Skip to content

chore(deps): bump the npm-minor-patch group across 1 directory with 47 updates - #504

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-patch-90875da66c
Open

chore(deps): bump the npm-minor-patch group across 1 directory with 47 updates#504
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-patch-90875da66c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 47 updates in the / directory:

Package From To
@biomejs/biome 2.5.6 2.5.10
@testing-library/user-event 14.6.1 14.6.6
turbo 2.10.7 2.10.12
better-sqlite3 13.0.2 13.0.3
@better-auth/api-key 1.7.0-rc.2 1.7.2
@better-auth/electron 1.7.0-rc.2 1.7.2
better-auth 1.7.0-rc.2 1.7.2
@electron/asar 4.2.1 4.3.0
@hookform/resolvers 5.5.7 5.9.1
playwright-core 1.62.0 1.62.1
react-hook-form 7.83.0 7.86.0
@better-auth/expo 1.7.0-rc.2 1.7.2
heroui-native 1.0.6 1.0.8
lucide-react-native 1.27.0 1.34.0
posthog-react-native 4.60.0 4.65.0
tailwind-variants 3.3.0 3.3.1
uniwind 1.10.0 1.11.0
posthog-js 1.407.3 1.421.0
@noble/ed25519 3.0.0 3.1.0
@noble/hashes 2.2.0 2.3.0
smol-toml 1.7.1 1.8.0
@types/semver 7.7.1 7.8.0
@lexical/react 0.48.0 0.49.0
@lexical/selection 0.48.0 0.49.0
@lexical/utils 0.48.0 0.49.0
@pierre/diffs 1.2.12 1.3.6
@shikijs/core 4.3.1 4.4.3
@shikijs/engine-javascript 4.3.1 4.4.3
@shikijs/langs 4.3.1 4.4.3
@shikijs/themes 4.3.1 4.4.3
dompurify 3.4.12 3.4.14
lexical 0.48.0 0.49.0
lucide-react 1.27.0 1.34.0
mermaid 11.16.0 11.17.2
remend 1.3.0 1.3.1
streamdown 2.5.0 2.6.0
virtua 0.50.0 0.50.5
@lexical/headless 0.48.0 0.49.0
@iconify-json/material-icon-theme 1.2.69 1.2.70
@iconify-json/simple-icons 1.2.92 1.2.93
@vitejs/plugin-react 6.0.4 6.1.0
swr 2.4.2 2.5.1
tsx 4.23.1 4.23.12
use-intl 4.13.4 4.13.7
vite 8.1.5 8.2.2
vitest 4.1.10 4.1.11
zustand 5.0.14 5.0.15

Updates @biomejs/biome from 2.5.6 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

    <!-- c -->

... (truncated)

Commits

Updates @testing-library/user-event from 14.6.1 to 14.6.6

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

  • default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

  • tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

v14.6.2

14.6.2 (2026-08-03)

Commits
  • 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
  • 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
  • d7e80e3 fix: keyboard event repeat property (#1312)
  • 43d8e6c ci: remove broken npm backfill step (#1322)
  • 1d18b1f fix(release): manually release a patch version (#1321)
  • 232f3e6 docs: add migration note and clean up README badges (#1320)
  • 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
  • e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
  • 13fa4bc ci: stop lint errors from blocking release (#1316)
  • c3cec18 chore(ci): make releases work with full git history (#1315)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.


Updates turbo from 2.10.7 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates better-sqlite3 from 13.0.2 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

Commits

Updates @better-auth/api-key from 1.7.0-rc.2 to 1.7.2

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.2

1.7.1

1.7.0

1.7.0-rc.6

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Commits

Updates @better-auth/electron from 1.7.0-rc.2 to 1.7.2

Release notes

Sourced from @​better-auth/electron's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/electron's changelog.

1.7.2

1.7.1

1.7.0

Minor Changes

  • #9645 e014029 Thanks @​ping-maxwell! - Harden the Electron OAuth flow and tighten custom-scheme trusted-origin matching.

    The Electron sign-in flow now mandates PKCE S256. Plain PKCE is rejected: the code_challenge_method parameter is gone and every authorization code is verified by hashing the verifier with SHA-256. The server no longer trusts an electron-origin header to set the request Origin. The Electron client now sends a real Origin (for example myapp:/), so upgrade the @better-auth/electron client and server together and make sure your app's scheme is in trustedOrigins. The unused disableOriginOverride option is removed.

    Custom-scheme entries in trustedOrigins now match by scheme and authority instead of string prefix. A host-less entry such as myapp:// or exp:// still trusts every host of that scheme, but a host-bearing entry such as myapp://callback matches that host exactly, so it is no longer satisfied by myapp://callback.attacker.tld.

  • #9069 c7d2253 Thanks @​gustavovalverde! - Rewrite the generic OAuth plugin as a first-class social provider with OAuth 2.1 security defaults. Providers now use signIn.social + callback/:id instead of dedicated plugin endpoints, with PKCE required by default (OAuth 2.1), RFC 9207 issuer validation, OIDC auto-discovery with openid scope injection, and typed provider IDs.

    Breaking changes:

    • signIn.oauth2({ providerId }) replaced by signIn.social({ provider })
    • oauth2.link() replaced by linkSocial()
    • Callback URL changed from /api/auth/oauth2/callback/:id to /api/auth/callback/:id
    • genericOAuthClient() removed; generic OAuth providers now use the standard social client APIs
    • pkce defaults to true (was false); set pkce: false for providers that reject PKCE
    • authorizationUrlParams and tokenUrlParams only accept Record<string, string>
    • issuer and requireIssuerValidation config fields removed; issuer validation is automatic via OIDC discovery
    • mapProfileToUser profile typed as OAuth2UserInfo & Record<string, unknown>

Patch Changes

  • #10505 d701f90 Thanks @​gustavovalverde! - One Tap, Electron, and Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.

1.7.0-rc.6

Patch Changes

  • #10794 2ad2928 Thanks @​bytaesu! - Restore client plugin declaration compatibility for downstream TypeScript consumers.

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Patch Changes

  • #10505 d701f90 Thanks @​gustavovalverde! - One Tap, Electron, and Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.
Commits

Updates better-auth from 1.7.0-rc.2 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

  • #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

  • #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

  • #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

  • #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

  • #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

  • #10959 c8dcfa5 Thanks Description has been truncated

@dependabot
chore(deps): bump the npm-minor-patch group across 1 directory with 4…
dbf2660 
…7 updates

Bumps the npm-minor-patch group with 47 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.10` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.6` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.7` | `2.10.12` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` |
| [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.0-rc.2` | `1.7.2` |
| [@better-auth/electron](https://github.com/better-auth/better-auth/tree/HEAD/packages/electron) | `1.7.0-rc.2` | `1.7.2` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.0-rc.2` | `1.7.2` |
| [@electron/asar](https://github.com/electron/asar) | `4.2.1` | `4.3.0` |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.5.7` | `5.9.1` |
| [playwright-core](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.83.0` | `7.86.0` |
| [@better-auth/expo](https://github.com/better-auth/better-auth/tree/HEAD/packages/expo) | `1.7.0-rc.2` | `1.7.2` |
| [heroui-native](https://github.com/heroui-inc/heroui-native) | `1.0.6` | `1.0.8` |
| [lucide-react-native](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react-native) | `1.27.0` | `1.34.0` |
| [posthog-react-native](https://github.com/PostHog/posthog-js/tree/HEAD/packages/react-native) | `4.60.0` | `4.65.0` |
| [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.3.0` | `3.3.1` |
| [uniwind](https://github.com/uni-stack/uniwind) | `1.10.0` | `1.11.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.407.3` | `1.421.0` |
| [@noble/ed25519](https://github.com/paulmillr/noble-ed25519) | `3.0.0` | `3.1.0` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.2.0` | `2.3.0` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.8.0` |
| [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` |
| [@lexical/react](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-react) | `0.48.0` | `0.49.0` |
| [@lexical/selection](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-selection) | `0.48.0` | `0.49.0` |
| [@lexical/utils](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils) | `0.48.0` | `0.49.0` |
| @pierre/diffs | `1.2.12` | `1.3.6` |
| [@shikijs/core](https://github.com/shikijs/shiki/tree/HEAD/packages/core) | `4.3.1` | `4.4.3` |
| [@shikijs/engine-javascript](https://github.com/shikijs/shiki/tree/HEAD/packages/engine-javascript) | `4.3.1` | `4.4.3` |
| [@shikijs/langs](https://github.com/shikijs/shiki/tree/HEAD/packages/langs) | `4.3.1` | `4.4.3` |
| [@shikijs/themes](https://github.com/shikijs/shiki/tree/HEAD/packages/themes) | `4.3.1` | `4.4.3` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.14` |
| [lexical](https://github.com/facebook/lexical/tree/HEAD/packages/lexical) | `0.48.0` | `0.49.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.27.0` | `1.34.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.0` | `11.17.2` |
| [remend](https://github.com/vercel/streamdown/tree/HEAD/packages/remend) | `1.3.0` | `1.3.1` |
| [streamdown](https://github.com/vercel/streamdown/tree/HEAD/packages/streamdown) | `2.5.0` | `2.6.0` |
| [virtua](https://github.com/inokawa/virtua) | `0.50.0` | `0.50.5` |
| [@lexical/headless](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-headless) | `0.48.0` | `0.49.0` |
| [@iconify-json/material-icon-theme](https://github.com/iconify/icon-sets) | `1.2.69` | `1.2.70` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.92` | `1.2.93` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.4` | `6.1.0` |
| [swr](https://github.com/vercel/swr) | `2.4.2` | `2.5.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [use-intl](https://github.com/amannn/next-intl) | `4.13.4` | `4.13.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.14` | `5.0.15` |



