chore(deps): bump the mastra group across 1 directory with 3 updates

[dependabot]

Bumps the mastra group with 3 updates in the / directory: @mastra/ai-sdk, @mastra/core and @mastra/memory.

Updates @mastra/ai-sdk from 1.4.1 to 1.4.2

Release notes

Sourced from @​mastra/ai-sdk's releases.

December 9, 2025

Changelog

Summary

• Total packages with changes: 12
• Packages with major changes: 0
• Packages with minor changes: 0
• Packages with patch changes: 4

---

@​mastra/agent-builder@​0.2.6-alpha.1

Patch Changes

• Fix install step validation error by making targetPath optional in InstallInputSchema. This resolves the "expected string, received undefined" error when running the agent builder template workflow without explicitly providing a targetPath parameter. (#10923)

Dependency Updates

• @​mastra/core@​0.24.7-alpha.3

---

@​mastra/ai-sdk@​0.3.3-alpha.0

Patch Changes

• Return NetworkDataPart on each agent-execution-event and workflow-execution-event in network streams (#10979)

• Fixed tool-call-suspended chunks being dropped in workflow-step-output when using AI SDK. Previously, when an agent inside a workflow step called a tool that got suspended, the tool-call-suspended chunk was not received on the frontend even though tool-input-available chunks were correctly received. (#10988)

  The issue occurred because tool-call-suspended was not included in the isMastraTextStreamChunk list, causing it to be filtered out in transformWorkflow. Now tool-call-suspended, tool-call-approval, object, and tripwire chunks are properly included in the text stream chunk list and will be transformed and passed through correctly.

  Fixes #10978

Dependency Updates

• @​mastra/core@​0.24.7-alpha.3

---

@​mastra/client-js@​0.17.0-alpha.3

Dependency Updates

• @​mastra/core@​0.24.7-alpha.3

---

... (truncated)

Changelog

Sourced from @​mastra/ai-sdk's changelog.

1.4.2

Patch Changes

• Fixed cache write tokens not being set on the AI SDK v6 usage object. inputTokenDetails.cacheWriteTokens now reflects the prompt cache creation tokens reported by the provider instead of always being undefined. Previously this value was only accessible via providerMetadata.anthropic.cacheCreationInputTokens. (#16354)

• Added support for showing different tool values to users than the values used internally during execution. AI SDK streams now read Mastra display values for tool call input, streamed input deltas, tool results, tool errors, approvals, and suspensions. (#16103)

  const lookupCustomer = createTool({
    // Runtime still receives the full input and returns the full output.
    execute: async ({ customerId, internalPath }) => lookupCustomerRecord(customerId, internalPath),
    transform: {
      display: {
        input: ({ input }) => ({ customerId: input?.customerId }),
        output: ({ output }) => ({ displayName: output?.displayName }),
        error: () => ({ message: 'Customer lookup failed' }),
      },
    },
  });

  This lets chat UIs show safe display values while runtime code keeps the original payloads. See mastra-ai/mastra#16054.

• Updated dependencies [9f17410, 7ad5585, ac47842, cc189cc, d1fdbd0, 210ea7a, 7c275a8, bae019e, 890b24c, f984b4d, 6742347, b59316f, 0f48ebf, 37c0dc5, 087e413, 83218c8, ef6b584, c6eb39e, 7b0ad1f, d91ebe2, 62666c3, 33f5061, 4af2160, 087e413, 265ec9f, ce01024, 6ce80bf, f984b4d, 136c959, 9268531, 13ead79, dccd8f1, 4df7cc7, f180e49, 9260e01, 2f6c54e, aca3121, e06a159, 4dd900d, b560d6f, 99869ec, 900d086, 4c0e286, 55f1e2d, 4ff5bdf, 9cdf38e, 087e413, db34bc6, 990851e, bbcd93c, 8373ff4, d48a705, 308bd07, 6068a6c, 36b3bbf, d86f031, b275631, 00106be, bd36d8e, 11c1528, 4999667, e2a079c, 8ac9141, 25184ff, 534a456, 105e454, aebde9c, 36bae07, 5688881]:

