chore(deps)(deps): bump convex from 1.31.7 to 1.38.0

[dependabot]

Bumps convex from 1.31.7 to 1.38.0.

Changelog

Sourced from convex's changelog.

1.38.0

• Adds ctx.meta.getRequestMetadata() to access request metadata in mutations and actions: request ID, client IP, and client User-Agent.
• Default env vars are now imported when creating a new local deployment.
• Allows creating new local deployments using npx convex deployment select local.
• Adds support for --expiry and --expires aliases for --expiration in npx convex deployment create.
• Supports using import "server-only" to mark files as server-only.
• Removes the npx convex disable-local-deployments command.
• Fixes an issue where stdout/stderr would be truncated after exit in the CLI.

1.37.0

• Adds useQuery_experimental, which accepts object-based args and returns an object with status, data, and error that doesn't throw errors by default.
• Adds npx convex deployment token create my-token --save-env, enabling scripts to configure agent environments with access only to develop and deploy against their own cloud deployment. e.g.

  npx convex deployment create dev/foo --select --expiration "in 7 days" --type dev
  # npx convex env set ... (optional - typically default env vars suffice)
  npx convex deployment token create foo --save-env
  # npx convex dev --once (optional)

• Re-exports ValidatorTypeToReturnType from convex/server
• AI Files will no longer prompt when connecting to an existing project.
• Updates the VisibilityProperties type to allow types like RegisteredQuery to be more easily extended without losing covariance.
• New ctx.meta.getDeploymentMetadata() function.
  • Includes the name, region and class of the deployment.

1.36.1

• Updated npx convex login --vercel to ask before joining a Convex team through the Vercel Marketplace.
• Allows targeting a project or specific deployment type rather than just a deployment for npx convex env default *.

1.36.0

• npx convex run now supports --inline-query for evaluating readonly queries without creating a named function first, for example: npx convex run --inline-query 'await ctx.db.query("messages").take(5)'.
• Added ctx.meta to access extra metadata at runtime:
  • ctx.meta.getFunctionMetadata(): the current function's name, component, visibility, and whether it's a query, mutation, or action.
  • ctx.meta.getTransactionMetrics(): how much capacity remains in the current transaction. Only available in queries and mutations.
• Added a npx convex env default command for getting and setting default

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 Golden Principles Validation

Overall Grade: B-
Total Violations: 9

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	8
🔵 Low	0

View all violations

GP-013

• high: mcp-server/src/lib/lance-sync.ts:104
  • Pretty-printed JSON wastes ~30% tokens in MCP responses
  • Fix: Use JSON.stringify(data) without formatting args

GP-003

• medium: mcp-server/src/tools/chain-recall.ts
  • Tool file is 251 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/context-primitives.ts
  • Tool file is 203 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/defrag.ts
  • Tool file is 246 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/hierarchical-recall.ts
  • Tool file is 448 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/recall.ts
  • Tool file is 461 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/subspaces.ts
  • Tool file is 308 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/system-prompt-builder.ts
  • Tool file is 342 lines (guideline: ≤200). Consider splitting.

GP-008

• medium: AGENTS.md
  • AGENTS.md is 250 lines (max: 150). Keep it a lean navigation map.

---

📚 Reference: Golden Principles | Validation Tool

[dependabot]

Superseded by #64.