chore(deps-dev): bump @assistant-ui/react from 0.15.18 to 0.15.19

[dependabot]

Bumps @assistant-ui/react from 0.15.18 to 0.15.19.

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.19

Patch Changes

• #6971 9247ae3 - fix: honor message part text render elements with an explicit component. (@​rupic-app)

• #6738 3c17a5f - fix: prevent queued live completion requests from starting after unmount (@​Kinfe123)

• #7115 4767a92 - feat: align the cloud SDK with Assistant Cloud 0.2 (@​okisdev)

  • run reports now carry provider, outcome_type (aborted, disconnected, length, content_filter), error_code and error, message_id, first_token_ms, duration_ms, a finish_reason per step from useCloudChat and trace_id, plus environment, release and tags from the telemetry config; one createRunReport builder in assistant-cloud assembles the body for the assistant-ui runtime and for @assistant-ui/cloud-ai-sdk, and provider_type and metadata stay on the wire for older self hosted clouds
  • assistant-cloud/telemetry (server side): createAssistantCloudTraceExporter, createAssistantCloudSpanProcessor, assistantCloudTraceMetadata and withAssistantCloudTraceMetadata send AI SDK GenAI spans to POST /v1/traces and hand the trace id to the browser, so a client report and its server spans merge into one run; the OpenTelemetry packages are optional peers of the subpath only
  • engagement events: sends, edits, stops, regenerates, copies, branch switches, suggestions, attachments, thread switches, speech, voice and shown errors are batched to POST /v1/events without any message content; telemetry.events: false opts out
  • cloud.scores.create for custom scores, and message feedback through useCloudChat().feedback next to the assistant-ui FeedbackAdapter
  • cloud.files.generatePresignedDownloadUrl and the object key on upload responses
  • CloudAPIError.code and details, including plan_limit_reached on a 402
  • @assistant-ui/core requires assistant-cloud@^0.2.0, and its store emits the composer, message and thread events the engagement reporter reads

• #6987 b8c5e68 - fix: compare arrays with indexed loops so sparse-array holes cannot read as equal; a sparse suggestions list now compacts to a dense one before it reaches the per-suggestion lookup (@​Kinfe123)

• #6961 98010f1 - fix: notify controlled and uncontrolled modal owners when a run opens a closed modal (@​ephraimduncan)

• #6985 7a82c22 - fix: keep parent IDs separate from ungrouped message parts (@​ephraimduncan)

• #6843 24a288e - feat(cloud): claim anonymous threads into a signed-in workspace by exposing the browser's anonymous refresh token and moving its threads into an authenticated Assistant Cloud workspace after sign-in. (@​okisdev)

• #6956 5e42b61 - fix: ignore flat mention items when categories is an empty list (@​ephraimduncan)

• #6993 91689ab - chore: update dependencies (@​Yonom)

• #6911 0d09f05 - Handle prototype-named tool and remote thread keys safely. (@​rupic-app)

• #7014 03fe35b - fix: support WebMCP tool cancellation below AbortSignal.any's browser floor and with a non-native caller signal (@​rupic-app)

• #7036 bb099f6 - refactor: extract the render-element Slot composition into one helper (@​okisdev)

• #6893 b0a03ce - fix: apply tool allowlist changes to mounted MCP app frames (@​ephraimduncan)

• #7159 e7a2ad0 - fix: reset message stall detection after equal-length content changes (@​Kinfe123)

• #6888 34af371 - fix: preserve the requested scroll behavior across nested viewport providers (@​ephraimduncan)

• #6960 4b88b57 - fix: render message part text inside the supplied render element. (@​ephraimduncan)

• #6876 912f5c5 - fix: reject quote selections that cross excluded content (@​ephraimduncan)

• #7186 6a3e11b - fix: finish sandbox teardown after bridge cleanup errors (@​Kinfe123)

• #6931 5febc06 - refactor: adjust state during render where an effect only mirrored a prop (@​okisdev)

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.19

Patch Changes

• #6971 9247ae3 - fix: honor message part text render elements with an explicit component. (@​rupic-app)

• #6738 3c17a5f - fix: prevent queued live completion requests from starting after unmount (@​Kinfe123)

• #7115 4767a92 - feat: align the cloud SDK with Assistant Cloud 0.2 (@​okisdev)

  • run reports now carry provider, outcome_type (aborted, disconnected, length, content_filter), error_code and error, message_id, first_token_ms, duration_ms, a finish_reason per step from useCloudChat and trace_id, plus environment, release and tags from the telemetry config; one createRunReport builder in assistant-cloud assembles the body for the assistant-ui runtime and for @assistant-ui/cloud-ai-sdk, and provider_type and metadata stay on the wire for older self hosted clouds
  • assistant-cloud/telemetry (server side): createAssistantCloudTraceExporter, createAssistantCloudSpanProcessor, assistantCloudTraceMetadata and withAssistantCloudTraceMetadata send AI SDK GenAI spans to POST /v1/traces and hand the trace id to the browser, so a client report and its server spans merge into one run; the OpenTelemetry packages are optional peers of the subpath only
  • engagement events: sends, edits, stops, regenerates, copies, branch switches, suggestions, attachments, thread switches, speech, voice and shown errors are batched to POST /v1/events without any message content; telemetry.events: false opts out
  • cloud.scores.create for custom scores, and message feedback through useCloudChat().feedback next to the assistant-ui FeedbackAdapter
  • cloud.files.generatePresignedDownloadUrl and the object key on upload responses
  • CloudAPIError.code and details, including plan_limit_reached on a 402
  • @assistant-ui/core requires assistant-cloud@^0.2.0, and its store emits the composer, message and thread events the engagement reporter reads

• #6987 b8c5e68 - fix: compare arrays with indexed loops so sparse-array holes cannot read as equal; a sparse suggestions list now compacts to a dense one before it reaches the per-suggestion lookup (@​Kinfe123)

• #6961 98010f1 - fix: notify controlled and uncontrolled modal owners when a run opens a closed modal (@​ephraimduncan)

• #6985 7a82c22 - fix: keep parent IDs separate from ungrouped message parts (@​ephraimduncan)

• #6843 24a288e - feat(cloud): claim anonymous threads into a signed-in workspace by exposing the browser's anonymous refresh token and moving its threads into an authenticated Assistant Cloud workspace after sign-in. (@​okisdev)

• #6956 5e42b61 - fix: ignore flat mention items when categories is an empty list (@​ephraimduncan)

• #6993 91689ab - chore: update dependencies (@​Yonom)

• #6911 0d09f05 - Handle prototype-named tool and remote thread keys safely. (@​rupic-app)

• #7014 03fe35b - fix: support WebMCP tool cancellation below AbortSignal.any's browser floor and with a non-native caller signal (@​rupic-app)

• #7036 bb099f6 - refactor: extract the render-element Slot composition into one helper (@​okisdev)

• #6893 b0a03ce - fix: apply tool allowlist changes to mounted MCP app frames (@​ephraimduncan)

• #7159 e7a2ad0 - fix: reset message stall detection after equal-length content changes (@​Kinfe123)

• #6888 34af371 - fix: preserve the requested scroll behavior across nested viewport providers (@​ephraimduncan)

• #6960 4b88b57 - fix: render message part text inside the supplied render element. (@​ephraimduncan)

• #6876 912f5c5 - fix: reject quote selections that cross excluded content (@​ephraimduncan)

• #7186 6a3e11b - fix: finish sandbox teardown after bridge cleanup errors (@​Kinfe123)

... (truncated)

Commits

• af74661 chore: update versions (#6816)
• 6a3e11b fix(react): finish sandbox teardown after cleanup errors (#7186)
• 3257a47 fix(react): stop disposed MCP App bridge activity (#7177)
• e7a2ad0 fix(react): detect equal-length message activity (#7159)
• 94c3fd5 fix(react): cancel WebMCP tools during async validation (#7121)
• bb099f6 refactor(react): compose render elements through one shared helper (#7036)
• 03fe35b fix(react): merge WebMCP abort signals without AbortSignal.any (#7014)
• 9247ae3 fix(react): honor message text render with component (#6971)
• 91689ab chore: update dependencies (#6993)
• b8c5e68 fix: compare arrays with indexed loops in the remaining comparators (#6987)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 801c90c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Bip Bop - Automated Dependency review of @assistant-ui/react@0.15.19

Note

Model: gpt-5.6-luna
Reviewed commit: 801c90ce59ea
Workflow: View research run

🟢 Verdict: MERGE

Confidence: high

Readiness: waiting for checks

The @assistant-ui/react patch update is technically safe to accept: repository usage is limited to the documented React runtime APIs, and the release primarily contains rendering, cancellation, modal, message-part, and related fixes. CI is still running and the required approval is absent, so the recommendation is technically positive but not mechanically ready.

Key findings

• Update: @assistant-ui/react 0.15.18 → 0.15.19, represented by a lockfile-only change (PR diff).
• Upstream compatibility: 0.15.19 is a patch release. Relevant fixes include honoring explicit message-part render components and preventing queued live-completion requests after unmount (upstream changelog, render fix).
• Direct usage: The repository imports @assistant-ui/react from cookbooks/app-react-ai for useLocalRuntime, AssistantRuntimeProvider, primitives, and message rendering (usage, runtime adapter).
• The upstream release also contains Assistant Cloud 0.2 behavior and optional telemetry functionality, but this repository’s call site uses useLocalRuntime and does not use the cloud runtime. That means those features are not exercised by the current call sites; lack of an explicit opt-out is not treated as proof that upstream defaults are globally inactive.
• No unresolved review threads or prior approval are present (reviews, comments).
• No failed checks are currently reported. Auto-Label PRs passed, CodeQL is neutral, and Code quality, build, unit, Playwright, and research checks remain in progress (check runs).
• The completed checks only validate repository automation and CodeQL status so far; they do not yet provide completed build, unit, or browser integration evidence. Runtime coverage remains limited because the changed cookbook path is not a full Assistant Cloud integration test.

Repository impact

• The dependency is declared as a cookbook devDependency with the existing compatible range ^0.15.0; only the resolved lockfile version changes (manifest).
• Under repository policy, a changeset is not required for this lockfile-only update because no published package manifest changed (Dependabot rules).
• The branch is mergeable but blocked, is current with main (behind_by: 0), and is one commit ahead (PR metadata, compare API).
• Repository rules require squash merging, one approving review, resolved review threads, and successful applicable quality gates (main ruleset).

Merge path

• Let the pending Code quality, Build affected packages, Unit tests, Playwright, and research checks complete successfully.
• Obtain the required approving review and ensure review-thread requirements remain satisfied.
• Squash-merge the PR; no changeset or rebase is required at the current behind_by: 0 freshness.
• Optional hardening: manually exercise the app-react-ai cookbook’s render and abort flows, since CI does not yet provide completed Assistant UI runtime integration evidence.

This workflow can rebase the branch and add required dependency changesets if repository state changes, but a maintainer must still decide whether to merge.

Generated by Fusion AI using the repository dependency-review skill.

[dependabot]

Superseded by #5573.