[dependabot]

Bumps the ui-and-utils group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.133.0	0.135.0
dotenv	18.0.7	18.0.8
ejs	6.0.1	7.0.2
express-rate-limit	8.7.0	8.7.1
globals	17.12.0	17.13.0

Updates @anthropic-ai/sdk from 0.133.0 to 0.135.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

sdk-v0.134.0

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start
• streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.135.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

0.134.0 (2026-10-14)

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start

... (truncated)

Commits

• 04a4c28 release: 0.135.0
• 69dbe62 Merge pull request #935 from anthropics/synced/published
• b61a531 feat(helpers): retry a rate-limited fast fallback at standard speed (#943)
• 38d0ab4 feat(api): add between_tools to thinking types in model capabilities
• 366b53b chore(docs): describe headers on Managed Agents and telemetry endpoints
• ca50812 docs(api): note that some models need a beta header to use speed
• 03f6012 fix(helpers): honor speed overrides from fallback entries when streaming (#942)
• 88bf034 docs(changelog): shorten the OpenTelemetry tracing note (#941)
• 7c807a0 fix(client): close streams dropped without being read to the end
• 64758f6 feat(api): add the speed parameter and usage.speed to Messages
• Additional commits viewable in compare view

Updates dotenv from 18.0.7 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

Commits

• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
• f757811 fix(types): allow undefined values in populate output
• fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
• See full diff in compare view

Updates ejs from 6.0.1 to 7.0.2

Release notes

Sourced from ejs's releases.

v7.0.2

Version 7.0.2

v7.0.1

Version 7.0.1

Commits

• 539f158 Version 7.0.2
• af616e4 Move release notes into notes/
• 9a22c75 Add release notes for v6 and v7
• f66c5fe Correct whitespace docs for slurp tags and rmWhitespace
• 3e1e0ac Speed up template compilation by building tag strings once
• 16a9413 Escape literal <%% and %%> tags safely with custom delimiters
• 5131ac1 Treat null or undefined renderFile data as no data
• fee8de0 Render an empty template returned by an includer
• e451b12 Add CONTRIBUTING.md with a policy on AI-generated pull requests
• 17fae08 Fix ejs --help output: unrendered placeholders and wrong option docs
• Additional commits viewable in compare view

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates globals from 17.12.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

• Update globals (2026-10-01) (#354) b007369

---

sindresorhus/globals@v17.12.0...v17.13.0

Commits

• ce512bc 17.13.0
• b007369 Update globals (2026-10-01) (#354)
• 16cb1fe Meta tweaks
• See full diff in compare view

[admonstrator]

@dependabot rebase

[Copilot]

🔵 Needs a closer look

The EJS major-version upgrade affects application-wide rendering and needs runtime compatibility confirmation before approval.

No open issues 🎉

What changed in this PR

Updates five dependencies used for AI integration, configuration, template rendering, rate limiting, and linting.

Changes:

• Bumps @anthropic-ai/sdk, dotenv, ejs, express-rate-limit, and globals.
• Synchronizes the lockfile and adds the Anthropic SDK’s OpenTelemetry API dependency.

File	Description
package.json	Updates version ranges for all five dependencies, including EJS 7.
package-lock.json	Records matching versions, integrity hashes, and the new transitive dependency.

_{Review effort: Balanced}