Skip to content

feat(deps): bump the production-patch-minor group across 3 directories with 16 updates#2147

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-patch-minor-4a0e91d090
Open

feat(deps): bump the production-patch-minor group across 3 directories with 16 updates#2147
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-patch-minor-4a0e91d090

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-patch-minor group with 16 updates in the / directory:

Package From To
dotenv 16.4.5 16.6.1
@apm-js-collab/code-transformer 0.12.0 0.15.0
@next/env 14.2.3 14.2.35
@vercel/functions 1.0.2 1.6.0
cors 2.8.5 2.8.6
esbuild 0.27.4 0.28.1
zod-to-json-schema 3.25.1 3.25.2
ai 5.0.76 5.0.204
@braintrust/bt-darwin-arm64 0.12.0 0.13.0
@braintrust/bt-darwin-x64 0.12.0 0.13.0
@braintrust/bt-linux-arm64 0.12.0 0.13.0
@braintrust/bt-linux-x64 0.12.0 0.13.0
@braintrust/bt-linux-x64-musl 0.12.0 0.13.0
@braintrust/bt-win32-arm64 0.12.0 0.13.0
@braintrust/bt-win32-x64 0.12.0 0.13.0
@ai-sdk/provider 0.0.11 0.0.26

Bumps the production-patch-minor group with 2 updates in the /integrations/vercel-ai-sdk directory: ai and @ai-sdk/provider.
Bumps the production-patch-minor group with 14 updates in the /js directory:

Package From To
dotenv 16.4.5 16.6.1
@apm-js-collab/code-transformer 0.12.0 0.15.0
@next/env 14.2.3 14.2.35
@vercel/functions 1.0.2 1.6.0
cors 2.8.5 2.8.6
esbuild 0.28.0 0.28.1
zod-to-json-schema 3.25.1 3.25.2
@braintrust/bt-darwin-arm64 0.12.0 0.13.0
@braintrust/bt-darwin-x64 0.12.0 0.13.0
@braintrust/bt-linux-arm64 0.12.0 0.13.0
@braintrust/bt-linux-x64 0.12.0 0.13.0
@braintrust/bt-linux-x64-musl 0.12.0 0.13.0
@braintrust/bt-win32-arm64 0.12.0 0.13.0
@braintrust/bt-win32-x64 0.12.0 0.13.0

Updates dotenv from 16.4.5 to 16.6.1

Changelog

Sourced from dotenv's changelog.

16.6.1 (2025-06-27)

Changed

  • Default quiet to true – hiding the runtime log message (#874)
  • NOTICE: 17.0.0 will be released with quiet defaulting to false. Use config({ quiet: true }) to suppress.
  • And check out the new dotenvx. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and code together with secure secrets. Simply switch require('dotenv').config() for require('@dotenvx/dotenvx').config().

16.6.0 (2025-06-26)

Added

  • Default log helpful message [dotenv@16.6.0] injecting env (1) from .env (#870)
  • Use { quiet: true } to suppress
  • Aligns dotenv more closely with dotenvx.

16.5.0 (2025-04-07)

Added

  • 🎉 Added new sponsor Graphite - the AI developer productivity platform helping teams on GitHub ship higher quality software, faster.

[!TIP] Become a sponsor

The dotenvx README is viewed thousands of times DAILY on GitHub and NPM. Sponsoring dotenv is a great way to get in front of developers and give back to the developer community at the same time.

