From c470bc2d3c4c1eeab91d221abb57a2a483685f09 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 2 Aug 2026 16:22:46 +0000 Subject: [PATCH 1/2] chore(deps): bump @google/genai in the all-minor-patch group Bumps the all-minor-patch group with 1 update: [@google/genai](https://github.com/googleapis/js-genai). Updates `@google/genai` from 2.13.0 to 2.15.0 - [Release notes](https://github.com/googleapis/js-genai/releases) - [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md) - [Commits](https://github.com/googleapis/js-genai/compare/v2.13.0...v2.15.0) --- updated-dependencies: - dependency-name: "@google/genai" dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-minor-patch ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index d7defe9..0af7928 100644 --- a/package-lock.json +++ b/package-lock.json @@ -21,9 +21,9 @@ } }, "node_modules/@google/genai": { - "version": "2.13.0", - "resolved": "https://registry.npmjs.org/@google/genai/-/genai-2.13.0.tgz", - "integrity": "sha512-GM7C8Kaomvjz05x5JEO6+l3d/pciL9LxAG9dUjJLD7nTPZ9X0Cfsf2Z7eET6UjgWyUmxXCHtYnQoQ77F9+ZIOQ==", + "version": "2.15.0", + "resolved": "https://registry.npmjs.org/@google/genai/-/genai-2.15.0.tgz", + "integrity": "sha512-Q41TvqwBQ9NcmWdh6qxY5qrpg+0FaVHD7febQoH007pykxzco4ohScBUP4BBBy+Q8j5D8euIBSRIBDfWuNVCKA==", "hasInstallScript": true, "license": "Apache-2.0", "dependencies": { From 7f45b3efb1f6ac3e73443c25836e26455096f6f7 Mon Sep 17 00:00:00 2001 From: Booyaka101 Date: Thu, 6 Aug 2026 23:35:33 +0800 Subject: [PATCH 2/2] chore(deps): re-pin allowScripts to @google/genai 2.15.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The allowlist is version-pinned on purpose, so every dependency bump moves the key out from under it and `sync --check` fails — that is the gate working, not a false positive. Re-pinned with `sync --write`: no new capabilities, decision preserved (true). `manifest --check` still clean; script-lens.json unchanged because @google/genai's preinstall has no install-time behavior to record. Co-Authored-By: Claude Opus 5 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 8ce44e7..d7dc24f 100644 --- a/package.json +++ b/package.json @@ -50,7 +50,7 @@ "commander": "^15.0.0" }, "allowScripts": { - "@google/genai@2.13.0": true, + "@google/genai@2.15.0": true, "better-sqlite3@12.11.1": true, "protobufjs@7.6.5": true }