Bump the npm-minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the npm-minor-and-patch group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.117.1	0.122.0
jose	6.2.8	6.2.10
@swc/core	1.16.0	1.16.1
next	15.5.23	15.5.24
@types/react-dom	19.2.4	19.2.5

Updates @anthropic-ai/sdk from 0.117.1 to 0.122.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.122.0

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

sdk: v0.121.0

0.121.0 (2026-08-26)

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

Bug Fixes

• tools: keep the tool runner going on pause_turn (#288) (f040dc9)
• types: don't reference NodeJS.ProcessEnv from published types (#367) (fd38dfd)

Chores

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

  The beta Files and Skills namespaces (client.beta.files, client.beta.skills) no longer send the files-api-2025-04-14 / skills-2025-10-02 headers and return the same shapes as client.files / client.skills (with Beta-prefixed type names). Requests that still send those headers on raw HTTP keep receiving the beta shapes.

  Changes in the beta namespaces:

  • client.beta.skills.delete() now deletes a Skill together with all of its versions (previously refused while any version existed). It returns BetaDeletedSkill (was SkillDeleteResponse).
  • Beta Messages type BetaSkill (the {type, skill_id, version} entry in BetaContainer.skills) is renamed BetaContainerSkill; the request-side BetaSkillParams keeps its name. BetaSkill now names the Skill object returned by client.beta.skills.create() / retrieve() / list() (replacing SkillCreateResponse / SkillRetrieveResponse / SkillListResponse), and skill versions are BetaSkillVersion / BetaDeletedSkillVersion (replacing Version*Response).
  • client.beta.files.list() returns a BetaFileMetadataPageCursor (PageCursor<BetaFileMetadata> with data / next_page) and FileListParams paginates with page / ids (was BetaFileMetadataPage, a Page<BetaFileMetadata> with data, has_more, first_id, last_id and before_id / after_id); for await auto-pagination is unchanged. BetaSkill uses display_name (was display_title, also in SkillCreateParams) and latest_version_id (was latest_version), and BetaSkillVersion is addressed by its skver_… id (the Unix-timestamp version field is gone).

  Migration guides: Migrate from files-api-2025-04-14 · Migrate from skills-2025-10-02

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

0.121.0 (2026-08-26)

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

... (truncated)

Commits

• 7f3898c chore: release main
• 956ccb5 docs(api): clarify pagination on the organization rate-limit list endpoints
• 2131d80 fix(tools): let read return a view_range of a file over the size cap (#427)
• f830c8f fix(aws,bedrock): prefer env credentials over AWS_PROFILE (#436)
• 4d50ddf test(ecosystem): expect cross-realm timeout errors to classify correctly
• acdd669 fix(client): classify cross-realm DOMException abort/timeout errors correctly
• 0a14622 test(tools): pin that read, edit and the memory tool preserve CRLF and CR lin...
• 17035de docs: document TypeScript 5.0 as the minimum supported version
• 2f95d8a fix(client): use configured logger for SSE parse errors
• 33f5103 feat(api): beta files/skills namespaces use GA shapes; drop dated beta header...
• Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates @swc/core from 1.16.0 to 1.16.1

Changelog

Sourced from @​swc/core's changelog.

[1.16.1] - 2026-08-19

Bug Fixes

• (es/minifier) Preserve for init (#12121) (0a1d4de)

• (es/modules) Preserve destructuring assignment targets in SystemJS (#12122) (557060b)

• (es/react) Handle apos JSX entities (#12125) (d09547f)

Commits

• 490c7d8 chore: Publish 1.16.1 with swc_core v77.0.2
• 7e4d782 chore: Publish 1.16.1-nightly-20260819.1 with swc_core v77.0.2
• See full diff in compare view

Updates next from 15.5.23 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Commits

• b6c45b4 v15.5.24
• b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 409772e [15.5.x] [next/image]: disable avif image optimization
• 9c44b88 [15.x] support sharp 0.34 and 0.35
• 144fa5d [15.5.x] Remove generated error codes (#97783)
• ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• 1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
• 70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
• e57d564 v15.5.23
• c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
• Additional commits viewable in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.