Skip to content

chore(deps): bump the production-minor group across 1 directory with 16 updates - #878

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-2addbc92c4
Open

chore(deps): bump the production-minor group across 1 directory with 16 updates#878
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-2addbc92c4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor group with 16 updates in the / directory:

Package From To
@cloudflare/workers-oauth-provider 0.8.3 0.10.3
lucide-react 1.28.0 1.33.0
next 16.2.12 16.3.2
pg 8.22.0 8.23.0
react 19.2.7 19.2.8
fast-xml-parser 5.10.1 5.11.0
agents 0.20.1 0.21.0
@sigstore/protobuf-specs 0.5.1 0.5.2
@sigstore/verify 4.1.0 4.1.2
ws 8.21.1 8.21.3
@remotion/bundler 4.0.503 4.0.515
@remotion/cli 4.0.503 4.0.515
@remotion/google-fonts 4.0.503 4.0.515
@remotion/renderer 4.0.503 4.0.515
@remotion/tailwind-v4 4.0.503 4.0.515
remotion 4.0.503 4.0.515

Updates @cloudflare/workers-oauth-provider from 0.8.3 to 0.10.3

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.10.3

Patch Changes

  • #299 dc63ec8 Thanks @​mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

v0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

v0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

v0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

v0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

v0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch

... (truncated)

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.10.3

Patch Changes

  • #299 dc63ec8 Thanks @​mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable

... (truncated)

Commits
  • d83b2e7 Version Packages (#300)
  • dc63ec8 fix(cimd): scope default grant revocation to the authorizing redirect URI (#299)
  • f3b8b27 Version Packages (#296)
  • 3a41fd7 fix(cimd): centralize client metadata resolution (#295)
  • a316ce8 Version Packages (#286)
  • 9e3f44d chore: release resource compatibility as patch (#291)
  • a3e69f7 refactor(auth): simplify client auth storage (#290)
  • 7a6baf9 fix(resource): preserve omission and legacy grants (#288)
  • 30b1f4f fix(auth): preserve legacy client-secret transports (#287)
  • 737dfa2 fix(cimd): negotiate optional client capabilities (#285)
  • Additional commits viewable in compare view

Updates lucide-react from 1.28.0 to 1.33.0

Release notes

Sourced from lucide-react's releases.

Version 1.33.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

Version 1.31.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.30.0...1.31.0

Version 1.30.0

What's Changed

... (truncated)

Commits
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • See full diff in compare view

Updates next from 16.2.12 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

  • docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
  • Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
  • Turbopack: rename to use turbopack: no side effects: #94427
  • refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360

... (truncated)

Commits
  • d0ac882 v16.3.2
  • 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
  • cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
  • eba236b [backport] Scope app-entry export validation to files inside the app director...
  • 3d32eb8 v16.3.1
  • 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
  • 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
  • Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates fast-xml-parser from 5.10.1 to 5.11.0

Release notes

Sourced from fast-xml-parser's releases.

v5.11.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)

... (truncated)

Commits

Updates agents from 0.20.1 to 0.21.0

Release notes

Sourced from agents's releases.

agents@0.21.0

Minor Changes

  • #2052 f9d71d6 Thanks @​cjol! - Expose WebSocketChatTransport and its connection types from the framework-neutral agents/chat/transport entry point. React peers are now optional for framework-neutral clients and servers.

    Existing users of agents/chat/react or @cloudflare/ai-chat/react must continue to declare compatible react and @ai-sdk/react dependencies explicitly.

  • #2091 4d2084c Thanks @​cjol! - Accept AI SDK flexible schemas in agentTool, including Valibot adapters, while preserving schema-driven input inference and structured output validation. Zod is no longer a peer requirement of @cloudflare/ai-chat.

    Existing custom schemas that no longer type-check as AI SDK FlexibleSchema must use the schema library's AI SDK adapter or wrap raw JSON Schema with jsonSchema(). Validation-only Standard Schema implementations are insufficient because tool inputs must expose JSON Schema to the model.

  • #2098 fe82e05 Thanks @​cjol! - Add connection-scoped Kitesurf support to Browser Tools through the browser: "kitesurf" session option. Unsupported durable session, Live View, recording, pause/resume, and Kitesurf-backed Quick Action surfaces remain unavailable.

    Existing Browser Tools users should note:

    • Large base64 values returned outside the canonical { type: "browser_screenshot", mediaType, data } shape are now redacted. Return screenshots in that shape or store binary output elsewhere.
    • TanStack browser tools have one output channel, so screenshot output is reduced to the compact model-facing summary rather than returning raw base64 data.

  • #1948 aed6d8f Thanks @​ericclemmons! - Pass Workflow retention through Agent.runWorkflow().