Updates `@biomejs/biome` from 2.5.6 to 2.5.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome)

Updates `@testing-library/user-event` from 14.6.1 to 14.6.6
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.1...v14.6.6)

Updates `turbo` from 2.10.7 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.7...v2.10.12)

Updates `better-sqlite3` from 13.0.2 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v13.0.2...v13.0.3)

Updates `@better-auth/api-key` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/api-key)

Updates `@better-auth/electron` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/electron/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/electron)

Updates `better-auth` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)

Updates `@electron/asar` from 4.2.1 to 4.3.0
- [Release notes](https://github.com/electron/asar/releases)
- [Changelog](https://github.com/electron/asar/blob/main/CHANGELOG.md)
- [Commits](electron/asar@v4.2.1...v4.3.0)

Updates `@hookform/resolvers` from 5.5.7 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.5.7...v5.9.1)

Updates `playwright-core` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `react-hook-form` from 7.83.0 to 7.86.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.83.0...v7.86.0)

Updates `@better-auth/expo` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/expo)

Updates `heroui-native` from 1.0.6 to 1.0.8
- [Release notes](https://github.com/heroui-inc/heroui-native/releases)
- [Changelog](https://github.com/heroui-inc/heroui-native/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/heroui-native@v1.0.6...v1.0.8)

Updates `lucide-react-native` from 1.27.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react-native)

Updates `posthog-react-native` from 4.60.0 to 4.65.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/react-native/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-react-native@4.65.0/packages/react-native)

Updates `tailwind-variants` from 3.3.0 to 3.3.1
- [Release notes](https://github.com/heroui-inc/tailwind-variants/releases)
- [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/tailwind-variants@v3.3.0...v3.3.1)

Updates `uniwind` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/uni-stack/uniwind/releases)
- [Commits](uni-stack/uniwind@v1.10.0...v1.11.0)

Updates `posthog-js` from 1.407.3 to 1.421.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.407.3...posthog-js@1.421.0)

Updates `@noble/ed25519` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/paulmillr/noble-ed25519/releases)
- [Changelog](https://github.com/paulmillr/noble-ed25519/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ed25519@3.0.0...3.1.0)

Updates `@noble/hashes` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.2.0...2.3.0)

Updates `smol-toml` from 1.7.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.7.1...v1.8.0)

Updates `@types/semver` from 7.7.1 to 7.8.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver)

Updates `@lexical/react` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-react)

Updates `@lexical/selection` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-selection)

Updates `@lexical/utils` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-utils)

Updates `@pierre/diffs` from 1.2.12 to 1.3.6

Updates `@shikijs/core` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/core)

Updates `@shikijs/engine-javascript` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/engine-javascript)

Updates `@shikijs/langs` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/langs)

Updates `@shikijs/themes` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/themes)

Updates `dompurify` from 3.4.12 to 3.4.14
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.14)

Updates `lexical` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical)

Updates `lucide-react` from 1.27.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)

Updates `mermaid` from 11.16.0 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.17.2)

Updates `remend` from 1.3.0 to 1.3.1
- [Release notes](https://github.com/vercel/streamdown/releases)
- [Changelog](https://github.com/vercel/streamdown/blob/main/packages/remend/CHANGELOG.md)
- [Commits](https://github.com/vercel/streamdown/commits/remend@1.3.1/packages/remend)

Updates `streamdown` from 2.5.0 to 2.6.0
- [Release notes](https://github.com/vercel/streamdown/releases)
- [Changelog](https://github.com/vercel/streamdown/blob/main/packages/streamdown/CHANGELOG.md)
- [Commits](https://github.com/vercel/streamdown/commits/streamdown@2.6.0/packages/streamdown)

Updates `virtua` from 0.50.0 to 0.50.5
- [Release notes](https://github.com/inokawa/virtua/releases)
- [Commits](inokawa/virtua@0.50.0...0.50.5)

Updates `@lexical/headless` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-headless)

Updates `@iconify-json/material-icon-theme` from 1.2.69 to 1.2.70
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.92 to 1.2.93
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@vitejs/plugin-react` from 6.0.4 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

Updates `swr` from 2.4.2 to 2.5.1
- [Release notes](https://github.com/vercel/swr/releases)
- [Commits](vercel/swr@v2.4.2...v2.5.1)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.12)

Updates `use-intl` from 4.13.4 to 4.13.7
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.13.4...v4.13.7)

Updates `vite` from 8.1.5 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `zustand` from 5.0.14 to 5.0.15
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.14...v5.0.15)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@better-auth/api-key"
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@better-auth/electron"
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: better-auth
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@electron/asar"
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright-core
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: react-hook-form
  dependency-version: 7.86.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@better-auth/expo"
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: heroui-native
  dependency-version: 1.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lucide-react-native
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: posthog-react-native
  dependency-version: 4.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tailwind-variants
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: uniwind
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: posthog-js
  dependency-version: 1.421.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@noble/ed25519"
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@noble/hashes"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/semver"
  dependency-version: 7.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/react"
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/selection"
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/utils"
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@pierre/diffs"
  dependency-version: 1.3.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/core"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/engine-javascript"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/langs"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/themes"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lexical
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: mermaid
  dependency-version: 11.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: remend
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: streamdown
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: virtua
  dependency-version: 0.50.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/headless"
  dependency-version: 0.49.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@iconify-json/material-icon-theme"
  dependency-version: 1.2.70
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.93
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: swr
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: use-intl
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: zustand
  dependency-version: 5.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2026
@greptile-apps

greptile-apps Bot commented Sep 3, 2026

Copy link
Copy Markdown

Greptile Summary

This PR updates 47 npm dependencies across the daemon, desktop, mobile, webview, shared workbench, foundation, host, and presentation packages, with corresponding catalog and lockfile changes.

  • Promotes Better Auth packages from the 1.7 release candidate to 1.7.2 across application surfaces.
  • Updates mobile UI, styling, icon, and analytics dependencies while retaining the existing Expo and React Native runtime versions.
  • Updates shared UI, editor, rendering, build, test, cryptography, database, and developer-tool dependencies.
  • Regenerates the pnpm lockfile to pin the resulting dependency graph.

Confidence Score: 5/5

The dependency update appears safe to merge because no concrete blocking or independently actionable issue was established.

The updated lockfile constrains installation and packaging resolutions, the mobile dependency peers match the pinned Expo and React Native stack, and no reachable authentication contract break was identified.

Important Files Changed
Filename Overview
apps/desktop/package.json Updates authentication, packaging, form, browser automation, and React form dependencies without an established compatibility defect.
apps/mobile/package.json Updates authentication and native UI/runtime packages whose resolved peer requirements remain compatible with the pinned mobile stack.
packages/presentation/ui/package.json Advances the coordinated Lexical, Shiki, rendering, icon, sanitization, and virtualization dependency set.
packages/foundation/common/package.json Updates the paired Noble cryptography packages to compatible exact versions.
pnpm-workspace.yaml Advances shared catalog versions for client, build, test, and icon tooling.
pnpm-lock.yaml Regenerates resolved versions and integrity-pinned transitive dependency metadata for the manifest updates.

Reviews (1): Last reviewed commit: "chore(deps): bump the npm-minor-patch gr..." | Re-trigger Greptile

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants