[dependabot]

Bumps the openai-agents-api group with 3 updates in the /templates/openai-agents-api directory: openai, vite and wrangler.

Updates openai from 7.34.0 to 7.45.1

Release notes

Sourced from openai's releases.

v7.45.1

7.45.1 (2026-10-27)

Bug Fixes

• api: clarify prompt cache breakpoint TTL behavior (#3057) (60224b3)
• vertex: support google-auth-library v11 (#3046) (381709f)

v7.45.0

7.45.0 (2026-10-26)

Features

• api: add gpt-6.1-terra model identifier (#3054) (f8120e5)

Bug Fixes

• deps-dev: bump @​cloudflare/workers-types from 5.20261011.1 to 5.20261018.1 in /ecosystem-tests/cloudflare-worker (#3037) (5185d2c)
• deps-dev: bump @​types/node from 26.6.4 to 26.6.5 (#3036) (a768d48)
• deps-dev: bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/ts-browser-webpack (#3052) (369d4fe)
• deps-dev: bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/vercel-edge (#3032) (5c02484)
• deps-dev: bump puppeteer from 25.13.0 to 25.14.0 in /ecosystem-tests/browser-direct-import (#3035) (834ba3d)
• deps-dev: bump puppeteer from 25.13.0 to 25.14.0 in /ecosystem-tests/ts-browser-webpack (#3048) (64abe79)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/cloudflare-worker (#3038) (83cc173)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-cjs (#3041) (a12706d)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-cjs-web (#3043) (c129750)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm (#3044) (ac9ee21)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm-auto (#3045) (9489f4d)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm-web (#3047) (c502053)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/vercel-edge (#3049) (b6c7bff)
• deps-dev: bump vitest from 5.0.3 to 5.0.5 (#3042) (d4b8a2d)
• deps-dev: bump wrangler from 4.149.0 to 4.151.1 in /ecosystem-tests/cloudflare-worker (#3039) (24e750e)
• deps: bump undici from 7.30.0 to 7.30.1 in /ecosystem-tests/node-ts-cjs (#3053) (364f0cb)
• deps: bump undici from 8.11.2 to 8.12.2 (#3033) (e63e09c)

v7.44.0

7.44.0 (2026-10-25)

Features

• api: add delegation controls and prompt cache lifetimes and scheduled automations via client.beta.agents.automations, including invocation endpoints and the automations agent-tool variant (#3029) (d8931e7)
• api: expand Live Decision item and question types. Breaking change in a minor release. Live Decision item events now include messages and function/custom-tool calls and outputs. DecisionItemCreatedEvent.item and DecisionItemCreateEvent.item are unions, so callers that directly access item.content or item.role may no longer compile. For both event types, use if ('content' in event.item) before accessing message fields, and handle tool-item variants separately. Message items may omit type, so checking only item.type === 'message' can skip valid messages. This release also updates image-model documentation: gpt-image-1 was shut down on October 23, 2026; replace explicit selections with gpt-image-2.5-sunburst or gpt-image-2.5-flare. The documented default for Responses image-generation tools is now gpt-image-2; specify a supported model explicitly when you need a particular model. (#3034) (7562cd2)

Performance Improvements

... (truncated)

Changelog

Sourced from openai's changelog.

7.45.1 (2026-10-27)

Bug Fixes

• api: clarify prompt cache breakpoint TTL behavior (#3057) (60224b3)
• vertex: support google-auth-library v11 (#3046) (381709f)

7.45.0 (2026-10-26)

Features

• api: add gpt-6.1-terra model identifier (#3054) (f8120e5)

Bug Fixes

• deps-dev: bump @​cloudflare/workers-types from 5.20261011.1 to 5.20261018.1 in /ecosystem-tests/cloudflare-worker (#3037) (5185d2c)
• deps-dev: bump @​types/node from 26.6.4 to 26.6.5 (#3036) (a768d48)
• deps-dev: bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/ts-browser-webpack (#3052) (369d4fe)
• deps-dev: bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/vercel-edge (#3032) (5c02484)
• deps-dev: bump puppeteer from 25.13.0 to 25.14.0 in /ecosystem-tests/browser-direct-import (#3035) (834ba3d)
• deps-dev: bump puppeteer from 25.13.0 to 25.14.0 in /ecosystem-tests/ts-browser-webpack (#3048) (64abe79)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/cloudflare-worker (#3038) (83cc173)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-cjs (#3041) (a12706d)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-cjs-web (#3043) (c129750)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm (#3044) (ac9ee21)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm-auto (#3045) (9489f4d)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/node-ts-esm-web (#3047) (c502053)
• deps-dev: bump ts-jest from 29.4.14 to 29.4.15 in /ecosystem-tests/vercel-edge (#3049) (b6c7bff)
• deps-dev: bump vitest from 5.0.3 to 5.0.5 (#3042) (d4b8a2d)
• deps-dev: bump wrangler from 4.149.0 to 4.151.1 in /ecosystem-tests/cloudflare-worker (#3039) (24e750e)
• deps: bump undici from 7.30.0 to 7.30.1 in /ecosystem-tests/node-ts-cjs (#3053) (364f0cb)
• deps: bump undici from 8.11.2 to 8.12.2 (#3033) (e63e09c)

7.44.0 (2026-10-25)

