build(deps): bump the minor-and-patch group across 1 directory with 17 updates by dependabot[bot] · Pull Request #11 · Synapsr/SaaS-Monitor

dependabot · 2026-10-26T07:27:08Z

Bumps the minor-and-patch group with 17 updates in the / directory:

Package	From	To
better-auth	`1.7.6`	`1.7.12`
cn	`0.4.0`	`0.5.0`
drizzle-orm	`0.45.3`	`0.45.4`
geist	`1.7.2`	`1.8.2`
gleap	`19.3.0`	`19.3.5`
lucide-react	`1.48.0`	`1.61.0`
mysql2	`3.24.4`	`3.24.6`
next	`16.3.6`	`16.4.2`
radix-ui	`1.6.7`	`1.8.1`
react	`19.2.8`	`19.3.1`
react-dom	`19.2.8`	`19.3.1`
zod	`4.6.5`	`4.6.7`
@types/node	`24.19.0`	`24.19.2`
eslint-config-next	`16.3.6`	`16.4.2`
prettier	`3.9.9`	`3.9.10`
shadcn	`4.21.0`	`4.22.1`
vitest	`5.0.2`	`5.0.5`

Updates better-auth from 1.7.6 to 1.7.12

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)

Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)

Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)

Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)

Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)

Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)

Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@alpcanaydin, @bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

#11925 fb48619 Thanks @bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

#11924 681aa5c Thanks @bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

#11930 b18e3b8 Thanks @bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

@better-auth/core@1.7.12

@better-auth/drizzle-adapter@1.7.12

@better-auth/kysely-adapter@1.7.12

@better-auth/memory-adapter@1.7.12

@better-auth/mongo-adapter@1.7.12

@better-auth/prisma-adapter@1.7.12

@better-auth/telemetry@1.7.12

1.7.11

Patch Changes

#10719 bd65db0 Thanks @rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

#11521 37a75c9 Thanks @aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

@better-auth/core@1.7.11

@better-auth/drizzle-adapter@1.7.11

@better-auth/kysely-adapter@1.7.11

@better-auth/memory-adapter@1.7.11

@better-auth/mongo-adapter@1.7.11

@better-auth/prisma-adapter@1.7.11

@better-auth/telemetry@1.7.11

1.7.10

Patch Changes

#11393 eebd47a Thanks @breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

#11821 09d07e6 Thanks @gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

... (truncated)

Commits

f4260a9 chore: release v1.7.12 (#11922)
b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
681aa5c fix(session): keep the cause of session lookup failures (#11924)
52ab801 chore: release v1.7.11 (#11827)
37a75c9 fix(rate-limit): convert a string lastRequest before computing X-Retry-After ...
bd65db0 fix(db): recognize postgres int8 as a number type in migration diffs (#10719)
b734a41 chore: release v1.7.10 (#11795)
eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
Additional commits viewable in compare view

Updates cn from 0.4.0 to 0.5.0

Release notes

Sourced from cn's releases.

cn@0.5.0

Minor Changes

#157 663adea Thanks @shadcn! - Drop Node 20, which reached end of life, and require Node 22 or later.

#164 64aa1d0 Thanks @shadcn! - cn build now follows package @imports, reads @theme declarations after nested blocks such as @keyframes, and drops names declared before a --*: initial reset.

Changelog

Sourced from cn's changelog.

0.5.0

Minor Changes

#157 663adea Thanks @shadcn! - Drop Node 20, which reached end of life, and require Node 22 or later.

#164 64aa1d0 Thanks @shadcn! - cn build now follows package @imports, reads @theme declarations after nested blocks such as @keyframes, and drops names declared before a --*: initial reset.

Commits

8ebcbf0 chore(release): version packages (#158)
64aa1d0 fix(build): read @theme scales the way Tailwind builds them (#164)
c71bd53 chore: migrate tooling to Vite+ (#156)
663adea chore: drop Node 20 (#157)
See full diff in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
See full diff in compare view

Updates geist from 1.7.2 to 1.8.2

Changelog

Sourced from geist's changelog.

1.8.2

Patch Changes

742b082: Center the horizontal bars in the Geist Sans yen sign across all weights.

1.8.1

Patch Changes

3b58290: Align font binary versions with the package version. Geist and Geist Italic: 1.800 → 1.801. Geist Mono and Geist Mono Italic: 1.700 → 1.801.

Geist Mono had stayed at 1.700 across v1.7.1 and v1.7.2, even though liga was reverted at source in #217, so pre- and post-revert binaries reported the same version (head.fontRevision / name ID 5). Geist Sans already reported 1.800, ahead of the 1.7.x package.

The package skips from 1.7.2 to 1.8.1 so the package version and the font version follow the same rule, M.X.Y ↔ M.(X×100+Y) (see "Version Numbers" in CONTRIBUTING.md). 1.8.0 is skipped because a GitHub release named 1.8.0 already exists with different font files.

Closes the second half of #231.

339fffd: Geist Sans: stop mapping U+03C9 (small omega ω) to the capital Omega glyph; encode U+2126 OHM SIGN instead.

Commits

1d6dfdb Version Packages (#252)
742b082 fix: center Geist Sans yen bars (#213)
e1f671c Fold small omega fix into the 1.8.1 release (#251)
fed9ff8 Version Packages (#249)
339fffd Geist Sans: don't map small omega to the capital Omega glyph (#248)
3b58290 Align package and font versions for 1.8.1 (#238)
See full diff in compare view

Updates gleap from 19.3.0 to 19.3.5

Release notes

Sourced from gleap's releases.

19.3.5

Fixed: a product tour step whose selector only matched a hidden element (display: none, such as the label of a collapsed menu or the hidden copy of a responsive menu) froze the page. The step pointed at the top-left corner, the overlay blocked every click, a click step had no way forward and reloading brought the step back. Steps now use the first visible match; with none, the tour waits up to 5 s for the element to appear and then ends, like a selector that matches nothing.

19.3.4

New: the widget can switch the visitor to a contact after the "Verify email" workflow step confirmed their email (adopt-session). The SDK checks the handed-over session with the server first and never replaces a user your app identified. New: custom actions from chat messages and message cards now pass their data to your Gleap.registerCustomAction callback as data (next to name and shareToken), with a Messenger that sends it. Callbacks that only read name keep working.

19.3.2

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

19.3.1

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs. Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

Changelog

Sourced from gleap's changelog.

19.3.5

Fixed: a product tour step whose selector only matched a hidden element (display: none, such as the label of a collapsed menu or the hidden copy of a responsive menu) froze the page. The step pointed at the top-left corner, the overlay blocked every click, a click step had no way forward and reloading brought the step back. Steps now use the first visible match; with none, the tour waits up to 5 s for the element to appear and then ends, like a selector that matches nothing.

19.3.4

New: the widget can switch the visitor to a contact after the "Verify email" workflow step confirmed their email (adopt-session). The SDK checks the handed-over session with the server first and never replaces a user your app identified. New: custom actions from chat messages and message cards now pass their data to your Gleap.registerCustomAction callback as data (next to name and shareToken), with a Messenger that sends it. Callbacks that only read name keep working.

19.3.3

Fixed: charts and other SVG graphics could be missing from screenshots. An empty <style> inside an <svg> was captured as a stylesheet link to null, and the screenshot then dropped everything in the svg after it. Inline style sheets now always stay <style> elements; linked style sheets whose rules can't be read are still linked.

19.3.2

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

19.3.1

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs. Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

Commits

ece8c93 Merge pull request #189 from GleapSDK/chore/release-19.3.5
7bd741b chore: version 19.3.5
b25ca35 Merge pull request #188 from GleapSDK/fix-185122-tour-hidden-target
a96fcbb fix(185122): don't anchor product tour steps to hidden elements
e2554ca Merge pull request #185 from GleapSDK/feat/adopt-session
c106b9b Merge remote-tracking branch 'origin/master' into feat/adopt-session
c881ce8 Merge pull request #187 from GleapSDK/feat/custom-action-data
b59308e chore: version 19.3.4
8790dbc Merge remote-tracking branch 'origin/master' into feat/adopt-session
6c438a0 feat: custom actions pass their data to registerCustomAction callbacks
Additional commits viewable in compare view

Updates lucide-react from 1.48.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

feat(icons): added circle-chevrons-down, circle-chevrons-left, circle-chevrons-right and 1 more icons by @ypotti in lucide-icons/lucide#5025

New Contributors

@ypotti made their first contribution in lucide-icons/lucide#5025

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

feat(icons): added tombstone icon by @ryck in lucide-icons/lucide#4929

feat(icons): added smartphone-user-round icon by @hitanshu-machhi in lucide-icons/lucide#4586

feat(icons): added bacon icon by @devkamani9313-lab in lucide-icons/lucide#4694

fix(site): Fix build by @ericfennis in lucide-icons/lucide#5033

chore(docs): Update icon count comparison with Feather Icons by @noahweidig in lucide-icons/lucide#5022

feat(icons): added letter-spacing icon by @madebyoz in lucide-icons/lucide#3038

chore(deps): bump the vue-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#5027

chore(deps-dev): bump react-native from 0.87.1 to 0.88.0 in the react-native-deps group by @dependabot[bot] in lucide-icons/lucide#5030

feat(icons): added line-height icon by @madebyoz in lucide-icons/lucide#3039

chore(deps-dev): bump the svelte-deps group across 1 directory with 2 updates by @dependabot[bot] in lucide-icons/lucide#5028

chore(deps): bump the react-deps group across 1 directory with 2 updates by @dependabot[bot] in lucide-icons/lucide#5026

feat(icons): added brain-off icon by @ej52 in lucide-icons/lucide#3535

feat(icons): added graph-hub icon by @Carlito-la-banane in lucide-icons/lucide#4974

feat(svelte): export __iconData and __iconNode across per-icon modules (#4936) by @ronitgupta138 in lucide-icons/lucide#4957

New Contributors

@hitanshu-machhi made their first contribution in lucide-icons/lucide#4586

@devkamani9313-lab made their first contribution in lucide-icons/lucide#4694

@noahweidig made their first contribution in lucide-icons/lucide#5022

@madebyoz made their first contribution in lucide-icons/lucide#3038

@ej52 made their first contribution in lucide-icons/lucide#3535

@Carlito-la-banane made their first contribution in lucide-icons/lucide#4974

@ronitgupta138 made their first contribution in lucide-icons/lucide#4957

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

feat(docs): Adds search field to docs pages by @ericfennis in lucide-icons/lucide#5012

fix(icons): changed chess-queen icon by @karsa-mistmere in lucide-icons/lucide#4613

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

feat(docs): add third-party package lucide-jte by @sgruendel in lucide-icons/lucide#5000

chore(integration-tests): Add Svelte integration tests for @ucide/svelte by @ericfennis in lucide-icons/lucide#5005

chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @dependabot[bot] in lucide-icons/lucide#5004

... (truncated)

Commits

fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
3f1255e chore(deps-dev): bump @vitejs/plugin-react (#4995)
949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
See full diff in compare view

Updates mysql2 from 3.24.4 to 3.24.6

Release notes

Sourced from mysql2's releases.

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

Changelog

Sourced from mysql2's changelog.

3.24.6 (2026-10-13)

Bug Fixes

allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

3.24.5 (2026-09-29)

Bug Fixes

strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

Commits

7f65d9a chore(master): release 3.24.6 (#4592)
ded9be2 build(deps-dev): bump rollup from 4.64.0 to 4.64.4 in the rollup group (#4605)
30201a2 build(deps-dev): bump @types/node from 26.6.4 to 26.6.5 (#4606)
5eb21f4 build(deps-dev): bump prettier (#4604)
477ca97 build(deps): bump lucide-react from 1.52.0 to 1.55.0 in /website (#4609)
9ea9345 build(deps-dev): bump prettier from 3.9.9 to 3.9.10 in /website (#4608)
c52e961 build(deps-dev): bump @types/node from 26.6.4 to 26.6.5 in /website (#4607)
1cdba3c build(deps-dev): bump @biomejs/biome from 2.5.14 to 2.5.15 (#4585)
a270608 build(deps-dev): bump @types/node from 26.6.3 to 26.6.4 (#4584)
51e02b3 build(deps-dev): bump brace-expansion from 5.0.9 to 5.0.12 (#4601)
Additional commits viewable in compare view

Updates next from 16.3.6 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

docs: improve clarity and punctuation in README: #86096

Fix debug build paths Pages Router support entries: #93529

bundle-analyzer: record historical snapshots on each analyze run: #93520

fix: detect proxy.ts correctly with compound pageExtensions: #93246

feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624

docs: proxy event argument: #96435

docs: remove experimental note from runtime prefetching: #96615

Preserve per-segment prefetching after dynamic navigation: #96583

Rename static generation stream option to waitForAllReady: #96564

Remove obsolete static generation plumbing: #96563

[turbopack] Drop dead writes to exports: #96381

[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380

[turbopack] Add test for sideEffects with optimizePackageImports: #96549

[turbopack] Strip leading BOM before parsing CSS: #96678

Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates radix-ui from 1.6.7 to 1.8.1

Changelog

Sourced from radix-ui's changelog.

1.8.1

Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

Updated dependencies: @radix-ui/react-accordion@1.3.1, @radix-ui/react-avatar@1.3.1, @radix-ui/react-checkbox@1.4.1, @radix-ui/react-collapsible@1.2.1, @radix-ui/react-context-menu@2.4.1, @radix-ui/react-dialog@1.3.1, @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-dropdown-menu@2.2.1, @radix-ui/react-focus-scope@1.3.1, @radix-ui/react-hover-card@1.2.1, @radix-ui/react-menu@2.2.1, @radix-ui/react-menubar@1.2.1, @radix-ui/react-navigation-menu@1.4.1, @radix-ui/react-one-time-password-field@0.2.1, @radix-ui/react-password-toggle-field@0.2.1, @radix-ui/react-popover@1.3.1, @radix-ui/react-progress@1.2.1, @radix-ui/react-roving-focus@1.2.1, @radix-ui/react-select@2.4.1, @radix-ui/react-slider@1.6.1, @radix-ui/react-switch@1.4.1, @radix-ui/react-tabs@1.2.1, @radix-ui/react-toast@1.3.1, @radix-ui/react-toggle@1.2.1, @radix-ui/react-toggle-group@1.2.1, @radix-ui/react-tooltip@1.4.1, @radix-ui/react-alert-dialog@1.2.1, @radix-ui/react-radio-group@1.5.1, @radix-ui/react-toolbar@1.2.1

1.8.0

Context Menu

Allowed side, sideOffset, and align props to be overridden on ContextMenu.Content.

Navigation Menu

Added data-state attribute to the content element when using NavigationMenu.Viewport for consistency.

Popover

Fixed aria-controls being set on Popover.Trigger while the popover is closed.

Select

Fixed content alignment when all items are disabled.

Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.

Slider

Fixed a bug where updating a Slider value programmatically while inside a <form> would dispatch an input event that propagated to ancestor onInput handlers.

Slot

Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

Toast

Fixed Toast.Viewport forcing a still-hydrating Suspense boundary to client-render.

Tooltip

Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.

Other updates

Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.

Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.

Fixed timing bugs in useCallbackRef.

Fixed FocusScope throwing a TypeError in test environments after teardown.

Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.

Some small and breaking changes in unstable collection APIs. This package is an internal utility, undocumented, and unstable APIs may change without a major version bump. Capturing those changes here just in case you did a naughty and used them.

Renamed unstable_CollectionProps to unstable_CollectionSlotProps and unstable_CollectionItemMap to unstable_CollectionDict.

Added useGetCollection to the functions returned from unstable_createCollection.

... (truncated)

Commits

See full diff in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699,

…7 updates Bumps the minor-and-patch group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.6` | `1.7.12` | | [cn](https://github.com/shadcn-ui/cn/tree/HEAD/packages/cn) | `0.4.0` | `0.5.0` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` | | [geist](https://github.com/vercel/geist-font/tree/HEAD/packages/next) | `1.7.2` | `1.8.2` | | [gleap](https://github.com/GleapSDK/JavaScript-SDK) | `19.3.0` | `19.3.5` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.61.0` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.24.4` | `3.24.6` | | [next](https://github.com/vercel/next.js) | `16.3.6` | `16.4.2` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.8.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.1` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.0` | `24.19.2` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.6` | `16.4.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.0` | `4.22.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.2` | `5.0.5` | Updates `better-auth` from 1.7.6 to 1.7.12 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/better-auth) Updates `cn` from 0.4.0 to 0.5.0 - [Release notes](https://github.com/shadcn-ui/cn/releases) - [Changelog](https://github.com/shadcn-ui/cn/blob/main/packages/cn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/cn/commits/cn@0.5.0/packages/cn) Updates `drizzle-orm` from 0.45.3 to 0.45.4 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4) Updates `geist` from 1.7.2 to 1.8.2 - [Release notes](https://github.com/vercel/geist-font/releases) - [Changelog](https://github.com/vercel/geist-font/blob/main/packages/next/CHANGELOG.md) - [Commits](https://github.com/vercel/geist-font/commits/v1.8.2/packages/next) Updates `gleap` from 19.3.0 to 19.3.5 - [Release notes](https://github.com/GleapSDK/JavaScript-SDK/releases) - [Changelog](https://github.com/GleapSDK/JavaScript-SDK/blob/master/CHANGELOG.md) - [Commits](GleapSDK/JavaScript-SDK@19.3.0...19.3.5) Updates `lucide-react` from 1.48.0 to 1.61.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react) Updates `mysql2` from 3.24.4 to 3.24.6 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.24.4...v3.24.6) Updates `next` from 16.3.6 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.6...v16.4.2) Updates `radix-ui` from 1.6.7 to 1.8.1 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `react` from 19.2.8 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.2.8 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@types/node` from 24.19.0 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint-config-next` from 16.3.6 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-config-next) Updates `prettier` from 3.9.9 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `shadcn` from 4.21.0 to 4.22.1 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.22.1/packages/shadcn) Updates `vitest` from 5.0.2 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: cn dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: drizzle-orm dependency-version: 0.45.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: geist dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: gleap dependency-version: 19.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mysql2 dependency-version: 3.24.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: radix-ui dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: shadcn dependency-version: 4.22.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-09T07:28:44Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026

dependabot Bot closed this Nov 9, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-f774f9b549 branch November 9, 2026 07:28

Navigation Menu

Repository navigation

build(deps): bump the minor-and-patch group across 1 directory with 17 updates - #11

build(deps): bump the minor-and-patch group across 1 directory with 17 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-f774f9b549

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.12

better-auth

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/mcp

Bug Fixes

@better-auth/sso

Bug Fixes

Contributors

1.7.12

Patch Changes

1.7.11

Patch Changes

1.7.10

Patch Changes

cn@0.5.0

Minor Changes

0.5.0

Minor Changes

0.45.4

1.8.2

Patch Changes

1.8.1

Patch Changes

19.3.5

19.3.4

19.3.2

19.3.1

19.3.5

19.3.4

19.3.3

19.3.2

19.3.1

Version 1.61.0

What's Changed

New Contributors

Version 1.60.0

What's Changed

New Contributors

Version 1.59.0

What's Changed

Version 1.58.0

What's Changed

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

3.24.6 (2026-10-13)

Bug Fixes

3.24.5 (2026-09-29)

Bug Fixes

v16.4.2

What's Changed

v16.4.1

v16.4.0

Core Changes

Misc Changes

1.8.1

1.8.0

Context Menu

Navigation Menu

Popover

Select

Slider

Slot

Toast

Tooltip

Other updates

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

`better-auth`

`@better-auth/core`

`@better-auth/mcp`

`@better-auth/sso`