build(deps): bump the all group across 1 directory with 5 updates

[dependabot]

Bumps the all group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/claude-agent-sdk	0.3.250	0.3.284
csv-parse	7.0.2	7.0.3
hyparquet	1.29.2	1.31.2
zod	4.4.3	4.6.5
@types/node	26.4.0	26.6.3

Updates @anthropic-ai/claude-agent-sdk from 0.3.250 to 0.3.284

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.284

What's changed

• Added a renamed skill's directory name to its SlashCommand aliases when the name is plain and Claude Code ships no command by that name
• Added applied.ultracodeAvailable and applied.ultracodeRequested to getSettings(): whether this session can run Ultracode, and whether it is requested, independent of whether it is in effect
• Fixed forkSession() copies reading back the wrong history when cut at a progress row or fork briefing after a rewind, or when the session was compacted with some messages kept
• Fixed getSessionMessages() leaving out messages from other agents, sessions and channels that the CLI transcript shows
• Fixed { decision: 'block' } returned by Elicitation and ElicitationResult hook callbacks being ignored; it now declines the MCP elicitation
• Fixed query() closing stdin before a follow-up turn woken by a finished background agent, which failed that turn's hooks, canUseTool and SDK MCP calls with "Stream closed"
• Changed the first turn to still wait up to 2s for connecting MCP servers named in allowedTools or by an mcp_tool hook, even with CLAUDE_CODE_MCP_STARTUP_WAIT_MS set to 0
• Changed applyFlagSettings({ ultracode: true }) to keep the current effort level instead of switching to xhigh; an effortLevel that changes the level without ultracode turns Ultracode off
• Updated to parity with Claude Code v2.1.284

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.284
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.284
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.284
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.284

v0.3.283

What's changed

• Added plugin_errors to the SDKSystemMessage type (system/init), including path for a --plugin-dir entry that did not load
• Fixed getSessionMessages() returning, and forkSession() copying, a rewound-away branch when the newest branch ends at a meta row or a local command's rows
• Changed stream-json output to include warnings and notices raised during a turn as system/informational messages; it previously dropped them
• Changed the set_max_thinking_tokens control request: omitting max_thinking_tokens now leaves the session's thinking budget unchanged; send null to reset it to the session default
• Updated to parity with Claude Code v2.1.283

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.283
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.283
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.283
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.283

v0.3.282

What's changed

• Added support for strictKnownMarketplaces and blockedMarketplaces in host-supplied managedSettings: the allowlist applies only where admin policy sets none; the blocklist adds to the admin's

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.284

• Added a renamed skill's directory name to its SlashCommand aliases when the name is plain and Claude Code ships no command by that name
• Added applied.ultracodeAvailable and applied.ultracodeRequested to getSettings(): whether this session can run Ultracode, and whether it is requested, independent of whether it is in effect
• Fixed forkSession() copies reading back the wrong history when cut at a progress row or fork briefing after a rewind, or when the session was compacted with some messages kept
• Fixed getSessionMessages() leaving out messages from other agents, sessions and channels that the CLI transcript shows
• Fixed { decision: 'block' } returned by Elicitation and ElicitationResult hook callbacks being ignored; it now declines the MCP elicitation
• Fixed query() closing stdin before a follow-up turn woken by a finished background agent, which failed that turn's hooks, canUseTool and SDK MCP calls with "Stream closed"
• Changed the first turn to still wait up to 2s for connecting MCP servers named in allowedTools or by an mcp_tool hook, even with CLAUDE_CODE_MCP_STARTUP_WAIT_MS set to 0
• Changed applyFlagSettings({ ultracode: true }) to keep the current effort level instead of switching to xhigh; an effortLevel that changes the level without ultracode turns Ultracode off
• Updated to parity with Claude Code v2.1.284

0.3.283

• Added plugin_errors to the SDKSystemMessage type (system/init), including path for a --plugin-dir entry that did not load
• Fixed getSessionMessages() returning, and forkSession() copying, a rewound-away branch when the newest branch ends at a meta row or a local command's rows
• Changed stream-json output to include warnings and notices raised during a turn as system/informational messages; it previously dropped them
• Changed the set_max_thinking_tokens control request: omitting max_thinking_tokens now leaves the session's thinking budget unchanged; send null to reset it to the session default
• Updated to parity with Claude Code v2.1.283

0.3.282

• Added support for strictKnownMarketplaces and blockedMarketplaces in host-supplied managedSettings: the allowlist applies only where admin policy sets none; the blocklist adds to the admin's
• Added @anthropic-ai/claude-agent-sdk/core, a smaller entry point for apps that bundle the SDK (query, MCP tool helpers, session mutations, resolveSettings); it uses your installed zod and MCP SDK
• Added prewarm() and SpareProcess.claim() (alpha): start a Claude Code process before its session is known and bind it to a folder and its per-session options later
• Fixed readMcpResource() relaying content _meta keys under the CLI-reserved com.anthropic/ prefix; they are now dropped, as for tool results
• Updated to parity with Claude Code v2.1.282

