Skip to content

deps(deps): bump the npm-minor-patch group across 1 directory with 13 updates#278

Merged
github-actions[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1da1cd4fde
Jun 8, 2026
Merged

deps(deps): bump the npm-minor-patch group across 1 directory with 13 updates#278
github-actions[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1da1cd4fde

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 13 updates in the / directory:

Package From To
@types/node 25.9.1 25.9.2
@google/adk 1.1.0 1.2.0
@langchain/langgraph 1.3.3 1.3.6
@mastra/core 1.38.0 1.41.0
@mastra/mcp 1.9.0 1.9.1
ai 6.0.194 6.0.197
browser-use 0.7.1 0.7.2
openai 6.41.0 6.42.0
@anthropic-ai/sdk 0.100.1 0.102.0
agents 0.13.3 0.14.5
@cloudflare/workers-types 4.20260602.1 4.20260608.1
wrangler 4.96.0 4.98.0
@cloudflare/vitest-pool-workers 0.16.11 0.16.13

Updates @types/node from 25.9.1 to 25.9.2

Commits

Updates @google/adk from 1.1.0 to 1.2.0

Release notes

Sourced from @​google/adk's releases.

adk: v1.2.0

1.2.0 (2026-06-02)

Features

  • abort agent execution on HTTP connection disconnected (#382) (e7776cc)
  • add pagination and sorting to listSessions (#331) (ed9b72b)
  • add VertexRagRetrievalTool for Vertex AI RAG Engine grounding (#277) (14f5f17)
  • Agent Engine Sandbox Code Executor (#317) (1138e3c)
  • Google maps tool (#321) (d2b4e91)
  • Implement customMetadata support in runAsync and runEphemeral. (#363) (faa458e)
  • Implement the Agent Registry in adk-js (#358) (27e5a92)
  • memory: implement Vertex AI Memory Bank service with tests (#291) (3d82451)
  • openapi: implement auth helpers and credential exchangers (part 1) (#384) (86f794e)

Bug Fixes

  • apply toolFilter in MCPToolset.getTools() (#312) (#313) (3cdc1fb)
  • auth/oauth2: block SSRF via IPv4-mapped IPv6 and fix dead 172.16/12 check (#354) (57b0af7)
  • core: wrap array responses in function tools to comply with Gemini API (#347) (af115b6)
  • do not propagate skipSummarization to parent EventActions in AgentTool (#301) (b3eb611), closes #288
  • filter temp: keys from sub-agent state delta in AgentTool (#271) (db1128b)
  • filter thought parts in stringifyContent and AgentTool merged text (#323) (58dac0b)
  • handle undefined type in toGeminiSchema for enum/const-only schemas (#370) (69f35b4)
  • mcp_toolset: Implement close session method (#394) (4e3faa9)
  • mcp: close MCP client session after listTools/callTool to fix Windows libuv assertion and process leak (#333) (dd5584a)
  • StreamingResponseAggregator.close() drops final event when last chunk has no candidates (#289) (#311) (30ba5c8)
  • streaming: suppress empty STOP chunks and preserve tool calls in SSE session history (#395) (e9e0fe6)

devtools: v1.2.0

1.2.0 (2026-06-02)

Features

  • abort agent execution on HTTP connection disconnected (#382) (e7776cc)
  • Add Agent Engine deployment support (#335) (3e901a5)

Bug Fixes

  • mark lightningcss and jiti as external in agent_loader esbuild to fix adk web on missing optional deps (#319) (ab625c9)
  • remove hardcoded Access-Control-Allow-Origin wildcard from run_sse (#360) (d2db989)
  • replace unix cp with node.js fs.cp in dev/build.js for windows compatibility (#318) (53ee7eb)
  • Resolve CORS vulnerability by disabling express.urlencoded parser (#378) (1fe631f)
  • server: restrict AdkApiServer to listen on configured host (#383) (7be8c81)

... (truncated)

Commits
  • c93ad5e Release: v1.2.0 (#315)
  • e9e0fe6 fix(streaming): suppress empty STOP chunks and preserve tool calls in SSE ses...
  • 4e3faa9 fix(mcp_toolset): Implement close session method (#394)
  • 3e901a5 Feat: Add Agent Engine deployment support (#335)
  • 71a4c01 docs: add TSDoc for example_util, event_actions, run_config, and structured_e...
  • 50b5a00 test: add unit tests for event_actions, structured_events, example_util, run_...
  • 69f35b4 fix: handle undefined type in toGeminiSchema for enum/const-only schemas (#370)
  • dd5584a fix(mcp): close MCP client session after listTools/callTool to fix Windows li...
  • 27e5a92 Feat: Implement the Agent Registry in adk-js (#358)
  • 86f794e feat(openapi): implement auth helpers and credential exchangers (part 1) (#384)
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.3.3 to 1.3.6

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph@​1.3.6

Patch Changes

  • 658a076 Thanks @​christian-bromann! - fix(langgraph): forward named custom stream channels consistently

    Forward remote StreamChannel emissions as custom:<name> protocol events and normalize them back to custom-channel payloads in the API session. This aligns JavaScript stream-channel forwarding with the protocol subscription shape used by remote clients, so custom:<name> subscriptions receive extension channel data consistently.

  • Updated dependencies [0a0e04e, 658a076, a9aa8d6]:

    • @​langchain/langgraph-sdk@​1.9.17

@​langchain/langgraph@​1.3.5

Patch Changes

  • #2489 e3a1933 Thanks @​christian-bromann! - fix(core): keep stream chunks as three-element tuples

    Emit lightweight checkpoint envelopes as separate [namespace, "checkpoints", envelope] chunks before paired values chunks. Public stream() always yields [namespace, mode, payload]; the v3 protocol path surfaces envelopes via convertToProtocolEvent.

  • Updated dependencies [244c24e]:

    • @​langchain/langgraph-sdk@​1.9.16

@​langchain/langgraph@​1.3.4

Patch Changes

  • #2035 7c3a98b Thanks @​JadenKim-dev! - fix(core): prevent Zod schema defaults from overwriting checkpoint state in Command.update

  • Updated dependencies [0491534]:

    • @​langchain/langgraph-sdk@​1.9.12
Changelog

Sourced from @​langchain/langgraph's changelog.

1.3.6

Patch Changes

  • 658a076 Thanks @​christian-bromann! - fix(langgraph): forward named custom stream channels consistently

    Forward remote StreamChannel emissions as custom:<name> protocol events and normalize them back to custom-channel payloads in the API session. This aligns JavaScript stream-channel forwarding with the protocol subscription shape used by remote clients, so custom:<name> subscriptions receive extension channel data consistently.

  • Updated dependencies [0a0e04e, 658a076, a9aa8d6]:

    • @​langchain/langgraph-sdk@​1.9.17

1.3.5

Patch Changes

  • #2489 e3a1933 Thanks @​christian-bromann! - fix(core): keep stream chunks as three-element tuples

    Emit lightweight checkpoint envelopes as separate [namespace, "checkpoints", envelope] chunks before paired values chunks. Public stream() always yields [namespace, mode, payload]; the v3 protocol path surfaces envelopes via convertToProtocolEvent.

  • Updated dependencies [244c24e]:

    • @​langchain/langgraph-sdk@​1.9.16

1.3.4

Patch Changes

  • #2035 7c3a98b Thanks @​JadenKim-dev! - fix(core): prevent Zod schema defaults from overwriting checkpoint state in Command.update

  • Updated dependencies [0491534]:

    • @​langchain/langgraph-sdk@​1.9.12
Commits
  • c418781 chore: version packages (#2495)
  • a9aa8d6 fix(sdk): reconcile subagents and subgraphs on thread reconnect (#2497)
  • 28fbf1d chore: version packages (#2490)
  • c6528b2 chore(sdk): update vitest browser dependency (#2493)
  • e3a1933 fix(core): keep stream() on 3-tuple shape (#2489)
  • a4919b6 chore(deps): bump the langchain group across 1 directory with 8 updates (#2476)
  • c6b29fb chore: version packages (#2465)
  • 7c3a98b fix(core): prevent Zod schema defaults from overwriting checkpoint state in C...
  • See full diff in compare view

Updates @mastra/core from 1.38.0 to 1.41.0

Release notes

Sourced from @​mastra/core's releases.

June 4, 2026

Highlights

Per-request Workspace sandboxes (multi-tenant + isolation)

@mastra/core Workspace sandbox can now be a resolver function, enabling per-request sandbox routing for multi-tenant deployments with isolated working directories/permissions; includes prompt-safe “stable placeholder” instructions by default with an opt-in instructions.dynamicSandbox mode.

Sandbox continuity for background processes via sandboxCacheKey

When using dynamic sandboxes, sandboxCacheKey lets background process tools (execute_command with background: true, get_process_output, kill_process) reliably attach to the same sandbox across follow-up requests, with cache management via workspace.clearSandboxCache().

Unified “stream until idle” behavior via untilIdle option (core + server + client SDKs)

stream()/resumeStream() now support untilIdle (boolean or { maxIdleMs }) to keep streams open across background-task continuations; the same untilIdle request field is supported on server endpoints and client SDKs.

Deprecation: dedicated *UntilIdle methods/endpoints

streamUntilIdle() and resumeStreamUntilIdle() (and the dedicated /stream-until-idle and /resume-stream-until-idle endpoints) are deprecated in favor of stream(..., { untilIdle: true }) / resumeStream(..., { untilIdle: true }).

Breaking Changes

  • None noted in this changelog.

Changelog

@​mastra/core@1.41.0

Minor Changes

  • Workspace sandbox now accepts a resolver function for per-request sandboxes. (#16048)

    Before: sandbox: WorkspaceSandbox (static, same sandbox for every request) After: sandbox: WorkspaceSandbox | (({ requestContext }) => WorkspaceSandbox) (static or per-request)

    This enables per-request sandbox routing from a single Workspace — useful for multi-tenant deployments where each user/role needs an isolated working directory or different execution permissions.

    const workspace = new Workspace({
  sandbox: ({ requestContext }) => {
    const userId = requestContext.get('user-id') as string;
    return new LocalSandbox({ workingDirectory: `/workspaces/${userId}` });
  },
});

    When using a resolver, the caller owns the returned sandbox's lifecycle — the Workspace will not call start() or destroy() on it. mounts throws an INVALID_CONFIG error with a resolver, and lsp: true is disabled with a warning because both require a concrete sandbox instance up front.

    Stable prompts by default

    Building workspace instructions no longer calls a sandbox resolver. Resolver-backed sandboxes contribute stable placeholder text to the agent's system message, so constructing the prompt never provisions a caller-owned sandbox and the prompt stays cache-friendly. Opt into concrete per-request instructions with instructions.dynamicSandbox:

    const workspace = new Workspace({
  sandbox: ({ requestContext }) => resolveSandbox(requestContext),
  instructions: { dynamicSandbox: 'resolve' }, // or a ({ requestContext }) => string function
});

... (truncated)

Commits

Updates @mastra/mcp from 1.9.0 to 1.9.1

Changelog

Sourced from @​mastra/mcp's changelog.

1.9.1

Patch Changes

  • Removed Hono from @​mastra/core and auth package runtime dependencies. Auth providers now receive framework-agnostic request types that support standard Request objects and Hono-compatible request shapes. MCP and deployer avoid relying on core-bundled Hono context types at package boundaries. (#17410)

  • Updated dependencies [c973db4, 552285e, 77e686c, ece8dba, e751af2, e2a8380, be3f1cd, a34d9db]:

    • @​mastra/core@​1.39.0

1.9.1-alpha.0

Patch Changes

  • Removed Hono from @​mastra/core and auth package runtime dependencies. Auth providers now receive framework-agnostic request types that support standard Request objects and Hono-compatible request shapes. MCP and deployer avoid relying on core-bundled Hono context types at package boundaries. (#17410)

  • Updated dependencies [c973db4, 552285e, 77e686c, ece8dba, e751af2, e2a8380, be3f1cd, a34d9db]:

    • @​mastra/core@​1.39.0-alpha.0
Commits

Updates ai from 6.0.194 to 6.0.197

Release notes

Sourced from ai's releases.

ai@6.0.197

Patch Changes

  • Updated dependencies [fef3b24]
    • @​ai-sdk/gateway@​3.0.125

ai@6.0.196

Patch Changes

  • Updated dependencies [286b7a2]
    • @​ai-sdk/gateway@​3.0.124
Changelog

Sourced from ai's changelog.

6.0.197

Patch Changes

  • Updated dependencies [fef3b24]
    • @​ai-sdk/gateway@​3.0.125

6.0.196

Patch Changes

  • Updated dependencies [286b7a2]
    • @​ai-sdk/gateway@​3.0.124

6.0.195

Patch Changes

  • Updated dependencies [537a022]
    • @​ai-sdk/gateway@​3.0.123
Commits

Updates browser-use from 0.7.1 to 0.7.2

Release notes

Sourced from browser-use's releases.

0.7.2

What's Changed

Full Changelog: webllm/browser-use@v0.7.1...v0.7.2

Commits
  • ae35380 fix(ci): align MCP manifest version
  • 464f9c8 chore(version): update version to 0.7.2
  • 44a3b65 Merge pull request #47 from webllm/fix-gemini
  • 4194b3b fix(ci): clear dependency audit failures
  • cdbbb98 fix(llm): send Google config through SDK config
  • See full diff in compare view

Updates openai from 6.41.0 to 6.42.0

Release notes

Sourced from openai's releases.

v6.42.0

6.42.0 (2026-06-03)

Full Changelog: v6.41.0...v6.42.0

Features

  • api: responses.moderation and chat_completions.moderation (6d8f592)
Changelog

Sourced from openai's changelog.

6.42.0 (2026-06-03)

Full Changelog: v6.41.0...v6.42.0

Features

  • api: responses.moderation and chat_completions.moderation (6d8f592)
Commits

Updates @anthropic-ai/sdk from 0.100.1 to 0.102.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.102.0

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

  • api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

  • client: run middleware before request signing (#45) (95f1a4a)

sdk: v0.101.0

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

  • client: add support for middleware (9b01120)

Bug Fixes

  • apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
  • streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
  • streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

  • internal: fix artifact url (925ec27)
  • internal: fix branch names (fa3cf2c)
  • internal: update private repo name (a8ac213)

Documentation

  • point security reports to Anthropic's HackerOne program (#16) (5c7912c)
Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

  • api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

  • client: run middleware before request signing (#45) (95f1a4a)

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

  • client: add support for middleware (9b01120)

Bug Fixes

  • apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
  • streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
  • streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

  • internal: fix artifact url (925ec27)
  • internal: fix branch names (fa3cf2c)
  • internal: update private repo name (a8ac213)

Documentation

  • point security reports to Anthropic's HackerOne program (#16) (5c7912c)
Commits
  • f7dfb97 chore: release main
  • a3f3c97 feat(api): small updates to Managed Agents types
  • a5c98d1 fix(client): run middleware before request signing (#45)
  • 185ec06 chore: release main
  • fab8910 codegen metadata
  • 7ff4036 fix: apply request timeout to inner fetch only, not middleware chain (#40)
  • 257bc1f feat(client): add support for middleware
  • 5b3ace5 chore(internal): fix artifact url
  • 70966be fix(streaming): correctly parse json numbers with scientific notation (#9)
  • 7e22f20 docs: point security reports to Anthropic's HackerOne program (#16)
  • Additional commits viewable in compare view

Updates agents from 0.13.3 to 0.14.5

Release notes

Sourced from agents's releases.

agents@0.14.5

Patch Changes

  • #1613 124a47a Thanks @​threepointone! - Introduce the first Think framework layer for convention-driven agent apps.

    This release adds a manifest-driven Vite plugin that discovers agents from the agents/ directory, generates a Worker entrypoint and virtual framework modules, derives stable Durable Object class names, and merges framework-owned Worker config defaults with user Wrangler config. It also keeps the Think Vite plugin usable directly in normal Vite plugin arrays.

    The framework now supports optional app server entries, manifest-scoped friendly agent and sub-agent routing, deterministic route surfaces, colocated skill detection, Worker Loader requirement diagnostics, and explicit diagnostics for unsupported nested sub-agent conventions. Think currently supports top-level agents and one sub-agent layer; deeper nesting is rejected with guidance so that the routing and lifecycle model can be designed deliberately.

    This framework layer is experimental: both the Vite plugin (once, on build start) and the think CLI (on startup) emit a notice that the API may change or be removed in any release. The core Think agent runtime is unchanged.

    The Think CLI now includes think init, think inspect, and think types. think init scaffolds a minimal Workers/Vite Think app, safely handles prompted or named target directories, refuses unsafe migrations, and installs npm dependencies by default. think inspect exposes manifest/config diagnostics in text or JSON, while think types generates Think-owned declarations and can optionally compose with Wrangler type generation.

    This release also adds host-framework coverage for React Router and TanStack Start, updates examples to use the convention-first framework shape, and hardens Agents/worker-bundler virtual modules for bundled skill compatibility.

  • #1613 124a47a Thanks @​threepointone! - Compile skill scripts ahead of time and remove the in-Worker bundler (drops ~14MB of esbuild-wasm from Worker bundles).

    Skill scripts are now always compiled to self-contained JavaScript before they run, and the runtime no longer ships an in-Worker bundler (@cloudflare/worker-bundler is no longer a dependency of agents):

    • The Agents Vite plugin compiles bundled skill scripts (scripts/*.ts/.tsx/.js/.mjs) with esbuild at build time — resolving sibling imports and stripping TypeScript — and marks them precompiled.
    • Skills served from R2 or other dynamic sources must be compiled before upload. A new compileSkillScript helper is exported from agents/skills/compile for use in your publish/upload tooling.
    • At runtime, a skill script that still needs compiling (raw TypeScript or a multi-file skill that wasn't bundled) throws a clear "must be compiled to a self-contained JavaScript module" error instead of silently bundling in-Worker.

    Breaking: if you ship raw TypeScript or multi-file skill scripts to R2 (or another dynamic source) and relied on the in-Worker bundler to compile them at runtime, bundle them ahead of time (e.g. with compileSkillScript) before upload. Bundled skills handled by the Vite plugin require no changes. The previously-added stubWorkerBundler option has been removed (there is nothing left to stub).

agents@0.14.4

Patch Changes

  • #1693 6496c80 Thanks @​threepointone! - Fix AIChatAgent orphaned-stream recovery merging a new assistant turn into the previous assistant message (#1691).

    When a stream was interrupted before its final assistant message was persisted (Durable Object hibernation, deploy churn, isolate restart, reconnect), orphan recovery reconstructed the message from stored chunks. If those chunks carried no provider start.messageId — the common case — recovery fell back to the last assistant message in history. That is correct for a continuation, but wrong for a normal new turn after a later user message: the recovered chunks for the new turn were appended onto the previous assistant message, corrupting both the persisted transcript and future model context.

... (truncated)

Changelog

Sourced from agents's changelog.

0.14.5

Patch Changes

  • #1613 124a47a Thanks @​threepointone! - Introduce the first Think framework layer for convention-driven agent apps.

    This release adds a manifest-driven Vite plugin that discovers agents from the agents/ directory, generates a Worker entrypoint and virtual framework modules, derives stable Durable Object class names, and merges framework-owned Worker config defaults with user Wrangler config. It also keeps the Think Vite plugin usable directly in normal Vite plugin arrays.

    The framework now supports optional app server entries, manifest-scoped friendly agent and sub-agent routing, deterministic route surfaces, colocated skill detection, Worker Loader requirement diagnostics, and explicit diagnostics for unsupported nested sub-agent conventions. Think currently supports top-level agents and one sub-agent layer; deeper nesting is rejected with guidance so that the routing and lifecycle model can be designed deliberately.

    This framework layer is experimental: both the Vite plugin (once, on build start) and the think CLI (on startup) emit a notice that the API may change or be removed in any release. The core Think agent runtime is unchanged.

    The Think CLI now includes think init, think inspect, and think types. think init scaffolds a minimal Workers/Vite Think app, safely handles prompted or named target directories, refuses unsafe migrations, and installs npm dependencies by default. think inspect exposes manifest/config diagnostics in text or JSON, while think types generates Think-owned declarations and can optionally compose with Wrangler type generation.

    This release also adds host-framework coverage for React Router and TanStack Start, updates examples to use the convention-first framework shape, and hardens Agents/worker-bundler virtual modules for bundled skill compatibility.

  • #1613 124a47a Thanks @​threepointone! - Compile skill scripts ahead of time and remove the in-Worker bundler (drops ~14MB of esbuild-wasm from Worker bundles).

    Skill scripts are now always compiled to self-contained JavaScript before they run, and the runtime no longer ships an in-Worker bundler (@cloudflare/worker-bundler is no longer a dependency of agents):

    • The Agents Vite plugin compiles bundled skill scripts (scripts/*.ts/.tsx/.js/.mjs) with esbuild at build time — resolving sibling imports and stripping TypeScript — and marks them precompiled.
    • Skills served from R2 or other dynamic sources must be compiled before upload. A new compileSkillScript helper is exported from agents/skills/compile for use in your publish/upload tooling.
    • At runtime, a skill script that still needs compiling (raw TypeScript or a multi-file skill that wasn't bundled) throws a clear "must be compiled to a self-contained JavaScript module" error instead of silently bundling in-Worker.

    Breaking: if you ship raw TypeScript or multi-file skill scripts to R2 (or another dynamic source) and relied on the in-Worker bundler to compile them at runtime, bundle them ahead of time (e.g. with compileSkillScript) before upload. Bundled skills handled by the Vite plugin require no changes. The previously-added stubWorkerBundler option has been removed (there is nothing left to stub).

0.14.4

Patch Changes

  • #1693 6496c80 Thanks @​threepointone! - Fix AIChatAgent orphaned-stream recovery merging a new assistant turn into the previous assistant message (#1691).

    When a stream was interrupted before its final assistant message was persisted (Durable Object hibernation, deploy churn, isolate restart, reconnect), orphan recovery reconstructed the message from stored chunks. If those chunks carried no provider start.messageId — the common case — recovery fell back to the last assistant message in history. That is correct for a continuation, but wrong for a normal new turn after a later user message: the recovered chunks for the new turn were appended onto the previous assistant message, corrupting both the persisted transcript and future model context.

... (truncated)

Commits
  • 3e8963a Version Packages (#1694)
  • 124a47a Add the first Think framework layer (Vite plugin, CLI, examples) (#1613)
  • 9a6666a Version Packages (#1689)
  • 6496c80 fix(chat): orphaned-stream recovery no longer merges a new turn into the prev...
  • f05ce69 Version Packages (#1687)
  • 1e49880 perf(chat): batch and pack SQLite writes for chat persistence (#1686)
  • 1dbb9d7 Migrate to pnpm. (#1682)
  • 83dd255 Version Packages (#1674)
  • ab6dd95 fix(chat-recovery): exempt human-in-the-loop turns from recovery budgets; clo...
  • df6c0d6 fix(think,agents): opt-in proactive + reactive recovery for mid-turn context-...
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 4.20260602.1 to 4.20260608.1

Commits

Updates wrangler from 4.96.0 to 4.98.0

Release notes

Sourced from wrangler's releases.

wrangler@4.98.0

Minor Changes

  • #14089 c6c61b5 Thanks @​alsuren! - Add migrations_pattern to D1 database bindings

    The D1 binding now accepts an optional migrations_pattern field, allowing you to point wrangler d1 migrations apply and wrangler d1 migrations list at migration files in nested layouts (e.g. ORM-generated folders like migrations/0000_init/migration.sql).

    migrations_pattern is a glob (relative to the wrangler config file) and defaults to ${migrations_dir}/*.sql, which preserves today's behaviour. Files that do not match the pattern are not executed.

    {
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "my-db",
      "database_id": "...",
      "migrations_dir": "migrations",
      "migrations_pattern": "migrations/*/migration.sql"
    }
  ]
}

    When no migrations match the configured pattern but files matching the common migrations/*/migration.sql (drizzle-style) layout do exist, Wrangler logs a hint suggesting migrations_pattern as an opt-in.

    wrangler d1 migrations create now returns an actionable error if the generated migration filename would not match the configured pattern.

  • #14153 7a6b1a4 Thanks @​dario-piotrowicz! - Generalize wrangler deploy and wrangler versions upload positional argument from [script] to [path]

    Both wrangler deploy and wrangler versions upload now accept a generic [path] positional argument that can point to either a Worker entry-point file or a directory of static assets. The type is auto-detected. For example:

    • File: wrangler deploy ./src/index.ts deploys a Worker (same as before)
    • Directory: wrangler deploy ./public deploys a static assets site (no interactive confirmation prompt)

    The --script named option is now hidden and deprecated for both commands. It continues to work for backwards compatibility but only accepts file paths. Passing a directory to --script now produces a clear error message suggesting the positional path argument or --assets flag instead.

