chore(deps): bump the version-minor-and-patch group across 1 directory with 10 updates

[dependabot]

Bumps the version-minor-and-patch group with 10 updates in the / directory:

Package	From	To
ts-jest	29.4.9	29.4.11
@genkit-ai/google-genai	1.37.0	1.39.0
@types/node	20.19.39	20.19.43
genkit	1.33.0	1.39.0
js-yaml	3.14.2	3.15.0
@types/nodemailer	8.0.0	8.0.1
@types/node-fetch	2.6.4	2.6.13
@genkit-ai/vertexai	1.37.0	1.39.0
sharp	0.34.5	0.35.2
nanoid	5.1.9	5.1.16

Updates ts-jest from 29.4.9 to 29.4.11

Release notes

Sourced from ts-jest's releases.

v29.4.11

Please refer to CHANGELOG.md for details.

v29.4.10

Please refer to CHANGELOG.md for details.

Changelog

Sourced from ts-jest's changelog.

29.4.11 (2026-05-21)

Bug Fixes

• preserve Bundler on the CJS path under TypeScript >= 6 (3941818), closes #4198

29.4.10 (2026-05-18)

Bug Fixes

• pass resolutionMode to ts.resolveModuleName for hybrid module support (b557a85)
• rebuild Program when consecutive compiles need different module kinds (a82a2b3), closes #4774
• respect tsconfig moduleResolution instead of forcing Node10 (1bffffc)
• transformer: transpile mjs files from node_modules for CJS mode (96d025d)
• transformer: use a consistent comparator in hoist-jest sortStatements (8a8fd2f)

Commits

• bff2d64 chore(release): 29.4.11
• 3941818 fix: preserve Bundler on the CJS path under TypeScript >= 6
• efb3c2f build(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in /website
• 4e46fad ci: refactor release workflow
• 96b3ac0 chore(release): 29.4.10
• e98ec64 build(deps): update github/codeql-action digest to 458d36d
• 21ac58f build(deps): update jest packages
• 0fdc96d build(deps): update dependency semver to ^7.8.0
• 4b95551 build(deps): update dependency jest-environment-jsdom to ^30.4.1 (#5311)
• 7b88447 build(deps): update eslint packages to ^8.59.3 (#5310)
• Additional commits viewable in compare view

Updates @genkit-ai/google-genai from 1.37.0 to 1.39.0

Release notes

Sourced from @​genkit-ai/google-genai's releases.

Genkit JS and CLI 1.39.0

⚠️ Breaking changes (beta)

• The beta Chat API has been removed and replaced by the new Agents API (#5248, #5251). The Chat class, ai.chat(...), and session.chat(...) are gone. Migrate to ai.defineAgent(...) and agent.chat() (see Agents below). All removed surface was beta.

---

This release introduces Agents, a first-class, multi-turn agent API for Genkit JS. Agents bundle a model/prompt, conversational state, tool loops, interrupts, persistence, streaming, and abort/resume into a single ergonomic, transport-agnostic surface that runs identically in-process on the server and over HTTP from the browser.

Highlights

defineAgent — the new Agents API (#5251)

Define a multi-turn agent in a single call, with three levels of control:

// Zero-config
const agent = ai.defineAgent({
  name: 'assistant',
  model: 'googleai/gemini-flash-latest',
  system: 'You are a helpful assistant.',
  tools: [searchTool],
});
// Reuse a registered .prompt (typed promptInput)
const agent = ai.definePromptAgent({ promptName: 'assistant', promptInput: { role: 'pirate' } });
// Full control via a custom turn handler
const agent = ai.defineCustomAgent({ name: 'custom' }, async (runner, input) => { /* ... */ });

Key capabilities:

• Stateful, multi-turn chats — chat() threads state, messages, snapshotId, and sessionId for you (send & stream).
• Typed custom state with Zod validation (stateSchema).
• Pluggable persistence via SessionStore (in-memory + file stores included); server-managed sessions resumable by sessionId.
• Streaming with live custom-state patches over the wire (JSON Patch).
• Interrupts & resume (restart / respond) for human-in-the-loop tools.
• Abort, detach (background turns) + heartbeats, and graceful failure that preserves the last-good state.
• clientTransform to redact/reshape state and stream chunks before they leave the server.
• Same API server or browser — remoteAgent(...) returns the same AgentAPI shape over HTTP.

Agents middleware: delegation & artifacts (#5252)

New @genkit-ai/middleware middlewares for building multi-agent, artifact-producing workflows:

• agents() — turns an agent into an orchestrator that delegates to other registered agents. Injects a dedicated delegate_to_<agent> tool per sub-agent, auto-discovers descriptions, returns sub-agent interrupts/failures as tool results, and adds guard rails (maxDelegations, historyLength).
• artifacts() — gives the model read_artifact / write_artifact tools backed by session state, with an <artifacts> listing injected each turn. Pair with agents({ artifactStrategy: 'session' }) so an orchestrator can read artifacts produced by its sub-agents.

useChat adapter for Agents — @genkit-ai/vercel-ai (#5426)

... (truncated)

Commits

• f37effb chore: JS version bump
• df98c2e chore: JS version bump
• 2a7d796 chore: JS version bump
• 6e26b5b fix(js/plugins/google-genai): Restore default voice to original (#5531)
• edf1d8d fix(js/plugins/google-genai): default a voice for Gemini TTS requests (#5491)
• See full diff in compare view

