chore(deps): update dependency promptfoo to v0.120.23 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
promptfoo	0.120.20 → 0.120.23

---

Release Notes

promptfoo/promptfoo (promptfoo)

v0.120.23

Compare Source

Bug Fixes

• blobs: restore cloud blob upload for shared evals (#​7484) (7eb1009)
• deps: update dependency @​opencode-ai/sdk to ^1.1.48 (#​7499) (b081a54)
• deps: update dependency commander to ^14.0.3 (#​7497) (1c8f67a)
• eval: restore runtime vars when filtering tests for re-run (#​7071) (c53523c)
• redteam: avoid undefined callApi with Python mischievous-user (#​7509) (395856c)
• redteam: data exfil grader falls through to LLM rubric on no server-side hit (#​7516) (6fbd246)
• redteam: include specific policy IDs in severity map (#​7492) (61935ee)
• redteam: skip refusal check when output contains valid prompt markers (#​7524) (882f47e)
• redteam: strip eval- prefix from dynamic page URLs (#​7496) (f467707)

Performance Improvements

• redteam: strip graderExamples from remote generation requests (#​7522) (d7df221)

v0.120.22

Compare Source

Features

• redteam: enable multilingual support for audio/video/image strategies (#​7485) (01b62ce)

Bug Fixes

• app: move rows useMemo after table declaration to fix build (#​7475) (d1c2a39)
• app: reduce payload to avoid RangeError (#​7436) (ff3d3d9)
• app: show all table rows when printing instead of just current page (#​7387) (ca50ce8)
• cli: improve error messages for missing config file (#​7464) (9189dbf)
• commands: use streaming iteration in recalculatePromptMetrics to avoid OOM (#​7471) (1346f0a)
• deps: override lodash-es to 4.17.23 to resolve prototype pollution (#​7474) (f8bbd45)
• deps: update dependency @​anthropic-ai/sdk to ^0.72.0 (#​7460) (4bce247)
• deps: update dependency @​anthropic-ai/sdk to ^0.72.1 (#​7472) (bc8be96)
• deps: update dependency ai to ^6.0.62 (#​7456) (cc259e9)
• deps: update dependency fast-xml-parser to ^5.3.4 (#​7476) (29121d5)
• deps: update dependency posthog-node to ~5.24.6 (#​7441) (9d2a59f)
• deps: update dependency posthog-node to ~5.24.7 (#​7465) (b87fbd9)
• export/table handling for falsy values (#​7440) (ec5b404)

v0.120.21

Compare Source

Features

• app: add print styles to DataTable for light mode printing (#​7365) (167b27c)
• app: improve HTTP endpoint request body editor (#​7438) (cfadb37)
• providers: add HuggingFace chat completion provider (#​7446) (cd709b7)
• providers: add tools and tool choice transformations (#​7420) (c332cef)
• providers: add xAI Grok Imagine video provider (#​7395) (8407969)
• redteam: Add indirect-web-pwn attack strategy (#​6973) (1065e71)

Bug Fixes

• app: refresh history page when evals complete (#​7189) (31ac183)
• assertions: resolve dynamic vars before passing to assertion functions (#​7374) (d3ad963)
• ci: replace raven-actions/actionlint with direct download (#​7373) (665f8d3)
• cli: ensure process exits on SIGINT during view command (#​7390) (1a21ce2)
• cli: show zero pass/fail counts in promptfoo show (#​7427) (ecc2abc)
• cli: use npx commands in README when init run via npx (#​7377) (1c0504e)
• deps: lock file maintenance example dependencies (#​7406) (4f4807c)
• deps: run npm audit fix (#​7450) (3f9ac78)
• deps: update dependency @​actions/core to ^2.0.3 (#​7415) (5f0e93f)
• deps: update dependency @​actions/github to ^8.0.1 (#​7412) (052ba95)
• deps: update dependency @​actions/github to v8 (#​7402) (b805942)
• deps: update dependency @​apidevtools/json-schema-ref-parser to ^15.2.2 (#​7362) (7ac8a53)
• deps: update dependency @​opencode-ai/sdk to ^1.1.35 (#​7380) (632f64d)
• deps: update dependency @​opencode-ai/sdk to ^1.1.36 (#​7389) (c23e90c)
• deps: update dependency ai to ^6.0.50 (#​7399) (af3542d)
• deps: update dependency ai to ^6.0.55 (#​7410) (890d6a7)
• deps: update dependency ai to ^6.0.56 (#​7417) (42d316f)
• deps: update dependency ai to ^6.0.57 (#​7421) (ca7972b)
• deps: update dependency ai to ^6.0.58 (#​7439) (2a05dbd)
• deps: update dependency ai to ^6.0.59 (#​7448) (a5f17ed)
• deps: update dependency ai to ^6.0.60 (#​7455) (ee7b28e)
• deps: update dependency lru-cache to ^11.2.5 (#​7400) (c193ebd)
• deps: update dependency openai to ^6.17.0 (#​7449) (65e75eb)
• deps: update dependency posthog-node to ~5.24.3 (#​7413) (f60d3e0)
• deps: update dependency swiper to ^12.1.0 (#​7442) (8b6af09)
• deps: update dependency undici (#​7422) (8ef17c6)
• deps: update dependency undici to ^7.19.1 (#​7368) (5a841d0)
• deps: update example dependencies (major) (#​7404) (a46f8dd)
• deps: update openai packages (#​7435) (241a2fc)
• deps: update type definitions (#​7431) (9e5cddb)
• g-eval prompt ambiguity (#​7397) (fb8d872)
• Langfuse variable type conversion (#​7461) (755d38c)
• prompt id hashing (#​6782) (18beb08)
• redteam: ensure provider cleanup on all exit paths (#​7407) (e1538fe)
• redteam: improve Request Body editor UX and error handling (#​7319) (a1b4eec)
• redteam: use word-boundary regex in isBasicRefusal to prevent false positives (#​7394) (2ad5692)
• remove dupe eval row ids (#​7426) (4ba7fad)

---

Configuration

📅 Schedule: Branch creation - "before 10am on friday" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Open in Overmind ↗

---

model|risks_v6
✨Encryption Key State Risk ✨KMS Key Creation

🔴 Change Signals

Policies 🔴 ▃▂▁ Multiple policy violations detected, including S3 bucket 'aws_s3_bucket.terraform-example-state-bucket' lacking server-side encryption and required tags, and security group allowing unrestricted SSH access, which is a security risk.
Routine 🟢 ▁▂▃▅▇ AWS SNS topic subscriptions showing regular updates with 2 events/week for the last 6 weeks.

View signals ↗

---

🔥 Risks

Note

All 1 resource is being created

Blast radius analysis requires existing infrastructure to examine. Once these resources are applied, future changes will show their dependencies.

---

---

💥 Blast Radius

Items 0

Edges 0

[github-actions]

✅ Auto-Approved

---

🟢 Decision

Auto-approved: All safety checks passed

---

🔥 Risks Summary

High 0 · Medium 0 · Low 0

---

View full analysis in Overmind ↗

[github-actions]

⛔ Auto-Blocked

---

🔴 Decision

Auto-blocked: Policy signal (-3) is below threshold (-2)

---

📊 Signals Summary

Policies 🔴 -3

---

🔥 Risks Summary

High 0 · Medium 0 · Low 0

---

View full analysis in Overmind ↗

[github-actions]

⛔ Auto-Blocked

---

🔴 Decision

Auto-blocked: Policy signal (-3) is below threshold (-2)

---

📊 Signals Summary

Policies 🔴 -3

Routine 🟢 +5

---

🔥 Risks Summary

High 0 · Medium 0 · Low 0

---

View full analysis in Overmind ↗