Patch Changes

  • #2037 1bca2a6 Thanks @​cjol! - Add buildAgentPath() and buildAgentUrl() for constructing canonical root-first Agent and sub-agent addresses for external HTTP requests, WebSocket connections, callbacks, and webhooks. React sub-agent connections now share the same descendant path encoder.

  • #2051 b9343a0 Thanks @​AntoniTok! - Stream forwarded request bodies into sub-agents instead of buffering them in the parent Durable Object.

    Agent._cf_forwardToFacet and routeSubAgentRequest both did forwardInit.body = await req.arrayBuffer() before dispatching to a child facet, materialising the entire request body in the parent's isolate. Two consequences:

    • The read sat in front of application-level validation. Agent.fetch returns before onRequest whenever the path matches /sub/{class}/{name}, so an app that carefully bounded request bodies in onRequest still had an unbounded read ahead of it — and no way to bound it itself.
    • The cost was per hop. A nested /sub/.../sub/... address re-materialised the same bytes at every level.

    Both call sites now pass req.body through as a stream. Measured on wrangler dev --local with a handler that never reads the body, peak RSS across the workerd processes for a single POST:

    Request body facet route, before facet route, after canonical route (control)
    16 MB +75 MB +4 MB +2 MB
    64 MB +268 MB +4 MB +2 MB
    128 MB +546 MB +4 MB +2 MB

    This restores the behaviour from before #1443, which switched to an explicit RequestInit in order to set a header on WebSocket upgrades and re-attached the body with arrayBuffer() as a side effect. The Upgrade header handling from that fix is unchanged.

    One behavioural note: backpressure now reaches the client. A child that returns without reading the body will cause the remainder of the upload to be cancelled, where previously the parent drained it in full. Existing handlers that require the complete upload must consume or stream request.body before returning.

  • #2034 efcb316 Thanks @​cjol! - Send Browser Run extraction schemas under response_format.json_schema, matching the Quick Actions /json contract.

    Direct browserExtract() and runQuickAction() callers must rename response_format.schema to response_format.json_schema. The model-facing browser_extract tool still accepts its schema in the top-level schema field.

  • #2023 2b2b598 Thanks @​threepointone! - Treat useAgentChat observer error frames as terminal responses.

    Plain-text error bodies are no longer parsed as stream chunks or merged into an empty assistant message. Error frames now clear observer streaming, replay, recovery, and tool-continuation state even when they omit done, matching the transport-owned stream behavior.

... (truncated)

Changelog

Sourced from agents's changelog.

0.21.0

Minor Changes

  • #2052 f9d71d6 Thanks @​cjol! - Expose WebSocketChatTransport and its connection types from the framework-neutral agents/chat/transport entry point. React peers are now optional for framework-neutral clients and servers.

    Existing users of agents/chat/react or @cloudflare/ai-chat/react must continue to declare compatible react and @ai-sdk/react dependencies explicitly.

  • #2091 4d2084c Thanks @​cjol! - Accept AI SDK flexible schemas in agentTool, including Valibot adapters, while preserving schema-driven input inference and structured output validation. Zod is no longer a peer requirement of @cloudflare/ai-chat.

    Existing custom schemas that no longer type-check as AI SDK FlexibleSchema must use the schema library's AI SDK adapter or wrap raw JSON Schema with jsonSchema(). Validation-only Standard Schema implementations are insufficient because tool inputs must expose JSON Schema to the model.

  • #2098 fe82e05 Thanks @​cjol! - Add connection-scoped Kitesurf support to Browser Tools through the browser: "kitesurf" session option. Unsupported durable session, Live View, recording, pause/resume, and Kitesurf-backed Quick Action surfaces remain unavailable.

    Existing Browser Tools users should note:

    • Large base64 values returned outside the canonical { type: "browser_screenshot", mediaType, data } shape are now redacted. Return screenshots in that shape or store binary output elsewhere.
    • TanStack browser tools have one output channel, so screenshot output is reduced to the compact model-facing summary rather than returning raw base64 data.

  • #1948 aed6d8f Thanks @​ericclemmons! - Pass Workflow retention through Agent.runWorkflow().

Patch Changes

  • #2037 1bca2a6 Thanks @​cjol! - Add buildAgentPath() and buildAgentUrl() for constructing canonical root-first Agent and sub-agent addresses for external HTTP requests, WebSocket connections, callbacks, and webhooks. React sub-agent connections now share the same descendant path encoder.

  • #2051 b9343a0 Thanks @​AntoniTok! - Stream forwarded request bodies into sub-agents instead of buffering them in the parent Durable Object.

    Agent._cf_forwardToFacet and routeSubAgentRequest both did forwardInit.body = await req.arrayBuffer() before dispatching to a child facet, materialising the entire request body in the parent's isolate. Two consequences:

    • The read sat in front of application-level validation. Agent.fetch returns before onRequest whenever the path matches /sub/{class}/{name}, so an app that carefully bounded request bodies in onRequest still had an unbounded read ahead of it — and no way to bound it itself.
    • The cost was per hop. A nested /sub/.../sub/... address re-materialised the same bytes at every level.

    Both call sites now pass req.body through as a stream. Measured on wrangler dev --local with a handler that never reads the body, peak RSS across the workerd processes for a single POST:

    Request body facet route, before facet route, after canonical route (control)
    16 MB +75 MB +4 MB +2 MB
    64 MB +268 MB +4 MB +2 MB
    128 MB +546 MB +4 MB +2 MB

    This restores the behaviour from before #1443, which switched to an explicit RequestInit in order to set a header on WebSocket upgrades and re-attached the body with arrayBuffer() as a side effect. The Upgrade header handling from that fix is unchanged.

    One behavioural note: backpressure now reaches the client. A child that returns without reading the body will cause the remainder of the upload to be cancelled, where previously the parent drained it in full. Existing handlers that require the complete upload must consume or stream request.body before returning.

  • #2034 efcb316 Thanks @​cjol! - Send Browser Run extraction schemas under response_format.json_schema, matching the Quick Actions /json contract.

    Direct browserExtract() and runQuickAction() callers must rename response_format.schema to response_format.json_schema. The model-facing browser_extract tool still accepts its schema in the top-level schema field.

  • #2023 2b2b598 Thanks @​threepointone! - Treat useAgentChat observer error frames as terminal responses.

... (truncated)

Commits

Updates @sigstore/protobuf-specs from 0.5.1 to 0.5.2

Changelog

Sourced from @​sigstore/protobuf-specs's changelog.

v0.5.2

  • Add monitor configuration protobuf definition (#907)
  • Add custom java_package to envelope.proto (#923)
Commits
  • 0342fe5 Prepare for 0.5.2 release (#925)
  • 15d97a6 build(deps): bump ts-proto...

    Description has been truncated

@dependabot
chore(deps): bump the production-minor group across 1 directory with …
f988d86 
…16 updates

Bumps the production-minor group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.8.3` | `0.10.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.33.0` |
| [next](https://github.com/vercel/next.js) | `16.2.12` | `16.3.2` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.10.1` | `5.11.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.20.1` | `0.21.0` |
| [@sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) | `0.5.1` | `0.5.2` |
| [@sigstore/verify](https://github.com/sigstore/sigstore-js) | `4.1.0` | `4.1.2` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [@remotion/bundler](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.515` |
| [@remotion/cli](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.515` |
| [@remotion/google-fonts](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.515` |
| [@remotion/renderer](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.515` |
| [@remotion/tailwind-v4](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.515` |
| [remotion](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.515` |



Updates `@cloudflare/workers-oauth-provider` from 0.8.3 to 0.10.3
- [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases)
- [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md)
- [Commits](cloudflare/workers-oauth-provider@v0.8.3...v0.10.3)

Updates `lucide-react` from 1.28.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)

Updates `next` from 16.2.12 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.2)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `fast-xml-parser` from 5.10.1 to 5.11.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0)

Updates `agents` from 0.20.1 to 0.21.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.21.0/packages/agents)

Updates `@sigstore/protobuf-specs` from 0.5.1 to 0.5.2
- [Release notes](https://github.com/sigstore/protobuf-specs/releases)
- [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md)
- [Commits](sigstore/protobuf-specs@v0.5.1...v0.5.2)

Updates `@sigstore/verify` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/verify@4.1.0...@sigstore/verify@4.1.2)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `@remotion/bundler` from 4.0.503 to 4.0.515
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.515)

Updates `@remotion/cli` from 4.0.503 to 4.0.515
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.515)

Updates `@remotion/google-fonts` from 4.0.503 to 4.0.515
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.515)

Updates `@remotion/renderer` from 4.0.503 to 4.0.515
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.515)

Updates `@remotion/tailwind-v4` from 4.0.503 to 4.0.515
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.515)

Updates `remotion` from 4.0.503 to 4.0.515
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.515)

---
updated-dependencies:
- dependency-name: "@cloudflare/workers-oauth-provider"
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: lucide-react
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: next
  dependency-version: 16.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: fast-xml-parser
  dependency-version: 5.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: agents
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: "@sigstore/protobuf-specs"
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@sigstore/verify"
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/bundler"
  dependency-version: 4.0.515
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/cli"
  dependency-version: 4.0.515
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/google-fonts"
  dependency-version: 4.0.515
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/renderer"
  dependency-version: 4.0.515
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/tailwind-v4"
  dependency-version: 4.0.515
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: remotion
  dependency-version: 4.0.515
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 26, 2026
@dependabot
dependabot Bot requested a review from choraria as a code owner August 26, 2026 03:04
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@choraria choraria Awaiting requested review from choraria choraria is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@choraria choraria

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@choraria