chore(deps)(deps): bump @assistant-ui/react from 0.14.5 to 0.14.16 in /web

[dependabot]

Bumps @assistant-ui/react from 0.14.5 to 0.14.16.

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.14.16

Patch Changes

• Updated dependencies:
  • @​assistant-ui/core@​0.2.12
  • @​assistant-ui/tap@​0.6.1

@​assistant-ui/react-langgraph@​0.14.7

Patch Changes

• #4246 dbdfb15 - feat: message queuing for external-store, langgraph, and local runtimes (@​okisdev)

  the composer can now stay usable while a run is in progress: a message sent during a run is held in composer.queue (rendered via ComposerPrimitive.Queue / QueueItemPrimitive.*) and processed once the run settles. external-store adapters opt in by providing a queue adapter (typically built with the new createMessageQueue helper); useLangGraphRuntime and useLocalRuntime opt in via unstable_enableMessageQueue. ExternalThreadQueueAdapter now lives in @assistant-ui/core (still re-exported from @assistant-ui/react).

• #4306 15878d8 - chore: update dependencies (@​Yonom)

• #4250 307a5fe - fix: batch parallel tool results so a turn with multiple tool calls resumes in a single run (@​Yonom)

• #4259 a3f6df8 - fix: preserve LangChain reasoning content when summary is absent (@​puneetdixit200)

• Updated dependencies [2a84174, a0a0769, 19c5b5f, dbdfb15, ca191dc, 15878d8, 44ff4bf, 01cf957, 26a365b]:

  • @​assistant-ui/core@​0.2.11
  • assistant-stream@0.3.21
  • assistant-cloud@0.1.32
  • @​assistant-ui/store@​0.2.14

@​assistant-ui/react@​0.14.15

Patch Changes

• #4260 19c5b5f - fix: make defineToolkit usable for plain runtime toolkits (@​Yonom)

• #4246 dbdfb15 - feat: message queuing for external-store, langgraph, and local runtimes (@​okisdev)

  the composer can now stay usable while a run is in progress: a message sent during a run is held in composer.queue (rendered via ComposerPrimitive.Queue / QueueItemPrimitive.*) and processed once the run settles. external-store adapters opt in by providing a queue adapter (typically built with the new createMessageQueue helper); useLangGraphRuntime and useLocalRuntime opt in via unstable_enableMessageQueue. ExternalThreadQueueAdapter now lives in @assistant-ui/core (still re-exported from @assistant-ui/react).

• #4249 ca191dc - feat: add externalTool for render-only generative toolkit entries (@​Yonom)

• #4306 15878d8 - chore: update dependencies (@​Yonom)

• #4280 e7f1aa0 - fix(mcp-apps): send the 2026-01-26 dialect on host→app messages so widgets built with @modelcontextprotocol/ext-apps initialize and receive tool results (@​okisdev)

  the bridge already normalized inbound ui/* method names, but every outbound message (the ui/initialize result and the tool input/result/host context notifications) stayed in the pre-spec dialect. spec widgets zod-validate the initialize result and require hostInfo + hostCapabilities, so they failed init; tool results were posted as notifications/tools/call/result, a method the official SDK never listens for, so a patched widget still rendered empty. the bridge now additively dual-sends both dialects (the initialize result carries host/capabilities and hostInfo/hostCapabilities, echoes the app's requested protocolVersion, and each notification posts its ui/notifications/* counterpart with the spec param shapes). unknown methods and fields are ignored by either SDK, so legacy widgets are unaffected.

• #4256 44ff4bf - feat: rename hitlTool to humanTool while keeping deprecated compatibility aliases (@​Yonom)

• #4298 72494e7 - refactor: extract a shared sandbox host (SafeContentFrame lifecycle, the single cross-origin guarded message listener, auto-resize) and reuse it for the MCP app frame, with no behavior change (@​okisdev)

• Updated dependencies [2a84174, a0a0769, 19c5b5f, dbdfb15, ca191dc, 15878d8, 44ff4bf, 01cf957, 01cf957, 26a365b]:

  • @​assistant-ui/core@​0.2.11
  • assistant-stream@0.3.21

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.14.16

Patch Changes

• Updated dependencies:
  • @​assistant-ui/core@​0.2.12
  • @​assistant-ui/tap@​0.6.1

0.14.15

Patch Changes

• #4260 19c5b5f - fix: make defineToolkit usable for plain runtime toolkits (@​Yonom)

• #4246 dbdfb15 - feat: message queuing for external-store, langgraph, and local runtimes (@​okisdev)

  the composer can now stay usable while a run is in progress: a message sent during a run is held in composer.queue (rendered via ComposerPrimitive.Queue / QueueItemPrimitive.*) and processed once the run settles. external-store adapters opt in by providing a queue adapter (typically built with the new createMessageQueue helper); useLangGraphRuntime and useLocalRuntime opt in via unstable_enableMessageQueue. ExternalThreadQueueAdapter now lives in @assistant-ui/core (still re-exported from @assistant-ui/react).

• #4249 ca191dc - feat: add externalTool for render-only generative toolkit entries (@​Yonom)

• #4306 15878d8 - chore: update dependencies (@​Yonom)

• #4280 e7f1aa0 - fix(mcp-apps): send the 2026-01-26 dialect on host→app messages so widgets built with @modelcontextprotocol/ext-apps initialize and receive tool results (@​okisdev)

  the bridge already normalized inbound ui/* method names, but every outbound message (the ui/initialize result and the tool input/result/host context notifications) stayed in the pre-spec dialect. spec widgets zod-validate the initialize result and require hostInfo + hostCapabilities, so they failed init; tool results were posted as notifications/tools/call/result, a method the official SDK never listens for, so a patched widget still rendered empty. the bridge now additively dual-sends both dialects (the initialize result carries host/capabilities and hostInfo/hostCapabilities, echoes the app's requested protocolVersion, and each notification posts its ui/notifications/* counterpart with the spec param shapes). unknown methods and fields are ignored by either SDK, so legacy widgets are unaffected.

• #4256 44ff4bf - feat: rename hitlTool to humanTool while keeping deprecated compatibility aliases (@​Yonom)

• #4298 72494e7 - refactor: extract a shared sandbox host (SafeContentFrame lifecycle, the single cross-origin guarded message listener, auto-resize) and reuse it for the MCP app frame, with no behavior change (@​okisdev)

• Updated dependencies [2a84174, a0a0769, 19c5b5f, dbdfb15, ca191dc, 15878d8, 44ff4bf, 01cf957, 01cf957, 26a365b]:

  • @​assistant-ui/core@​0.2.11
  • assistant-stream@0.3.21
  • assistant-cloud@0.1.32
  • safe-content-frame@0.0.21
  • @​assistant-ui/store@​0.2.14
  • @​assistant-ui/tap@​0.6.0

0.14.14

Patch Changes

• #4212 5fe118d - feat: add MCP server support to generative toolkits (@​Yonom)

• #4213 dcd5897 - feat: add provider-executed tool support to generative toolkits (@​Yonom)

• #4127 606c9d4 - feat(assistant-transport): honour Aui-Replay-Content-Length to split sync-server replay from live bytes (@​Yonom)

  useAssistantTransportRuntime now reads the Aui-Replay-Content-Length response header on resume and gates the body at that byte boundary. The replay prefix is decoded while isLoading: true has rendered through React, then the reader pauses until isLoading: false has rendered before releasing live bytes. Tool calls in the replayed portion are recorded as historical and skip streamCall / execute, while tool calls that begin after the replay boundary fire normally. Responses without the header behave as today.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: lightconsen. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Superseded by #75.