  • #13863 3b8b80a Thanks @​aslakhellesoy! - getPlatformProxy() now passes through workflow bindings that have a script_name

    Workflows without a script_name are still stripped (and warned about) because the engine for an internal workflow can't run inside the empty proxy worker that backs getPlatformProxy(). Workflows with a script_name are handed to miniflare unchanged; miniflare reroutes the engine's USER_WORKFLOW binding through the dev-registry-proxy when the target worker is running in another Miniflare instance — the same mecha...

    Description has been truncated

@dependabot @github

dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions github-actions Bot enabled auto-merge (squash) June 8, 2026 03:23
@dependabot
deps(deps): bump the npm-minor-patch group across 1 directory with 13…
a17c85e 
… updates

Bumps the npm-minor-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `25.9.2` |
| [@google/adk](https://github.com/google/adk-js) | `1.1.0` | `1.2.0` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.3.3` | `1.3.6` |
| [@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core) | `1.38.0` | `1.41.0` |
| [@mastra/mcp](https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp) | `1.9.0` | `1.9.1` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.194` | `6.0.197` |
| [browser-use](https://github.com/webllm/browser-use) | `0.7.1` | `0.7.2` |
| [openai](https://github.com/openai/openai-node) | `6.41.0` | `6.42.0` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.100.1` | `0.102.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.13.3` | `0.14.5` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260602.1` | `4.20260608.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.96.0` | `4.98.0` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.16.11` | `0.16.13` |



Updates `@types/node` from 25.9.1 to 25.9.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@google/adk` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/google/adk-js/releases)
- [Commits](google/adk-js@adk-v1.1.0...adk-v1.2.0)

Updates `@langchain/langgraph` from 1.3.3 to 1.3.6
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.3.6/libs/langgraph-core)

Updates `@mastra/core` from 1.38.0 to 1.41.0
- [Release notes](https://github.com/mastra-ai/mastra/releases)
- [Changelog](https://github.com/mastra-ai/mastra/blob/main/docs/CHANGELOG.md)
- [Commits](https://github.com/mastra-ai/mastra/commits/@mastra/core@1.41.0/packages/core)

Updates `@mastra/mcp` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/mastra-ai/mastra/releases)
- [Changelog](https://github.com/mastra-ai/mastra/blob/main/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/mastra-ai/mastra/commits/@mastra/mcp@1.9.1/packages/mcp)

Updates `ai` from 6.0.194 to 6.0.197
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.197/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.197/packages/ai)

Updates `browser-use` from 0.7.1 to 0.7.2
- [Release notes](https://github.com/webllm/browser-use/releases)
- [Commits](webllm/browser-use@v0.7.1...v0.7.2)

Updates `openai` from 6.41.0 to 6.42.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.41.0...v6.42.0)

Updates `@anthropic-ai/sdk` from 0.100.1 to 0.102.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.100.1...sdk-v0.102.0)

Updates `agents` from 0.13.3 to 0.14.5
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.14.5/packages/agents)

Updates `@cloudflare/workers-types` from 4.20260602.1 to 4.20260608.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.96.0 to 4.98.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.98.0/packages/wrangler)

Updates `@cloudflare/vitest-pool-workers` from 0.16.11 to 0.16.13
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.16.13/packages/vitest-pool-workers)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.102.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.16.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 4.20260608.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@google/adk"
  dependency-version: 1.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@mastra/core"
  dependency-version: 1.41.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@mastra/mcp"
  dependency-version: 1.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 25.9.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: agents
  dependency-version: 0.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: ai
  dependency-version: 6.0.197
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: browser-use
  dependency-version: 0.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: openai
  dependency-version: 6.42.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: wrangler
  dependency-version: 4.98.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps(deps): bump the npm-minor-patch group with 13 updates deps(deps): bump the npm-minor-patch group across 1 directory with 13 updates Jun 8, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-1da1cd4fde branch from a630e49 to a17c85e Compare June 8, 2026 08:20
@github-actions github-actions Bot merged commit cd812db into main Jun 8, 2026
12 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-1da1cd4fde branch June 8, 2026 20:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@creatornader