chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@ai-sdk/anthropic (source)	3.0.96 → 3.0.98			dependencies	patch	3.0.99
@ai-sdk/google (source)	3.0.91 → 3.0.95			dependencies	patch	3.0.97 (+1)
@ai-sdk/openai (source)	3.0.84 → 3.0.86			dependencies	patch
@harperfast/skills (source)	1.10.8 → 1.11.0			dependencies	minor
actions/setup-node	v6.4.0 → v6.5.0			action	minor
ai (source)	6.0.224 → 6.0.230			dependencies	patch	6.0.232 (+1)
harper (source)	5.1.18 → 5.1.22			devDependencies	patch
hono (source)	4.12.29 → 4.12.30			devDependencies	patch	4.12.31
ink	7.1.0 → 7.1.1			overrides	patch
ink	7.1.0 → 7.1.1			dependencies	patch
oxlint (source)	1.73.0 → 1.74.0			devDependencies	minor
semantic-release	25.0.6 → 25.0.8			devDependencies	patch
tsx (source)	4.23.0 → 4.23.1			devDependencies	patch

---

Release Notes

vercel/ai (@​ai-sdk/anthropic)

v3.0.98

Compare Source

Patch Changes

• 10366a2: fix(provider/anthropic): preserve web search citations when replaying assistant messages
• Updated dependencies [19093fd]
  • @​ai-sdk/provider-utils@​4.0.40

v3.0.97

Compare Source

Patch Changes

• Updated dependencies [06fb54c]
  • @​ai-sdk/provider-utils@​4.0.39

HarperFast/skills (@​harperfast/skills)

v1.11.0

Compare Source

Features

• rules: add v5-upgrade rule from v5 migration guide (#​71) (6c99002)

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

harperfast/harper (harper)

v5.1.22

Compare Source

Reliability

• Source-apply commit retry now recovers from ERR_TRY_AGAIN (#​1696): a replay / source-apply commit that hits ERR_TRY_AGAIN is retried on a fresh transaction instead of failing in place — previously this could wedge replication apply for the whole database. Follow-up to #​1223 (which retried in place).

Full Changelog: HarperFast/harper@v5.1.21...v5.1.22

v5.1.21

Compare Source

Reliability

• Over-time write transactions now abort instead of force-committing (#​1407, #​1411). A write transaction that exceeds its open-time limit is now cleanly aborted and surfaced as an error rather than force-committed — which could otherwise persist a partially-applied transaction. Applies to both storage engines.

Full Changelog: HarperFast/harper@v5.1.20...v5.1.21

v5.1.20

Compare Source

Performance & correctness

• get_analytics no longer risks a multi-million-row scan on large hdb_analytics tables. The query planner estimated a primary-key between range as a flat 10% of the table rather than from its actual width, so a narrow time window on a selective metric could be judged costlier than a plain metric match — driving iteration off the metric index and decoding its entire history instead of the requested window. On a large analytics table this could turn a routine status query into a scan that never completes and restarts the instance. get_analytics now leads with the bounded time window and pins execution order when one is given. (#​1798)

Security

• Fixed a ReDoS in configValidator's directory-path validation that could hang the CLI at 100% CPU on a crafted input. Replaced the vulnerable regex with a control-character denylist and hardened it further to reject C1 control codes and Unicode line separators. (#​1784)

Build & packaging

• The published npm-shrinkwrap.json no longer vendors dev-only packages. npm prune --omit=dev only touches node_modules, not the generated lockfile, so dev-only platform-specific packages (like @esbuild/*, pulled in via tsx) were shipping in the published shrinkwrap — and could cause npm ci to fail on a consumer's machine with EBADPLATFORM if their own lockfile folded that subtree in. The build now prunes dev entries from the shrinkwrap after it's generated. (#​1781, #​1783)

v5.1.19

Compare Source

Static component & deploy

• Fixed root-mounted static serving 404ing every asset. A static component mounted at urlPath: '/' was being treated as a sub-route: the boundary check joined '/' + '/', which never matches any sub-path, so only the exact path / was served and every other asset 404'd. normalizeUrlPath now treats '/', '', and undefined as "no path constraint," restoring 5.0.x root-mount semantics. Also hardened trailing-slash handling ('/api//', '///', etc. now normalize consistently instead of surviving as a residual slash that failed both exact- and boundary-match). (#​1766)

Configuration

• Config vars set via a component's .env file now warn instead of silently doing nothing. HARPER_DEFAULT_CONFIG / HARPER_CONFIG / HARPER_SET_CONFIG delivered through a component's loadEnv were being composed away before components ever loaded — no error, no effect. Harper now warns at boot and again at component-load time (for components deployed after boot), naming the variable, the file, and where it's actually supported (process environment or harper-config.yaml). (#​1513)

Full Changelog: HarperFast/harper@v5.1.18...v5.1.19

honojs/hono (hono)

v4.12.30

Compare Source

What's Changed

• chore(benchmark/routers): bump deps in #​5107
• chore(benchmark): remove not used benchmarks in #​5108
• chore: update to ts6 in prep for ts7 in #​5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #​5025
• fix(compress): do not compress 206 Partial Content responses in #​5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #​5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #​5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

vadimdemedes/ink (ink)

v7.1.1

Compare Source

• Fix: Preserve last <Static> line erased after a full-clear frame (#​974) e51dfdd
• Make measureElement() also return position coordinates (#​968) c073b27

---

oxc-project/oxc (oxlint)

v1.74.0

Compare Source

🚀 Features

• 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#​24044) (Boshen)

🐛 Bug Fixes

• 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#​24341) (leaysgur)
• 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#​24339) (leaysgur)

⚡ Performance

• 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#​24413) (connorshea)
• 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#​24417) (connorshea)
• 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#​24420) (connorshea)

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

privatenumber/tsx (tsx)

v4.23.1

Compare Source

Bug Fixes

• support tsImport after global preload (8d4ffc2)
• watch: avoid clearing piped output (95d0672)
• watch: treat script and dependency paths literally (79fddde)

Performance Improvements

• index transform cache lazily (e818ad6)
• load esbuild lazily in CLI (d067938)
• map Node TypeScript formats directly (cdcc623)
• use sync module hooks on Node v22.22.3+ (f8992f1)

---

This release is also available on:

• npm package (@​latest dist-tag)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dawsontoth]

Reviewed & approved via scheduled Renovate triage.

Coordinated @ai-sdk/* bump — all providers move together (anthropic, gateway, google, openai) onto @ai-sdk/provider-utils@4.0.39, with ai 6.0.224→6.0.229, all staying within the ai@6 / provider-v3 generation, so no model specificationVersion boundary is crossed. CI is CLEAN (all checks green). Diff is version + lockfile only. LGTM.

[github-actions]

🎉 This PR is included in version 0.16.27 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