Changed

  • Remove _log method. Use _debug #862

16.4.7 (2024-12-03)

Changed

  • Ignore .tap folder when publishing. (oops, sorry about that everyone. - @​motdotla) #848

16.4.6 (2024-12-02)

Changed

  • Clean up stale dev dependencies #847
  • Various README updates clarifying usage and alternative solutions using dotenvx
Commits

Updates @apm-js-collab/code-transformer from 0.12.0 to 0.15.0

Release notes

Sourced from @​apm-js-collab/code-transformer's releases.

code-transformer: v0.15.0

0.15.0 (2026-06-18)

Features

  • Add a cli tool to assist with testing configurations (#68) (0743fe1)

Bug Fixes

code-transformer: v0.14.0

0.14.0 (2026-05-26)

Features

  • Expose Transformer moduleName and filePath (#74) (954539b)

code-transformer: v0.13.0

0.13.0 (2026-04-29)

Features

  • add return kind option to support iterators (#67) (4e77ee5)

Bug Fixes

  • Updated transformer to prevent instrumenting a non-existent method on a class (#59) (661eb1a)
Changelog

Sourced from @​apm-js-collab/code-transformer's changelog.

0.15.0 (2026-06-18)

Features

  • Add a cli tool to assist with testing configurations (#68) (0743fe1)

Bug Fixes

0.14.0 (2026-05-26)

Features

  • Expose Transformer moduleName and filePath (#74) (954539b)

0.13.0 (2026-04-29)

Features

  • Add return kind option to support iterators (#67) (4e77ee5)
  • Add auto function kind for dynamic return value mechanisms (#64) (0a67e16)
  • Convert ArrowFunctionExpression to FunctionExpression in traceFunction (#60) (d8290b5)

Bug Fixes

  • Fix incorrect function type breaking arg length and generators (#70) (24f2e4c)
Commits
  • 8a3a4a7 chore: release v0.15.0 (#77)
  • 0743fe1 feat: Add a cli tool to assist with testing configurations (#68)
  • 082458b fix: Pass through sourcemaps (#76)
  • dc04dcf chore: release v0.14.0 (#75)
  • 954539b feat: Expose Transformer moduleName and filePath (#74)
  • c498739 chore: release v0.13.0 (#61)
  • 506010d ci: Added a workflow to validate that the PR title is using a conventional co...
  • 4e77ee5 feat: add return kind option to support iterators (#67)
  • 24f2e4c fix incorrect function type breaking arg length and generators (#70)
  • a075ce1 update instance method test to use another file for subclass (#65)
  • Additional commits viewable in compare view

Updates @next/env from 14.2.3 to 14.2.35

Commits

Updates @vercel/functions from 1.0.2 to 1.6.0

Changelog

Sourced from @​vercel/functions's changelog.

1.6.0

Minor Changes

  • Add middleware-related helper functions (#12938)

1.5.2

Patch Changes

  • [vercel/functions] add geolocation.postalCode (#12753)

1.5.1

Patch Changes

  • [@​vercel/functions] update headers doc (#12649)

1.5.0

Minor Changes

  • ipAddress: accept headers as input (#12429)

1.4.2

Patch Changes

  • [functions] decode city name (#12234)

1.4.1

Patch Changes

  • Package files in the root folder (#11982)

1.4.0

Minor Changes

  • Added OIDC Token utility functions (#11701)

1.3.0

Minor Changes

  • [functions] add getEnv method. (#11783)

1.2.0

... (truncated)

Commits

Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates esbuild from 0.27.4 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

Updates zod-to-json-schema from 3.25.1 to 3.25.2

Changelog

Sourced from zod-to-json-schema's changelog.

Changelog

Version Change
3.25.2 Bumps the peer dependency of Zod 3 to 3.25.28 - Versions before patch 13 caused OOM issues and versions between that and 28 removed the /v3 import alias.
3.25.1 Fixes large install size due to accidental inclusion of test files. Thanks, Felix Mosheev!
3.25.0 Adds support for v3.25 and v3 through v4 (import { z } from "zod/v3"). Big thank you to both Andrey Gubanovs and especially to Faïz Hernawan Abdillah, whose more minimal implementation was merged. This will likely be the final release of zod-to-json-schema, as v4 now supports JSON schema natively.
3.24.6 Removed use of instanceOf to check for optional properties as differing package versions could produce intermittent bugs. Added OpenAiAnyType to work around their schema restrictions.
3.24.5 Update .npmignore to drop 2 mb of test files. Thanks Misha Kaletsky!
3.24.4 Added options to set the value of additionalProperties in objects and record
3.24.3 Adds postProcess callback option
3.24.2 Restructured internals to remove circular dependencies which apparently might cause some build systems to whine a bit. Big thanks to Víctor Hernández for the fix.
3.24.1 Adds OpenAI target
3.24.0 Implements new string checks (jwt, base64url, cidr ipv4/v6), matching the new Zod version
3.23.5 Module import hotfix by Enzo Monjardín. Thanks!
3.23.4 Fixes branded regex property names and a weird edgecase in arrays. Thanks to Isaiah Marc Sanchez and Mitchell Merry!
3.23.3 More tests (Thanks Brett Zamir!), removed dead code
3.23.2 Lazily loads Emoji regex to avoid incompatibility with some environments. Thanks Jacob Lee!
3.23.1 Best-effort RegEx flag support by Spappz! Some minor fixes and additions, such as the title option.
3.23.0 Adds support for base64, date, time, duration and nanoid string validations. A warm welcome and a big thanks to Colin, the creator of Zod, joining in as a contributor :)
3.22.5 Adds new z.date() parsing options and override callback
3.22.4 Adds fix for nullable references in OpenAPI mode
3.22.3 Adjust root path from "#/" to "#" according to RFC 6901
3.22.2 Adds "output" pipe strategy
3.22.1 Fixes broken imports when using some bundlers
3.22.0 Support readonly. Export both CJS and ESM. Export everything from index. Alternative map parser. Improved pattern handling and updated sources.
3.21.4 Fixes missing support for exact array length
3.21.3 Fixes issue #77 (Reference path to nullable schemas in Open-API mode)
3.21.2 Adds "integer" type Date output to support min/max checks, markdownDescription option, fixes "none" refStrategy by adding "seen" and adds an option to use "pattern" with Zods' email enum instead of "format".
3.21.1 New target (2019-09) along with improved intersection schemas, improved mutual recursion references in definitions, descriptions respected in union parser and not removed in collapsed
3.21.0 Added new string validations (ip, emoji, etc) and BigInt checks to support Zod 3.21
3.20.5 Added uniqueItems to Set and an option to disregard pipe schemas
3.20.4 Bugfixes and improved record parsing for openApi3
3.20.3 Added Cuid2 support introduced in Zod 3.20.3
3.20.2 Reintroduced conditional simplified return-type for when target is OpenAPI 3
3.20.1 Fixed inconsistent casing in imports
3.20.0 Adds support for Zod 3.20 with catch and pipe parser as well as new string validations. Refactored Ref handling; adding definitions no longer considered experimental. Main API function refactored and simplified; output type less defined but a lot easier to maintain. Doubt anyone will miss it. Narrator: Someone did in fact miss it
3.19.4 Adds custom error message support
3.19.3 Mark definitions as experimental in the readme
3.19.2 Added definitions option
3.19.1 Strict unions fix
3.19.0 No new features added in Zod, parity bump
3.18.2 Fixes support for native enums
3.18.1 Add strictUnions options
3.18.0 Added support for branded types
3.17.2 Fix for reference paths when supplying name option string.
3.17.1 Added startsWith and endsWith string checks. Merge multiple pattern checks into allOf array.
3.17.0 Added switch case handler for new trim "check". No changes to functionality.
3.15.x - 3.16.x Skipped: Did not change the Zod API in any way relevant for this package.
3.14.1 Dependabot security updates

... (truncated)

Commits

Updates ai from 5.0.76 to 5.0.204

Changelog

Sourced from ai's changelog.

