Update dependency promptfoo to v0.121.20

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
promptfoo (source)	0.121.18 → 0.121.20

---

Release Notes

promptfoo/promptfoo (promptfoo)

v0.121.20

Compare Source

Features

• providers: add Claude Opus 5 support (#​10210) (ff84f13)
• providers: add current Azure, Claude, and Gemini models (#​10128) (5c216a1)
• providers: add Kimi K3 support to Moonshot provider (#​10132) (a1168b6)
• websocket: support URL templating (#​10171) (a9aaced)

Bug Fixes

• assertions: default conversation-relevance threshold to 0.5 (#​10142) (2812d76)
• azure: avoid crash on empty completion choices (#​10124) (17d8d03)
• deps: align Renovate npm registry (#​10115) (688a905)
• deps: update anthropic packages (#​10146) (cfa9bee)
• deps: update anthropic packages (#​10199) (2d3f3f1)
• deps: update anthropic packages (#​10229) (2834215)
• deps: update dependency js-yaml to v5.2.2 [security] (#​10218) (18ea879)
• eval: avoid prompt index collisions for duplicate providers (#​10208) (5aa0958)
• eval: isolate conversation history by result column (#​10212) (a377bb7)
• integrations: migrate Langfuse prompts to SDK v5 (#​10131) (08b3f50)
• providers: align OpenAI models and capabilities (#​10125) (e17ce87)
• providers: preserve WebSocket retries for certificate-like URLs (#​10197) (85e0710)
• providers: reject Vertex Omni passthrough follow-ups (#​10135) (8482570)
• providers: restore secret-safe WebSocket retries (#​10176) (6d89cbb)
• python: keep worker control markers on their own line (#​10097) (6bc2b95)
• redteam: harden risk reports and WebSocket timeout tests (#​10211) (9ab178e)
• redteam: improve risk-category report row accessibility (b163738)
• redteam: preserve generation provider selection (#​10133) (ac8971f)
• site: repair stale event pages, dead links, and hydration mismatches (#​10215) (b0e3c25)

v0.121.19

Compare Source

Features

• providers: add Bedrock GPT-5.6 frontier support (#​10081) (a97c8eb)
• providers: add Meta Model API (Muse Spark) provider (#​10041) (e6f06da)
• providers: add Open Interpreter provider (#​10079) (c4d9028)
• providers: add xAI Grok 4.5 support (#​10032) (83cedf0)
• providers: honor CLAUDE_CONFIG_DIR for Claude Code creds (#​9980) (a643f8b)
• providers: support GPT-5.6 GA (#​10040) (3280625)
• redteam: account for generation-phase token usage (#​9967) (e0d1698)
• redteam: add goblin strategy (#​10057) (c0c86f1)
• types: optional token-usage fields on public types/schemas (#​9962) (7365c32)
• util: add token-usage helpers (error/generation accumulation) (#​9969) (79ebc2d)

Bug Fixes

• assertions: allow numeric 0 as contains/icontains value (#​10012) (06d8105)
• assertions: return pass:false for tool calls missing a function object (#​10076) (ffd8922)
• azure: avoid crash on empty choices array when reading logprobs (#​9867) (f189f84)
• code-scan: harden action supply chain (#​9991) (17e90eb)
• db: protect user database from test runners (#​9590) (aabb699)
• deps: update anthropic packages (#​10037) (fed1d2a)
• deps: update anthropic packages (#​10066) (24a3ef1)
• deps: update dependency js-yaml to v5.2.1 (#​10052) (fe22aa7)
• deps: update opentelemetry (#​10067) (03e3f2a)
• eval: combineFilterConditions doesn't recognize lowercase 'or' (#​10087) (25fedb6)
• matchers: count missing faithfulness verdicts as unsupported (#​9984) (ce4a3d3)
• matchers: preserve reserved grader vars in model-graded matchers (#​10042) (9f6afcc)
• matchers: preserve reserved rag grader vars (#​9994) (6e9e2ee)
• providers: address xAI response edge cases (#​10072) (0300eb0)
• providers: avoid app-server config recursion (#​10078) (61a043f)
• providers: bill GPT-5.6 image input tokens (#​10050) (ab52ee0)
• providers: clamp DeepSeek cached tokens in cost calc (#​9908) (eca0cdc)
• providers: correct Codex SDK provider config handling (#​9963) (a311483)
• providers: guard array access in Bedrock Titan and Cohere output handlers (#​9897) (9a2aa85)
• providers: handle TrueFoundry guardrail blocks (#​10021) (a9cfc86)
• providers: preserve TrueFoundry filter errors (#​10027) (051914a)
• providers: report cached request counts in token usage (#​9970) (2392ce3)
• providers: stringify simulated user provider outputs (#​10019) (46ee400)
• redteam: add missing lowercase f to homoglyph map (#​10071) (fe3151e)
• redteam: clean up Hydra and Hex handling (#​10077) (ef61281)
• redteam: encode hex strategy payloads as UTF-8 bytes (#​10073) (080dc99)
• redteam: match cross-session leaks case-insensitively (#​10074) (53d7586)
• redteam: pass target output to structured graders (#​10068) (c5f205d)
• redteam: preserve punctuation in Pig Latin encoding (#​10025) (fe6bf3a)
• redteam: stop empty prompts at metadata boundaries (#​10015) (3957d90)
• util: handle even backslashes before slash comments (#​10030) (fd607d1)
• util: handle single-quoted escaped paths (#​10080) (01694e7)
• util: remove unused NormalizedTokenUsage export (#​10065) (402a84d)

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 10am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Caution

[High Risk] Replacing the only healthy ALB backend will cause temporary API downtime

The change replaces the EC2 instance behind 540044833068.eu-west-2.elbv2-target-group.api-207c90ee-tg and also replaces its aws_lb_target_group_attachment. In the current state, that target group has only one registered backend, i-0bf4039822e01f430, and it is the sole healthy target serving the ALB on port 80 with HTTP /health checks.

During apply, the old instance will be deregistered or drained while the replacement instance is created, attached, registered, and waits to pass its initial health checks. Because there is no second healthy target in the group to absorb traffic, the ALB will temporarily have zero healthy backends and requests to the API service will fail until the new instance becomes healthy.
_{View reasoning tree here.}

Caution

[High Risk] Instance-specific alert retargeting will create a monitoring gap during compute replacement

The change replaces the AWS API server instance and both GCP service instances while the corresponding CloudWatch and Cloud Monitoring alerts are scoped to ephemeral instance identifiers. The current CloudWatch alarm targets only InstanceId=i-0bf4039822e01f430, and the GCP alert policies filter on exact resource.labels.instance_id values for inventory-api and payments-api. Because replacement creates new instance IDs, the monitoring configuration is being retargeted at the same time as the compute cutover instead of using stable labels or overlapping coverage.

During the replacement window, CPU and uptime alerts can stop matching either the old or new instances, leaving outages or failed startups undetected across both AWS and GCP. The new SNS email subscription also will not deliver notifications until the recipient confirms the subscription, so even alerts that do fire may not reach responders.
_{View reasoning tree here.}

Signals

Routine → Multiple compute and monitoring resources are showing unusual, infrequent update patterns that may need review, most commonly at 1 event/week for the last 2-5 months. Some API server and subscription resources changed slightly more often at 2-4 events/week for the last 3-5 months.

_{Additional Change Details:} Items 72 Edges 137 model|risks_v6 ✨Encryption Key State Risk ✨KMS Key Creation