Features

• api: add delegation controls and prompt cache lifetimes and scheduled automations via client.beta.agents.automations, including invocation endpoints and the automations agent-tool variant (#3029) (d8931e7)
• api: expand Live Decision item and question types. Breaking change in a minor release. Live Decision item events now include messages and function/custom-tool calls and outputs. DecisionItemCreatedEvent.item and DecisionItemCreateEvent.item are unions, so callers that directly access item.content or item.role may no longer compile. For both event types, use if ('content' in event.item) before accessing message fields, and handle tool-item variants separately. Message items may omit type, so checking only item.type === 'message' can skip valid messages. This release also updates image-model documentation: gpt-image-1 was shut down on October 23, 2026; replace explicit selections with gpt-image-2.5-sunburst or gpt-image-2.5-flare. The documented default for Responses image-generation tools is now gpt-image-2; specify a supported model explicitly when you need a particular model. (#3034) (7562cd2)

Performance Improvements

• agents: reuse action checks between stream events (#3028) (8e32d2d)

... (truncated)

Commits

• 4e95fe2 release: 7.45.1 (#3055)
• 60224b3 fix(api): clarify prompt cache breakpoint TTL behavior (#3057)
• 381709f fix(vertex): support google-auth-library v11 (#3046)
• af8336b release: 7.45.0 (#3051)
• f8120e5 feat(api): add gpt-6.1-terra model identifier (#3054)
• cd0d140 test: remove redundant ecosystem CLI retry subprocesses (#3030)
• 8f92abc test: parallelize packed Undici consumer installs (#3031)
• 364f0cb fix(deps): bump undici from 7.30.0 to 7.30.1 in /ecosystem-tests/node-ts-cjs ...
• d4b8a2d fix(deps-dev): bump vitest from 5.0.3 to 5.0.5 (#3042)
• 369d4fe fix(deps-dev): bump fast-uri from 3.1.7 to 3.1.9 in /ecosystem-tests/ts-brows...
• Additional commits viewable in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Updates wrangler from 4.151.1 to 4.156.0

Release notes

Sourced from wrangler's releases.

wrangler@4.156.0

Minor Changes

• #16532 25802bc Thanks @​simonha9! - Allow the experimental wrangler d1 insights command to run across every D1 database in the account

  The database name is now optional. With no name, the command returns the top queries across every D1 database in the account, and each result gains a databaseId field.

Patch Changes

• #16369 ec0bea4 Thanks @​MattieTK! - Stop autoconfig in non-interactive runs when a project root holds both static files and a Pages functions directory

  When a project without a detected framework has a functions directory, autoconfig asks whether it is a Cloudflare Pages project. Non-interactive runs (CI and coding agents) assume it is not and continue as a static site. When the static files are in the project root, that deploys the root as static assets, and the Pages Functions (the project's API routes) are not deployed.

  In that case autoconfig now stops with an error explaining that Pages Functions cannot be migrated automatically yet. For Pages Functions it suggests moving the static files into a subdirectory and deploying with wrangler pages deploy, or migrating the Functions to a Worker; for a functions directory that is not Pages Functions, it suggests moving the static files into a subdirectory or adding a configuration file. Projects whose static files are already in a subdirectory, projects detected as Pages or with a detected framework, and interactive runs where the user answers the prompt are unaffected.

• #16367 b4653b4 Thanks @​MattieTK! - Write a protective .assetsignore when autoconfig uses the project root as the static assets directory

  Autoconfig is meant to write an .assetsignore when the project root itself is the assets directory, so that local files are not uploaded as public assets. The check compared the detected output directory, which is relative ("."), with the absolute project path, so it never matched and no .assetsignore was written. A static project with an index.html at its root (for example after wrangler setup or a zero-config wrangler deploy) then uploaded files such as .env, .dev.vars, .git and node_modules as public assets.

  The check now resolves the assets directory that the generated configuration uses and compares it with the project root, so frameworks that set their own build output directory (such as Nuxt or SvelteKit) do not get an unused root .assetsignore. The generated .assetsignore also covers what a Cloudflare Pages upload skips, alongside the existing .wrangler, .dev.vars* and .env* entries: /_worker.js, /_routes.json and /functions at the root (so nested paths such as blog/functions/index.html are still uploaded), node_modules, .git and .DS_Store at any depth, and .npmrc. If an existing .assetsignore only lists a narrower pattern such as .env, .env* is added so that files like .env.production are skipped too. When the project root of an assets-only project contains a Pages functions directory or _worker.js, autoconfig now warns that it will not be deployed, since it is excluded from the assets and not run as server code.

• #16532 25802bc Thanks @​simonha9! - Fail the experimental wrangler d1 insights command with an actionable error when the GraphQL Analytics API rejects the request

  Previously the command printed an empty []. Rate limit errors now say how long to wait before retrying, and authorization errors name the "Account Analytics: Read" permission the API token needs.

• #16013 8b64bec Thanks @​swalker326! - Fix Durable Object self-references in tests and container validation

  Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

  Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.

• Updated dependencies [15fbaed, d8899ac]:

  • miniflare@5.20261023.3-beta

wrangler@4.155.0

Minor Changes

• #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]

... (truncated)

Commits

• b1ced56 Version Packages (#16556)
• 8b64bec [config] Fix Durable Object self-references without changing deployment targe...
• 25802bc [wrangler] Run wrangler d1 insights account-wide (#16532)
• b4653b4 [autoconfig] Write a protective .assetsignore when the project root is the as...
• a09957a Version Packages (#16553)
• c7a3373 Revert "Version Packages" (#16554)
• a95d647 [wrangler] Support remote Analytics Engine bindings in local dev (#16536)
• 52315bd Version Packages (#16529)
• dba0e81 [wrangler] Escape terminal controls in tail output (#16526)
• fc57bc0 [miniflare] Enable local Flagship management without Worker bindings (#16489)
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 17efda3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Worker tests retain an older runtime

The existing Miniflare override stays at 5.20261012.1-beta, while wrangler now depends on 5.20261019.2-beta. Worker tests therefore cannot cover runtime changes introduced by this upgrade.

---

Was this helpful? React with 👍 or 👎 to provide feedback.