5.0.204

Patch Changes

  • 9169261: fix(provider-utils): cancel response body on download rejection to prevent socket leak

    When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit and download, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

  • Updated dependencies [dd9349d]

  • Updated dependencies [9169261]

    • @​ai-sdk/gateway@​2.0.103
    • @​ai-sdk/provider-utils@​3.0.27

5.0.203

Patch Changes

  • Updated dependencies [49f2e26]
    • @​ai-sdk/gateway@​2.0.102

5.0.202

Patch Changes

  • Updated dependencies [3a5c051]
    • @​ai-sdk/gateway@​2.0.101

5.0.201

Patch Changes

  • Updated dependencies [6a1d24c]
    • @​ai-sdk/gateway@​2.0.100

5.0.200

Patch Changes

  • eea9166: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

    • A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
    • IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
    • Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
    • Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).

    The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.

  • 15cf74f: Harden stream text processing and middleware against prototype pollution from stream part IDs.

... (truncated)

Commits
  • d5f3aab Version Packages (#16158)
  • 9169261 Backport: fix(provider-utils): cancel response body on download rejection to ...
  • 4505af3 Version Packages (#16133)
  • 54020f8 Version Packages (#16109)
  • 37bc216 Version Packages (#16088)
  • 08442eb Version Packages (#16027)
  • 8ad6f80 Backport: fix(ai): redact server error details from UI message streams by def...
  • eea9166 Backport: fix(provider-utils,ai): harden download SSRF guard against hostname...
  • 15cf74f Backport: Backport: fix: Harden stream text processing and middleware against...
  • ccdc431 Version Packages (#16013)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ai since your current version.


Updates @braintrust/bt-darwin-arm64 from 0.12.0 to 0.13.0

Release notes

Sourced from @​braintrust/bt-darwin-arm64's releases.

v0.13.0

Install bt 0.13.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/braintrustdata/bt/releases/download/v0.13.0/bt-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/braintrustdata/bt/releases/download/v0.13.0/bt-installer.ps1 | iex"

Download bt 0.13.0

File Platform Checksum
bt-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
bt-x86_64-apple-darwin.tar.gz Intel macOS checksum
bt-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
bt-x86_64-pc-windows-msvc.zip x64 Windows checksum
bt-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
bt-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
bt-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
Commits

Updates @braintrust/bt-darwin-x64 from 0.12.0 to 0.13.0

Release notes

Sourced from @​braintrust/bt-darwin-x64's releases.

v0.13.0

Install bt 0.13.0

Install prebuilt binaries via shell script

curl --proto '...
Description has been truncated

@dependabot
feat(deps): bump the production-patch-minor group across 3 directorie…
172aad3 
…s with 16 updates

Bumps the production-patch-minor group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dotenv](https://github.com/motdotla/dotenv) | `16.4.5` | `16.6.1` |
| [@apm-js-collab/code-transformer](https://github.com/nodejs/orchestrion-js) | `0.12.0` | `0.15.0` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `14.2.3` | `14.2.35` |
| [@vercel/functions](https://github.com/vercel/vercel/tree/HEAD/packages/functions) | `1.0.2` | `1.6.0` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.4` | `0.28.1` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.1` | `3.25.2` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `5.0.76` | `5.0.204` |
| [@braintrust/bt-darwin-arm64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-darwin-x64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-linux-arm64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-linux-x64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-linux-x64-musl](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-win32-arm64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-win32-x64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@ai-sdk/provider](https://github.com/vercel/ai/tree/HEAD/packages/provider) | `0.0.11` | `0.0.26` |

Bumps the production-patch-minor group with 2 updates in the /integrations/vercel-ai-sdk directory: [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) and [@ai-sdk/provider](https://github.com/vercel/ai/tree/HEAD/packages/provider).
Bumps the production-patch-minor group with 14 updates in the /js directory:

| Package | From | To |
| --- | --- | --- |
| [dotenv](https://github.com/motdotla/dotenv) | `16.4.5` | `16.6.1` |
| [@apm-js-collab/code-transformer](https://github.com/nodejs/orchestrion-js) | `0.12.0` | `0.15.0` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `14.2.3` | `14.2.35` |
| [@vercel/functions](https://github.com/vercel/vercel/tree/HEAD/packages/functions) | `1.0.2` | `1.6.0` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.1` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.1` | `3.25.2` |
| [@braintrust/bt-darwin-arm64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-darwin-x64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-linux-arm64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-linux-x64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-linux-x64-musl](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-win32-arm64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |
| [@braintrust/bt-win32-x64](https://github.com/braintrustdata/bt) | `0.12.0` | `0.13.0` |



