chore(deps): bump the minor-and-patch group across 1 directory with 46 updates

[dependabot]

Bumps the minor-and-patch group with 44 updates in the / directory:

Package	From	To
@ar-agents/identity	0.5.1	0.9.4
@auth/prisma-adapter	2.11.2	2.11.3
@capacitor/android	8.3.1	8.5.0
@capacitor/app	8.1.0	8.1.1
@capacitor/browser	8.0.3	8.0.4
@capacitor/core	8.3.1	8.5.0
@capacitor/push-notifications	8.0.4	8.1.2
@capacitor/status-bar	8.0.2	8.0.3
@formatjs/intl-localematcher	0.8.9	0.8.13
@google-cloud/secret-manager	6.1.2	6.3.0
@google-cloud/storage	7.19.0	7.21.0
@google-cloud/tasks	6.2.2	6.3.0
@google/adk	1.1.0	1.6.0
@google/genai	2.6.0	2.16.0
@modelcontextprotocol/sdk	1.29.0	1.30.0
@radix-ui/react-dialog	1.1.15	1.1.23
@radix-ui/react-select	2.2.6	2.3.7
@radix-ui/react-separator	1.1.8	1.1.15
@radix-ui/react-switch	1.2.6	1.3.7
@radix-ui/react-toggle	1.1.10	1.1.18
@radix-ui/react-toggle-group	1.1.11	1.1.19
@radix-ui/react-tooltip	1.2.8	1.2.16
@tanstack/react-query	5.100.14	5.101.4
@tanstack/react-virtual	3.13.24	3.14.9
chrono-node	2.9.1	2.10.1
cron-parser	5.5.0	5.7.0
jose	6.2.3	6.2.8
libphonenumber-js	1.13.6	1.13.10
lucide-react	1.16.0	1.30.0
mercadopago	3.0.0	3.3.0
next	16.2.6	16.3.0
pdfkit	0.18.0	0.19.1
react	19.2.6	19.2.8
@types/react	19.2.14	19.2.18
react-dom	19.2.6	19.2.8
@types/react-dom	19.2.3	19.2.4
recharts	3.8.1	3.10.1
@capacitor/cli	8.3.1	8.5.0
@playwright/test	1.60.0	1.62.1
@tailwindcss/postcss	4.3.0	4.3.3
esbuild	0.28.0	0.28.1
eslint	10.4.0	10.8.0
typescript-eslint	8.59.1	8.66.0
vitest	4.1.7	4.1.10

Updates @ar-agents/identity from 0.5.1 to 0.9.4

Release notes

Sourced from @​ar-agents/identity's releases.

@​ar-agents/identity@​0.9.4

Patch Changes

• Updated dependencies [21e5c38]:
  • @​ar-agents/core@​0.4.0

@​ar-agents/identity-attest@​0.9.0

Minor Changes

• #146 ce478a3 Thanks @​naza00000! - Migrate the MercadoPago identity adapter onto @ar-agents/core's HttpClient (SDK-audit P1 #14, following banking-bcra, inpi, and aduana).

  MercadoPagoIdentityAdapter is a trust-critical adapter — a successful MP micro-charge is used as implicit identity proof — and the audit flagged its network path as LOW: zero timeout on api.mercadopago.com (a hung request blocked verification forever) and a blind as {…} cast with an unguarded JSON parse on the payment body.

  Now both the payment lookup (GET /v1/payments/{id}) and the best-effort refund (POST …/refunds) run through the shared client, which adds a real per-request timeout (default 10s), idempotent-GET retry with backoff, and — for the refund — retry: false so a non-idempotent refund is never fired twice. Most importantly the payment body is schema-validated: a 200 that isn't a real MP payment (missing status/transaction_amount) now throws AttestAdapterError (fail-closed) instead of being cast into a verification and minting an identity attestation from garbage. A non-2xx lookup still returns { verified: false }; approved-payment behavior and subject binding are unchanged.

  New MercadoPagoIdentityAdapterOptions.timeoutMs. The fetchImpl/baseUrl/accessToken options are unchanged.

Patch Changes

• Updated dependencies [21e5c38]:
  • @​ar-agents/core@​0.4.0

@​ar-agents/identity@​0.9.3

Patch Changes

• #140 1024d51 Thanks @​naza00000! - Security hardening.

  • identity-attest: the Auth0 id_token verification now pins the signature algorithm (RS256), closing the algorithm-confusion vector (consistent with the ap2 verifier).
  • identity / firma-digital: node-forge (on the signature-verification path) is constrained to ~1.4.0 (patch-only) so a consumer cannot silently resolve a regressed minor.
  • mcp: @modelcontextprotocol/sdk is constrained to ~1.29.0 (patch-only) on the transport path.

• Updated dependencies [1024d51]:

  • @​ar-agents/core@​0.3.1

@​ar-agents/identity-attest@​0.8.2

Patch Changes

• #140 1024d51 Thanks @​naza00000! - Security hardening.

  • identity-attest: the Auth0 id_token verification now pins the signature algorithm (RS256), closing the algorithm-confusion vector (consistent with the ap2 verifier).
  • identity / firma-digital: node-forge (on the signature-verification path) is constrained to ~1.4.0 (patch-only) so a consumer cannot silently resolve a regressed minor.
  • mcp: @modelcontextprotocol/sdk is constrained to ~1.29.0 (patch-only) on the transport path.

• Updated dependencies [1024d51]:

  • @​ar-agents/core@​0.3.1

@​ar-agents/identity-attest@​0.8.1

Patch Changes

• Updated dependencies [1a64552, 4e20dac, 2670917]:

... (truncated)

Changelog

Sourced from @​ar-agents/identity's changelog.

0.9.4

Patch Changes

• Updated dependencies [21e5c38]:
  • @​ar-agents/core@​0.4.0

0.9.3

Patch Changes

• #140 1024d51 Thanks @​naza00000! - Security hardening.

  • identity-attest: the Auth0 id_token verification now pins the signature algorithm (RS256), closing the algorithm-confusion vector (consistent with the ap2 verifier).
  • identity / firma-digital: node-forge (on the signature-verification path) is constrained to ~1.4.0 (patch-only) so a consumer cannot silently resolve a regressed minor.
  • mcp: @modelcontextprotocol/sdk is constrained to ~1.29.0 (patch-only) on the transport path.

• Updated dependencies [1024d51]:

  • @​ar-agents/core@​0.3.1

0.9.2

Patch Changes

• Updated dependencies [1a64552, 4e20dac, 2670917]:
  • @​ar-agents/core@​0.3.0

0.9.1

Patch Changes

• #94 ce7d818 Thanks @​naza00000! - Sanitize monotributoCategoria and fechaInscripcion in AFIP padron data (DeepSec MEDIUM follow-up).

  The prompt-injection sanitizer covered nombre/domicilioFiscal/actividades but skipped monotributoCategoria and fechaInscripcion as "coded fields". The WSCDC parser actually fills both from raw AFIP response text (<descripcionCategoria>, contract/categorization dates), so a hostile taxpayer record could smuggle control/zero-width/bidi characters and instruction-like text through them into the agent loop. sanitizeAfipData now cleans both fields, and the _provenance note lists them as untrusted. condicion (a derived enum, never raw text) is the only field passed through.

0.9.0

Minor Changes

• #90 5c2ff8c Thanks @​naza00000! - Harden the agent-callable AFIP padron lookup against abuse and prompt injection (DeepSec MEDIUM).

  • lookup_cuit_afip now enforces the CUIT checksum (parseCuit().valid) in code before querying AFIP, instead of relying on the tool description to tell the model to call validate_cuit first. Malformed CUITs short-circuit with a clear error and never reach the adapter.
  • New IdentityToolsOptions.authorizeLookup hook (IdentityLookupContext → IdentityLookupDecision) lets hosts add authorization, per-tenant allowlisting, or rate limiting. It runs after validation and before the adapter, and fails closed: returning false / { allowed: false, reason } denies the lookup without hitting AFIP.
  • AFIP free-text (nombre, domicilioFiscal, actividades) is now sanitized — control codes, zero-width characters, and bidi overrides stripped — both at the WSCDC parser and at the tool boundary, and tool output carries a _provenance marker tagging it as untrusted external data so an agent treats embedded text as data, never instructions.

  New exports: sanitizeRegistryText, sanitizeAfipData, withRegistryProvenance, REGISTRY_PROVENANCE, IdentityLookupContext, IdentityLookupDecision.

