[dependabot]

Bumps the production-minor group with 9 updates in the / directory:

Package	From	To
@browserbasehq/stagehand	4.1.0	4.2.1
@google-cloud/storage	8.2.0	8.4.0
eve	0.71.2	0.76.3
express	5.2.1	5.3.0
framer-motion	14.0.0	14.1.0
isomorphic-dompurify	4.4.0	4.5.0
lucide-react	1.52.0	1.55.0
nodemailer	10.0.15	10.1.0
react-hook-form	7.89.0	7.90.0

Updates @browserbasehq/stagehand from 4.1.0 to 4.2.1

Changelog

Sourced from @​browserbasehq/stagehand's changelog.

TypeScript SDK 4.2.1

Patch Changes

• #3157 bfeda48 Thanks @​github-actions! - Accept new model IDs for supported providers without a Stagehand release. Reject empty or whitespace-containing IDs and let providers report model availability.

Python SDK 4.2.1

Patch Changes

• #3157 bfeda48 Thanks @​github-actions! - Accept new model IDs for supported providers without a Stagehand release. Reject empty or whitespace-containing IDs and let providers report model availability.

Extension Runtime 1.1.1

Patch Changes

• #3157 bfeda48 Thanks @​github-actions! - Accept new model IDs for supported providers without a Stagehand release. Reject empty or whitespace-containing IDs and let providers report model availability.

Go SDK 4.2.1

Patch Changes

• #3157 bfeda48 Thanks @​github-actions! - Accept new model IDs for supported providers without a Stagehand release. Reject empty or whitespace-containing IDs and let providers report model availability.

Protocol 2.1.1

Patch Changes

• #3157 bfeda48 Thanks @​github-actions! - Accept new model IDs for supported providers without a Stagehand release. Reject empty or whitespace-containing IDs and let providers report model availability.

Eve Extension 0.2.1

Patch Changes

• Updated dependencies [bfeda48]:
  • @​browserbasehq/stagehand@​4.2.1

TypeScript SDK 4.2.0

Minor Changes

• #3030 34edfa3 Thanks @​supremeboxlogos! - Export browser pages as PDF bytes in TypeScript, Python, and Go, with configurable print settings and timeouts, and optional local file saving in TypeScript and Python.

• #3118 a837acf Thanks @​miguelg719! - Add clientOptions to browserbase.launch() and browserbase.connect(). Thanks to @​pr1m8 for the original proposal that motivated this feature.

• #3083 666b6fa Thanks @​seanmcguire12! - expose a timeout option for page.snapshot() across all sdks, defaulting to 20 seconds. set it to 0 for unlimited execution. one budget covers the whole snapshot capture.

• #3140 f2060a6 Thanks @​seanmcguire12! - automatically discover Stagehand extensions when connecting to browsers. deprecate & ignore extension IDs passed into .connect().

... (truncated)

Commits

• f261c38 Release Stagehand packages (#3160)
• bfeda48 [Claimed #3155] fix: accept new model IDs without a Stagehand release (#3157)
• 2d605b0 Release Stagehand packages (#2969)
• 7d8dcef [fix]: use progress tracker in waitForSelector() (#3146)
• f2060a6 [fix]: discover extension automatically & deprecate extension id param (#3140)
• 0f3d0df Point eval sites at Vercel instead of GitHub Pages (#3141)
• a837acf feat(sdk): add Browserbase clientOptions to launch and connect (#3118)
• 7abca76 [chore]: bump various transitive JS deps across monorepo (#3115)
• 82ef425 [refactor]: use progress tracker in act/extract/observe (#3109)
• 819db28 Add bounded CDP heartbeat and sanitized disconnect diagnostics (#2894)
• Additional commits viewable in compare view

Updates @google-cloud/storage from 8.2.0 to 8.4.0

Release notes

Sourced from @​google-cloud/storage's releases.

storage: v8.4.0

8.4.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

cloud-profiler: v8.2.1

8.2.1 (2026-10-09)

Bug Fixes

• Use npm in prepare/compile lifecycle scripts (#9587) (64c3a2b)

Changelog

Sourced from @​google-cloud/storage's changelog.

8.4.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

8.3.0 (2026-10-07)

Features

• tools: Add individual CLI flags for Bun monkey patches (#9533) (a5eec89)

8.2.1 (2026-10-06)

Bug Fixes

• storage: Re-enable docs check and update linkinator (#9257) (6f9d967)
• storage: Upgrade google-auth-library to v11, gaxios to v7 and align auth client types (#9289) (c6c946d)

Commits

• 27d6be6 chore(main): release storage 8.4.0 (#9576)
• 5250db6 chore(main): release storage 8.3.0 (#9552)
• a5eec89 feat(tools): add individual CLI flags for Bun monkey patches (#9533)
• c0239c8 chore(main): release storage 8.2.1 (#9527)
• c6c946d fix(storage): upgrade google-auth-library to v11, gaxios to v7 and align auth...
• 6f9d967 fix(storage): re-enable docs check and update linkinator (#9257)
• f11413c test(storage): adopt run-test runner and fix Bun shim caching and mocking for...
• fd32884 chore(main): release storage 8.2.0 (#9297)
• b880f66 refactor(storage): dynamically import mime and p-limit with module caching (#...
• 3ff5ae9 chore: update .nycrc, Contributing.md, and .gitignore across packages (#9144)
• Additional commits viewable in compare view

Updates eve from 0.71.2 to 0.76.3

Release notes

Sourced from eve's releases.

eve@0.76.3

Patch Changes

• 592f773: Fix eve build failing with "Identifier has already been declared" when a tool callback's destructured parameter or local declaration shadows a variable from an enclosing scope. This also fixes building agents that mount eve/extensions/git.

eve@0.76.2

Patch Changes

• 91f4b68: Add modelOptions.promptCache for models eve calls directly. promptCache: { anthropic: { ttl: "1h" } } switches eve's Anthropic cache breakpoints to a 1-hour lifetime. promptCache: { anthropic: {} } turns breakpoints on for an Anthropic model eve can't recognize from its id, such as a Bedrock application inference profile.
• c160b22: A session that replaces a retired stranded session names the session it replaced in ctx.session.predecessor (also on dynamic resolver contexts) and session.started data.predecessor ({ sessionId }). The new transcriptReducer() in eve/client folds a session's stream into its user and completed assistant text since the last clear; combine it with sessions.attach(predecessor.sessionId).stream() from eve/server in a session.started user-role dynamic instruction to give the replacement the earlier conversation.
• 89bd625: Add eve/tanstack, a Vite plugin that runs an eve agent inside a TanStack Start app: Nitro proxies /eve/v1/** to a local eve server in development, and Vercel builds deploy eve as a sibling service. Set devServerTimeoutMs to wait longer for a slow eve dev server to start. eve build and eve dev now always use Nitro's Rolldown builder, so an agent that shares its root with a TanStack Start app no longer fails to start.
• b664838: eve add channel/web now asks which framework Web Chat uses and can install a TanStack Start app under apps/web/, hosted as a separate Vercel service or inside the app through eve/tanstack; non-interactive installs keep Next.js unless you pass --answer 'web-framework="tanstack"'. Web Chat setup also checks for authored configuration before writing, removes the vercel.ts and scripts it wrote when you switch hosting modes, and renders text in the loaded Geist fonts.

eve@0.76.0

Minor Changes

• 8c55ea7: Skills now load through eve__skill({ name }), which every agent with a skill has in place of load_skill, and a skill with deferred: true (in SKILL.md frontmatter or on defineSkill, static or dynamic) leaves the system prompt and is found with eve__search instead.

  • The load_skill tool and the eve/tools/load_skill export are removed. Delete any agent/tools/load_skill.ts override or approval policy that names it; an authored agent/tools/load_skill.ts is now an ordinary tool.
  • A skill load's load-skill action now carries the skill's name, and its input is the model's { name } instead of { skill }. Its result is a load-skill-result with the same name instead of a tool-result named load_skill. Its client message part has the toolName eve__skill instead of eve:load-skill, with the skill's name in toolMetadata.eve.name. Sessions recorded by earlier versions replay with name filled in from input.skill.
  • Eval facts report skill loads in skillLoads, which t.loadedSkill reads. They no longer count toward toolCallCount, usedNoTools, or maxToolCalls.
  • Skill names must use only ASCII letters, digits, underscores, and dashes, start with a letter or digit, and have at most 64 characters. The compiler rejects a static skill with another name, and eve skips a dynamic skill resolver that returns one.

• 8c55ea7: An agent with deferred entries or connections now has eve__search to find tools marked deferred: true, agents marked tool: "deferred", and every connection tool, and eve__tool to call them, without growing the model's tool list. An agent with skills has eve__skill to load them, and eve__search also finds deferred skills. An agent with none of these gets no catalog tools, so its tool list is unchanged apart from load_skill becoming eve__skill. They replace connection_search and connection_execute, and stream events, approvals, hooks, and traces now name each connection tool call <connection>__<tool>. eve__search never asks the user to sign in: it lists a connection that needs sign-in under the connection's own name, and eve__tool on that name, such as eve__tool({ name: "linear" }), asks the user to sign in. eve__search takes a required query; a query such as linear__ searches only that connection's tools.

  Breaking changes:

  • The tools eve adds itself now live in the eve namespace: task_wait is eve__task_wait, task_cancel is eve__task_cancel, and final_output, the tool a session with an output schema calls to deliver its structured result, is eve__reply. The catalog tools are eve__search, eve__tool, and eve__skill. Update evals, approval policies, hooks, and channel code that match task_wait, task_cancel, or final_output by name. A turn held on task_wait when you upgrade stays held until the next message or a cancel.
  • eve reserves the eve namespace. A tool, subagent, skill, connection, or extension mount named eve or starting with eve__ now fails to build, or fails when the agent loads or a dynamic entry resolves; rename it. search, execute, task_wait, task_cancel, and final_output are ordinary names again.
  • A connection owns its name and every name starting with <name>__. A tool, subagent, or connection under another connection's prefix is rejected at build time, and a dynamic one when it resolves.
  • Dynamic tool map keys must be legal tool names: ASCII letters, digits, _, and -, starting with a letter, up to 64 characters.
  • Connection approvals are keyed by <connection>__<tool> instead of a [connection, tool] pair, so saved "always approve" decisions for connection tools reset.
  • A connection_execute call still waiting for approval when you upgrade fails when someone answers it, with "The tool "connection_execute" is no longer available, so the call didn't run."
  • Eval tool-name helpers (calledTool, notCalledTool, toolOrder, and requireToolCall) now throw, saying what to assert instead, for eve__tool and eve__skill, whose calls are reported under the entry they reach and as skill loads, and for a retired eve tool name (load_skill, task_wait, task_cancel, final_output, connection_search, connection_execute) unless the root agent declares a tool by that name or has a dynamic tool resolver. Before, notCalledTool on one of these names always passed. usedNoTools and maxToolCalls count eve__search calls; skill loads no longer do.
  • Removed: the parentCallId field on tool-call actions in actions.requested events, and the agent.action.parent_call_id span attribute. The subagent parentCallId on session.started invocation metadata is unchanged.

• 2cc43ca: GitHub work moves out of eve/extensions/code into a new built-in extension, eve/extensions/git. The code extension used to tell every agent that "GitHub credentials are not available to ordinary bash" and to route GitHub work through its gh tool, which only works with Connect-brokered github config. Agents whose shell already has gh credentials were steered to a tool that could not authenticate.

  git({}) adds the GitHub instructions and a git__pr skill that commits, pushes, and opens a draft with the shell's gh pr create --draft. git({ github }) adds the Connect-brokered git__gh tool and switches git__pr to the signed-commit workflow. The tool and sandbox helpers are exported from eve/extensions/git/tools and eve/extensions/git/sandbox.

  Deprecated: code({ github }). While it is set, the code extension still contributes code__gh, its GitHub instructions, and the signed-commit code__pr skill. Without it, code({}) no longer contributes code__gh, code__pr, or any GitHub instructions; mount eve/extensions/git for the pull request skill. gh from eve/extensions/code/tools and the GitHub shell helpers from eve/extensions/code/sandbox still work but are deprecated.

• 14f2af0: Add dynamic schedule updates for timing and complete payload replacement, with prepared-payload approval for model calls. Payload replacement makes the updating caller the new creator; custom schedule providers must implement update, and preparePayload now receives a create or update operation.

• 0ef5c4c: eve add channel/slack now resumes interrupted setup, reopens workspace installation for existing connectors, fixes stale routes without detaching, and avoids sharing a Slack app with another project or creating one with a taken name. The eve/setup Slack provisioning API now takes a connector selection from inspectSlackbotConnectors rather than inspecting a second time; a failed Vercel create reports its original error instead of a misleading cleanup failure.

Patch Changes

• 32aaf68: Accept create-session responses from remote agents on eve 0.66–0.68 (protocol 1). A newer parent no longer fails a call that the older remote already accepted and is running.
• 8c55ea7: Catalog calls now read as what happened: eve__search shows Search tools for “linear issues” and then how much it found, a skill load shows Load skill <name> and then Loaded skill <name>, and a connection's sign-in entry shows Sign in to Linear. Linear activities, Chat SDK typing indicators, and ACP tool calls now show each call's label instead of its raw tool name, and eve/client tool parts carry that text as toolMetadata.eve.label.
• 47f1f18: grep and apply_patch in eve/extensions/code now work in sandboxes whose workspace is not /workspace, such as /app. apply_patch no longer requires a git checkout: root is optional and defaults to the workspace root, and outside git it still reports whitespace problems the patch introduced. It also accepts unified-diff range headers such as @@ -118,8 +118,8 @@ def second():, using the function context to pick between identical blocks.
• afe7058: eve__tool now runs a tool from the agent's tool list, other than eve's own catalog and task tools and tools a provider or client runs, instead of returning an error, so a model that routes a listed tool through it no longer wastes a step.
• f8ea556: webSearch({ provider: "native" }) uses the model vendor's own hosted search for AI Gateway models: OpenAI web search for OpenAI models, Anthropic web search for Anthropic models, and Google Search grounding for Gemini 3 and later, instead of Exa. Other Gateway models don't get web_search with this setting unless you set fallback, for example webSearch({ provider: "native", fallback: "exa" }). Gemini models before Gemini 3, including direct ones, no longer get Google Search, which made the model drop every other tool.
• 73adcdf: Dynamic schedules now use Vercel's local scheduler and queue delivery under vc dev, so cron and one-time occurrences fire automatically. The local consumer loads only for Vercel-backed dynamic collections; standalone eve dev keeps its in-memory scheduling backend.

... (truncated)

Changelog

Sourced from eve's changelog.

0.76.3

Patch Changes

• 592f773: Fix eve build failing with "Identifier has already been declared" when a tool callback's destructured parameter or local declaration shadows a variable from an enclosing scope. This also fixes building agents that mount eve/extensions/git.

0.76.2

Patch Changes

• 91f4b68: Add modelOptions.promptCache for models eve calls directly. promptCache: { anthropic: { ttl: "1h" } } switches eve's Anthropic cache breakpoints to a 1-hour lifetime. promptCache: { anthropic: {} } turns breakpoints on for an Anthropic model eve can't recognize from its id, such as a Bedrock application inference profile.
• c160b22: A session that replaces a retired stranded session names the session it replaced in ctx.session.predecessor (also on dynamic resolver contexts) and session.started data.predecessor ({ sessionId }). The new transcriptReducer() in eve/client folds a session's stream into its user and completed assistant text since the last clear; combine it with sessions.attach(predecessor.sessionId).stream() from eve/server in a session.started user-role dynamic instruction to give the replacement the earlier conversation.
• 89bd625: Add eve/tanstack, a Vite plugin that runs an eve agent inside a TanStack Start app: Nitro proxies /eve/v1/** to a local eve server in development, and Vercel builds deploy eve as a sibling service. Set devServerTimeoutMs to wait longer for a slow eve dev server to start. eve build and eve dev now always use Nitro's Rolldown builder, so an agent that shares its root with a TanStack Start app no longer fails to start.
• b664838: eve add channel/web now asks which framework Web Chat uses and can install a TanStack Start app under apps/web/, hosted as a separate Vercel service or inside the app through eve/tanstack; non-interactive installs keep Next.js unless you pass --answer 'web-framework="tanstack"'. Web Chat setup also checks for authored configuration before writing, removes the vercel.ts and scripts it wrote when you switch hosting modes, and renders text in the loaded Geist fonts.

0.76.1

Patch Changes

• fcbd479: A denied tool approval that carries text now passes that note to the model in the denial reason instead of dropping it.
• 9626748: Use build-stamped package metadata in bundled runtimes so serverless functions can start without resolving eve/package.json at runtime.
• 25b3f35: /login chatgpt now lists current subscription models such as gpt-6-luna, and the default chatgpt() model (gpt-6-luna-fast) works: eve sends it to Codex as gpt-6-luna on the priority service tier, since Codex rejects -fast model IDs.
• 416e63e: Direct OpenAI and chatgpt() model calls now send a per-session promptCacheKey, which helps OpenAI route a session's calls to the cache holding its prompt prefix. chatgpt() calls also send it as the session-id header the Codex backend routes on. An authored providerOptions.openai.promptCacheKey still takes precedence.
• b04acbb: On worlds without per-deployment routing, incompatible subagent sessions and workflow tool runs (including tasks) are now cancelled when their queue deliveries arrive, instead of attempting replay on the new eve version. Top-level sessions remain available for replacement or reset, and session timeout workflows continue to run.
• b04acbb: Sessions whose workflow run cannot execute after an eve upgrade (a stranded session) are no longer accepted and left unanswered, and the local World and Postgres stop replaying and failing them with CORRUPTED_EVENT_LOG. eve treats every World other than Vercel as running one eve version at a time, so the next message through a channel address (Slack, from(address).send()) ends a stranded session and starts a fresh one. Sends by session ID throw SessionStrandedError (ClientSessionStrandedError in eve/client), and the eve HTTP channel returns 409 session_stranded; reset() ends a stranded session while clear() refuses one, and recorded history stays readable with stream({ follow: false }) or follow=false on the stream route. On Worlds other than Vercel, a retired session's own session timeout now ends it at its deadline, so a retired session no longer stays active forever when no message arrives.
• cf72486: Agents whose OpenAI model is served by an endpoint without OpenAI web search, such as Amazon Bedrock through createOpenAI({ baseURL }) or AI Gateway, now retry the step without web_search instead of failing every turn.

0.76.0

Minor Changes

• 8c55ea7: Skills now load through eve__skill({ name }), which every agent with a skill has in place of load_skill, and a skill with deferred: true (in SKILL.md frontmatter or on defineSkill, static or dynamic) leaves the system prompt and is found with eve__search instead.

  • The load_skill tool and the eve/tools/load_skill export are removed. Delete any agent/tools/load_skill.ts override or approval policy that names it; an authored agent/tools/load_skill.ts is now an ordinary tool.
  • A skill load's load-skill action now carries the skill's name, and its input is the model's { name } instead of { skill }. Its result is a load-skill-result with the same name instead of a tool-result named load_skill. Its client message part has the toolName eve__skill instead of eve:load-skill, with the skill's name in toolMetadata.eve.name. Sessions recorded by earlier versions replay with name filled in from input.skill.
  • Eval facts report skill loads in skillLoads, which t.loadedSkill reads. They no longer count toward toolCallCount, usedNoTools, or maxToolCalls.
  • Skill names must use only ASCII letters, digits, underscores, and dashes, start with a letter or digit, and have at most 64 characters. The compiler rejects a static skill with another name, and eve skips a dynamic skill resolver that returns one.

• 8c55ea7: An agent with deferred entries or connections now has eve__search to find tools marked deferred: true, agents marked tool: "deferred", and every connection tool, and eve__tool to call them, without growing the model's tool list. An agent with skills has eve__skill to load them, and eve__search also finds deferred skills. An agent with none of these gets no catalog tools, so its tool list is unchanged apart from load_skill becoming eve__skill. They replace connection_search and connection_execute, and stream events, approvals, hooks, and traces now name each connection tool call <connection>__<tool>. eve__search never asks the user to sign in: it lists a connection that needs sign-in under the connection's own name, and eve__tool on that name, such as eve__tool({ name: "linear" }), asks the user to sign in. eve__search takes a required query; a query such as linear__ searches only that connection's tools.

  Breaking changes:

  • The tools eve adds itself now live in the eve namespace: task_wait is eve__task_wait, task_cancel is eve__task_cancel, and final_output, the tool a session with an output schema calls to deliver its structured result, is eve__reply. The catalog tools are eve__search, eve__tool, and eve__skill. Update evals, approval policies, hooks, and channel code that match task_wait, task_cancel, or final_output by name. A turn held on task_wait when you upgrade stays held until the next message or a cancel.
  • eve reserves the eve namespace. A tool, subagent, skill, connection, or extension mount named eve or starting with eve__ now fails to build, or fails when the agent loads or a dynamic entry resolves; rename it. search, execute, task_wait, task_cancel, and final_output are ordinary names again.
  • A connection owns its name and every name starting with <name>__. A tool, subagent, or connection under another connection's prefix is rejected at build time, and a dynamic one when it resolves.
  • Dynamic tool map keys must be legal tool names: ASCII letters, digits, _, and -, starting with a letter, up to 64 characters.
  • Connection approvals are keyed by <connection>__<tool> instead of a [connection, tool] pair, so saved "always approve" decisions for connection tools reset.
  • A connection_execute call still waiting for approval when you upgrade fails when someone answers it, with "The tool "connection_execute" is no longer available, so the call didn't run."
  • Eval tool-name helpers (calledTool, notCalledTool, toolOrder, and requireToolCall) now throw, saying what to assert instead, for eve__tool and eve__skill, whose calls are reported under the entry they reach and as skill loads, and for a retired eve tool name (load_skill, task_wait, task_cancel, final_output, connection_search, connection_execute) unless the root agent declares a tool by that name or has a dynamic tool resolver. Before, notCalledTool on one of these names always passed. usedNoTools and maxToolCalls count eve__search calls; skill loads no longer do.
  • Removed: the parentCallId field on tool-call actions in actions.requested events, and the agent.action.parent_call_id span attribute. The subagent parentCallId on session.started invocation metadata is unchanged.

• 2cc43ca: GitHub work moves out of eve/extensions/code into a new built-in extension, eve/extensions/git. The code extension used to tell every agent that "GitHub credentials are not available to ordinary bash" and to route GitHub work through its gh tool, which only works with Connect-brokered github config. Agents whose shell already has gh credentials were steered to a tool that could not authenticate.

... (truncated)

Commits

• d72c98a Version Packages (#4642)
• 592f773 fix(eve): respect callback scope when capturing tool closure variables (#4639)
• 220cd09 Version Packages (#4592)
• b664838 feat(eve): add TanStack Start as a Web Chat framework (#4395)
• 89bd625 feat(eve): add eve/tanstack Vite plugin for TanStack Start (#4394)
• 91f4b68 feat(eve): add modelOptions.promptCache.anthropic.ttl to set Anthropic cach...
• 730048d Version Packages (#4589)
• c160b22 feat(eve): name a replaced session's predecessor and add transcriptReducer (#...
• fcbd479 fix(eve): pass a denied approval's note to the model (#4478)
• 9626748 fix(eve): avoid runtime package resolution for bundled identity (#2481)
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates framer-motion from 14.0.0 to 14.1.0

Changelog

Sourced from framer-motion's changelog.

[14.1.0] 2026-10-09

Added

• animateLayout: Layout animations for vanilla JS.

Fixed

• Delay animation start when main thread held to prevent visual jumps.
• Fix whileHover/whileTap getting stuck after Fast Refresh reorders siblings.
• scroll/useScroll: Fix reporting of elastic overscroll.
• AnimatePresence: Fix popLayout when rendering into another window or iframe.
• animate: Fix JS animations jumping ahead when played after a pause at non-1 speed.
• Allow layout animations inside dragged elements.

Commits

• b497798 v14.1.0
• 2f236b0 Latest
• 73a21d3 Merge pull request #3912 from motiondivision/claude/project-thread-tvp91y
• 34bad0f Export animateLayout from motion
• 5c5073a Merge pull request #3895 from motiondivision/proto/issue-1630
• 1def636 Merge pull request #3901 from motiondivision/claude/project-thread-teqyqt
• b62d551 Merge pull request #3911 from motiondivision/claude/project-thread-vl8yhx
• 2feb17a Remove isTreeAnimationBlocked
• 0bbe422 Simplify isReversed flex axis check in scroll info
• 97a6003 Merge pull request #3896 from motiondivision/claude/project-thread-op72nq
• Additional commits viewable in compare view

Updates isomorphic-dompurify from 4.4.0 to 4.5.0

Release notes

Sourced from isomorphic-dompurify's releases.

4.5.0: Updated dependencies

• jsdom 30.1.1 -> 30.1.2
• dompurify range pinned to ^3.4.16
• Dev tooling: @​biomejs/biome 2.5.14 -> 2.5.15, vitest 5.0.1 -> 5.0.3, lefthook 2.1.14 -> 2.1.16
• packageManager pnpm 12.4.2 -> 12.9.1

Commits

• 2e9d5d1 chore: release 4.5.0
• 71f0052 chore(deps): align package.json version floors with lockfile
• 13320e8 chore(deps): bump jsdom from 30.1.1 to 30.1.2
• 8dda958 chore(deps-dev): bump lefthook from 2.1.15 to 2.1.16
• 1553b1a chore(deps-dev): bump @​biomejs/biome from 2.5.14 to 2.5.15
• a640561 chore(deps-dev): bump vitest from 5.0.2 to 5.0.3
• ab6c1dd chore(deps-dev): bump lefthook from 2.1.14 to 2.1.15
• 4163446 chore(deps-dev): bump vitest from 5.0.1 to 5.0.2
• See full diff in compare view

Updates lucide-react from 1.52.0 to 1.55.0

Release notesDescription has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 14, 2026 2:56pm UTC

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1791988221698
• lhr-1791988233499
• lhr-1791988244955
• lhr-1791988255788
• lhr-1791988266552
• lhr-1791988277325
• lhr-1791988288334
• lhr-1791988299036
• lhr-1791988309794

Reports are also available as workflow artifacts

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1791989967388
• lhr-1791989980168
• lhr-1791989992508
• lhr-1791990004044
• lhr-1791990015581
• lhr-1791990027234
• lhr-1791990038767
• lhr-1791990050196
• lhr-1791990061726

Reports are also available as workflow artifacts