chore(deps): update dependency promptfoo to v0.121.14

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
promptfoo (source)	0.121.12 → 0.121.14

---

Release Notes

promptfoo/promptfoo (promptfoo)

v0.121.14

Compare Source

Features

• add A2A provider (#​9586) (963b264)
• assertions: add agent-rubric grader (#​9453) (cadb3c5)
• build: publish a lightweight promptfoo/contracts subpath (#​9535) (6e89fd4)
• cli: add seeded random sampling (#​9522) (6e4ba60)
• eval: extract eval-creator readiness and validation modules (#​9397) (d3af118)
• eval: surface trace linkage on result rows (#​9027) (9468d66)
• providers: add OpenAI GPT-5.5/5.4 frontier models + Codex on Amazon Bedrock (#​9587) (1e35267)
• providers: add OpenAI originator header (#​9474) (6141070)
• providers: expose traceable agent turn markers (#​9475) (4018837)
• providers: promote Fireworks AI from registry stub to dedicated provider (#​9542) (2bae148)
• tracing: add runtime receiver controls (#​9028) (90df6a1)

Bug Fixes

• assertions: don't classify gen_ai.tool.definitions chat spans as tool calls (#​9524) (b59f397)
• cli: preflight force imports before collision lookup (#​9570) (0b93733)
• cloud: on-prem API host for guardrails and http-generator, with host-resolution tests (#​9580) (b9a014a)
• cloud: use on-prem API host in checkEmailStatus (#​9576) (063c62b)
• db: avoid SQLITE_LOCKED flakiness in shared-cache test database (#​9567) (1fdb59b)
• db: serialize libsql test database cleanup (#​9540) (f4380c2)
• deps: keep ModelAudit pydantic-core pinned to compatible 2.46.4 (b2b35b0)
• deps: update dependency ai to ^6.0.190 (#​9577) (9ec614a)
• eval: canonicalize retry JSONL output with atomic rewrites (#​9547) (8d7c920)
• eval: redact credentials from the persisted browser store (#​9396) (4d5bed5)
• evaluator: preserve and harden programmatic JSONL output (#​9538) (8ddd906)
• output: redact api-key and legacy transport headers in JSONL/DB (#​9546) (e194c85)
• providers: handle Codex SDK rate limits (#​9473) (76d3db4)
• providers: inject n8n sessions into custom bodies (#​9527) (9cc0542)
• providers: preserve n8n array body templates (#​9544) (6cdf63d)
• providers: preserve streamed Anthropic refusal guardrails (#​9560) (ff8eafd)
• providers: serialize persistent browser sessions (#​9414) (097ff9b)
• redteam: authenticate remote-generation requests against on-prem cloud (#​9584) (7df8fae)
• util: restore nested SAS tokens after array reorder (#​9528) (9759e5a)
• webui: render negative-only metric charts (#​9526) (7ccafa4)

v0.121.13

Compare Source

Features

• add MiniMax provider (#​8207) (ebd78f6)
• anthropic: add support for Claude Opus 4.8 (#​9500) (e090730)
• assertions: add ignore option to trajectory:tool-args-match (#​9466) (6423f2a)
• assertions: add metadata shortcut to assertion context (#​6863) (5264680)
• assertions: support glob patterns in trajectory:tool-args-match ignore (#​9484) (18b3eef)
• assertions: tolerate optional defaults in trajectory:tool-args-match (#​9471) (a74894a)
• cli: add prompt optimization (#​9294) (27d6dbe)
• cli: warn on deprecated Node.js 20 runtime (#​9494) (8de3408)
• eval: add eval runtime vars (#​9331) (3c76045)
• eval: add output detail deep links (#​9170) (1f5845b)
• eval: load test sets from azure blob storage (#​9282) (b5ea8ab)
• google: add Gemini 3.5 Flash and refresh Google/Vertex models (#​9376) (6c81c8d)
• output: add html report detail drawer (#​9291) (8c54598)
• output: add named metric columns to CSV exports (#​9480) (4531750)
• providers: add MLflow AI Gateway provider (#​8860) (d0e7e2d)
• providers: add n8n webhook provider (#​6770) (3dc6e32)
• providers: add Novita provider (#​8190) (42930e8)
• providers: add NVIDIA NIM provider (#​9491) (fa3e4a9)
• providers: add OrcaRouter provider (#​9493) (fe115ab)
• redteam: add runtime tags to redteam run (#​9499) (72d4cb4)

Bug Fixes

• app: clarify metric pill filtering (#​9252) (05e5a30)
• app: reorder eval output actions (#​9261) (91dc814)
• cache: make the fetch cache key stable across processes (#​9509) (7be3ef5)
• ci: avoid shell interpolation in telemetry check (#​9280) (4160a90)
• ci: disable deploy dependency cache (#​9281) (f3a2502)
• ci: pin code-scan Node to 24.15.0 to stop install timeout (#​9374) (e200bb5)
• ci: scope code-scan-action mirror sync to release artifacts (#​9363) (76c3a29)
• classify script stderr by severity (#​9459) (1eeef19)
• cli: validate optimization split input (#​9514) (e7e29d1)
• code-scan: emit structured fork PR skip output (#​9426) (61c624c)
• code-scan: honor minimum-severity alias when min-severity is unset (#​9433) (ea5ea9e)
• code-scan: suppress SARIF on skipped fork scans (#​9451) (8236e65)
• config: dedupe repeated executable providers (#​9430) (6325653)
• config: preserve all function providers in combineConfigs (#​9408) (ed4e29e)
• db: isolate libsql test databases (#​9504) (b01b257)
• db: parameterize JSON path filters (#​9345) (dc5e2ed)
• db: replace better-sqlite3 with libsql (#​9486) (ca3dea4)
• db: restore SQLite busy_timeout for the libsql driver (#​9508) (a74b2fe)
• deps: avoid Socket-blocked package releases (#​9456) (89d6e61)
• deps: bump brace-expansion and webpack-dev-server [security] (#​9339) (bb1d57e)
• deps: lazy-load optional integration packages (#​9284) (db37941)
• deps: patch qs denial of service advisory (#​9384) (b392051)
• deps: update anthropic packages (#​9461) (87277b9)
• deps: update dependency engine.io to v6.6.7 (#​9457) (5f36395)
• deps: update dependency engine.io to v6.6.8 (#​9477) (3366b67)
• deps: update dependency engine.io-client to v6.6.5 (#​9478) (32610e3)
• eval: accept defaultTest-only configs in prompt optimizer (#​9365) (f8ecebd)
• eval: error when optimizer pair has no runnable tests (#​9372) (45046ac)
• eval: handle Google Sheets export classification (#​9385) (5ffeb33)
• eval: invalidate count cache after retry cleanup (#​9431) (3ea3599)
• eval: invalidate history cache after result update (#​9487) (2e48494)
• eval: invalidate result-count cache on insert (#​9348) (#​9421) (4651ceb)
• eval: keep eval runtime vars out of persisted results (#​9370) (734db7c)
• eval: preserve all distinct CallApiFunction providers in combineConfigs (#​9402) (b7f2a93)
• eval: preserve optimized prompt routing (#​9391) (fff7ca4)
• eval: preserve prompt optimizer progress when a later round fails (#​9505) (211fadf)
• eval: prevent optimize from polluting jsonl output (#​9364) (1205a2a)
• eval: redact Azure Blob SAS tokens in outputs (#​9386) (23a5376)
• eval: refresh history cache after inserts (#​9496) (ed17310)
• eval: restore result header borders and live metrics (#​9273) (4ceaeb5)
• eval: reuse configured grading provider references (#​9460) (28b26d9)
• eval: show test descriptions in HTML output (#​9390) (206f1dd)
• handle chart and Google response edge cases (#​9409) (09701a8)
• http: isolate auth token cache (#​8636) (8d745cd)
• http: redact debug request metadata (#​8635) (6594491)
• mcp: use cryptographic session identifiers (#​9392) (c6f5144)
• providers: align Gemini safety block handling (#​9387) (45fed35)
• providers: harden callback file URL parsing (#​9479) (d6bfc1f)
• providers: honor Vertex default host overrides (#​9389) (11a8d9b)
• providers: improve invalid provider diagnostics (#​9405) (04c5aa4)
• providers: normalize Claude Opus compatibility (#​9510) (14e9dc1)
• providers: preserve AI Studio grounding metadata (#​9436) (79b6b63)
• providers: preserve raw Google stream chunks (#​9437) (2875f4e)
• providers: price unknown Grok Imagine slugs at the quality tier (#​9337) (efa689e)
• providers: redact MLflow Gateway api key and restore Novita routing test (#​9511) (9e2eaf5)
• providers: reject MiniMax function_call (#​9512) (b9a849b)
• providers: return refreshed HTTP auth tokens safely (#​9394) (9a258a5)
• providers: show labels in missing API key diagnostics (#​9404) (b43625b)
• providers: stop double-counting xAI reasoning tokens in cost (#​9326) (26f6d13)
• providers: stop double-counting xAI reasoning tokens in cost (#​9507) (7f2932c)
• secure script temporary artifacts (#​9393) (c320916)
• server: publish eval job completion only after results are saved (#​9395) (a9f5bcf)
• server: restore Azure Blob SAS tokens by value, not array position (#​9516) (b7f4a04)
• util: don't misreport a missing transitive dep as the optional package (#​9513) (e93c817)
• web-viewer: preserve config variable order instead of alphabetizing (#​9435) (a53d6f7)
• webui: avoid NaN in named metric charts (#​9352) (a6b860f)
• webui: clear row hint on eval selection (#​9380) (4586da4)
• webui: clear stale eval detail row hint (#​9377) (c9a3f61)
• webui: clear stale rowId and details hash on filter clear (#​9369) (e9b8e98)
• webui: harden eval table deep links and header borders (#​9285) (3514f6d)
• webui: make full metric chip area clickable (#​9368) (8eed102)
• webui: page eval deep links by rowId when filtered (#​9371) (16ede34)

Performance Improvements

• webui: speed up evaluation selection (#​9462) (dda3db3)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: package-lock.json

npm --before could not be enforced because existing locked packages were published after the minimumReleaseAge cutoff. This will resolve after the next lock file maintenance run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fcb0ad239

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Restore the missing lockfile peer entry

With this lockfile, npm ci fails before installing dependencies using the supported npm 11.4.x range (Missing: gcp-metadata@ from lock file). The promptfoo bump removed node_modules/mongoose/node_modules/gcp-metadata, but mongoose/node_modules/mongodb@7.2.0 still has gcp-metadata as an optional peer, so the lockfile is no longer internally consistent; every workflow section I checked that builds or packages this action runs npm ci, so this dependency update cannot pass CI until the lockfile is regenerated with that entry restored.

Useful? React with 👍 / 👎.