chore(deps-dev): bump promptfoo from 0.121.3 to 0.121.19 in /examples/promptfoo

[dependabot]

Bumps promptfoo from 0.121.3 to 0.121.19.

Release notes

Sourced from promptfoo's releases.

0.121.19

0.121.19 (2026-07-14)

Features

• providers: add Bedrock GPT-5.6 frontier support (#10081) (a97c8eb)
• providers: add Meta Model API (Muse Spark) provider (#10041) (e6f06da)
• providers: add Open Interpreter provider (#10079) (c4d9028)
• providers: add xAI Grok 4.5 support (#10032) (83cedf0)
• providers: honor CLAUDE_CONFIG_DIR for Claude Code creds (#9980) (a643f8b)
• providers: support GPT-5.6 GA (#10040) (3280625)
• redteam: account for generation-phase token usage (#9967) (e0d1698)
• redteam: add goblin strategy (#10057) (c0c86f1)
• types: optional token-usage fields on public types/schemas (#9962) (7365c32)
• util: add token-usage helpers (error/generation accumulation) (#9969) (79ebc2d)

Bug Fixes

• assertions: allow numeric 0 as contains/icontains value (#10012) (06d8105)
• assertions: return pass:false for tool calls missing a function object (#10076) (ffd8922)
• azure: avoid crash on empty choices array when reading logprobs (#9867) (f189f84)
• code-scan: harden action supply chain (#9991) (17e90eb)
• db: protect user database from test runners (#9590) (aabb699)
• deps: update anthropic packages (#10037) (fed1d2a)
• deps: update anthropic packages (#10066) (24a3ef1)
• deps: update dependency js-yaml to v5.2.1 (#10052) (fe22aa7)
• deps: update opentelemetry (#10067) (03e3f2a)
• eval: combineFilterConditions doesn't recognize lowercase 'or' (#10087) (25fedb6)
• matchers: count missing faithfulness verdicts as unsupported (#9984) (ce4a3d3)
• matchers: preserve reserved grader vars in model-graded matchers (#10042) (9f6afcc)
• matchers: preserve reserved rag grader vars (#9994) (6e9e2ee)
• providers: address xAI response edge cases (#10072) (0300eb0)
• providers: avoid app-server config recursion (#10078) (61a043f)
• providers: bill GPT-5.6 image input tokens (#10050) (ab52ee0)
• providers: clamp DeepSeek cached tokens in cost calc (#9908) (eca0cdc)
• providers: correct Codex SDK provider config handling (#9963) (a311483)
• providers: guard array access in Bedrock Titan and Cohere output handlers (#9897) (9a2aa85)
• providers: handle TrueFoundry guardrail blocks (#10021) (a9cfc86)
• providers: preserve TrueFoundry filter errors (#10027) (051914a)
• providers: report cached request counts in token usage (#9970) (2392ce3)
• providers: stringify simulated user provider outputs (#10019) (46ee400)
• redteam: add missing lowercase f to homoglyph map (#10071) (fe3151e)
• redteam: clean up Hydra and Hex handling (#10077) (ef61281)
• redteam: encode hex strategy payloads as UTF-8 bytes (#10073) (080dc99)
• redteam: match cross-session leaks case-insensitively (#10074) (53d7586)
• redteam: pass target output to structured graders (#10068) (c5f205d)
• redteam: preserve punctuation in Pig Latin encoding (#10025) (fe6bf3a)
• redteam: stop empty prompts at metadata boundaries (#10015) (3957d90)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.121.19 (2026-07-14)

Features

• providers: add Bedrock GPT-5.6 frontier support (#10081) (a97c8eb)
• providers: add Meta Model API (Muse Spark) provider (#10041) (e6f06da)
• providers: add Open Interpreter provider (#10079) (c4d9028)
• providers: add xAI Grok 4.5 support (#10032) (83cedf0)
• providers: honor CLAUDE_CONFIG_DIR for Claude Code creds (#9980) (a643f8b)
• providers: support GPT-5.6 GA (#10040) (3280625)
• redteam: account for generation-phase token usage (#9967) (e0d1698)
• redteam: add goblin strategy (#10057) (c0c86f1)
• types: optional token-usage fields on public types/schemas (#9962) (7365c32)
• util: add token-usage helpers (error/generation accumulation) (#9969) (79ebc2d)

