Skip to content

build(deps): Bump the tanstack group with 4 updates#6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tanstack-678f16e528
Open

build(deps): Bump the tanstack group with 4 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tanstack-678f16e528

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown

Bumps the tanstack group with 4 updates: @tanstack/ai, @tanstack/ai-anthropic, @tanstack/ai-sandbox and @tanstack/ai-sandbox-sprites.

Updates @tanstack/ai from 0.39.0 to 0.40.0

Release notes

Sourced from @​tanstack/ai's releases.

@​tanstack/ai@​0.40.0

Minor Changes

  • #651 5deda27 - Add OpenAI transcription diarization support with diarized_json output, speaker-labeled segments, diarization model validation, chunking strategy options, and docs.

@​tanstack/ai@​0.39.1

Patch Changes

  • #855 afba322 - Preserve Anthropic server-tool results (web_search / web_fetch) across turns.

    Previously the Anthropic adapter dropped server_tool_use and web_search_tool_result / web_fetch_tool_result blocks while streaming, so the evidence never round-tripped — a follow-up turn could no longer see the prior web-search sources (issue #839). These now stream as a provider-executed tool call carrying the raw result, which the agent loop skips (never executed client-side) and the adapter replays verbatim into the next request. Adds the ProviderExecutedToolMetadata convention plus isProviderExecutedToolCall / getProviderExecutedMetadata helpers to @tanstack/ai.

    (No e2e: aimock cannot synthesize server_tool_use blocks; covered by unit tests and verified live against the Anthropic API.)

  • #867 e7ad181 - Fix addToolResult / addToolOutput silently no-op'ing after a MESSAGES_SNAPSHOT. The AG-UI snapshot wire shape cannot reconstruct client-side tool-call metadata a server may omit (a role: 'tool' message only carries toolCallId + content, and an assistant message may drop toolCalls the client already observed via TOOL_CALL_* events). handleMessagesSnapshotEvent now runs a reconciliation pass that anchors detached tool-result-only assistant messages into the preceding assistant message (matching the streaming fan-out shape) and carries forward a tool-call part from the pre-snapshot state when the snapshot references its toolCallId via a tool-result but omits the corresponding tool-call part. This keeps the UI representation consistent and lets a subsequent addToolResult(toolCallId) locate the call. Fixes #859.

Changelog

Sourced from @​tanstack/ai's changelog.

0.40.0

Minor Changes

  • #651 5deda27 - Add OpenAI transcription diarization support with diarized_json output, speaker-labeled segments, diarization model validation, chunking strategy options, and docs.

0.39.1

Patch Changes

  • #855 afba322 - Preserve Anthropic server-tool results (web_search / web_fetch) across turns.

    Previously the Anthropic adapter dropped server_tool_use and web_search_tool_result / web_fetch_tool_result blocks while streaming, so the evidence never round-tripped — a follow-up turn could no longer see the prior web-search sources (issue #839). These now stream as a provider-executed tool call carrying the raw result, which the agent loop skips (never executed client-side) and the adapter replays verbatim into the next request. Adds the ProviderExecutedToolMetadata convention plus isProviderExecutedToolCall / getProviderExecutedMetadata helpers to @tanstack/ai.

    (No e2e: aimock cannot synthesize server_tool_use blocks; covered by unit tests and verified live against the Anthropic API.)

  • #867 e7ad181 - Fix addToolResult / addToolOutput silently no-op'ing after a MESSAGES_SNAPSHOT. The AG-UI snapshot wire shape cannot reconstruct client-side tool-call metadata a server may omit (a role: 'tool' message only carries toolCallId + content, and an assistant message may drop toolCalls the client already observed via TOOL_CALL_* events). handleMessagesSnapshotEvent now runs a reconciliation pass that anchors detached tool-result-only assistant messages into the preceding assistant message (matching the streaming fan-out shape) and carries forward a tool-call part from the pre-snapshot state when the snapshot references its toolCallId via a tool-result but omits the corresponding tool-call part. This keeps the UI representation consistent and lets a subsequent addToolResult(toolCallId) locate the call. Fixes #859.

Commits
  • e3de949 ci: Version Packages (#895)
  • 405c9d4 feat(ai): typed custom events + sandbox file-diff hooks (#892)
  • 9be8fa4 fix(anthropic): default max_tokens to the model's output ceiling (#849) (#853)
  • 5deda27 feat: add OpenAI diarization support (#651)
  • 2bfe772 ci: Version Packages (#881)
  • fe5d788 fix(ai-anthropic): correct Opus 4.8 ids and remove retired model ids (#885)
  • afba322 fix(ai-anthropic): preserve web_search/web_fetch results across turns (#839) ...
  • 091e820 feat(ai-anthropic): first-class Claude Sonnet 5 and Claude Fable 5 support (#...
  • e7ad181 fix(ai): preserve tool-call metadata across MESSAGES_SNAPSHOT so addToolResul...
  • 84d1225 feat(ai-gemini): support Nano Banana 2 Lite (gemini-3.1-flash-lite-image) (#874)
  • See full diff in compare view

Updates @tanstack/ai-anthropic from 0.15.13 to 0.16.1

Release notes

Sourced from @​tanstack/ai-anthropic's releases.

@​tanstack/ai-anthropic@​0.16.1

Patch Changes

  • #853 9be8fa4 - Default Anthropic max_tokens to the selected model's real output ceiling (max_output_tokens from model metadata — e.g. 64K for Sonnet, 128K for Opus) when the caller doesn't pass one, instead of a hard-coded 1024 that silently truncated long responses with stop_reason: "max_tokens" (#849). Unknown models fall back to a safe constant. max_tokens is a ceiling, not a reservation, so this costs nothing unless the model genuinely produces more.

    The adapter also now logs a warning when a response is truncated while using the defaulted (caller-unspecified) cap, so the truncation isn't silently attributed to the model "doing nothing". Callers that set modelOptions.max_tokens explicitly are unaffected.

    The non-streaming structured-output path (structuredOutput()) clamps this default to the Anthropic SDK's non-streaming-safe limit (~21K tokens). The SDK refuses a non-streaming request whose max_tokens could exceed its 10-minute timeout, so without the clamp the full-ceiling default would make every chat({ outputSchema }) call on a fallback-path model throw "Streaming is required for operations that may take longer than 10 minutes". The streaming chat path keeps the model's full ceiling.

  • Updated dependencies [5deda27]:

    • @​tanstack/ai@​0.40.0

@​tanstack/ai-anthropic@​0.16.0

Minor Changes

  • #884 091e820 - Add first-class support for Claude Sonnet 5 (claude-sonnet-5) and Claude Fable 5 (claude-fable-5), and clean up the model registry so every registered id resolves against the first-party Anthropic API.

    New model support. Both 5-generation models carry accurate metadata (adaptive thinking, sticker pricing for Sonnet 5) and per-model provider-option types that match the API: adaptive-only thinking on Fable 5 (explicit disabled and budget_tokens are rejected), adaptive-or-disabled thinking on Sonnet 5, and no temperature / top_p / top_k on either. output_config.effort gains the 'xhigh' level. Both models (plus Opus 4.8) are registered for native combined tools + output-schema requests. Closes #880.

    Corrected ids (breaking). claude-opus-4.8 is now claude-opus-4-8 — the dot spelling came from an OpenRouter metadata sync and returns 404 on the Anthropic API. Opus 4.7 and 4.8 also get correct per-model types (adaptive thinking, no budget_tokens, no sampling parameters) and Opus/Sonnet 4.6 now accept thinking: { type: 'adaptive' }.

    Removed retired models (breaking). The following ids no longer resolve on the Anthropic API (verified live) and were removed from ANTHROPIC_MODELS: claude-3-7-sonnet, claude-3-5-haiku, claude-3-haiku, claude-opus-4, claude-sonnet-4, and the claude-opus-4-6-fast / claude-opus-4-7-fast / claude-opus-4.8-fast variants (fast mode is requested via the speed parameter, not a model id). If you were pinning one of these, migrate to a current model (claude-sonnet-5, claude-haiku-4-5, claude-opus-4-8).

Patch Changes

  • #855 afba322 - Preserve Anthropic server-tool results (web_search / web_fetch) across turns.

    Previously the Anthropic adapter dropped server_tool_use and web_search_tool_result / web_fetch_tool_result blocks while streaming, so the evidence never round-tripped — a follow-up turn could no longer see the prior web-search sources (issue #839). These now stream as a provider-executed tool call carrying the raw result, which the agent loop skips (never executed client-side) and the adapter replays verbatim into the next request. Adds the ProviderExecutedToolMetadata convention plus isProviderExecutedToolCall / getProviderExecutedMetadata helpers to @tanstack/ai.

... (truncated)

Changelog

Sourced from @​tanstack/ai-anthropic's changelog.

0.16.1

Patch Changes

  • #853 9be8fa4 - Default Anthropic max_tokens to the selected model's real output ceiling (max_output_tokens from model metadata — e.g. 64K for Sonnet, 128K for Opus) when the caller doesn't pass one, instead of a hard-coded 1024 that silently truncated long responses with stop_reason: "max_tokens" (#849). Unknown models fall back to a safe constant. max_tokens is a ceiling, not a reservation, so this costs nothing unless the model genuinely produces more.

    The adapter also now logs a warning when a response is truncated while using the defaulted (caller-unspecified) cap, so the truncation isn't silently attributed to the model "doing nothing". Callers that set modelOptions.max_tokens explicitly are unaffected.

    The non-streaming structured-output path (structuredOutput()) clamps this default to the Anthropic SDK's non-streaming-safe limit (~21K tokens). The SDK refuses a non-streaming request whose max_tokens could exceed its 10-minute timeout, so without the clamp the full-ceiling default would make every chat({ outputSchema }) call on a fallback-path model throw "Streaming is required for operations that may take longer than 10 minutes". The streaming chat path keeps the model's full ceiling.

  • Updated dependencies [5deda27]:

    • @​tanstack/ai@​0.40.0

0.16.0

Minor Changes

  • #884 091e820 - Add first-class support for Claude Sonnet 5 (claude-sonnet-5) and Claude Fable 5 (claude-fable-5), and clean up the model registry so every registered id resolves against the first-party Anthropic API.

    New model support. Both 5-generation models carry accurate metadata (adaptive thinking, sticker pricing for Sonnet 5) and per-model provider-option types that match the API: adaptive-only thinking on Fable 5 (explicit disabled and budget_tokens are rejected), adaptive-or-disabled thinking on Sonnet 5, and no temperature / top_p / top_k on either. output_config.effort gains the 'xhigh' level. Both models (plus Opus 4.8) are registered for native combined tools + output-schema requests. Closes #880.

    Corrected ids (breaking). claude-opus-4.8 is now claude-opus-4-8 — the dot spelling came from an OpenRouter metadata sync and returns 404 on the Anthropic API. Opus 4.7 and 4.8 also get correct per-model types (adaptive thinking, no budget_tokens, no sampling parameters) and Opus/Sonnet 4.6 now accept thinking: { type: 'adaptive' }.

    Removed retired models (breaking). The following ids no longer resolve on the Anthropic API (verified live) and were removed from ANTHROPIC_MODELS: claude-3-7-sonnet, claude-3-5-haiku, claude-3-haiku, claude-opus-4, claude-sonnet-4, and the claude-opus-4-6-fast / claude-opus-4-7-fast / claude-opus-4.8-fast variants (fast mode is requested via the speed parameter, not a model id). If you were pinning one of these, migrate to a current model (claude-sonnet-5, claude-haiku-4-5, claude-opus-4-8).

Patch Changes

  • #855 afba322 - Preserve Anthropic server-tool results (web_search / web_fetch) across turns.

    Previously the Anthropic adapter dropped server_tool_use and web_search_tool_result / web_fetch_tool_result blocks while streaming, so the evidence never round-tripped — a follow-up turn could no longer see the prior web-search sources (issue #839). These now stream as a provider-executed tool call carrying the raw result, which the agent loop skips (never executed client-side) and the adapter replays verbatim into the next request. Adds the ProviderExecutedToolMetadata convention plus isProviderExecutedToolCall /

... (truncated)

Commits
  • e3de949 ci: Version Packages (#895)
  • 9be8fa4 fix(anthropic): default max_tokens to the model's output ceiling (#849) (#853)
  • 2bfe772 ci: Version Packages (#881)
  • fe5d788 fix(ai-anthropic): correct Opus 4.8 ids and remove retired model ids (#885)
  • f8b145f feat(ai-anthropic): add Claude Sonnet 5, Fable 5 and other missing models to ...
  • afba322 fix(ai-anthropic): preserve web_search/web_fetch results across turns (#839) ...
  • 091e820 feat(ai-anthropic): first-class Claude Sonnet 5 and Claude Fable 5 support (#...
  • See full diff in compare view

Updates @tanstack/ai-sandbox from 0.2.0 to 0.2.2

Release notes

Sourced from @​tanstack/ai-sandbox's releases.

@​tanstack/ai-sandbox-cloudflare@​0.2.2

Patch Changes

  • Updated dependencies [5deda27]:
    • @​tanstack/ai@​0.40.0
    • @​tanstack/ai-sandbox@​0.2.2
    • @​tanstack/ai-sandbox-local-process@​0.2.0

@​tanstack/ai-sandbox@​0.2.2

Patch Changes

@​tanstack/ai-sandbox-cloudflare@​0.2.1

Patch Changes

  • #889 9b58c08 - Give providers a deterministic sandbox id on create.

    SandboxCreateInput now carries an optional id, and ensure() passes the compound sandbox key into provider.create(). Providers whose native id is addressable by name and expose a preview URL keyed by that id — Cloudflare (DO id) and Sprites (sprite name) — honor it (input.id ?? <random>), so out-of-band consumers (e.g. attaching a preview iframe) can reconstruct the exact sandbox an agent is editing from run context instead of the random id previously recoverable only from the sandbox store. Providers that mint their own opaque id (Daytona, Vercel) ignore it, so behavior is unchanged for them.

  • Updated dependencies [afba322, 9b58c08, e7ad181]:

    • @​tanstack/ai@​0.39.1
    • @​tanstack/ai-sandbox@​0.2.1
    • @​tanstack/ai-sandbox-local-process@​0.2.0

@​tanstack/ai-sandbox-sprites@​0.2.1

Patch Changes

  • #889 9b58c08 - Give providers a deterministic sandbox id on create.

    SandboxCreateInput now carries an optional id, and ensure() passes the compound sandbox key into provider.create(). Providers whose native id is addressable by name and expose a preview URL keyed by that id — Cloudflare (DO id) and Sprites (sprite name) — honor it (input.id ?? <random>), so out-of-band consumers (e.g. attaching a preview iframe) can reconstruct the exact sandbox an agent is editing from run context instead of the random id previously recoverable only from the sandbox store. Providers that mint their own opaque id (Daytona, Vercel) ignore it, so behavior is unchanged for them.

  • Updated dependencies [9b58c08]:

    • @​tanstack/ai-sandbox@​0.2.1

... (truncated)

Changelog

Sourced from @​tanstack/ai-sandbox's changelog.

0.2.2

Patch Changes

0.2.1

Patch Changes

  • #889 9b58c08 - Give providers a deterministic sandbox id on create.

    SandboxCreateInput now carries an optional id, and ensure() passes the compound sandbox key into provider.create(). Providers whose native id is addressable by name and expose a preview URL keyed by that id — Cloudflare (DO id) and Sprites (sprite name) — honor it (input.id ?? <random>), so out-of-band consumers (e.g. attaching a preview iframe) can reconstruct the exact sandbox an agent is editing from run context instead of the random id previously recoverable only from the sandbox store. Providers that mint their own opaque id (Daytona, Vercel) ignore it, so behavior is unchanged for them.

  • Updated dependencies [afba322, e7ad181]:

    • @​tanstack/ai@​0.39.1
Commits

Updates @tanstack/ai-sandbox-sprites from 0.2.0 to 0.2.1

Release notes

Sourced from @​tanstack/ai-sandbox-sprites's releases.

@​tanstack/ai-sandbox-sprites@​0.2.1

Patch Changes

  • #889 9b58c08 - Give providers a deterministic sandbox id on create.

    SandboxCreateInput now carries an optional id, and ensure() passes the compound sandbox key into provider.create(). Providers whose native id is addressable by name and expose a preview URL keyed by that id — Cloudflare (DO id) and Sprites (sprite name) — honor it (input.id ?? <random>), so out-of-band consumers (e.g. attaching a preview iframe) can reconstruct the exact sandbox an agent is editing from run context instead of the random id previously recoverable only from the sandbox store. Providers that mint their own opaque id (Daytona, Vercel) ignore it, so behavior is unchanged for them.

  • Updated dependencies [9b58c08]:

    • @​tanstack/ai-sandbox@​0.2.1
Changelog

Sourced from @​tanstack/ai-sandbox-sprites's changelog.

0.2.1

Patch Changes

  • #889 9b58c08 - Give providers a deterministic sandbox id on create.

    SandboxCreateInput now carries an optional id, and ensure() passes the compound sandbox key into provider.create(). Providers whose native id is addressable by name and expose a preview URL keyed by that id — Cloudflare (DO id) and Sprites (sprite name) — honor it (input.id ?? <random>), so out-of-band consumers (e.g. attaching a preview iframe) can reconstruct the exact sandbox an agent is editing from run context instead of the random id previously recoverable only from the sandbox store. Providers that mint their own opaque id (Daytona, Vercel) ignore it, so behavior is unchanged for them.

  • Updated dependencies [9b58c08]:

    • @​tanstack/ai-sandbox@​0.2.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the tanstack group with 4 updates
306c2e1 
Bumps the tanstack group with 4 updates: [@tanstack/ai](https://github.com/TanStack/ai/tree/HEAD/packages/ai), [@tanstack/ai-anthropic](https://github.com/TanStack/ai/tree/HEAD/packages/ai-anthropic), [@tanstack/ai-sandbox](https://github.com/TanStack/ai/tree/HEAD/packages/ai-sandbox) and [@tanstack/ai-sandbox-sprites](https://github.com/TanStack/ai/tree/HEAD/packages/ai-sandbox-sprites).


Updates `@tanstack/ai` from 0.39.0 to 0.40.0
- [Release notes](https://github.com/TanStack/ai/releases)
- [Changelog](https://github.com/TanStack/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/TanStack/ai/commits/@tanstack/ai@0.40.0/packages/ai)

Updates `@tanstack/ai-anthropic` from 0.15.13 to 0.16.1
- [Release notes](https://github.com/TanStack/ai/releases)
- [Changelog](https://github.com/TanStack/ai/blob/main/packages/ai-anthropic/CHANGELOG.md)
- [Commits](https://github.com/TanStack/ai/commits/@tanstack/ai-anthropic@0.16.1/packages/ai-anthropic)

Updates `@tanstack/ai-sandbox` from 0.2.0 to 0.2.2
- [Release notes](https://github.com/TanStack/ai/releases)
- [Changelog](https://github.com/TanStack/ai/blob/main/packages/ai-sandbox/CHANGELOG.md)
- [Commits](https://github.com/TanStack/ai/commits/@tanstack/ai-sandbox@0.2.2/packages/ai-sandbox)

Updates `@tanstack/ai-sandbox-sprites` from 0.2.0 to 0.2.1
- [Release notes](https://github.com/TanStack/ai/releases)
- [Changelog](https://github.com/TanStack/ai/blob/main/packages/ai-sandbox-sprites/CHANGELOG.md)
- [Commits](https://github.com/TanStack/ai/commits/@tanstack/ai-sandbox-sprites@0.2.1/packages/ai-sandbox-sprites)

---
updated-dependencies:
- dependency-name: "@tanstack/ai"
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tanstack
- dependency-name: "@tanstack/ai-anthropic"
  dependency-version: 0.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tanstack
- dependency-name: "@tanstack/ai-sandbox"
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tanstack
- dependency-name: "@tanstack/ai-sandbox-sprites"
  dependency-version: 0.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tanstack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants