chore(deps): bump the version-minor-and-patch group across 1 directory with 11 updates

[dependabot]

Bumps the version-minor-and-patch group with 11 updates in the / directory:

Package	From	To
ts-jest	29.4.9	29.4.11
@genkit-ai/google-genai	1.37.0	1.39.0
@types/node	20.19.39	20.19.43
genkit	1.33.0	1.39.0
js-yaml	3.14.2	3.15.0
nodemailer	9.0.1	9.0.3
smtp-server	3.19.1	3.19.2
@types/node-fetch	2.6.4	2.6.13
@genkit-ai/vertexai	1.37.0	1.39.0
sharp	0.34.5	0.35.3
nanoid	5.1.9	5.1.16

Updates ts-jest from 29.4.9 to 29.4.11

Release notes

Sourced from ts-jest's releases.

v29.4.11

Please refer to CHANGELOG.md for details.

v29.4.10

Please refer to CHANGELOG.md for details.

Changelog

Sourced from ts-jest's changelog.

29.4.11 (2026-05-21)

Bug Fixes

• preserve Bundler on the CJS path under TypeScript >= 6 (3941818), closes #4198

29.4.10 (2026-05-18)

Bug Fixes

• pass resolutionMode to ts.resolveModuleName for hybrid module support (b557a85)
• rebuild Program when consecutive compiles need different module kinds (a82a2b3), closes #4774
• respect tsconfig moduleResolution instead of forcing Node10 (1bffffc)
• transformer: transpile mjs files from node_modules for CJS mode (96d025d)
• transformer: use a consistent comparator in hoist-jest sortStatements (8a8fd2f)

Commits

• bff2d64 chore(release): 29.4.11
• 3941818 fix: preserve Bundler on the CJS path under TypeScript >= 6
• efb3c2f build(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in /website
• 4e46fad ci: refactor release workflow
• 96b3ac0 chore(release): 29.4.10
• e98ec64 build(deps): update github/codeql-action digest to 458d36d
• 21ac58f build(deps): update jest packages
• 0fdc96d build(deps): update dependency semver to ^7.8.0
• 4b95551 build(deps): update dependency jest-environment-jsdom to ^30.4.1 (#5311)
• 7b88447 build(deps): update eslint packages to ^8.59.3 (#5310)
• Additional commits viewable in compare view

Updates @genkit-ai/google-genai from 1.37.0 to 1.39.0

Release notes

Sourced from @​genkit-ai/google-genai's releases.

Genkit JS and CLI 1.39.0

⚠️ Breaking changes (beta)

• The beta Chat API has been removed and replaced by the new Agents API (#5248, #5251). The Chat class, ai.chat(...), and session.chat(...) are gone. Migrate to ai.defineAgent(...) and agent.chat() (see Agents below). All removed surface was beta.

---

This release introduces Agents, a first-class, multi-turn agent API for Genkit JS. Agents bundle a model/prompt, conversational state, tool loops, interrupts, persistence, streaming, and abort/resume into a single ergonomic, transport-agnostic surface that runs identically in-process on the server and over HTTP from the browser.

Highlights

defineAgent — the new Agents API (#5251)

Define a multi-turn agent in a single call, with three levels of control:

// Zero-config
const agent = ai.defineAgent({
  name: 'assistant',
  model: 'googleai/gemini-flash-latest',
  system: 'You are a helpful assistant.',
  tools: [searchTool],
});
// Reuse a registered .prompt (typed promptInput)
const agent = ai.definePromptAgent({ promptName: 'assistant', promptInput: { role: 'pirate' } });
// Full control via a custom turn handler
const agent = ai.defineCustomAgent({ name: 'custom' }, async (runner, input) => { /* ... */ });

Key capabilities:

• Stateful, multi-turn chats — chat() threads state, messages, snapshotId, and sessionId for you (send & stream).
• Typed custom state with Zod validation (stateSchema).
• Pluggable persistence via SessionStore (in-memory + file stores included); server-managed sessions resumable by sessionId.
• Streaming with live custom-state patches over the wire (JSON Patch).
• Interrupts & resume (restart / respond) for human-in-the-loop tools.
• Abort, detach (background turns) + heartbeats, and graceful failure that preserves the last-good state.
• clientTransform to redact/reshape state and stream chunks before they leave the server.
• Same API server or browser — remoteAgent(...) returns the same AgentAPI shape over HTTP.

Agents middleware: delegation & artifacts (#5252)

New @genkit-ai/middleware middlewares for building multi-agent, artifact-producing workflows:

• agents() — turns an agent into an orchestrator that delegates to other registered agents. Injects a dedicated delegate_to_<agent> tool per sub-agent, auto-discovers descriptions, returns sub-agent interrupts/failures as tool results, and adds guard rails (maxDelegations, historyLength).
• artifacts() — gives the model read_artifact / write_artifact tools backed by session state, with an <artifacts> listing injected each turn. Pair with agents({ artifactStrategy: 'session' }) so an orchestrator can read artifacts produced by its sub-agents.

useChat adapter for Agents — @genkit-ai/vercel-ai (#5426)

... (truncated)

Commits

• f37effb chore: JS version bump
• df98c2e chore: JS version bump
• 2a7d796 chore: JS version bump
• 6e26b5b fix(js/plugins/google-genai): Restore default voice to original (#5531)
• edf1d8d fix(js/plugins/google-genai): default a voice for Gemini TTS requests (#5491)
• See full diff in compare view

Updates @types/node from 20.19.39 to 20.19.43

Commits

• See full diff in compare view

Updates genkit from 1.33.0 to 1.39.0

Commits

• f37effb chore: JS version bump
• df98c2e chore: JS version bump
• a7d3247 feat(js/plugins/google-cloud|firebase): implemented Firestore session store (...
• 510b447 feat(js): implemented defineAgent (#5251)
• dd1d2d2 refactor(js)!: remove Chat API and associated session methods (#5248)
• b798ebf feat(js): add init data support to client and express handler (#5247)
• 379bcda feat(js): implement bidi actions and flows (#4288)
• 2a7d796 chore: JS version bump
• e1eca51 chore: JS version bump
• 7d87219 feat(dev-ui): add ui component metadata (#5430)
• Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• d8ff750 Add package lock
• 24f13e7 Added maxTotalMergeKeys (10000) loader option (v5 backport)
• See full diff in compare view

Updates nodemailer from 9.0.1 to 9.0.3

Release notes

Sourced from nodemailer's releases.

v9.0.3

9.0.3 (2026-06-30)

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

v9.0.2

9.0.2 (2026-06-29)

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
• reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

Changelog

Sourced from nodemailer's changelog.

9.0.3 (2026-06-30)

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

9.0.2 (2026-06-29)

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
• reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

Commits

• 1f61eb4 chore(master): release 9.0.3 (#1836)
• 07d8253 fix(smtp-connection): harden STARTTLS upgrade and secure socket handling (#1835)
• 4801f3a chore(master): release 9.0.2 (#1832)
• 9ba1064 fix(addressparser): keep operator chars inside an address-literal as text (#1...
• 22ddcea fix: harden smtp-connection low-severity issues
• af002eb chore: add Node.js 26 to the CI test matrix
• 6347b47 fix: reject CRLF in HTTP proxy CONNECT destination to prevent request injection
• 68860b9 fix: harden smtp-connection response parsing and socket lifecycle
• 9517bc5 fix: prevent SES transport callback double-invocation and hang on sync errors...
• See full diff in compare view

Updates smtp-server from 3.19.1 to 3.19.2

Changelog

Sourced from smtp-server's changelog.

3.19.2 (2026-07-05)

Bug Fixes

• update dependencies (nodemailer 9.0.3) (0eaaeb0)

Commits

• 350e869 chore(master): release 3.19.2 (#264)
• 0eaaeb0 fix: update dependencies (nodemailer 9.0.3)
• See full diff in compare view

Updates @types/node-fetch from 2.6.4 to 2.6.13

Commits

• See full diff in compare view

Updates @genkit-ai/vertexai from 1.37.0 to 1.39.0

Release notes

Sourced from @​genkit-ai/vertexai's releases.

Genkit JS and CLI 1.39.0

⚠️ Breaking changes (beta)

• The beta Chat API has been removed and replaced by the new Agents API (#5248, #5251). The Chat class, ai.chat(...), and session.chat(...) are gone. Migrate to ai.defineAgent(...) and agent.chat() (see Agents below). All removed surface was beta.

---

This release introduces Agents, a first-class, multi-turn agent API for Genkit JS. Agents bundle a model/prompt, conversational state, tool loops, interrupts, persistence, streaming, and abort/resume into a single ergonomic, transport-agnostic surface that runs identically in-process on the server and over HTTP from the browser.

Highlights

defineAgent — the new Agents API (#5251)

Define a multi-turn agent in a single call, with three levels of control:

// Zero-config
const agent = ai.defineAgent({
  name: 'assistant',
  model: 'googleai/gemini-flash-latest',
  system: 'You are a helpful assistant.',
  tools: [searchTool],
});
// Reuse a registered .prompt (typed promptInput)
const agent = ai.definePromptAgent({ promptName: 'assistant', promptInput: { role: 'pirate' } });
// Full control via a custom turn handler
const agent = ai.defineCustomAgent({ name: 'custom' }, async (runner, input) => { /* ... */ });

Key capabilities:

• Stateful, multi-turn chats — chat() threads state, messages, snapshotId, and sessionId for you (send & stream).
• Typed custom state with Zod validation (stateSchema).
• Pluggable persistence via SessionStore (in-memory + file stores included); server-managed sessions resumable by sessionId.
• Streaming with live custom-state patches over the wire (JSON Patch).
• Interrupts & resume (restart / respond) for human-in-the-loop tools.
• Abort, detach (background turns) + heartbeats, and graceful failure that preserves the last-good state.
• clientTransform to redact/reshape state and stream chunks before they leave the server.
• Same API server or browser — remoteAgent(...) returns the same AgentAPI shape over HTTP.

Agents middleware: delegation & artifacts (#5252)

New @genkit-ai/middleware middlewares for building multi-agent, artifact-producing workflows:

• agents() — turns an agent into an orchestrator that delegates to other registered agents. Injects a dedicated delegate_to_<agent> tool per sub-agent, auto-discovers descriptions, returns sub-agent interrupts/failures as tool results, and adds guard rails (maxDelegations, historyLength).
• artifacts() — gives the model read_artifact / write_artifact tools backed by session state, with an <artifacts> listing injected each turn. Pair with agents({ artifactStrategy: 'session' }) so an orchestrator can read artifacts produced by its sub-agents.

useChat adapter for Agents — @genkit-ai/vercel-ai (#5426)

... (truncated)

Commits

• f37effb chore: JS version bump
• df98c2e chore: JS version bump
• 2a7d796 chore: JS version bump
• See full diff in compare view

Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Updates nanoid from 5.1.9 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking nanoid by requesting big ID (by @​alanzabihi).

Changelog

Sourced from nanoid's changelog.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

Commits

• 6ccc67b Release 5.1.16 version
• 6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
• 3925903 Update dependencies
• 0b69554 Release 5.1.15 version
• 333c5a0 Backport changelog changes for 3.x
• 266eb63 Remove debug code
• a6a94d3 Do not allow to pollute pool
• 93fe197 Reduce ID size
• e4b7a9a Release 5.1.14 version
• 6bf3469 Update release action
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.