0.8.3

Patch Changes

... (truncated)

Commits

• 1d5ab8e chore(release): version packages — core@0.4.0 + HTTP-migration adapters (#147)
• fdb9fb3 chore: version packages (SDK audit P0 + security hardening release) (#141)
• 1024d51 fix(sdk): correctness + security fixes across live-integration adapters (#140)
• 0595453 fix(landing): Track-A coherence + honesty sweep (post-audit polish) (#138)
• e7d9645 chore(release): version packages (#131)
• ca3abeb chore(release): version identity@0.9.1 (sanitize coded fields)
• e920ef0 fix(identity): sanitize monotributoCategoria + fechaInscripcion (DeepSec MEDI...
• 36f4978 chore(release): version identity@0.9.0 (AFIP lookup hardening)
• 30111f1 fix(identity): harden AFIP lookup — validate, authorize, sanitize (DeepSec ME...
• ce6d4eb chore(release): version identity@0.8.3, facturacion@0.4.3 (SOAP-XML hardening)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by naza-ar, a new releaser for @​ar-agents/identity since your current version.

Updates @auth/prisma-adapter from 2.11.2 to 2.11.3

Release notes

Sourced from @​auth/prisma-adapter's releases.

@​auth/prisma-adapter@​2.11.3

Other

• @​auth/core: dependency update (8a933f95)

Commits

• 5af7357 chore(release): bump package version(s) [skip ci]
• 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
• 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
• 1116034 Chore/nodemailer 8 peer deps (#13434)
• 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
• b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
• a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
• d008b9b Merge commit from fork
• af42d8f chore: lint (#13446)
• e707770 Merge commit from fork
• Additional commits viewable in compare view

Updates @capacitor/android from 8.3.1 to 8.5.0

Release notes

Sourced from @​capacitor/android's releases.

8.5.0

8.5.0 (2026-07-31)

Bug Fixes

• cli: support TypeScript 7 when loading capacitor.config.ts (#8534) (4c1c870)

Features

• cli: add migrator functionality for adopting UIScene (#8544) (984fa85)
• ios: UIScene Support (#8536) (3fa04a3)

8.4.2

8.4.2 (2026-07-14)

Bug Fixes

• android: explicitly grant URI permissions for image capture intent (#8526) (6f2d328)

8.4.1

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)

... (truncated)

Changelog

Sourced from @​capacitor/android's changelog.

8.5.0 (2026-07-31)

Bug Fixes

• cli: support TypeScript 7 when loading capacitor.config.ts (#8534) (4c1c870)

Features

• cli: add migrator functionality for adopting UIScene (#8544) (984fa85)
• ios: UIScene Support (#8536) (3fa04a3)

8.4.2 (2026-07-14)

Bug Fixes

• android: explicitly grant URI permissions for image capture intent (#8526) (6f2d328)

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)
• cli: capture ios_package_manager in telemetry (#8482) (b4b297a)

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2 (2026-05-07)

... (truncated)

Commits

• 3ab4139 Release 8.5.0
• 984fa85 feat(cli): add migrator functionality for adopting UIScene (#8544)
• 3fa04a3 feat(ios): UIScene Support (#8536)
• 4c1c870 fix(cli): support TypeScript 7 when loading capacitor.config.ts (#8534)
• f368a1b chore(android): fix lint issues (#8542)
• 1834b97 Release 8.4.2
• 6f2d328 fix(android): explicitly grant URI permissions for image capture intent (#8526)
• b789b68 chore: run npm run fmt to fix lint errors (#8516)
• 7217b52 Release 8.4.1
• 6048e90 fix(cli): make SPM dependency patch work on prereleases (#8508)
• Additional commits viewable in compare view

Updates @capacitor/app from 8.1.0 to 8.1.1

Release notes

Sourced from @​capacitor/app's releases.

@​capacitor/app@​8.1.1

8.1.1 (2026-07-15)

Note: Version bump only for package @​capacitor/app

Commits

• 0bfde98 chore(release): publish [skip ci]
• 2be8127 docs(motion): add orientation listener example to README (#2558)
• 060e41c chore: add dist to root gitignore (#2560)
• 5b65292 docs(browser): remove Web/iOS specific warning for close() (#2519)
• ee34758 chore(android): format code for latest prettier (#2553)
• e84bf95 chore(status-bar): format Package.swift (#2547)
• 0b4e735 docs(README): remove watch plugin and add local-llm (#2544)
• d32b1c6 chore: format java code (#2536)
• 265ca0b chore: format java code (#2535)
• 63c874c chore(release): publish [skip ci]
• Additional commits viewable in compare view

Updates @capacitor/browser from 8.0.3 to 8.0.4

Release notes

Sourced from @​capacitor/browser's releases.

@​capacitor/browser@​8.0.4

8.0.4 (2026-07-15)

Note: Version bump only for package @​capacitor/browser

Commits

• 0bfde98 chore(release): publish [skip ci]
• 2be8127 docs(motion): add orientation listener example to README (#2558)
• 060e41c chore: add dist to root gitignore (#2560)
• 5b65292 docs(browser): remove Web/iOS specific warning for close() (#2519)
• ee34758 chore(android): format code for latest prettier (#2553)
• e84bf95 chore(status-bar): format Package.swift (#2547)
• 0b4e735 docs(README): remove watch plugin and add local-llm (#2544)
• d32b1c6 chore: format java code (#2536)
• 265ca0b chore: format java code (#2535)
• 63c874c chore(release): publish [skip ci]
• Additional commits viewable in compare view

Updates @capacitor/core from 8.3.1 to 8.5.0

Release notes

Sourced from @​capacitor/core's releases.

8.5.0

8.5.0 (2026-07-31)

Bug Fixes

• cli: support TypeScript 7 when loading capacitor.config.ts (#8534) (4c1c870)

Features

• cli: add migrator functionality for adopting UIScene (#8544) (984fa85)
• ios: UIScene Support (#8536) (3fa04a3)

8.4.2

8.4.2 (2026-07-14)

Bug Fixes

• android: explicitly grant URI permissions for image capture intent (#8526) (6f2d328)

8.4.1

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)

... (truncated)

Changelog

Sourced from @​capacitor/core's changelog.

8.5.0 (2026-07-31)

Bug Fixes

• cli: support TypeScript 7 when loading capacitor.config.ts (#8534) (4c1c870)

Features

• cli: add migrator functionality for adopting UIScene (#8544) (984fa85)
• ios: UIScene Support (#8536) (3fa04a3)

8.4.2 (2026-07-14)

Bug Fixes

• android: explicitly grant URI permissions for image capture intent (#8526) (6f2d328)

8.4.1 (2026-06-19)

Bug Fixes

• cli: make SPM dependency patch work on prereleases (#8508) (6048e90)
• cli: patch Capacitor SPM dependency version in plugins (#8492) (28bb2c6)

8.4.0 (2026-06-02)

Bug Fixes

• android: show only the requested system bar (#8480) (4c6c321)
• cli: revert live reload config on failure (#8485) (1d031a4)
• SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
• SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

• add method getDouble to plugin config (#7638) (93c72de)
• cli: add experimental packageOptions (#8471) (258867b)
• cli: capture ios_package_manager in telemetry (#8482) (b4b297a)

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2 (2026-05-07)

... (truncated)

Commits

• 3ab4139 Release 8.5.0
• 984fa85 feat(cli): add migrator functionality for adopting UIScene (#8544)
• 3fa04a3 feat(ios): UIScene Support (#8536)
• 4c1c870 fix(cli): support TypeScript 7 when loading capacitor.config.ts (#8534)
• f368a1b chore(android): fix lint issues (#8542)
• 1834b97 Release 8.4.2
• 6f2d328 fix(android): explicitly grant URI permissions for image capture intent (#8526)
• b789b68 chore: run npm run fmt to fix lint errors (#8516)
• 7217b52 Release 8.4.1
• 6048e90 fix(cli): make SPM dependency patch work on prereleases (#8508)
• Additional commits viewable in compare view

Updates @capacitor/push-notifications from 8.0.4 to 8.1.2

Release notes

Sourced from @​capacitor/push-notifications's releases.

@​capacitor/push-notifications@​8.1.2

8.1.2 (2026-07-15)

Note: Version bump only for package @​capacitor/push-notifications

@​capacitor/push-notifications@​8.1.1

8.1.1 (2026-05-15)

Note: Version bump only for package @​capacitor/push-notifications

@​capacitor/push-notifications@​8.1.0

8.1.0 (2026-05-15)

Features

• push-notifications: add banner and list presentation options for iOS (#2529) (f266d2e)

Commits

• 0bfde98 chore(release): publish [skip ci]
• 2be8127 docs(motion): add orientation listener example to README (#2558)
• 060e41c chore: add dist to root gitignore (#2560)
• 5b65292 docs(browser): remove Web/iOS specific warning for close() (#2519)
• ee34758 chore(android): format code for latest prettier (#2553)
• e84bf95 chore(status-bar): format Package.swift (#2547)
• 0b4e735 docs(README): remove watch plugin and add local-llm (#2544)
• d32b1c6 chore: format java code (#2536)
• 265ca0b chore: format java code (#2535)
• 63c874c chore(release): publish [skip ci]
• Additional commits viewable in compare view

Updates @capacitor/status-bar from 8.0.2 to 8.0.3

Release notes

Sourced from @​capacitor/status-bar's releases.

@​capacitor/status-bar@​8.0.3

8.0.3 (2026-07-15)

Note: Version bump only for package @​capacitor/status-bar

Commits

• 0bfde98 chore(release): publish [skip ci]
• 2be8127 docs(motion): add orientation listener example to README (#2558)
• 060e41c chore: add dist to root gitignore (#2560)
• 5b65292 docs(browser): remove Web/iOS specific warning for close() (#2519)
• ee34758 chore(android): format code for latest prettier (#2553)
• e84bf95 chore(status-bar): format Package.swift (#2547)
• 0b4e735 docs(README): remove watch plugin and add local-llm (#2544)
• d32b1c6 chore: format java code (#2536)
• 265ca0b chore: format java code (#2535)
• 63c874c chore(release): publish [skip ci]
• Additional commits viewable in compare view

Updates @formatjs/intl-localematcher from 0.8.9 to 0.8.13

Release notes

Sourced from @​formatjs/intl-localematcher's releases.

@​formatjs/intl-localematcher: 0.8.13

0.8.13 (2026-07-16)

What's Changed

• docs: add Korean (ko-KR) to homepage live demo by @​moduvoice in formatjs/formatjs#6858
• chore(deps): update OXC packages to 0.138 by @​renovate[bot] in formatjs/formatjs#6826
• chore(deps): update dependency oxfmt to ^0.57.0 by @​renovate[bot] in formatjs/formatjs#6824
• chore(deps): update dependency eslint to v10.6.0 by @​renovate[bot] in formatjs/formatjs#6821
• chore(deps): update rust crate anyhow to v1.0.103 by @​renovate[bot] in formatjs/formatjs#6861
• fix(deps): align NAPI runtime and derive by @​renovate[bot] in formatjs/formatjs#6862
• fix(deps): update dependency babel-plugin-formatjs to v11.3.14 by @​renovate[bot] in formatjs/formatjs#6863
• fix(deps): update dependency eslint-plugin-formatjs to v6.4.16 by @​renovate[bot] in formatjs/formatjs#6864
• fix(deps): update formatjs monorepo by @​renovate[bot] in formatjs/formatjs#6865
• chore(deps): update actions/checkout action to v7 by @​renovate[bot] in formatjs/formatjs#6867
• chore(deps): update jest monorepo to v30 by @​renovate[bot] in formatjs/formatjs#6868
• fix(deps): restore Jest 29 compatibility by @​longlho in formatjs/formatjs#6872
• chore(deps): update dependency rolldown to v1.1.4 by @​renovate[bot] in formatjs/formatjs#6860
• fix(deps): update oxc to 0.139 by @​renovate[bot] in formatjs/formatjs#6870
• feat(babel-plugin-formatjs): require Babel 8 by @​renovate[bot] in formatjs/formatjs#6869
• chore(deps): adopt TypeScript 7 by @​renovate[bot] in formatjs/formatjs#6819
• chore(deps): update dependency oxfmt to ^0.58.0 by @​renovate[bot] in formatjs/formatjs#6875
• chore(deps): update dependency rolldown-plugin-dts to ^0.27.0 by @​renovate[bot] in formatjs/formatjs#6825
• chore(deps): update pnpm to v11.10.0 by @​renovate[bot] in formatjs/formatjs#6866
• chore(deps): update dependency rolldown to v1.1.5 by @​renovate[bot] in formatjs/formatjs#6878
• fix(deps): update example TypeScript to v7 by @​renovate[bot] in formatjs/formatjs#6881
• fix(icu_messageformat_parser): dedupe structural variables by @​longlho in formatjs/formatjs#6883
• fix(deps): update dependency babel-plugin-formatjs to v11.3.15 by Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.