Release Radar — 2026-11-02
What shipped on PyPI and npm in the last 7 days across 93 tracked packages, with the exact lines of the release notes that say breaking, deprecated, removed, renamed, dropped support or no longer. Quotes are verbatim; the flag is a regular-expression match, not an opinion. Packages with a sandbox-verified fix on Errata (19 packages there) carry a green badge.
- 15releases, last 24 h
- 145releases, last 7 days
- 14with breaking / deprecated wording
- 12in packages with an Errata correction
- 93packages tracked
Last 24 hFlaggedPyPI, 7 daysnpm, 7 daysAll packages
Last 24 h
…amic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as `/` or `=` can no longer change the generated markup. A string that does not start with a valid element name (for example `'!--'` or `''`) now throws an er…
…27cd805bd8103cd873) - Update the observer options before subscribing so revealing an `<Activity>` tree whose query key changed while hidden no longer fetches the previous key.…
- npmtypescript7.1.0-dev.20261102.1pre-release2026-11-02 08:16 UTC · 11 h agoErrata: verified correction
Flagged in the last 7 days
…amic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as `/` or `=` can no longer change the generated markup. A string that does not start with a valid element name (for example `'!--'` or `''`) now throws an er…
…27cd805bd8103cd873) - Update the observer options before subscribing so revealing an `<Activity>` tree whose query key changed while hidden no longer fetches the previous key.…
Affects: `mount()` in `hono/mount` and `app.mount()`. A dynamic prefix such as `/api/:tenant/*` was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded `\` became `/` and `..` collapsed. Both let a crafted request…
1. A provider-specific reasoning setting in `providerOptions` is sent unchanged. OpenAI no longer drops `providerOptions.openai.reasoningEffort` values that are not in its list for the model, and Fireworks no longer rewrites `providerOptions.fireworks.reasoningEffort`. Fireworks…
- 0cc4921: graduate LanguageModelStreamPart to stable and deprecate Experimental_LanguageModelStreamPart
- 077cfb3: feat(ai): Graduate `filterActiveTools` from experimental. It is now exported as `filterActiveTools`; `experimental_filterActiveTools` remains as a deprecated alias.
- pypihuggingface-hub2.4.02026-10-29 15:30 UTC · 4 d agobreaking / deprecated wording Errata: verified correction
`hf extensions update` also repairs Python extensions that no longer start. After a Homebrew upgrade removed the Python an extension was installed with, running it failed with `dyld: Library not loaded`, and `hf extensions update` said it was already up to date. It now recreates…
## Breaking changes * 🚨 Separate EP logic into its own file (#49679) by @3outeille
* Remove deprecation cycle for candidate generators (#50034) by @Cyrilvallez in [#50034]
- pypigoogle-genai2.34.02026-10-29 06:43 UTC · 4 d agobreaking / deprecated wording Errata: verified correction
* Drop support for Python 3.10 ([2677298](https://github.com/googleapis/python-genai/commit/2677298eaa011df6662d6379280441d75a4693aa))
…://github.com/withastro/astro/commit/e4e25fa7d47e702985cbb1ee633d4ffb92f8dad6) Thanks [@umeraamir69](https://github.com/umeraamir69)! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into `script-src` a…
…/astro/commit/d0240b9d5738a97f0b8ad100b76bce8b7527e4cd) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes a `DEP0190` deprecation warning printed by `astro info` on Node.js 24 and later…
…thub.com/sera-wi)! - fix(core): escape `drawMermaid` node metadata labels and leave out object values, so metadata with brackets or objects no longer breaks Mermaid parsing…
## Removals and backward incompatible breaking changes
## Deprecations (removal in next major release) - [\#14742](https://github.com/pytest-dev/pytest/issues/14742): The private `_pytest.python.CallSpec2` name has been renamed to `CallSpec`.
- [\#14742](https://github.com/pytest-dev/pytest/issues/14742): The private `_pytest.python.CallSpec2` name has been renamed to `CallSpec`.
`streamText`, `generateText`, `generateObject` and `streamObject` no longer validate messages against the `ModelMessage` schema. This removes a cost that grew linearly with message history and was paid on every `streamText` step. Type checks on call settings, steering messages, t…
Transcription requests no longer send `response_format=verbose_json` or `timestamp_granularities[]=segment` unless the caller sets them or the model needs them. Previously, any `providerOptions.openai` value (such as a `prompt`) caused `verbose_json` to be sent for models like `g…
## ⚠️ Breaking Changes & Deprecations * **Header Defaults:** Only plain objects, null-prototype maps, and compatible `AxiosHeaders` instances are treated as common or method-specific defaults; literal headers such as `Link` are now preserved. Applications using custom class insta…
…RF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (__[#11166](https://github.com/axios/axios/pull/11166)__, __[#11225](https://gith…
* **Same-Origin Checks:** Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (__[#11174](https://github.com/axios/axios/pull/11174)__)
PyPI — last 7 days (37)
- pypihuggingface-hub2.4.02026-10-29 15:30 UTC · 4 d agobreaking / deprecated wording Errata: verified correction
`hf extensions update` also repairs Python extensions that no longer start. After a Homebrew upgrade removed the Python an extension was installed with, running it failed with `dyld: Library not loaded`, and `hf extensions update` said it was already up to date. It now recreates…
## Breaking changes * 🚨 Separate EP logic into its own file (#49679) by @3outeille
* Remove deprecation cycle for candidate generators (#50034) by @Cyrilvallez in [#50034]
- pypigoogle-genai2.34.02026-10-29 06:43 UTC · 4 d agobreaking / deprecated wording Errata: verified correction
* Drop support for Python 3.10 ([2677298](https://github.com/googleapis/python-genai/commit/2677298eaa011df6662d6379280441d75a4693aa))
## Removals and backward incompatible breaking changes
## Deprecations (removal in next major release) - [\#14742](https://github.com/pytest-dev/pytest/issues/14742): The private `_pytest.python.CallSpec2` name has been renamed to `CallSpec`.
- [\#14742](https://github.com/pytest-dev/pytest/issues/14742): The private `_pytest.python.CallSpec2` name has been renamed to `CallSpec`.
npm — last 7 days (108)
…amic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as `/` or `=` can no longer change the generated markup. A string that does not start with a valid element name (for example `'!--'` or `''`) now throws an er…
…27cd805bd8103cd873) - Update the observer options before subscribing so revealing an `<Activity>` tree whose query key changed while hidden no longer fetches the previous key.…
- npmtypescript7.1.0-dev.20261102.1pre-release2026-11-02 08:16 UTC · 11 h agoErrata: verified correction
- npmtypescript7.1.0-dev.20261101.1pre-release2026-11-01 08:05 UTC · 35 h agoErrata: verified correction
Affects: `mount()` in `hono/mount` and `app.mount()`. A dynamic prefix such as `/api/:tenant/*` was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded `\` became `/` and `..` collapsed. Both let a crafted request…
- npmtypescript7.1.0-dev.20261031.1pre-release2026-10-31 08:26 UTC · 2 d agoErrata: verified correction
- npmtypescript7.1.0-dev.20261030.1pre-release2026-10-30 08:33 UTC · 3 d agoErrata: verified correction
1. A provider-specific reasoning setting in `providerOptions` is sent unchanged. OpenAI no longer drops `providerOptions.openai.reasoningEffort` values that are not in its list for the model, and Fireworks no longer rewrites `providerOptions.fireworks.reasoningEffort`. Fireworks…
- 0cc4921: graduate LanguageModelStreamPart to stable and deprecate Experimental_LanguageModelStreamPart
- 077cfb3: feat(ai): Graduate `filterActiveTools` from experimental. It is now exported as `filterActiveTools`; `experimental_filterActiveTools` remains as a deprecated alias.
- npmtypescript7.1.0-dev.20261029.1pre-release2026-10-29 08:22 UTC · 4 d agoErrata: verified correction
…://github.com/withastro/astro/commit/e4e25fa7d47e702985cbb1ee633d4ffb92f8dad6) Thanks [@umeraamir69](https://github.com/umeraamir69)! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into `script-src` a…
…/astro/commit/d0240b9d5738a97f0b8ad100b76bce8b7527e4cd) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes a `DEP0190` deprecation warning printed by `astro info` on Node.js 24 and later…
- npmtypescript7.1.0-dev.20261028.1pre-release2026-10-28 08:12 UTC · 5 d agoErrata: verified correction
…thub.com/sera-wi)! - fix(core): escape `drawMermaid` node metadata labels and leave out object values, so metadata with brackets or objects no longer breaks Mermaid parsing…
`streamText`, `generateText`, `generateObject` and `streamObject` no longer validate messages against the `ModelMessage` schema. This removes a cost that grew linearly with message history and was paid on every `streamText` step. Type checks on call settings, steering messages, t…
Transcription requests no longer send `response_format=verbose_json` or `timestamp_granularities[]=segment` unless the caller sets them or the model needs them. Previously, any `providerOptions.openai` value (such as a `prompt`) caused `verbose_json` to be sent for models like `g…
- npmtypescript7.1.0-dev.20261027.1pre-release2026-10-27 08:36 UTC · 6 d agoErrata: verified correction
## ⚠️ Breaking Changes & Deprecations * **Header Defaults:** Only plain objects, null-prototype maps, and compatible `AxiosHeaders` instances are treated as common or method-specific defaults; literal headers such as `Link` are now preserved. Applications using custom class insta…
…RF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (__[#11166](https://github.com/axios/axios/pull/11166)__, __[#11225](https://gith…
* **Same-Origin Checks:** Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (__[#11174](https://github.com/axios/axios/pull/11174)__)
All tracked packages (93)
| eco | package | latest | releases / 7 d | newest release | Errata |
|---|---|---|---|---|---|
| npm | @ai-sdk/openai | 4.0.106 | 9 | 2026-10-30 19:33 UTC | |
| npm | @anthropic-ai/sdk | 1.3.0 | 0 | — | |
| npm | @google/genai | 2.32.0 | 1 | 2026-10-29 06:40 UTC | |
| npm | @langchain/core | 1.3.2 | 2 | 2026-10-29 17:55 UTC | |
| npm | @modelcontextprotocol/sdk | 1.32.2 | 0 | — | |
| npm | @prisma/client | 7.10.1 | 0 | — | |
| npm | @supabase/supabase-js | 2.118.0 | 2 | 2026-10-28 13:29 UTC | |
| npm | @tanstack/react-query | 5.105.2 | 2 | 2026-11-02 13:57 UTC | |
| npm | ai | 7.0.159 | 10 | 2026-10-30 22:18 UTC | |
| npm | astro | 7.4.5 | 4 | 2026-11-02 14:26 UTC | |
| npm | axios | 1.21.0 | 1 | 2026-10-27 07:18 UTC | |
| npm | commander | 15.0.0 | 0 | — | |
| npm | dotenv | 18.0.9 | 0 | — | |
| npm | drizzle-orm | 0.45.4 | 0 | — | |
| npm | esbuild | 0.28.2 | 0 | — | |
| npm | eslint | 10.14.0 | 1 | 2026-10-30 14:12 UTC | |
| npm | express | 5.3.0 | 0 | — | |
| npm | fastify | 5.12.8 | 2 | 2026-11-02 10:46 UTC | |
| npm | firebase | 13.1.0 | 1 | 2026-10-30 16:25 UTC | Errata ×2 |
| npm | hono | 4.13.16 | 2 | 2026-11-01 03:04 UTC | |
| npm | ioredis | 6.0.0 | 0 | — | |
| npm | jest | 30.5.2 | 0 | — | |
| npm | langchain | 1.6.0 | 2 | 2026-10-28 00:55 UTC | |
| npm | mongoose | 9.11.4 | 0 | — | |
| npm | next | 16.4.4 | 10 | 2026-11-02 10:49 UTC | |
| npm | nuxt | 4.6.3 | 1 | 2026-10-27 01:08 UTC | |
| npm | openai | 7.47.0 | 3 | 2026-10-31 05:06 UTC | |
| npm | pg | 8.23.1 | 0 | — | |
| npm | playwright | 1.64.1 | 9 | 2026-11-02 05:18 UTC | |
| npm | prettier | 3.9.10 | 0 | — | |
| npm | prisma | 8.0.0-rc.29 | 12 | 2026-10-31 06:31 UTC | |
| npm | puppeteer | 25.16.0 | 0 | — | |
| npm | react | 19.3.1 | 8 | 2026-10-31 09:15 UTC | |
| npm | react-dom | 19.3.1 | 8 | 2026-10-31 09:18 UTC | |
| npm | react-router | 8.5.1 | 2 | 2026-10-27 21:39 UTC | |
| npm | stripe | 23.1.0 | 3 | 2026-10-30 18:14 UTC | |
| npm | svelte | 5.57.3 | 0 | — | |
| npm | tailwindcss | 4.3.3 | 4 | 2026-11-02 12:11 UTC | |
| npm | typescript | 7.0.2 | 7 | 2026-11-02 08:16 UTC | Errata ×1 |
| npm | vite | 8.3.5 | 0 | — | |
| npm | vitest | 5.1.0 | 1 | 2026-11-02 16:12 UTC | |
| npm | vue | 3.5.44 | 1 | 2026-10-30 08:02 UTC | |
| npm | zod | 4.6.7 | 0 | — | |
| npm | zustand | 5.0.16 | 0 | — | |
| pypi | aiohttp | 3.14.5 | 0 | — | |
| pypi | alembic | 1.20.1 | 0 | — | |
| pypi | anthropic | 2.3.0 | 0 | — | |
| pypi | black | 26.10.1 | 0 | — | |
| pypi | boto3 | 1.43.123 | 4 | 2026-10-30 19:18 UTC | |
| pypi | celery | 5.6.3 | 0 | — | |
| pypi | click | 8.5.0 | 0 | — | Errata ×1 |
| pypi | cryptography | 50.0.2 | 0 | — | Errata ×1 |
| pypi | django | 6.1.2 | 0 | — | |
| pypi | fastapi | 0.162.0 | 0 | — | |
| pypi | flask | 3.1.3 | 0 | — | |
| pypi | google-genai | 2.34.0 | 1 | 2026-10-29 06:43 UTC | Errata ×1 |
| pypi | httpx | 0.28.1 | 0 | — | |
| pypi | huggingface-hub | 2.4.0 | 2 | 2026-10-29 15:30 UTC | Errata ×1 |
| pypi | instructor | 1.17.0 | 0 | — | |
| pypi | jinja2 | 3.1.6 | 0 | — | |
| pypi | langchain | 1.4.8 | 1 | 2026-11-02 15:44 UTC | |
| pypi | langchain-core | 1.7.4 | 4 | 2026-11-02 15:31 UTC | |
| pypi | langgraph | 1.2.19 | 2 | 2026-10-30 22:23 UTC | |
| pypi | litellm | 1.106.6 | 9 | 2026-10-30 03:47 UTC | |
| pypi | llama-index | 0.14.25 | 0 | — | |
| pypi | mcp | 2.3.0 | 0 | — | Errata ×3 |
| pypi | mypy | 2.4.1 | 1 | 2026-10-28 19:21 UTC | |
| pypi | numpy | 2.5.4 | 0 | — | |
| pypi | openai | 3.42.1 | 4 | 2026-11-01 20:57 UTC | |
| pypi | openai-agents | 0.24.0 | 0 | — | |
| pypi | orjson | 3.13.0 | 0 | — | |
| pypi | pandas | 3.1.0 | 0 | — | |
| pypi | pillow | 13.0.0 | 0 | — | |
| pypi | playwright | 1.64.1 | 0 | — | |
| pypi | polars | 2.1.0 | 0 | — | |
| pypi | pydantic | 2.14.2 | 2 | 2026-10-29 16:37 UTC | |
| pypi | pydantic-settings | 2.16.2 | 1 | 2026-10-28 11:14 UTC | |
| pypi | pyjwt | 2.15.1 | 0 | — | |
| pypi | pytest | 9.2.0 | 1 | 2026-10-27 21:30 UTC | |
| pypi | pyyaml | 6.0.3 | 0 | — | |
| pypi | redis | 8.1.0 | 0 | — | |
| pypi | requests | 2.34.2 | 0 | — | |
| pypi | rich | 15.0.0 | 0 | — | |
| pypi | ruff | 0.17.3 | 1 | 2026-10-27 00:33 UTC | |
| pypi | scipy | 1.18.1 | 0 | — | Errata ×2 |
| pypi | sqlalchemy | 2.1.6 | 0 | — | |
| pypi | starlette | 1.10.0 | 0 | — | |
| pypi | structlog | 26.1.0 | 0 | — | |
| pypi | tiktoken | 0.14.0 | 0 | — | |
| pypi | transformers | 5.22.1 | 3 | 2026-10-30 07:47 UTC | |
| pypi | typer | 0.27.3 | 0 | — | |
| pypi | uvicorn | 0.54.0 | 0 | — | |
| pypi | websockets | 17.4 | 1 | 2026-10-30 15:06 UTC | Errata ×1 |
For machines
/today.json — this page as data · /feed.xml — RSS · /pkg/<eco>/<name>/index.json — per package · /llms.txt · /build.json. Want a package added? It is one line in config/packages.txt of the public repository.