Updates @types/node from 20.19.39 to 20.19.43

Commits

• See full diff in compare view

Updates genkit from 1.33.0 to 1.39.0

Commits

• f37effb chore: JS version bump
• df98c2e chore: JS version bump
• a7d3247 feat(js/plugins/google-cloud|firebase): implemented Firestore session store (...
• 510b447 feat(js): implemented defineAgent (#5251)
• dd1d2d2 refactor(js)!: remove Chat API and associated session methods (#5248)
• b798ebf feat(js): add init data support to client and express handler (#5247)
• 379bcda feat(js): implement bidi actions and flows (#4288)
• 2a7d796 chore: JS version bump
• e1eca51 chore: JS version bump
• 7d87219 feat(dev-ui): add ui component metadata (#5430)
• Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• d8ff750 Add package lock
• 24f13e7 Added maxTotalMergeKeys (10000) loader option (v5 backport)
• See full diff in compare view

Updates @types/nodemailer from 8.0.0 to 8.0.1

Commits

• See full diff in compare view

Updates @types/node-fetch from 2.6.4 to 2.6.13

Commits

• See full diff in compare view

Updates @genkit-ai/vertexai from 1.37.0 to 1.39.0

Release notes

Sourced from @​genkit-ai/vertexai's releases.

Genkit JS and CLI 1.39.0

⚠️ Breaking changes (beta)

• The beta Chat API has been removed and replaced by the new Agents API (#5248, #5251). The Chat class, ai.chat(...), and session.chat(...) are gone. Migrate to ai.defineAgent(...) and agent.chat() (see Agents below). All removed surface was beta.

---

This release introduces Agents, a first-class, multi-turn agent API for Genkit JS. Agents bundle a model/prompt, conversational state, tool loops, interrupts, persistence, streaming, and abort/resume into a single ergonomic, transport-agnostic surface that runs identically in-process on the server and over HTTP from the browser.

Highlights

defineAgent — the new Agents API (#5251)

Define a multi-turn agent in a single call, with three levels of control:

// Zero-config
const agent = ai.defineAgent({
  name: 'assistant',
  model: 'googleai/gemini-flash-latest',
  system: 'You are a helpful assistant.',
  tools: [searchTool],
});
// Reuse a registered .prompt (typed promptInput)
const agent = ai.definePromptAgent({ promptName: 'assistant', promptInput: { role: 'pirate' } });
// Full control via a custom turn handler
const agent = ai.defineCustomAgent({ name: 'custom' }, async (runner, input) => { /* ... */ });

Key capabilities:

• Stateful, multi-turn chats — chat() threads state, messages, snapshotId, and sessionId for you (send & stream).
• Typed custom state with Zod validation (stateSchema).
• Pluggable persistence via SessionStore (in-memory + file stores included); server-managed sessions resumable by sessionId.
• Streaming with live custom-state patches over the wire (JSON Patch).
• Interrupts & resume (restart / respond) for human-in-the-loop tools.
• Abort, detach (background turns) + heartbeats, and graceful failure that preserves the last-good state.
• clientTransform to redact/reshape state and stream chunks before they leave the server.
• Same API server or browser — remoteAgent(...) returns the same AgentAPI shape over HTTP.

Agents middleware: delegation & artifacts (#5252)

New @genkit-ai/middleware middlewares for building multi-agent, artifact-producing workflows:

• agents() — turns an agent into an orchestrator that delegates to other registered agents. Injects a dedicated delegate_to_<agent> tool per sub-agent, auto-discovers descriptions, returns sub-agent interrupts/failures as tool results, and adds guard rails (maxDelegations, historyLength).
• artifacts() — gives the model read_artifact / write_artifact tools backed by session state, with an <artifacts> listing injected each turn. Pair with agents({ artifactStrategy: 'session' }) so an orchestrator can read artifacts produced by its sub-agents.

useChat adapter for Agents — @genkit-ai/vercel-ai (#5426)

... (truncated)

Commits

• f37effb chore: JS version bump
• df98c2e chore: JS version bump
• 2a7d796 chore: JS version bump
• See full diff in compare view

Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

• Bound dilate and erode width to avoid mask-size overflow. #4548 @​metsw24-max

• Verify convolve kernel values are numbers. #4549 @​metsw24-max

v0.35.2-rc.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

• c9622a3 Release v0.35.2
• cd4568f Upgrade to sharp-libvips v1.3.1
• 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
• 61210b4 Verify convolve kernel values are numbers (#4549)
• 1cb27dc Prerelease v0.35.2-rc.2
• c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
• 29d1e9e Prerelease v0.35.2-rc.1
• bbba0a1 Improve code bundler support with stub binaries
• ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
• 0f594dd Prerelease v0.35.2-rc.0
• Additional commits viewable in compare view

Updates nanoid from 5.1.9 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking nanoid by requesting big ID (by @​alanzabihi).

Changelog

Sourced from nanoid's changelog.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

Commits

• 6ccc67b Release 5.1.16 version
• 6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
• 3925903 Update dependencies
• 0b69554 Release 5.1.15 version
• 333c5a0 Backport changelog changes for 3.x
• 266eb63 Remove debug code
• a6a94d3 Do not allow to pollute pool
• 93fe197 Reduce ID size
• e4b7a9a Release 5.1.14 version
• 6bf3469 Update release action
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions