chore(deps):(deps): bump the production-minor group with 3 updates

[dependabot]

Bumps the production-minor group with 3 updates: @radix-ui/react-slot, @radix-ui/react-tooltip and eve.

Updates @radix-ui/react-slot from 1.4.0 to 1.5.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.5.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.3.0 to 1.4.0

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-visually-hidden@1.2.13

Commits

• See full diff in compare view

Updates eve from 0.76.3 to 0.77.0

Release notes

Sourced from eve's releases.

eve@0.77.0

Minor Changes

• 0248e69: eve now downloads attachment links itself instead of handing them to the model provider. When a channel's fetchFile returns null, or the channel has none, eve fetches a public https: link with the 25 MB upload cap and a 30-second timeout, at most 10 links per message and one at a time, and any other link or failed download reaches the model as a note. A private or expired link, such as a Google Drive file shared in Slack, no longer fails every later model call, and sessions that already hold such a link recover.
• 0248e69: read_file now shows PDFs up to 20 MiB to the model as files, so the agent can reopen an attached PDF after compaction, or read one that a tool or bash wrote to the sandbox. Its output's image field is now file and carries pages for PDFs. read_file also refuses images over 8000 pixels per side, which providers reject.

Patch Changes

• b6b353f: A custom channel's fetchFile can throw attachmentError(message) from eve/channels to tell the model why a file didn't arrive, such as a size limit, while the original error stays in operator logs. fetchFile now types the session it already receives, and eve/channels exports the FetchFileFunction, FetchFileContext, and FetchFileResult types for resolvers written in their own module.
• 0248e69: Every attachment now reaches the model with a label that names its sandbox path, including images and PDFs that also arrive as bytes, so the agent can pass a visible file to bash or open it again. eve checks image and PDF media types against the file's bytes. Only PNG, JPEG, GIF, and WebP images up to 3 MiB and 8000 pixels per side, and PDFs up to 20 MiB, go to the model as bytes, and tool results follow the same rule. A HEIC photo, an oversized screenshot, or a mislabeled file renders as its label instead of failing the model call. Live sessions pay one prompt-cache rewrite after upgrading.
• 0248e69: A turn cancelled before its first model call now stages its attachments, so a photo sent just before a follow-up message no longer breaks every later turn. File parts eve can't stage become a note instead of entering session history. Byte-valued file parts cross the queue as data: URLs, a string with any URL scheme reaches the channel's fetchFile instead of being decoded as base64, and message.received reports an inline file's size instead of echoing its data: URL.
• caf61ff: cancel() from useEveAgent() and EveAgentStore now stops a turn that an approval or other input answer resumed. Previously it sent no cancel request and the resumed turn ran to completion. MessageResponse.cancel() on a ClientSession.respond() response now targets that resumed turn too.
• 351f66d: Memory recalled on compaction.completed during a turn now joins history before the turn's latest user message, where turn.started recall goes, instead of after it. The question stays the last user message the model reads, with client context between the recalled memory and the question. Compaction between turns still appends the recall.
• 8f50d9d: A connection tool call no longer fails with Unrecognized key when the model sends a key the connection supplies through toolCall.providedArguments. eve drops the model's value and the provided value is used, as documented.
• b6b353f: eveChannel() accepts fetchFile, so a web client can upload a large file to its own storage and send only the URL. eve loads the file inside the workflow step, past the platform's request body limit. defineChannel and eveChannel take an uploadPolicy that eve now applies to every staged file, including URLs it downloads itself, on the final bytes and their verified media type. Slack, Telegram, and Teams apply their own uploadPolicy the same way. A file over the cap or of a disallowed type reaches the model as a note. An eveChannel with uploadPolicy or fetchFile reports its instrumentation kind as channel:eve instead of http, as one with events already does.
• 66ed5f9: Importing eve/next from a node -e script, such as the loader vercel dev uses for next.config.*, no longer throws ERR_INVALID_ARG_VALUE for "[eval]".
• 15177c6: Fix a second, never-settling web_search part under AI Gateway. eve no longer streams input for provider tools such as web_search, so each search shows up once, under the call id it runs and settles with.
• 2eb861a: eve/vue and eve/svelte no longer export the internal session projection types SessionAuthorization, SessionCall, SessionCallStatus, and SessionProjection, matching eve/react. Use ToolCallStatus and toolCallState() to read a tool call's status.
• 88edd75: just-bash sandboxes now start when the app runs from a different path than the one it was built in. The prepared artifact stores the template key, and eve resolves it under the runtime sandbox cache, so copying .output and .eve/sandbox-cache to a new root no longer fails with SandboxTemplateNotProvisionedError.
• dd4374e: Agents that use mockModel from eve/evals now compile without modelContextWindowTokens. Before, the documented one-line mockModel example failed with a missing AI Gateway context window error; mock models now default to a 1,000,000-token window.
• 85d1fcb: Slack now removes the buttons from every settled tool-approval card when one step posts many approvals. Before, a grouped message could grow past Slack's 50-block limit as cards settled, Slack rejected the update, and settled cards kept their Approve and Cancel buttons. A settled card now shows the outcome and who answered on the card itself instead of in extra lines below it.
• 13998d2: The Slack channel now collects every file posted in a thread since the previous mention of the app, up to 10 messages back, instead of only the newest message's files, so a file shared before a follow-up question reaches the agent. It skips Google Drive, Dropbox, and other remote files, whose links stay in the message text, keeps audio and video attachments, and stops a file download after 30 seconds.
• b56b4ff: A model stream that stops sending output without closing no longer holds the turn forever. After 10 minutes without output eve abandons the stream and retries the model call, and the turn fails normally once retries run out. Time spent running tools does not count toward the timeout. eve now requires ai 7.0.137 or later.
• 5d37843: When a failed turn ends the session, built-in channels now post one notice telling the person to start over, instead of a "please try again" notice followed by a "start a new session" notice for the same error. turn.failed events now carry terminal: true when session.failed follows (and false when the session waits for the next message), so custom channel handlers can make the same choice.
• 11392bd: eve link --non-interactive --project <name> and eve deploy --non-interactive --yes --project <name> now link a multi-agent workspace from its root instead of failing with "No eve agent in this directory", so a fresh CI checkout can link and deploy every agent without a prompt.

Changelog

Sourced from eve's changelog.

0.77.0

Minor Changes

• 0248e69: eve now downloads attachment links itself instead of handing them to the model provider. When a channel's fetchFile returns null, or the channel has none, eve fetches a public https: link with the 25 MB upload cap and a 30-second timeout, at most 10 links per message and one at a time, and any other link or failed download reaches the model as a note. A private or expired link, such as a Google Drive file shared in Slack, no longer fails every later model call, and sessions that already hold such a link recover.
• 0248e69: read_file now shows PDFs up to 20 MiB to the model as files, so the agent can reopen an attached PDF after compaction, or read one that a tool or bash wrote to the sandbox. Its output's image field is now file and carries pages for PDFs. read_file also refuses images over 8000 pixels per side, which providers reject.

Patch Changes

• b6b353f: A custom channel's fetchFile can throw attachmentError(message) from eve/channels to tell the model why a file didn't arrive, such as a size limit, while the original error stays in operator logs. fetchFile now types the session it already receives, and eve/channels exports the FetchFileFunction, FetchFileContext, and FetchFileResult types for resolvers written in their own module.
• 0248e69: Every attachment now reaches the model with a label that names its sandbox path, including images and PDFs that also arrive as bytes, so the agent can pass a visible file to bash or open it again. eve checks image and PDF media types against the file's bytes. Only PNG, JPEG, GIF, and WebP images up to 3 MiB and 8000 pixels per side, and PDFs up to 20 MiB, go to the model as bytes, and tool results follow the same rule. A HEIC photo, an oversized screenshot, or a mislabeled file renders as its label instead of failing the model call. Live sessions pay one prompt-cache rewrite after upgrading.
• 0248e69: A turn cancelled before its first model call now stages its attachments, so a photo sent just before a follow-up message no longer breaks every later turn. File parts eve can't stage become a note instead of entering session history. Byte-valued file parts cross the queue as data: URLs, a string with any URL scheme reaches the channel's fetchFile instead of being decoded as base64, and message.received reports an inline file's size instead of echoing its data: URL.
• caf61ff: cancel() from useEveAgent() and EveAgentStore now stops a turn that an approval or other input answer resumed. Previously it sent no cancel request and the resumed turn ran to completion. MessageResponse.cancel() on a ClientSession.respond() response now targets that resumed turn too.
• 351f66d: Memory recalled on compaction.completed during a turn now joins history before the turn's latest user message, where turn.started recall goes, instead of after it. The question stays the last user message the model reads, with client context between the recalled memory and the question. Compaction between turns still appends the recall.
• 8f50d9d: A connection tool call no longer fails with Unrecognized key when the model sends a key the connection supplies through toolCall.providedArguments. eve drops the model's value and the provided value is used, as documented.
• b6b353f: eveChannel() accepts fetchFile, so a web client can upload a large file to its own storage and send only the URL. eve loads the file inside the workflow step, past the platform's request body limit. defineChannel and eveChannel take an uploadPolicy that eve now applies to every staged file, including URLs it downloads itself, on the final bytes and their verified media type. Slack, Telegram, and Teams apply their own uploadPolicy the same way. A file over the cap or of a disallowed type reaches the model as a note. An eveChannel with uploadPolicy or fetchFile reports its instrumentation kind as channel:eve instead of http, as one with events already does.
• 66ed5f9: Importing eve/next from a node -e script, such as the loader vercel dev uses for next.config.*, no longer throws ERR_INVALID_ARG_VALUE for "[eval]".
• 15177c6: Fix a second, never-settling web_search part under AI Gateway. eve no longer streams input for provider tools such as web_search, so each search shows up once, under the call id it runs and settles with.
• 2eb861a: eve/vue and eve/svelte no longer export the internal session projection types SessionAuthorization, SessionCall, SessionCallStatus, and SessionProjection, matching eve/react. Use ToolCallStatus and toolCallState() to read a tool call's status.
• 88edd75: just-bash sandboxes now start when the app runs from a different path than the one it was built in. The prepared artifact stores the template key, and eve resolves it under the runtime sandbox cache, so copying .output and .eve/sandbox-cache to a new root no longer fails with SandboxTemplateNotProvisionedError.
• dd4374e: Agents that use mockModel from eve/evals now compile without modelContextWindowTokens. Before, the documented one-line mockModel example failed with a missing AI Gateway context window error; mock models now default to a 1,000,000-token window.
• 85d1fcb: Slack now removes the buttons from every settled tool-approval card when one step posts many approvals. Before, a grouped message could grow past Slack's 50-block limit as cards settled, Slack rejected the update, and settled cards kept their Approve and Cancel buttons. A settled card now shows the outcome and who answered on the card itself instead of in extra lines below it.
• 13998d2: The Slack channel now collects every file posted in a thread since the previous mention of the app, up to 10 messages back, instead of only the newest message's files, so a file shared before a follow-up question reaches the agent. It skips Google Drive, Dropbox, and other remote files, whose links stay in the message text, keeps audio and video attachments, and stops a file download after 30 seconds.
• b56b4ff: A model stream that stops sending output without closing no longer holds the turn forever. After 10 minutes without output eve abandons the stream and retries the model call, and the turn fails normally once retries run out. Time spent running tools does not count toward the timeout. eve now requires ai 7.0.137 or later.
• 5d37843: When a failed turn ends the session, built-in channels now post one notice telling the person to start over, instead of a "please try again" notice followed by a "start a new session" notice for the same error. turn.failed events now carry terminal: true when session.failed follows (and false when the session waits for the next message), so custom channel handlers can make the same choice.
• 11392bd: eve link --non-interactive --project <name> and eve deploy --non-interactive --yes --project <name> now link a multi-agent workspace from its root instead of failing with "No eve agent in this directory", so a fresh CI checkout can link and deploy every agent without a prompt.

Commits

• aca9dc7 Version Packages (#4644)
• b56b4ff fix(eve): retry a model stream that stops sending output (#4598)
• 66ed5f9 fix(eve): let eve/next load under node -e (#4647)
• caf61ff fix(eve): cancel a turn resumed by an input answer (#4570)
• 2eb861a fix(eve): keep session projection types internal in eve/vue and eve/svelte (#...
• 88edd75 fix(eve): resolve just-bash templates under the runtime sandbox cache (#4607)
• 8f50d9d fix(eve): drop model values for provided connection arguments before validati...
• 11392bd fix(eve): link workspace roots with non-interactive link and deploy (#4621)
• 351f66d fix(eve): place compaction memory recall before the turn's user message (#4613)
• 15177c6 fix(eve): stop streaming input for provider tools like web_search (#4610)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 15, 2026 3:14am UTC

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1792034213166
• lhr-1792034225902
• lhr-1792034238035
• lhr-1792034249385
• lhr-1792034260649
• lhr-1792034271928
• lhr-1792034283241
• lhr-1792034294456
• lhr-1792034305762

Reports are also available as workflow artifacts

[daggerstuff]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.