chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@ai-sdk/openai (source)	3.0.67 → 3.0.68			dependencies	patch
@harperfast/skills (source)	1.7.0 → 1.9.1			dependencies	minor
@types/react (source)	19.2.15 → 19.2.16			devDependencies	patch	19.2.17
@vitest/coverage-v8 (source)	4.1.7 → 4.1.8			devDependencies	patch
actions/checkout	v6.0.2 → v6.0.3			action	patch
ai (source)	6.0.193 → 6.0.197			dependencies	patch
graphql	16.14.0 → 16.14.1			dependencies	patch
harper (source)	5.0.22 → 5.0.26			devDependencies	patch	5.0.28
oxlint (source)	1.67.0 → 1.68.0			devDependencies	minor
react (source)	19.2.6 → 19.2.7			dependencies	patch
tsx (source)	4.22.3 → 4.22.4			devDependencies	patch
vitest (source)	4.1.7 → 4.1.8			devDependencies	patch

---

Release Notes

vercel/ai (@​ai-sdk/openai)

v3.0.68

Compare Source

Patch Changes

• c65c952: fix(openai): round-trip namespace on function_call input items

  When tool_search dispatches a deferred tool, the resulting function_call carries a namespace field identifying which deferred-tool group the model picked. #14789 preserved this on the read side (providerMetadata.openai.namespace), but the write side still serialized function_call input items without namespace. Multi-step / multi-turn conversations then failed with Missing namespace for function_call '<name>'. ... Round-trip the model's function_call item with its namespace field included.

  convert-to-openai-responses-input.ts now reads namespace from providerOptions.openai.namespace (or providerMetadata.openai.namespace) on tool-call parts and includes it on the serialized function_call item, mirroring how itemId is round-tripped.

HarperFast/skills (@​harperfast/skills)

v1.9.1

Compare Source

v1.9.0

Compare Source

Features

• rule baseline freshness guard + provenance-rich sync PRs (#​52) (2a8e1b9)

v1.8.0

Compare Source

Features

• phase 4 — migrate 3 rules to mode:generate, add failure-issue observability (#​46) (dd1ce4b), closes #​47 #​48

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

vercel/ai (ai)

v6.0.197

Compare Source

v6.0.196

Compare Source

Patch Changes

• Updated dependencies [286b7a2]
  • @​ai-sdk/gateway@​3.0.124

v6.0.195

Compare Source

v6.0.194

Compare Source

graphql/graphql-js (graphql)

v16.14.1

Compare Source

v16.14.1 (2026-06-02)

Docs 📝

9 PRs were merged

• #​4737 docs: refresh upgrade guide and v17 topics (@​yaacovCR)
• #​4741 docs: add v16 API docs lint coverage (@​yaacovCR)
• #​4748 docs: update banner (@​yaacovCR)
• #​4750 docs: use api docs generated from inline jsdoc comments (@​yaacovCR)
• #​4754 docs: update website caniuse-lite data (@​yaacovCR)
• #​4755 docs: hide internal type member __validationErrors (@​yaacovCR)
• #​4757 docs: fix inline examples, deprecation descriptions, type category (@​yaacovCR)
• #​4759 docs: fix static export redirect config (@​yaacovCR)
• #​4767 docs: fix Post_body example variable (@​fallintoplace)

Polish 💅

• #​4738 chore(tests): add test for directive extensions without flag enabled (@​yaacovCR)

Internal 🏠

• #​4778 fix: generated version documentation (@​yaacovCR)

Committers: 2

• Minh Vu(@​fallintoplace)
• Yaacov Rydzinski (@​yaacovCR)

harperfast/harper (harper)

v5.0.26

Compare Source

What's Changed

• chore(deps): bump @​harperfast/rocksdb-js to ^1.4.2
• fix(replay): purge aged transaction logs during recovery before replay
• fix(table): bound out-of-order audit-chain walk to prevent full-copy OOM
• refactor: collapse aggregate-iterator retry into a bounded for-loop

Full Changelog: HarperFast/harper@v5.0.25...v5.0.26

v5.0.25

Compare Source

What's Changed

• chore: bump @​harperfast/rocksdb-js to 1.4.1

Full Changelog: HarperFast/harper@v5.0.24...v5.0.25

v5.0.23

Compare Source

What's Changed

• fix(RecordEncoder): retain blob files still referenced by the new record on update
• fix(migration): reuse copied structures during LMDB→RocksDB re-encode
• resolve cherry-pick conflict in package.json scripts
• test: run unitTests/bin under lmdb so the migration regression test executes
• fix(migration): preserve records with file-backed blobs during v4->v5 migration
• test(v5.0): guard LMDB analytics asserts + skip flaky resources tests
• cherry-pick: chore(deps): Update rocksdb-js to 1.4.0 (#​875) → v5.0 (#​883)
• fix: persist indexingFailed in runIndexing outer catch

Full Changelog: HarperFast/harper@v5.0.22...v5.0.23

oxc-project/oxc (oxlint)

v1.68.0

Compare Source

🚀 Features

• e4b1f46 linter/typescript: Implement method-signature-style rule (#​22679) (Mikhail Baev)
• bc462ca linter/vue: Implement no-reserved-component-names rule (#​22741) (bab)
• ef9e751 linter/vue: Implement component-definition-name-casing rule (#​22818) (bab)
• d67f51a linter/vue: Implement require-prop-type-constructor rule (#​22708) (bab)
• 8422e8b linter/jsdoc: Implement require-yields-description rule (#​22805) (Mikhail Baev)
• fe93f97 linter/eslint: Implement prefer-named-capture-group rule (#​22759) (Sebastian Poxhofer)

facebook/react (react)

v19.2.7

Compare Source

privatenumber/tsx (tsx)

v4.22.4

Compare Source

Bug Fixes

• resolve CommonJS directory requires inside dependencies (#​803) (1ce8463)

---

This release is also available on:

• npm package (@​latest dist-tag)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🎉 This PR is included in version 0.16.18 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