Bug Fixes

• assertions: allow numeric 0 as contains/icontains value (#10012) (06d8105)
• assertions: return pass:false for tool calls missing a function object (#10076) (ffd8922)
• azure: avoid crash on empty choices array when reading logprobs (#9867) (f189f84)
• code-scan: harden action supply chain (#9991) (17e90eb)
• db: protect user database from test runners (#9590) (aabb699)
• deps: update anthropic packages (#10037) (fed1d2a)
• deps: update anthropic packages (#10066) (24a3ef1)
• deps: update dependency js-yaml to v5.2.1 (#10052) (fe22aa7)
• deps: update opentelemetry (#10067) (03e3f2a)
• eval: combineFilterConditions doesn't recognize lowercase 'or' (#10087) (25fedb6)
• matchers: count missing faithfulness verdicts as unsupported (#9984) (ce4a3d3)
• matchers: preserve reserved grader vars in model-graded matchers (#10042) (9f6afcc)
• matchers: preserve reserved rag grader vars (#9994) (6e9e2ee)
• providers: address xAI response edge cases (#10072) (0300eb0)
• providers: avoid app-server config recursion (#10078) (61a043f)
• providers: bill GPT-5.6 image input tokens (#10050) (ab52ee0)
• providers: clamp DeepSeek cached tokens in cost calc (#9908) (eca0cdc)
• providers: correct Codex SDK provider config handling (#9963) (a311483)
• providers: guard array access in Bedrock Titan and Cohere output handlers (#9897) (9a2aa85)
• providers: handle TrueFoundry guardrail blocks (#10021) (a9cfc86)
• providers: preserve TrueFoundry filter errors (#10027) (051914a)
• providers: report cached request counts in token usage (#9970) (2392ce3)
• providers: stringify simulated user provider outputs (#10019) (46ee400)
• redteam: add missing lowercase f to homoglyph map (#10071) (fe3151e)
• redteam: clean up Hydra and Hex handling (#10077) (ef61281)
• redteam: encode hex strategy payloads as UTF-8 bytes (#10073) (080dc99)
• redteam: match cross-session leaks case-insensitively (#10074) (53d7586)
• redteam: pass target output to structured graders (#10068) (c5f205d)
• redteam: preserve punctuation in Pig Latin encoding (#10025) (fe6bf3a)
• redteam: stop empty prompts at metadata boundaries (#10015) (3957d90)
• util: handle even backslashes before slash comments (#10030) (fd607d1)
• util: handle single-quoted escaped paths (#10080) (01694e7)
• util: remove unused NormalizedTokenUsage export (#10065) (402a84d)

... (truncated)

Commits

• 1ede17a chore(main): release 0.121.19 (#10026)
• 25fedb6 fix(eval): combineFilterConditions doesn't recognize lowercase 'or' (#10087)
• 69a094a docs(site): fix leetspeak strategy examples (#10088)
• 0ac2f15 chore(deps): update dependency protobufjs to v8.6.6 (#10085)
• 1a511ca chore(deps): update dependency @​anthropic-ai/claude-agent-sdk to v0.3.201 (#1...
• c4d9028 feat(providers): add Open Interpreter provider (#10079)
• 01694e7 fix(util): handle single-quoted escaped paths (#10080)
• ef61281 fix(redteam): clean up Hydra and Hex handling (#10077)
• ffd8922 fix(assertions): return pass:false for tool calls missing a function object (...
• 61a043f fix(providers): avoid app-server config recursion (#10078)
• Additional commits viewable in compare view

[ManintheCrowds]

@dependabot rebase

[ManintheCrowds]

Superseded by #18 (regenerated lockfile; local npm ci + 4/4 eval). Closing in favor of #18 once #18 is green.

[ManintheCrowds]

Closed as superseded by #18 (synced lockfile; promptfoo-eval green).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.