chore(deps): bump the npm_and_yarn group across 3 directories with 6 updates by dependabot[bot] · Pull Request #2453 · google/adk-samples

dependabot · 2026-08-03T16:53:22Z

Bumps the npm_and_yarn group with 4 updates in the /python/agents/genmedia-for-commerce/frontend directory: postcss, vite, brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 5 updates in the /python/agents/deep-search/frontend directory:

Package	From	To
postcss	`8.5.3`	`8.5.25`
vite	`6.4.1`	`8.2.0`
brace-expansion	`1.1.11`	`1.1.18`
js-yaml	`4.1.0`	`4.3.1`
uuid	`9.0.1`	`removed`

Bumps the npm_and_yarn group with 1 update in the /typescript/agents/customer_service directory: uuid.

Updates postcss from 8.5.13 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

... (truncated)

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 8.0.10 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

add input to server.fs.allow (#23035) (95a3cda)

bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)

bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)

config: include column in config incompatibility location (#23064) (8a24572)

dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)

deps: update all non-major dependencies (#23069) (4c07b74)

hmr: preserve environment snapshot during server restart (#22992) (b1186c3)

importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)

server: strip base in indexHtml module graph lookup (#22932) (fa005d1)

support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

add input option (#22642) (9beae37)

config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)

css: export PostCSS config type for type-safe configs (#22792) (302c755)

dev: label network URLs with their interface name (#22830) (78accc4)

optimizer: support aube lockfile (#22813) (6319827)

optimizer: support nub lockfile (#22891) (65d3604)

update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)

wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)

config: exclude virtual modules from native config compat check (#22979) (2ced1fe)

css: rewrite urls in OnceExit-injected content (#22983) (abb793e)

deps: update all non-major dependencies (#22985) (04f345b)

deps: update dependency magic-string to v1 (#22998) (c60b4d7)

hmr: remove hot data after prune (#23002) (be96316)

resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

24a611f release: v7.2.4
2d66b7b fix: revert "perf(deps): replace debug with obug (#21107)"
a668014 release: v7.2.3
acfe939 perf(deps): replace debug with obug (#21107)
4f8171e fix(deps): update all non-major dependencies (#21128)
5029720 chore(deps): update rolldown-related dependencies (#21127)
5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
39a0a15 chore(deps): update rolldown-related dependencies (#21095)
6a34ac3 fix(deps): update all non-major dependencies (#21096)
02ceaec chore(deps): update dependency @rollup/plugin-commonjs to v29 (#21099)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
See full diff in compare view

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
Additional commits viewable in compare view

Updates postcss from 8.5.3 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

... (truncated)

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 6.4.1 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

add input to server.fs.allow (#23035) (95a3cda)

bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)

bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)

config: include column in config incompatibility location (#23064) (8a24572)

dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)

deps: update all non-major dependencies (#23069) (4c07b74)

hmr: preserve environment snapshot during server restart (#22992) (b1186c3)

importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)

server: strip base in indexHtml module graph lookup (#22932) (fa005d1)

support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

add input option (#22642) (9beae37)

config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)

css: export PostCSS config type for type-safe configs (#22792) (302c755)

dev: label network URLs with their interface name (#22830) (78accc4)

optimizer: support aube lockfile (#22813) (6319827)

optimizer: support nub lockfile (#22891) (65d3604)

update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)

wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)

config: exclude virtual modules from native config compat check (#22979) (2ced1fe)

css: rewrite urls in OnceExit-injected content (#22983) (abb793e)

deps: update all non-major dependencies (#22985) (04f345b)

deps: update dependency magic-string to v1 (#22998) (c60b4d7)

hmr: remove hot data after prune (#23002) (be96316)

resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

24a611f release: v7.2.4
2d66b7b fix: revert "perf(deps): replace debug with obug (#21107)"
a668014 release: v7.2.3
acfe939 perf(deps): replace debug with obug (#21107)
4f8171e fix(deps): update all non-major dependencies (#21128)
5029720 chore(deps): update rolldown-related dependencies (#21127)
5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
39a0a15 chore(deps): update rolldown-related dependencies (#21095)
6a34ac3 fix(deps): update all non-major dependencies (#21096)
02ceaec chore(deps): update dependency @rollup/plugin-commonjs to v29 (#21099)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
See full diff in compare view

Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
Additional commits viewable in compare view

Removes uuid

Updates langsmith from 0.3.25 to 0.8.9

Release notes

Sourced from langsmith's releases.

v0.8.9

What's Changed

feat(sandbox): add JS Dockerfile snapshots by @langchain-infra in langchain-ai/langsmith-sdk#2951

chore(deps-dev): bump the js-minor-and-patch group across 1 directory with 11 updates by @dependabot[bot] in langchain-ai/langsmith-sdk#2931

chore(deps): bump websockets from 15.0.1 to 16.0 in /python by @dependabot[bot] in langchain-ai/langsmith-sdk#2811

chore(deps): update myst-parser requirement from >=3 to >=4.0.1 in /python by @dependabot[bot] in langchain-ai/langsmith-sdk#2841

chore(deps): bump the py-minor-and-patch group across 1 directory with 19 updates by @dependabot[bot] in langchain-ai/langsmith-sdk#2934

chore(deps): bump typescript from 5.9.3 to 6.0.3 in /js by @dependabot[bot] in langchain-ai/langsmith-sdk#2839

chore(deps-dev): bump google-adk from 1.10.0 to 2.1.0 in /python by @dependabot[bot] in langchain-ai/langsmith-sdk#2960

chore(deps-dev): bump wrapt from 1.17.3 to 2.2.1 in /python by @dependabot[bot] in langchain-ai/langsmith-sdk#2961

chore(deps-dev): bump the py-minor-and-patch group in /python with 6 updates by @dependabot[bot] in langchain-ai/langsmith-sdk#2958

chore(deps-dev): bump types-tqdm from 4.67.3.20260408 to 4.67.3.20260518 in /python by @dependabot[bot] in langchain-ai/langsmith-sdk#2959

ci: add minimum workflow permissions by @jkennedyvz in langchain-ai/langsmith-sdk#2967

chore: update dependabot.yml to comply with posture checks by @jkennedyvz in langchain-ai/langsmith-sdk#2966

test(python): deflake test_tracing_queue_limit_drops_when_full by @baskaryan in langchain-ai/langsmith-sdk#2964

feat(sandbox): size the dockerfile-build sandbox via vcpus/mem_bytes (python) by @langchain-infra in langchain-ai/langsmith-sdk#2979

Full Changelog: langchain-ai/langsmith-sdk@v0.8.8...v0.8.9

v0.8.8

What's Changed

fix(python): retry sandbox pool timeouts by @baskaryan in langchain-ai/langsmith-sdk#2953

fix(sandbox): build Dockerfile snapshots off /tmp by @langchain-infra in langchain-ai/langsmith-sdk#2956

Full Changelog: langchain-ai/langsmith-sdk@v0.8.7...v0.8.8

v0.8.7

What's Changed

fix: reconnect sandbox command streams on EOF by @ramon-langchain in langchain-ai/langsmith-sdk#2941

feat(sandbox): build snapshots from Dockerfiles by @langchain-infra in langchain-ai/langsmith-sdk#2950

fix(python): add organization id to context URLs by @vishnu-ssuresh in langchain-ai/langsmith-sdk#2945

fix(js): add organization id to context URLs by @vishnu-ssuresh in langchain-ai/langsmith-sdk#2946

release(py): 0.8.7 by

…updates Bumps the npm_and_yarn group with 4 updates in the /python/agents/genmedia-for-commerce/frontend directory: [postcss](https://github.com/postcss/postcss), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 5 updates in the /python/agents/deep-search/frontend directory: | Package | From | To | | --- | --- | --- | | [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.25` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `8.2.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` | | [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `removed` | Bumps the npm_and_yarn group with 1 update in the /typescript/agents/customer_service directory: [uuid](https://github.com/uuidjs/uuid). Updates `postcss` from 8.5.13 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.13...8.5.25) Updates `vite` from 8.0.10 to 8.2.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite) Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `js-yaml` from 4.1.1 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) Updates `postcss` from 8.5.3 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.13...8.5.25) Updates `vite` from 6.4.1 to 8.2.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite) Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `js-yaml` from 4.1.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) Removes `uuid` Updates `langsmith` from 0.3.25 to 0.8.9 - [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases) - [Commits](langchain-ai/langsmith-sdk@v0.3.25...v0.8.9) Updates `uuid` from 13.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](https://github.com/uuidjs/uuid/commits) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.2.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.2.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: langsmith dependency-version: 0.8.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-03T16:59:16Z

  "dependencies": {
-    "@langchain/core": "^0.3.55",
-    "@langchain/langgraph-sdk": "^0.0.74",
+    "@langchain/core": "^1.2.4",


Upgrading these LangChain packages removes the transitive dependency on uuid, which is directly imported by src/App.tsx, breaking the build. Please add uuid explicitly to the dependencies of this frontend.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026

dependabot Bot requested a review from happyhuman as a code owner August 3, 2026 16:53

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026

github-actions Bot approved these changes Aug 3, 2026

View reviewed changes

github-actions Bot reviewed Aug 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 3 directories with 6 updates - #2453

chore(deps): bump the npm_and_yarn group across 3 directories with 6 updates#2453
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/python/agents/genmedia-for-commerce/frontend/npm_and_yarn-85790781c0

dependabot Bot commented on behalf of github Aug 3, 2026

Uh oh!

github-actions Bot Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 3, 2026

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

create-vite@8.2.0

plugin-legacy@8.2.0

v8.2.0

v8.2.0-beta.0

v8.1.5

v8.1.4

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

8.2.0 (2026-07-30)

Features

Bug Fixes

Documentation

Tests

8.2.0-beta.0 (2026-07-22)

Features

Bug Fixes

Performance Improvements

v1.1.15

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.25

8.5.24