[dependabot]

Bumps the production-minor group with 3 updates in the / directory: eve, mongodb and mongoose.

Updates eve from 0.76.3 to 0.77.0

Release notes

Sourced from eve's releases.

eve@0.77.0

Minor Changes

• 0248e69: eve now downloads attachment links itself instead of handing them to the model provider. When a channel's fetchFile returns null, or the channel has none, eve fetches a public https: link with the 25 MB upload cap and a 30-second timeout, at most 10 links per message and one at a time, and any other link or failed download reaches the model as a note. A private or expired link, such as a Google Drive file shared in Slack, no longer fails every later model call, and sessions that already hold such a link recover.
• 0248e69: read_file now shows PDFs up to 20 MiB to the model as files, so the agent can reopen an attached PDF after compaction, or read one that a tool or bash wrote to the sandbox. Its output's image field is now file and carries pages for PDFs. read_file also refuses images over 8000 pixels per side, which providers reject.

Patch Changes

• b6b353f: A custom channel's fetchFile can throw attachmentError(message) from eve/channels to tell the model why a file didn't arrive, such as a size limit, while the original error stays in operator logs. fetchFile now types the session it already receives, and eve/channels exports the FetchFileFunction, FetchFileContext, and FetchFileResult types for resolvers written in their own module.
• 0248e69: Every attachment now reaches the model with a label that names its sandbox path, including images and PDFs that also arrive as bytes, so the agent can pass a visible file to bash or open it again. eve checks image and PDF media types against the file's bytes. Only PNG, JPEG, GIF, and WebP images up to 3 MiB and 8000 pixels per side, and PDFs up to 20 MiB, go to the model as bytes, and tool results follow the same rule. A HEIC photo, an oversized screenshot, or a mislabeled file renders as its label instead of failing the model call. Live sessions pay one prompt-cache rewrite after upgrading.
• 0248e69: A turn cancelled before its first model call now stages its attachments, so a photo sent just before a follow-up message no longer breaks every later turn. File parts eve can't stage become a note instead of entering session history. Byte-valued file parts cross the queue as data: URLs, a string with any URL scheme reaches the channel's fetchFile instead of being decoded as base64, and message.received reports an inline file's size instead of echoing its data: URL.
• caf61ff: cancel() from useEveAgent() and EveAgentStore now stops a turn that an approval or other input answer resumed. Previously it sent no cancel request and the resumed turn ran to completion. MessageResponse.cancel() on a ClientSession.respond() response now targets that resumed turn too.
• 351f66d: Memory recalled on compaction.completed during a turn now joins history before the turn's latest user message, where turn.started recall goes, instead of after it. The question stays the last user message the model reads, with client context between the recalled memory and the question. Compaction between turns still appends the recall.
• 8f50d9d: A connection tool call no longer fails with Unrecognized key when the model sends a key the connection supplies through toolCall.providedArguments. eve drops the model's value and the provided value is used, as documented.
• b6b353f: eveChannel() accepts fetchFile, so a web client can upload a large file to its own storage and send only the URL. eve loads the file inside the workflow step, past the platform's request body limit. defineChannel and eveChannel take an uploadPolicy that eve now applies to every staged file, including URLs it downloads itself, on the final bytes and their verified media type. Slack, Telegram, and Teams apply their own uploadPolicy the same way. A file over the cap or of a disallowed type reaches the model as a note. An eveChannel with uploadPolicy or fetchFile reports its instrumentation kind as channel:eve instead of http, as one with events already does.
• 66ed5f9: Importing eve/next from a node -e script, such as the loader vercel dev uses for next.config.*, no longer throws ERR_INVALID_ARG_VALUE for "[eval]".
• 15177c6: Fix a second, never-settling web_search part under AI Gateway. eve no longer streams input for provider tools such as web_search, so each search shows up once, under the call id it runs and settles with.
• 2eb861a: eve/vue and eve/svelte no longer export the internal session projection types SessionAuthorization, SessionCall, SessionCallStatus, and SessionProjection, matching eve/react. Use ToolCallStatus and toolCallState() to read a tool call's status.
• 88edd75: just-bash sandboxes now start when the app runs from a different path than the one it was built in. The prepared artifact stores the template key, and eve resolves it under the runtime sandbox cache, so copying .output and .eve/sandbox-cache to a new root no longer fails with SandboxTemplateNotProvisionedError.
• dd4374e: Agents that use mockModel from eve/evals now compile without modelContextWindowTokens. Before, the documented one-line mockModel example failed with a missing AI Gateway context window error; mock models now default to a 1,000,000-token window.
• 85d1fcb: Slack now removes the buttons from every settled tool-approval card when one step posts many approvals. Before, a grouped message could grow past Slack's 50-block limit as cards settled, Slack rejected the update, and settled cards kept their Approve and Cancel buttons. A settled card now shows the outcome and who answered on the card itself instead of in extra lines below it.
• 13998d2: The Slack channel now collects every file posted in a thread since the previous mention of the app, up to 10 messages back, instead of only the newest message's files, so a file shared before a follow-up question reaches the agent. It skips Google Drive, Dropbox, and other remote files, whose links stay in the message text, keeps audio and video attachments, and stops a file download after 30 seconds.
• b56b4ff: A model stream that stops sending output without closing no longer holds the turn forever. After 10 minutes without output eve abandons the stream and retries the model call, and the turn fails normally once retries run out. Time spent running tools does not count toward the timeout. eve now requires ai 7.0.137 or later.
• 5d37843: When a failed turn ends the session, built-in channels now post one notice telling the person to start over, instead of a "please try again" notice followed by a "start a new session" notice for the same error. turn.failed events now carry terminal: true when session.failed follows (and false when the session waits for the next message), so custom channel handlers can make the same choice.
• 11392bd: eve link --non-interactive --project <name> and eve deploy --non-interactive --yes --project <name> now link a multi-agent workspace from its root instead of failing with "No eve agent in this directory", so a fresh CI checkout can link and deploy every agent without a prompt.

Changelog

Sourced from eve's changelog.

0.77.0

Minor Changes

• 0248e69: eve now downloads attachment links itself instead of handing them to the model provider. When a channel's fetchFile returns null, or the channel has none, eve fetches a public https: link with the 25 MB upload cap and a 30-second timeout, at most 10 links per message and one at a time, and any other link or failed download reaches the model as a note. A private or expired link, such as a Google Drive file shared in Slack, no longer fails every later model call, and sessions that already hold such a link recover.
• 0248e69: read_file now shows PDFs up to 20 MiB to the model as files, so the agent can reopen an attached PDF after compaction, or read one that a tool or bash wrote to the sandbox. Its output's image field is now file and carries pages for PDFs. read_file also refuses images over 8000 pixels per side, which providers reject.

Patch Changes

• b6b353f: A custom channel's fetchFile can throw attachmentError(message) from eve/channels to tell the model why a file didn't arrive, such as a size limit, while the original error stays in operator logs. fetchFile now types the session it already receives, and eve/channels exports the FetchFileFunction, FetchFileContext, and FetchFileResult types for resolvers written in their own module.
• 0248e69: Every attachment now reaches the model with a label that names its sandbox path, including images and PDFs that also arrive as bytes, so the agent can pass a visible file to bash or open it again. eve checks image and PDF media types against the file's bytes. Only PNG, JPEG, GIF, and WebP images up to 3 MiB and 8000 pixels per side, and PDFs up to 20 MiB, go to the model as bytes, and tool results follow the same rule. A HEIC photo, an oversized screenshot, or a mislabeled file renders as its label instead of failing the model call. Live sessions pay one prompt-cache rewrite after upgrading.
• 0248e69: A turn cancelled before its first model call now stages its attachments, so a photo sent just before a follow-up message no longer breaks every later turn. File parts eve can't stage become a note instead of entering session history. Byte-valued file parts cross the queue as data: URLs, a string with any URL scheme reaches the channel's fetchFile instead of being decoded as base64, and message.received reports an inline file's size instead of echoing its data: URL.
• caf61ff: cancel() from useEveAgent() and EveAgentStore now stops a turn that an approval or other input answer resumed. Previously it sent no cancel request and the resumed turn ran to completion. MessageResponse.cancel() on a ClientSession.respond() response now targets that resumed turn too.
• 351f66d: Memory recalled on compaction.completed during a turn now joins history before the turn's latest user message, where turn.started recall goes, instead of after it. The question stays the last user message the model reads, with client context between the recalled memory and the question. Compaction between turns still appends the recall.
• 8f50d9d: A connection tool call no longer fails with Unrecognized key when the model sends a key the connection supplies through toolCall.providedArguments. eve drops the model's value and the provided value is used, as documented.
• b6b353f: eveChannel() accepts fetchFile, so a web client can upload a large file to its own storage and send only the URL. eve loads the file inside the workflow step, past the platform's request body limit. defineChannel and eveChannel take an uploadPolicy that eve now applies to every staged file, including URLs it downloads itself, on the final bytes and their verified media type. Slack, Telegram, and Teams apply their own uploadPolicy the same way. A file over the cap or of a disallowed type reaches the model as a note. An eveChannel with uploadPolicy or fetchFile reports its instrumentation kind as channel:eve instead of http, as one with events already does.
• 66ed5f9: Importing eve/next from a node -e script, such as the loader vercel dev uses for next.config.*, no longer throws ERR_INVALID_ARG_VALUE for "[eval]".
• 15177c6: Fix a second, never-settling web_search part under AI Gateway. eve no longer streams input for provider tools such as web_search, so each search shows up once, under the call id it runs and settles with.
• 2eb861a: eve/vue and eve/svelte no longer export the internal session projection types SessionAuthorization, SessionCall, SessionCallStatus, and SessionProjection, matching eve/react. Use ToolCallStatus and toolCallState() to read a tool call's status.
• 88edd75: just-bash sandboxes now start when the app runs from a different path than the one it was built in. The prepared artifact stores the template key, and eve resolves it under the runtime sandbox cache, so copying .output and .eve/sandbox-cache to a new root no longer fails with SandboxTemplateNotProvisionedError.
• dd4374e: Agents that use mockModel from eve/evals now compile without modelContextWindowTokens. Before, the documented one-line mockModel example failed with a missing AI Gateway context window error; mock models now default to a 1,000,000-token window.
• 85d1fcb: Slack now removes the buttons from every settled tool-approval card when one step posts many approvals. Before, a grouped message could grow past Slack's 50-block limit as cards settled, Slack rejected the update, and settled cards kept their Approve and Cancel buttons. A settled card now shows the outcome and who answered on the card itself instead of in extra lines below it.
• 13998d2: The Slack channel now collects every file posted in a thread since the previous mention of the app, up to 10 messages back, instead of only the newest message's files, so a file shared before a follow-up question reaches the agent. It skips Google Drive, Dropbox, and other remote files, whose links stay in the message text, keeps audio and video attachments, and stops a file download after 30 seconds.
• b56b4ff: A model stream that stops sending output without closing no longer holds the turn forever. After 10 minutes without output eve abandons the stream and retries the model call, and the turn fails normally once retries run out. Time spent running tools does not count toward the timeout. eve now requires ai 7.0.137 or later.
• 5d37843: When a failed turn ends the session, built-in channels now post one notice telling the person to start over, instead of a "please try again" notice followed by a "start a new session" notice for the same error. turn.failed events now carry terminal: true when session.failed follows (and false when the session waits for the next message), so custom channel handlers can make the same choice.
• 11392bd: eve link --non-interactive --project <name> and eve deploy --non-interactive --yes --project <name> now link a multi-agent workspace from its root instead of failing with "No eve agent in this directory", so a fresh CI checkout can link and deploy every agent without a prompt.

Commits

• aca9dc7 Version Packages (#4644)
• b56b4ff fix(eve): retry a model stream that stops sending output (#4598)
• 66ed5f9 fix(eve): let eve/next load under node -e (#4647)
• caf61ff fix(eve): cancel a turn resumed by an input answer (#4570)
• 2eb861a fix(eve): keep session projection types internal in eve/vue and eve/svelte (#...
• 88edd75 fix(eve): resolve just-bash templates under the runtime sandbox cache (#4607)
• 8f50d9d fix(eve): drop model values for provided connection arguments before validati...
• 11392bd fix(eve): link workspace roots with non-interactive link and deploy (#4621)
• 351f66d fix(eve): place compaction memory recall before the turn's user message (#4613)
• 15177c6 fix(eve): stop streaming input for provider tools like web_search (#4610)
• Additional commits viewable in compare view

Updates mongodb from 7.6.0 to 7.7.0

Release notes

Sourced from mongodb's releases.

v7.7.0

7.7.0 (2026-09-28)

The MongoDB Node.js team is pleased to announce version 7.7.0 of the mongodb package!

Release Notes

OIDC authentication recovers from a failed token fetch

A single failed OIDC token fetch, such as a cloud metadata endpoint timing out, used to leave the driver's token-fetch mutex holding that failure. Every later operation on the affected MongoClient then failed with the original error without attempting a new token fetch, and only restarting the process restored authentication. A failed token fetch now affects only the operation that triggered it.

Driver dependencies updates

Dependency version changes:

• bson: 7.2.0 -> 7.3.2
• mongodb-connection-string-url: 7.0.1 -> 7.0.2
• mongodb-js/saslprep: 1.4.11 -> 1.5.0

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Changelog

Sourced from mongodb's changelog.

7.7.0 (2026-09-18)

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

Commits

• 20b001b chore(main): release 7.7.0 (#5039)
• 7e953ed fix(NODE-7858): re-arm OIDC callback lock after a rejection (#5056)
• 73f4982 test(NODE-7831): widen duration bounds in flaky timing assertions (#5050)
• cca9250 chore(NODE-7856): bump drivers-evergreen-tools submodule to unblock CI (#5055)
• 783d489 chore(NODE-7771): align tags to match their versions on evergreen tasks (#5048)
• af0bcb2 chore(NODE-7691): add optional section into PR template for bug fixes (#5042)
• 83668e6 chore(NODE-7694): Successful lint tasks can precede integration tests as a de...
• 28e455d chore(NODE-7788): remove csot perf tests (#5044)
• dba1544 chore(NODE-7805): restrict release_notes to PRs from this repository (#5043)
• de31f12 chore: bump drivers-evergreen-tools (#5047)
• Additional commits viewable in compare view

Updates mongoose from 9.11.2 to 9.11.1

Changelog

Sourced from mongoose's changelog.

9.11.2 / 2026-10-12

• perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585
• perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588
• fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar
• fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk
• types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580
• docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

• fix(document): call recursive toObject() when setting a path to a nested object #16571
• fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS
• fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml
• fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai
• fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai
• fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny
• fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1
• fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1
• types(schema): treat Int32 paths as number #16565 #16564 lazerg
• types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

• feat: use MongoDB Node.js driver 7.7.x #16550
• feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
• fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
• types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
• docs(guide): use async/await instead of removed callbacks #16566 joi-agent
• test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

• fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557
• fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits
• fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS
• fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi
• fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404
• docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

• fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1
• fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot
• fix(schema): run setters declared on the union path itself #16528 giaBaoJS
• fix(collection): open collection if connection was already opened #16527 #16525 #16524
• fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

9.10.2 / 2026-09-22

... (truncated)

Commits

• beec597 Merge pull request #16558 from giaBaoJS/fix/array-filters-skip-unknown-path
• ddd064d fix(document): apply flattenDecimals when toObject() takes the shallow fast path
• ca71597 test(types): cover lowercase 'int32' alias
• 83e9665 Merge pull request #16546 from Mohamed-Elshesheny/fix/nested-docarray-init-pa...
• 6c1478e Merge pull request #16543 from breken-ai/fix/embedded-discriminator-eq-filter
• e823d32 Merge pull request #16542 from breken-ai/fix/elemmatch-not-cast
• 23a1216 chore: release 9.11.0
• 9cdeb3f Merge pull request #16567 from Automattic/9.11
• 4bd7183 fix lint
• fcd1f5b Merge branch 'master' into 9.11
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 15, 2026 7:06pm UTC

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1792091348442
• lhr-1792091360707
• lhr-1792091372488
• lhr-1792091383608
• lhr-1792091394595
• lhr-1792091405654
• lhr-1792091416618
• lhr-1792091427568
• lhr-1792091438537

Reports are also available as workflow artifacts