  • @​mastra/core@​1.33.0

1.4.2-alpha.1

Patch Changes

• Added support for showing different tool values to users than the values used internally during execution. AI SDK streams now read Mastra display values for tool call input, streamed input deltas, tool results, tool errors, approvals, and suspensions. (#16103)

  const lookupCustomer = createTool({
    // Runtime still receives the full input and returns the full output.
    execute: async ({ customerId, internalPath }) => lookupCustomerRecord(customerId, internalPath),
    transform: {
      display: {
        input: ({ input }) => ({ customerId: input?.customerId }),
        output: ({ output }) => ({ displayName: output?.displayName }),
        error: () => ({ message: 'Customer lookup failed' }),
      },
    },
  });

  This lets chat UIs show safe display values while runtime code keeps the original payloads. See mastra-ai/mastra#16054.

• Updated dependencies [7c275a8, 890b24c, 0f48ebf, f180e49, 9260e01, 2f6c54e, e06a159, db34bc6]:

... (truncated)

Commits

• 10e5b2d chore: version - exit prerelease mode
• 038966c chore: version packages
• 6219299 chore: version packages
• 0f48ebf feat(core): add tool payload projections (#16103)
• ccaa8fa Fix cache write tokens not being set in AI SDK v6 usage (#16354)
• 9f17410 chore(deps): update ai sdk (#16126)
• See full diff in compare view

Updates @mastra/core from 1.26.0 to 1.35.0

Release notes

Sourced from @​mastra/core's releases.

May 15, 2026

Highlights

FGA Route Policy Coverage + Resolver Hooks (Core/Server/WorkOS)

New FGA route policy coverage controls add guardrails for protected routes, with built-in resource route metadata resolution and resolver hooks so you can centrally map route → {resourceType, resourceId, permission} while still overriding per-route config.

Favorites Storage Domain for Agents/Skills (Core + Storage Adapters)

A new favorites storage domain lets users favorite/unfavorite stored agents and skills, and adds visibility (private|public) and favoriteCount fields so listings can be filtered and ordered by favorite state (e.g., pinFavoritedFor, favoritedOnly).

Favorites Support Across Major Storage Backends

Favorites is implemented across multiple adapters (@​mastra/pg, @​mastra/libsql, @​mastra/mongodb, @​mastra/clickhouse, @​mastra/cloudflare), enabling consistent favoriting/visibility queries regardless of your chosen persistence layer.

Observational Memory: Accurate Token Estimation for Large File Parts

@mastra/memory improves local token estimation for non-image file parts (notably large PDFs), preventing observational memory from missing thresholds and replaying excessive history when provider token-count endpoints aren’t available.

Reliability Fixes for Workspaces, Workflows, and Route Matching

Multiple fixes improve correctness: workspace PATCH no longer overwrites stored values with undefined, scheduled workflows created via @mastra/core/workflows apply schedules correctly, NestJS adapter prefix matching is stricter, and a circular ESM import crash in @mastra/core/workflows/workflow is resolved.

Breaking Changes

• None called out in this changelog.

Changelog

@​mastra/core@1.35.0

Minor Changes

• Added FGA route policy coverage controls, built-in resource route metadata resolution, and resolver hooks. (#16485)

  For example:

  import { MastraFGAWorkos } from '@mastra/auth-workos';
  import type { FGARouteConfig, FGARouteResolver, IFGAProvider } from '@mastra/core/auth/ee';
  import { createRoute } from '@mastra/server/server-adapter';
  const routeFGA = {
  'GET /billing/:accountId': {
  resourceType: 'account',
  resourceIdParam: 'accountId',
  permission: 'billing:read',
  },
  } satisfies Record<string, FGARouteConfig>;
  const resolveRouteFGA: FGARouteResolver = ({ route }) => routeFGA[${route.method} ${route.path}];
  const fga: IFGAProvider = new MastraFGAWorkos({
  apiKey: process.env.WORKOS_API_KEY!,
  clientId: process.env.WORKOS_CLIENT_ID!,
  requireForProtectedRoutes: true,
  auditProtectedRoutes: 'warn',

... (truncated)

Commits

• 7449a3e chore: version - exit prerelease mode
• bbbf6d0 chore: version packages (alpha) (#16657)
• 75c7c38 fix(core): break workflows barrel cycle in signal-drain-step (#16661)
• 271c044 fix(core): preserve active signal transcript order (#16623)
• fd5fbb4 chore: version packages (alpha) (#16624)
• 3a8a6b2 chore: regenerate providers and docs [skip ci]
• 816b974 feat(storage): favorites + visibility storage foundation (#16580)
• b32ba5f fix(core,nestjs): restore scheduled workflow and prefix handling (#16637)
• 7bc78d9 chore: version packages
• bad08e9 Add FGA route policy coverage controls (#16485)
• Additional commits viewable in compare view

Updates @mastra/memory from 1.16.0 to 1.18.2

Changelog

Sourced from @​mastra/memory's changelog.

1.18.2

Patch Changes

• Fixed thread deletion so it also clears thread-scoped observational memory. (#16628)

• Fixed Observational Memory missing the observation threshold for messages with large file parts. Previously TokenCounter's local/sync counting path only stringified the file descriptor (type, mimeType, filename) for non-image files, so a 100KB PDF looked like ~8 tokens to OM and the conversation kept replaying the full unobserved history past every reasonable threshold. (#16562)

  TokenCounter now estimates non-image file part tokens locally from the attachment's byte size and mime type using a per-provider heuristic, mirroring the existing local image-token estimator:

  • Anthropic PDFs ≈ bytes / 3 (floor 1500)
  • Google PDFs ≈ bytes / 20 (floor 258)
  • OpenAI / unknown PDFs ≈ bytes / 4 (floor 500)
  • Text-ish mime types (text/*, JSON, XML, YAML) ≈ bytes / 4
  • Other binary ≈ bytes / 4

  URL-only file parts (no body to size) keep the previous descriptor-only local estimate. countMessagesAsync() continues to prefer provider token-count endpoints for supported providers; this change only improves the local fallback used when no provider endpoint is available.

  // Before: this PDF counted as ~8 tokens locally regardless of size, so OM never triggered.
  const part = {
    type: 'file',
    data: largePdfBase64,
    mimeType: 'application/pdf',
    filename: 'report.pdf',
  };
  // counter.countMessage(message) ≈ 8
  // After: estimated locally from byte size on the active provider.
  // counter.countMessage(message) ≈ tens of thousands of tokens
  //   → OM threshold trips as expected.

  The internal token-estimate cache version was bumped, which invalidates persisted estimates from older @mastra/memory releases on the next read; entries are recomputed automatically.

  Fixes mastra-ai/mastra#16522

• Updated dependencies [b661349, 816b974, 271c044, bad08e9, 816b974, b32ba5f, 75c7c38]:

  • @​mastra/core@​1.35.0

1.18.2-alpha.1

Patch Changes

• Fixed thread deletion so it also clears thread-scoped observational memory. (#16628)

• Updated dependencies [816b974, 816b974, b32ba5f]:

  • @​mastra/core@​1.35.0-alpha.2

1.18.2-alpha.0

... (truncated)

Commits

• 7449a3e chore: version - exit prerelease mode
• fd5fbb4 chore: version packages (alpha) (#16624)
• d332faf fix memory test (#16575)
• 1be0793 fix(memory): clear observational memory on thread deletion (#16628)
• 7bc78d9 chore: version packages
• 3d42730 fix(memory): estimate local non-image file token counts from byte size (#16562)
• b55b38e chore: version - exit prerelease mode
• 75141fc chore: version packages
• 97fe629 feat(memory): honor caller-supplied tokenEstimate on file parts (#16565)
• 10e5b2d chore: version - exit prerelease mode
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
omerakben-com	Ready	Preview, Comment	May 18, 2026 10:02pm