chore(deps-dev): bump the development-dependencies group across 1 directory with 3 updates by dependabot[bot] · Pull Request #71 · 97harsh/pictionary

dependabot · 2026-03-09T09:38:46Z

Bumps the development-dependencies group with 3 updates in the / directory: @types/node, genkit-cli and postcss.

Updates @types/node from 25.0.9 to 25.9.5

Commits

See full diff in compare view

Updates genkit-cli from 1.27.0 to 1.41.0

Release notes

Genkit JS and CLI 1.41.0

JS SDK

New GPT-5.x models in the OpenAI-compatible plugin. Added gpt-5.2, gpt-5.4, gpt-5.4-mini, gpt-5.4-nano, and gpt-5.5 to compat-oai, so you can reach the latest OpenAI models without waiting on a plugin bump. (#5389)

Per-request Anthropic API keys. The Anthropic plugin now resolves the API key lazily at request time instead of only at init, so you can override the key per call. Handy for multi-tenant setups and key rotation. (#4298)

Clearer retry and fallback logs. The retry and fallback model middleware now emit structured warnings explaining what happened: which attempt, how long the backoff is, why a retry was skipped, and which model it's falling back to. AbortError and ToolInterruptError are now correctly treated as non-retryable. (#5449)

Fixed audio transcription file extensions. compat-oai speech-to-text now derives the right file extension from the content type (.mp3, .wav, .webm, and friends) instead of a generic name, which fixes transcription failures with providers that key off the extension. (#3367)

More reliable agent resume. validateResumeAgainstHistory now searches history newest-first, fixing an edge case when resuming interrupted conversations. (#5832)

Options for checkOperation and cancelOperation. You can now pass options (including per-request client config) when polling or cancelling long-running operations. Auth and secrets are also now scrubbed from context logging. (#5972)

Security hardening for background operations (heads up: minor breaking change). The google-genai plugin no longer persists clientOptions in operation metadata, which previously risked leaking API keys if you returned a full operation object to a client. If you use per-request overrides (like a custom API key) with long-running models, you now need to pass those same overrides to each checkOperation/cancelOperation call. (#5992)

ROUGE evaluator fix on Vertex AI. Corrected the type used by the ROUGE score evaluator and cleaned up duplicated evaluator types. (#3592)

CLI

Structured output now survives "Export to .prompt". When you export from the Dev UI model runner, the output schema is included in the front matter (written as Picoschema) instead of being dropped, so exported prompts keep their structured output config. (#5506)

Cleaner trace:get output. genkit trace:get <id> gets a readable tree view, and --format json gives you clean JSON that's easy to pipe into other tools. (#5848)

More reliable startup in ephemeral runtimes. The CLI now waits for actions to finish registering before proceeding, fixing flaky behavior where actions weren't yet available. (#5949)

Dev UI

This release makes the runners smarter about structured output, sharpens live streaming in the Agent Runner, and clears up a bunch of rough edges in traces, tools, and datasets.

Highlights

See and edit output config in the Model Runner. The Model Runner now has an editable Output panel. When you load a generation from a trace, you can inspect the inherited format and JSON schema, tweak them, or switch back to plain text for a freeform prompt. The schema shows up as readable JSON Schema instead of a raw Zod blob, and a reset restores the inherited config.

Structured JSON output, rendered properly. Model Runner output that comes back as JSON is now rendered as clean, formatted JSON instead of a wall of text.

Output conformance in the Prompt Runner. The Prompt Runner now supports output conformance, so prompts that define a structured schema behave consistently with the rest of the tooling.

Live streaming patches in the Agent Runner. Agent Runner now supports customPatch streaming, so incremental updates from your agent show up in the UI as they arrive.

Improvements & Fixes

No more garbled streamed text. Fixed a decoding bug where multi-byte characters (CJK, emoji, accented letters) split across network chunks would render as �. Streamed output now decodes cleanly across chunk boundaries.

Structured output + tools now play nicely together. Schemas are sent under the field the generate action actually reads, so structured output no longer accidentally suppresses tool calls. The tool loop runs and applies the structured result on the final turn.

Real-time span metadata in traces. In-progress spans now keep their initial metadata (name, path, type) instead of dropping it, and show a clean -- placeholder for duration until the span completes.

Agent Runner session fixes. Switching from multi-turn (bidi) to single-turn mode no longer trips strict backends (e.g. Python/Pydantic) with extra_forbidden errors, session IDs update correctly when a bidi stream ends, and context is preserved when starting a new chat or loading a trace.

Manual tool responses are now sent as proper messages, and tool action cards render correctly when resuming or adding a model message with tool requests.

Interruptions callout added to the Tools page so it's clearer what's happening when a tool interrupts.

Dataset sample editor restored to its cleaner previous style, plus tidier JSON editor spacing.

New Contributors

... (truncated)

Commits

0b47313 chore: CLI version bump
cd26b57 feat(genkit-tools): Update trace:get to support clean outputs (#5848)
cd69a77 fix(cli): wait for action registration in ephemeral runtimes (#5949)
b318f2b fix(tools): allow analytics for help command (#5822)
1cbd076 feat(cli): add runtime dimension to metrics (#5781)
dbb4f34 chore: CLI version bump
c85153e chore: CLI version bump
66bfbbc fix(genkit-tools): prevent path traversal and bind to localhost (#5751)
54c60aa chore: CLI version bump
e4d9d5d chore: CLI version bump
Additional commits viewable in compare view

Updates postcss from 8.5.18 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
Additional commits viewable in compare view

dependabot · 2026-03-09T09:38:47Z

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-03-09T09:38:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pictionary	Ready	Preview	Aug 17, 2026 9:12am

github-actions · 2026-03-09T09:38:57Z