0.3.281

• Added optional trigger, user_message_uuid and timestamp fields to the conversation_reset message so clients can tell what reset the conversation, match a /clear to its message, and show when the reset happened
• Fixed permission and dialog callbacks still being invoked for requests that arrived after close()
• Fixed control requests issued after a query closed hanging or leaking, and permission prompts that could not be cancelled after a cancelled request was redelivered
• Fixed session_state_changed staying at requires_action after an overlapping permission prompt and sandbox network-access prompt were both answered
• Improved SDK package size and load time: sdk.mjs no longer bundles unused dependencies (1.47 MB → 0.97 MB)
• Improved startup time for query() sessions with in-process MCP servers (createSdkMcpServer) by running their handshake inside the SDK; initialize may now wait up to 250 ms for them
• Improved SDK session start-up: the CLI now answers the host's initialize request before starting its background start-up work
• Changed the Settings type's attribution field to boolean | {...}; TypeScript code that reads attribution.commit from returned settings needs a type narrow
• Updated to parity with Claude Code v2.1.281

0.3.280

• Added optional fireReason to the task-notification SDKMessageOrigin; a local host's declared scheduled-task fire is honored only in a process it started with CLAUDE_CODE_HOST_SCHEDULED_RUN=1
• Added verbatimPrompts option: prompts are delivered as written — no @path expansion, no slash-command dispatch and, on current CLIs, no ambient attachments with the prompt (Claude Code 2.1.248+)
• Added _meta to mcpServerStatus() tool entries, carrying a tool's MCP Apps ui metadata so a host can find its ui:// resource
• Added readMcpResource() (alpha) to read an MCP Apps ui:// resource from an MCP server that Claude Code connected
• Improved askSideQuestion(): asked while a turn is running, it now sees that turn (its prompt, replies and finished tool results so far) instead of only the last completed turn
• Improved unattended retry (CLAUDE_CODE_RETRY_WATCHDOG): a usage-limit wait emits rate_limit_event (rejected, resetsAt) as it begins; api_retry heartbeats continue while sub-agent work waits
• Changed session_state_changed events (CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS=1) to report requires_action while an MCP elicitation waits on the user, as for permission prompts
• Changed headless sessions to cancel an MCP server's pending form question when the tool call that drew it ends

... (truncated)

Commits

• 41cad2a chore: Update CHANGELOG.md
• fc99cf7 ci: pin the model for issue triage (#480)
• 9e1902d chore: Update CHANGELOG.md
• 9e477a1 chore: Update CHANGELOG.md
• fb04f66 chore: Update CHANGELOG.md
• 58d2e4b chore: Update CHANGELOG.md
• 18661ed chore: Update CHANGELOG.md
• ba8f408 chore: Update CHANGELOG.md
• 4919e06 chore: Update CHANGELOG.md
• e51cd0b chore: Update CHANGELOG.md
• Additional commits viewable in compare view

Updates csv-parse from 7.0.2 to 7.0.3

Changelog

Sourced from csv-parse's changelog.

7.0.3 (2026-09-25)

Bug Fixes

• csv-parse: preserve typed column keys (#500) (745f045)
• csv-parse: type the delimiter_auto score callback arguments (#499) (4aa04da)

Commits

• 594c646 chore(release): publish
• 16d9900 refactor(csv-parse): isolate error and normalize_options in types
• 4aa04da fix(csv-parse): type the delimiter_auto score callback arguments (#499)
• 8d4173d build: latest dev dependencies
• c8caa1c build: generate latest dist
• 6c45c9b build: remove npx usage in package scripts
• 6f39f27 test: remove lint errors
• 94ae7b9 test: rename mocha setup rule
• 42a6b09 test: remove ts-node usage
• 745f045 fix(csv-parse): preserve typed column keys (#500)
• Additional commits viewable in compare view

Updates hyparquet from 1.29.2 to 1.31.2

Changelog

Sourced from hyparquet's changelog.

[1.31.2]

• Coalesce column chunk reads within a row group when gaps are at most 8 KB (#182)
• Faster INT32 and INT64 delta binary packed decoding (#180, #181)

[1.31.1]

• Avoid decoding unselected rows when reading nested VARIANT columns (#179)

[1.31.0]

• Custom parsers option accepts a partial object, keeping default parsers for anything not overridden (#178)

[1.30.1]

• Fix $not filters on dot-notation paths (#177)

[1.30.0]

• Add opt-in physical row index symbol to object rows (#176)

Commits

• 460fb57 Publish v1.31.2
• 8007ea2 coalesce selected column chunk reads within a row group when gaps are at most...
• 1a44c10 Read INT64 delta bitpacks in 32-bit chunks (#181)
• 23a36d8 Optimize INT32 delta binary packed decoding (#180)
• 3c8626b Publish v1.31.1
• a51a523 Clip selected rows before nested VARIANT assembly (#179)
• 9fd598a Publish v1.31.0
• 8981323 Keep default parsers when only some are overridden (#178)
• 252af4b Publish v1.30.1
• ea07519 Fix $not filters on dot-notation paths (#177)
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Updates @types/node from 26.4.0 to 26.6.3

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions