with 3 updates ...
147e082 chore(deps): bump google-auth-library from 10.9.1 to 11.0.2 in the google gro...
7969427 chore(deps): bump changesets/action from 1.9.0 to 2.1.1 in the gh-actions-maj...
Additional commits viewable in compare view

Updates @sentry/nextjs from 10.70.0 to 10.73.0

Release notes

Sourced from @sentry/nextjs's releases.

10.73.0

Important Changes
feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.
// next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';
Other Changes

feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)

fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

Bundle size 📦

Path Size

@sentry/browser 27.1 KB

@sentry/browser - with treeshaking flags 25.58 KB

@sentry/browser (incl. Tracing) 45.54 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.28 KB

@sentry/browser (incl. Tracing, Profiling) 50.17 KB

@sentry/browser (incl. Tracing, Replay) 83.87 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 100.83 KB

@sentry/browser (incl. Feedback) 43.87 KB

@sentry/browser (incl. sendFeedback) 31.78 KB

@sentry/browser (incl. FeedbackAsync) 36.79 KB

@sentry/browser (incl. Metrics) 28.16 KB

@sentry/browser (incl. Logs) 28.38 KB

@sentry/browser (incl. Metrics & Logs) 29.06 KB

@sentry/react 28.86 KB

@sentry/react (incl. Tracing) 47.74 KB

@sentry/vue 32.4 KB

@sentry/vue (incl. Tracing) 47.46 KB

@sentry/svelte 27.12 KB

CDN Bundle 29.43 KB

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

10.73.0

Important Changes
feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.
// next.config.mjs
- import { withSentryConfig } from '@sentry/nextjs';
+ import { withSentryConfig } from '@sentry/nextjs/config';
Other Changes

feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)

fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

10.72.0

Important Changes

AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

fix(v10/astro): support astro v7 route patterns properly (#23657)

fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)

fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)

fix(v10/node): Only end the process session when it is still ok (#23731)

fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)

fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)

fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)

fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)

fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)

fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

... (truncated)

Commits

f109d92 release: 10.73.0
1a3e04e meta(changelog): Update changelog for 10.73.0 (#23778)
da8d769 test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)
bea4d38 feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler a...
605caaf feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)
da17307 fix(v10/cloudflare): Instrument Durable Object handlers installed as read-onl...
2c4ca38 Merge branch 'release/10.72.0' into v10
0d23628 release: 10.72.0
ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
Additional commits viewable in compare view

Updates @tavily/core from 0.7.7 to 0.7.9

Commits

See full diff in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits

48db09e 8.7.0
dce5871 v8.7.0 changelog
2f08044 Add inspect.software health badge (#673)
a29757c feat: add retryAfter option (#661)
146e88b chore: rename license
5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
Additional commits viewable in compare view

Updates inngest from 4.18.1 to 4.19.0

Release notes

Sourced from inngest's releases.

inngest@4.19.0

Minor Changes

#1701 f4fa1eb8 Thanks @jakobevangelista! - Wait for newly created sandboxes to reach RUNNING by default, with runningTimeout: false as an explicit opt-out.

Patch Changes

#1713 f7c49003 Thanks @KiKoS0! - Route signing-key API requests to the correct branch environment and include SDK identification headers.

#1700 8f5dceb4 Thanks @jakobevangelista! - Return captured sandbox command stdout and stderr as UTF-8 strings.

#1705 28603273 Thanks @jakobevangelista! - Allow sandbox commands to use executable names and relative paths.

#1684 dde88e4d Thanks @jakobevangelista! - Support shell command strings in the experimental sandbox command and managed process APIs.

#1693 a2cd5b48 Thanks @scottnuma! - Validate propagated sessions with step.invoke and defer

#1712 a9975874 Thanks @jakobevangelista! - Export SandboxCommand from inngest/experimental.

Updated dependencies [abc4a63f]:

@inngest/ai@0.1.8

Changelog

Sourced from inngest's changelog.

4.19.0

Minor Changes

#1701 f4fa1eb8 Thanks @jakobevangelista! - Wait for newly created sandboxes to reach RUNNING by default, with runningTimeout: false as an explicit opt-out.

Patch Changes

#1713 f7c49003 Thanks @KiKoS0! - Route signing-key API requests to the correct branch environment and include SDK identification headers.

#1700 8f5dceb4 Thanks @jakobevangelista! - Return captured sandbox command stdout and stderr as UTF-8 strings.

#1705 28603273 Thanks @jakobevangelista! - Allow sandbox commands to use executable names and relative paths.

#1684 dde88e4d Thanks @jakobevangelista! - Support shell command strings in the experimental sandbox command and managed process APIs.

#1693 a2cd5b48 Thanks @scottnuma! - Validate propagated sessions with step.invoke and defer

#1712 a9975874 Thanks @jakobevangelista! - Export SandboxCommand from inngest/experimental.

Updated dependencies [abc4a63f]:

@inngest/ai@0.1.8

Commits

947a244 Release @latest (#1709)
2860327 feat(sandbox): allow non-absolute commands (#1705)
a997587 fix(sandbox): export SandboxCommand type (#1712)
f7c4900 fix: send environment on signing-key API requests (#1713)
dde88e4 feat(sandbox): support shell command strings (#1684)
f4fa1eb feat(sandbox): wait for running by default (#1701)
8f5dceb fix(sandbox): return command output as text (#1700)
a2cd5b4 fix: catch invalid propagated sessions with step.invoke and defer (#1693)
See full diff in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

fix(input): reserve the password manager badge gutter only where it fits

fix(input): disable spellcheck by default

fix(input): feature-detect ResizeObserver before observing

fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom

fix(input): clear pending synchronization timeouts on unmount

feat(input): add a nonce prop for Content-Security-Policy support

fix(input): guard the input reference used by the selectionchange listener

fix(input): opt the container out of browser translation

fix(input): report cosmetic CSS rule failures as warnings instead of errors

docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1

revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0

docs: align the mobile and edge-case documentation with the stable candidate

test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

fix(input): reserve the password manager badge gutter only where it fits

Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.

fix(input): disable spellcheck by default

Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.

fix(input): feature-detect ResizeObserver before observing

Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.

fix(input): fall back to 16px font-size until --root-height resolves

Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.

fix(input): clear pending sync timeouts on unmount

The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.

feat(input): add nonce prop

Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.

fix(input): use the guarded input reference inside the selectionchange listener

Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.

fix(input): opt the container out of browser translation

Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

fix(input): log CSS rule insertion failures as warnings, not errors

Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.

~~chore(types): narrow onComplete to (value: string) => unknown~~

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

fix(input): reserve the password manager badge gutter only where it fits

fix(input): disable spellcheck by default

fix(input): feature-detect ResizeObserver before observing

fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom

fix(input): clear pending synchronization timeouts on unmount

feat(input): add a nonce prop for Content-Security-Policy support

fix(input): guard the input reference used by the selectionchange listener

fix(input): opt the container out of browser translation

fix(input): report cosmetic CSS rule failures as warnings instead of errors

docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1

revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0

docs: align the mobile and edge-case documentation with the stable candidate

test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

fix(input): reserve the password manager badge gutter only where it fits

Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.

fix(input): disable spellcheck by default

Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.

fix(input): feature-detect ResizeObserver before observing

Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.

fix(input): fall back to 16px font-size until --root-height resolves

Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.

fix(input): clear pending sync timeouts on unmount

The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.

feat(input): add nonce prop

Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.

fix(input): use the guarded input reference inside the selectionchange listener

Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.

fix(input): opt the container out of browser translation

Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.

Updates langchain from 1.5.8 to 1.5.10

Release notes

Sourced from langchain's releases.

langchain@1.5.10

Patch Changes

#11412 7df258c Thanks @hntrl! - chore(langgraph): update langgraph deps to track serialization fix

langchain@1.5.9

Patch Changes

#11369 d6ad973 Thanks @hntrl! - fix(langchain): use unified endpoint for gateway

#11342 3b0e4c4 Thanks @thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

@langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

Commits

e493ed6 chore: version packages (#11393)
8384848 fix(google-common): release endpoint routing fix as patch (#11413)
8cfff4d feat(google): add gateway support for genai (#11405)
7df258c chore(langchain): update langgraph deps (#11412)
3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.40.0

Release notes

Sourced from lucide-react's releases.

Version 1.40.0

What's Changed

feat(icons): added can icon by @l0uisgrange in lucide-icons/lucide#4767

feat(icons): added bridge icon by @Nykoula in lucide-icons/lucide#3949

feat(icons): added shrimp-off icon by @jguddas in lucide-icons/lucide#3613

feat(icons): added shopping-cart-plus & shopping-cart-minus icons by @Ajay199210 in lucide-icons/lucide#4248

fix(docs): updated artboard name on illustrator template by @EthanHazel in lucide-icons/lucide#4724

chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the github-actions group by @dependabot[bot] in lucide-icons/lucide#4781

feat(icons): added lighthouse icon by @Xougui in lucide-icons/lucide#4507

New Contributors

@Nykoula made their first contribution in lucide-icons/lucide#3949

@Ajay199210 made their first contribution in lucide-icons/lucide#4248

@Xougui made their first contribution in lucide-icons/lucide#4507

Full Changelog: lucide-icons/lucide@1.39.0...1.40.0

Version 1.39.0

What's Changed

fix(icons): added RWD metadata to monitor, tablet & smartphone icons by @karsa-mistmere in lucide-icons/lucide#4775

feat(icons): add whistle icon by @timmy471 in lucide-icons/lucide#3006

feat(icons): Add mail-pen icon by @jennieboops in lucide-icons/lucide#4399

Full Changelog: lucide-icons/lucide@1.38.0...1.39.0

Version 1.38.0

What's Changed

feat(icons): Add polygon icon by @timmy471 in lucide-icons/lucide#3007

Full Changelog: lucide-icons/lucide@1.36.0...1.38.0

Version 1.37.0

What's Changed

feat(icons): added 'robot-vacuum' icon by @benhaube in lucide-icons/lucide#4599

feat(icons): made face-angry even more angry by @karsa-mistmere in lucide-icons/lucide#4708

fix(icons): changed swords icon by @jguddas in lucide-icons/lucide#4707

fix(icons): changed shopping-cart icon by @jguddas in lucide-icons/lucide#2909

docs(icon-description): added old and empty tags/use case for ghost by @TFJ5183 in lucide-icons/lucide#4762

feat(icons): add playing-card, playing-cards, and playing-cards-fan by

…y with 17 updates Bumps the production-dependencies group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.8.0` | `5.9.1` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.7` | `1.2.9` | | [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.7` | `1.5.11` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.70.0` | `10.73.0` | | [@tavily/core](https://github.com/tavily-ai/tavily-js) | `0.7.7` | `0.7.9` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` | | [inngest](https://github.com/inngest/inngest-js/tree/HEAD/packages/inngest) | `4.18.1` | `4.19.0` | | [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp) | `1.4.2` | `1.5.0` | | [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.8` | `1.5.10` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.40.0` | | [mongoose](https://github.com/Automattic/mongoose) | `9.9.2` | `9.9.4` | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.4` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.417.0` | `1.426.4` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.87.0` | | [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.2` | `4.12.3` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | Updates `@hookform/resolvers` from 5.8.0 to 5.9.1 - [Release notes](https://github.com/react-hook-form/resolvers/releases) - [Commits](react-hook-form/resolvers@v5.8.0...v5.9.1) Updates `@langchain/core` from 1.2.7 to 1.2.9 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.7...@langchain/core@1.2.9) Updates `@langchain/openai` from 1.5.7 to 1.5.11 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.7...@langchain/openai@1.5.11) Updates `@sentry/nextjs` from 10.70.0 to 10.73.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.73.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.70.0...10.73.0) Updates `@tavily/core` from 0.7.7 to 0.7.9 - [Commits](https://github.com/tavily-ai/tavily-js/commits) Updates `express-rate-limit` from 8.6.2 to 8.7.0 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.0) Updates `inngest` from 4.18.1 to 4.19.0 - [Release notes](https://github.com/inngest/inngest-js/releases) - [Changelog](https://github.com/inngest/inngest-js/blob/main/packages/inngest/CHANGELOG.md) - [Commits](https://github.com/inngest/inngest-js/commits/inngest@4.19.0/packages/inngest) Updates `input-otp` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/guilhermerodz/input-otp/releases) - [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md) - [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp) Updates `langchain` from 1.5.8 to 1.5.10 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.8...langchain@1.5.10) Updates `lucide-react` from 1.31.0 to 1.40.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.40.0/packages/lucide-react) Updates `mongoose` from 9.9.2 to 9.9.4 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.9.2...9.9.4) Updates `next` from 16.3.1 to 16.3.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.1...v16.3.4) Updates `posthog-js` from 1.417.0 to 1.426.4 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.417.0...posthog-js@1.426.4) Updates `react-hook-form` from 7.85.0 to 7.87.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.85.0...v7.87.0) Updates `react-resizable-panels` from 4.12.2 to 4.12.3 - [Release notes](https://github.com/bvaughn/react-resizable-panels/releases) - [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md) - [Commits](bvaughn/react-resizable-panels@4.12.2...4.12.3) Updates `uuid` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.1...v14.0.2) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) --- updated-dependencies: - dependency-name: "@hookform/resolvers" dependency-version: 5.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@langchain/core" dependency-version: 1.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@langchain/openai" dependency-version: 1.5.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@sentry/nextjs" dependency-version: 10.73.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@tavily/core" dependency-version: 0.7.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: express-rate-limit dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: inngest dependency-version: 4.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: input-otp dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: langchain dependency-version: 1.5.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: lucide-react dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: mongoose dependency-version: 9.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: next dependency-version: 16.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: posthog-js dependency-version: 1.426.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react-hook-form dependency-version: 7.87.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react-resizable-panels dependency-version: 4.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-07T09:15:39Z

Assignees

The following users could not be added as assignees: vectorMindsAI. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot · 2026-09-14T09:13:13Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot closed this Sep 14, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-8c17d44eb2 branch September 14, 2026 09:13

Navigation Menu

chore(deps): bump the production-dependencies group across 1 directory with 17 updates - #127

chore(deps): bump the production-dependencies group across 1 directory with 17 updates#127
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-8c17d44eb2

dependabot Bot commented on behalf of github Sep 7, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.1 KB
`@sentry/browser` - with treeshaking flags	25.58 KB
`@sentry/browser` (incl. Tracing)	45.54 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.28 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.17 KB
`@sentry/browser` (incl. Tracing, Replay)	83.87 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	88.49 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	100.83 KB
`@sentry/browser` (incl. Feedback)	43.87 KB
`@sentry/browser` (incl. sendFeedback)	31.78 KB
`@sentry/browser` (incl. FeedbackAsync)	36.79 KB
`@sentry/browser` (incl. Metrics)	28.16 KB
`@sentry/browser` (incl. Logs)	28.38 KB
`@sentry/browser` (incl. Metrics & Logs)	29.06 KB
`@sentry/react`	28.86 KB
`@sentry/react` (incl. Tracing)	47.74 KB
`@sentry/vue`	32.4 KB
`@sentry/vue` (incl. Tracing)	47.46 KB
`@sentry/svelte`	27.12 KB
CDN Bundle	29.43 KB

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

v5.9.0

5.9.0 (2026-08-15)

Features

@​langchain/core@​1.2.9

Patch Changes

@​langchain/core@​1.2.8

Patch Changes

@​langchain/openai@​1.5.11

Patch Changes

@​langchain/openai@​1.5.10

Patch Changes

@​langchain/openai@​1.5.9

Patch Changes

@​langchain/openai@​1.5.8

Patch Changes

10.73.0

Important Changes

Other Changes

Bundle size 📦

10.73.0

Important Changes

Other Changes

10.72.0

Important Changes

Other Changes

v8.7.0

inngest@4.19.0

Minor Changes

Patch Changes

4.19.0

Minor Changes

Patch Changes

v1.5.0

[1.5.0]

[1.5.0-beta.2]

[1.5.0-beta.1]

[1.5.0-beta.0]

langchain@1.5.10

Patch Changes

langchain@1.5.9

Patch Changes

Version 1.40.0

What's Changed

New Contributors

Version 1.39.0

What's Changed

Version 1.38.0

What's Changed

Version 1.37.0

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Assignees

Labels

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 7, 2026 •

edited

Loading

`@langchain/core@1`.2.9

`@langchain/core@1`.2.8

`@langchain/openai@1`.5.11

`@langchain/openai@1`.5.10

`@langchain/openai@1`.5.9

`@langchain/openai@1`.5.8