Updates `dotenv` from 16.4.5 to 16.6.1
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.4.5...v16.6.1)

Updates `@apm-js-collab/code-transformer` from 0.12.0 to 0.15.0
- [Release notes](https://github.com/nodejs/orchestrion-js/releases)
- [Changelog](https://github.com/nodejs/orchestrion-js/blob/main/CHANGELOG.md)
- [Commits](nodejs/orchestrion-js@code-transformer-v0.12.0...code-transformer-v0.15.0)

Updates `@next/env` from 14.2.3 to 14.2.35
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v14.2.35/packages/next-env)

Updates `@vercel/functions` from 1.0.2 to 1.6.0
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/functions/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/functions@1.6.0/packages/functions)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `esbuild` from 0.27.4 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.4...v0.28.1)

Updates `zod-to-json-schema` from 3.25.1 to 3.25.2
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

Updates `ai` from 5.0.76 to 5.0.204
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.204/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.204/packages/ai)

Updates `@braintrust/bt-darwin-arm64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-darwin-x64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-linux-arm64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-linux-x64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-linux-x64-musl` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-win32-arm64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-win32-x64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@ai-sdk/provider` from 0.0.11 to 0.0.26
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider@0.0.26/packages/provider)

Updates `ai` from 5.0.76 to 5.0.204
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.204/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.204/packages/ai)

Updates `@ai-sdk/provider` from 0.0.11 to 0.0.26
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider@0.0.26/packages/provider)

Updates `dotenv` from 16.4.5 to 16.6.1
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.4.5...v16.6.1)

Updates `@apm-js-collab/code-transformer` from 0.12.0 to 0.15.0
- [Release notes](https://github.com/nodejs/orchestrion-js/releases)
- [Changelog](https://github.com/nodejs/orchestrion-js/blob/main/CHANGELOG.md)
- [Commits](nodejs/orchestrion-js@code-transformer-v0.12.0...code-transformer-v0.15.0)

Updates `@next/env` from 14.2.3 to 14.2.35
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v14.2.35/packages/next-env)

Updates `@vercel/functions` from 1.0.2 to 1.6.0
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/functions/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/functions@1.6.0/packages/functions)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.4...v0.28.1)

Updates `zod-to-json-schema` from 3.25.1 to 3.25.2
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

Updates `@braintrust/bt-darwin-arm64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-darwin-x64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-linux-arm64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-linux-x64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-linux-x64-musl` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-win32-arm64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

Updates `@braintrust/bt-win32-x64` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/braintrustdata/bt/releases)
- [Commits](braintrustdata/bt@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 16.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@apm-js-collab/code-transformer"
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@next/env"
  dependency-version: 14.2.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: "@vercel/functions"
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: ai
  dependency-version: 5.0.204
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-darwin-arm64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-darwin-x64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-linux-arm64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-linux-x64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-linux-x64-musl"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-win32-arm64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-win32-x64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@ai-sdk/provider"
  dependency-version: 0.0.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: ai
  dependency-version: 5.0.204
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: "@ai-sdk/provider"
  dependency-version: 0.0.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: dotenv
  dependency-version: 16.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@apm-js-collab/code-transformer"
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@next/env"
  dependency-version: 14.2.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: "@vercel/functions"
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-darwin-arm64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-darwin-x64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-linux-arm64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-linux-x64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-linux-x64-musl"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-win32-arm64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
- dependency-name: "@braintrust/bt-win32-x64"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-patch-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 22, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

2 similar comments
@dependabot @github

dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

@dependabot @github

dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants