build(deps): bump the production-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
@hono/node-server	2.0.12	2.1.1
@opencode-ai/sdk	1.17.11	1.18.18
@pierre/diffs	1.2.10	1.3.5
ai	6.0.206	7.0.65
ai-sdk-provider-claude-code	3.5.0	4.1.0
hono	4.12.32	4.13.2
property-information	7.1.0	7.2.0

Updates @hono/node-server from 2.0.12 to 2.1.1

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• See full diff in compare view

Updates @opencode-ai/sdk from 1.17.11 to 1.18.18

Commits

• See full diff in compare view

Updates @pierre/diffs from 1.2.10 to 1.3.5

Updates ai from 6.0.206 to 7.0.65

Changelog

Sourced from ai's changelog.

7.0.65

Patch Changes

• dc8caae: Avoid repeatedly cloning accumulated text in readUIMessageStream while preserving independent snapshots for mutable nested values.
• 72ec74f: Preserve root-level JSON Schema definitions when wrapping array output schemas.
• c5b0515: Propagate errors thrown by the Chat onFinish callback to the initiating request.
• Updated dependencies [16650e9]
  • @​ai-sdk/gateway@​4.0.52

7.0.64

Patch Changes

• Updated dependencies [ea75787]
• Updated dependencies [b20de9e]
  • @​ai-sdk/gateway@​4.0.51

7.0.63

Patch Changes

• d0a5807: Preserve reasoning block IDs from UI message streams on reasoning UI parts.
• dcf33e8: Allow providers without reranking model support to be assigned to Provider.
• Updated dependencies [a4d386d]
  • @​ai-sdk/gateway@​4.0.50

7.0.62

Patch Changes

• e0bcf52: feat(ui): add typed custom bodies to Completion APIs

7.0.61

Patch Changes

• 326054b: Prevent resumeStream from copying the previous assistant message into the resumed response.
• 975bb28: Cancel messages that are still being prepared when a chat is stopped.
• Updated dependencies [7fbfc6d]
  • @​ai-sdk/provider-utils@​5.0.27
  • @​ai-sdk/gateway@​4.0.49

7.0.60

Patch Changes

• 79c52ef: Align ToolLoopAgent prepareCall types with the settings available and honored at runtime.
• Updated dependencies [3cc1bb6]

... (truncated)

Commits

• d76eb85 Version Packages (#18810)
• dc8caae fix: prevent quadratic readUIMessageStream allocation without weakening snaps...
• c5b0515 fix: Chat requests resolve when onFinish throws (#18755)
• 72ec74f fix: support root-referenced JSON Schema definitions in array outputs (#18802)
• 398166f Version Packages (#18780)
• a7f0d72 Version Packages (#18749)
• d0a5807 fix: reasoning UI message parts lose their SSE block IDs (#18746)
• dcf33e8 fix: Provider rejects conforming providers without reranking model support (#...
• 8b77c83 Version Packages (#18723)
• e0bcf52 feat(ui): add typed custom bodies to Completion APIs (#18679)
• Additional commits viewable in compare view

Updates ai-sdk-provider-claude-code from 3.5.0 to 4.1.0

Changelog

Sourced from ai-sdk-provider-claude-code's changelog.

[4.1.0] - 2026-08-10

Added

• resumeDropsTurn setting (#142) - Maps the Agent SDK's new resumeDropsTurn option: when resuming a session, drop the turn containing the given chain-entry UUID from the restored context (companion to resumeSessionAt for forking at a specific point).

Changed

• Claude Agent SDK pinned at 0.3.226 - Bumps the exact @anthropic-ai/claude-agent-sdk pin from 0.3.205, resolving the weekly canary's Options drift guard failure (#142). resumeDropsTurn was the only new Options key; typecheck and the unit suite pass against the new pin.

[4.0.1] - 2026-07-10

Fixed

• Visible and bounded subprocess diagnostics (#136) - Error messages now carry a trimmed stderr tail, authentication and timeout classification also inspect captured stderr using separate high-precision login/API-key and timeout phrases to avoid incidental matches, and retained stderr stored in mapped error metadata, including timeout errors, is capped at 4000 characters.

[4.0.0] - 2026-07-10

Added

• Claude Agent SDK event callbacks - Adds first-class onSdkMessage, onTaskEvent, onHookEvent, onMcpStatusChange, onElicitation, and agent settings so hosts can observe raw SDK messages, task/subagent lifecycle, hook lifecycle, the request's initial MCP server status snapshot, MCP elicitation, and named main-thread agents without reaching through sdkOptions.
• Query controller API - Exports createClaudeCodeQueryController(query) and the ClaudeCodeQueryController type, and adds onQueryControllerCreated for safe live-query controls (interrupt, setPermissionMode, setMcpPermissionModeOverride, setModel, setMaxThinkingTokens, applyFlagSettings, mcpServerStatus, reconnectMcpServer, toggleMcpServer, setMcpServers, getContextUsage, rewindFiles, stopTask, backgroundTasks, and optional streamInput) while keeping the raw SDK Query reachable via controller.rawQuery. Control-protocol calls require the SDK Query to still be live, and most require SDK streaming input/output.
• Expanded provider metadata - Adds taskEvents, hookEvents, initial MCP server-status snapshots in mcpServers, and enriched permissionDenials (agentId, decisionReasonType, and raw when available) under providerMetadata['claude-code'].
• Additional SDK helper re-exports - Re-exports resolveSettings, filterEscalatingDefaultMode, SandboxCredentialsConfig, and SDKFilesPersistedEvent.
• Auto image streaming - With streamingInput: 'auto', supported image payloads now enable the Agent SDK streaming-input path automatically instead of requiring callers to set streamingInput: 'always' only for image prompts; streamingInput: 'off' disables that path and emits a generic type: 'other' image streaming-input warning.

Changed

• AI SDK v7 / LanguageModelV4 port - Updates the provider implementation for the AI SDK v7 provider contract and documents the remaining v7 support boundaries.
• Runtime and package baseline raised - Requires Node.js >=22, ships ESM-only output (CommonJS require() is no longer available), and requires a Zod peer of ^4.1.8.
• Claude Agent SDK pinned at 0.3.205 - Bumps the exact @anthropic-ai/claude-agent-sdk pin to 0.3.205. Upstream fixed the 0.3.198–0.3.202 published .d.ts defect (undeclared SDKControlRequestProgressMessage/SDKConversationResetMessage) in 0.3.203; 0.3.205 also changes Query.interrupt() to return the control-protocol response, which the query controller absorbs so ClaudeCodeQueryController.interrupt() keeps resolving void. The dependency stays an exact pin (not a caret) because upstream releases have repeatedly shipped broken type declarations; the weekly canary gates each pin move.
• Tool-error stream extension removed - Failed tool executions now use the AI SDK spec shape: tool-result with isError: true, replacing the provider-specific tool-error stream extension.
• AI SDK v6 users - Stay on the maintained 3.x line (ai-sdk-v6 dist-tag, ai-sdk-v6 maintenance branch) until adopting AI SDK v7 with the 4.x line.
• Optional-provider feasibility documented - ProviderV4.files() and ProviderV4.skills() remain absent because Claude Agent SDK 0.3.205 has no direct durable provider-reference upload API for files or skill bundles; the README distinguishes inline file data from reusable provider-reference uploads.
• Workflow serialization deferred - Documents that @ai-sdk/provider-utils@5.0.5 exposes WORKFLOW_SERIALIZE, WORKFLOW_DESERIALIZE, and serializeModelOptions() for provider model classes, while this provider defers serialization for provider instances/settings; callback and function settings must be reconstructed by applications.
• Custom/reasoning-file feasibility documented - Documents current V4 behavior for custom and reasoning-file parts: assistant-history replay skips parts Claude Code cannot represent, and the provider does not emit custom output or durable reasoning-file artifacts yet.

Fixed

• SDK peer lockfile fidelity restored - Restores the @anthropic-ai/sdk and @modelcontextprotocol/sdk peer dependency lockfile entries so clean installs get the Agent SDK's full derived type fidelity, and removes the CI --legacy-peer-deps flag now that standard peer resolution succeeds.
• Structured output tool envelope suppressed - JSON-mode structured output now streams and returns only the object text, without leaking the Agent SDK's internal StructuredOutput tool lifecycle as provider-executed tool parts.
• JSON-mode tool argument streaming isolated - Ordinary tool calls in JSON-mode requests no longer leak their argument deltas into response text, emit empty-input tool calls, or produce out-of-order tool-input deltas after the tool call; server/MCP tool blocks (server_tool_use / mcp_tool_use) also no longer leak their argument deltas into response text.
• Assistant history tool-result replay - Replayed assistant history now round-trips tool results correctly under the v7 message/content model instead of losing the result context.
• Non-data image URL schemes rejected safely - Image file parts whose URL uses a scheme other than data: (for example file:// or blob:) now emit the image-URL warning instead of falling through to the base64 fallback, which previously encoded the URL string itself as image data.
• Non-image file parts warn instead of vanishing - Inline file parts with a non-image media type (for example application/pdf) now emit an Unsupported file part call warning instead of being silently dropped from the prompt.
• Prompt-suggestion default documented correctly - The CLI emits prompt_suggestion only when promptSuggestions: true (unset means disabled, verified against Agent SDK 0.3.205); README/JSDoc previously claimed unset meant enabled. validateSettings now warns when onPromptSuggestion is registered without promptSuggestions enabled.

[3.5.1] - 2026-07-06

Fixed

... (truncated)

Commits

• b677227 feat: bump Claude Agent SDK to 0.3.226 and map resumeDropsTurn (v4.1.0) (#143)
• 0bae2dd fix: surface captured stderr in error messages and classification (#137)
• 836895e feat!: adopt AI SDK v7 (LanguageModelV4) (#134)
• e294bc5 fix: fail canary with a named error on collapsed SDKMessage types (v3.5.1) (#...
• See full diff in compare view

Updates hono from 4.12.32 to 4.13.2

Commits

• 41bdc42 4.13.2
• 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
• 329b6f4 fix(client): send falsy JSON bodies (#5215)
• a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
• d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
• 26de731 fix(etag): stabilize digest across stream chunks (#5205)
• 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
• f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
• 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
• 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
• Additional commits viewable in compare view

Updates property-information from 7.1.0 to 7.2.0

Commits

• f6f547b 7.2.0
• 992bfbc Add number for colSpan
• 0839151 Update dev-dependencies
• cb86e8b Add new properties
• 83ece09 Update actions
• 930b589 Add missing JSDoc description
• a2822cf Update dev-dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions