Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 22 updates - #18

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-55852ea300
Open

build(deps): bump the minor-and-patch group across 1 directory with 22 updates#18
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-55852ea300

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown

Bumps the minor-and-patch group with 22 updates in the / directory:

Package From To
better-auth 1.7.6 1.7.18
cn 0.4.0 0.5.2
d3-scale 4.0.2 4.0.3
d3-shape 3.2.0 3.2.1
d3-time 3.1.0 3.1.1
drizzle-orm 0.45.3 0.45.4
geist 1.7.2 1.9.1
gleap 19.3.0 19.3.9
lucide-react 1.48.0 1.70.0
mysql2 3.24.4 3.24.6
next 16.3.6 16.4.5
radix-ui 1.6.7 1.8.1
react 19.2.8 19.3.1
react-dom 19.2.8 19.3.1
zod 4.6.5 4.6.7
@tailwindcss/postcss 4.3.3 4.3.4
@types/node 24.19.0 24.19.2
eslint-config-next 16.3.6 16.4.5
prettier 3.9.9 3.9.10
shadcn 4.21.0 4.23.0
tailwindcss 4.3.3 4.3.4
vitest 5.0.2 5.1.0

Updates better-auth from 1.7.6 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

  • #12259 9e2a0ec Thanks @​gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

  • #12244 85f4342 Thanks @​gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

  • #12250 278bb28 Thanks @​gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

  • Updated dependencies [9342a73]:

    • @​better-auth/core@​1.7.18
    • @​better-auth/drizzle-adapter@​1.7.18
    • @​better-auth/kysely-adapter@​1.7.18
    • @​better-auth/memory-adapter@​1.7.18
    • @​better-auth/mongo-adapter@​1.7.18
    • @​better-auth/prisma-adapter@​1.7.18
    • @​better-auth/telemetry@​1.7.18

1.7.17

Patch Changes

  • #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

  • #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

  • #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

  • #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

  • #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

  • #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

  • #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

  • Updated dependencies [fc2e00b]:

    • @​better-auth/kysely-adapter@​1.7.17
    • @​better-auth/core@​1.7.17
    • @​better-auth/drizzle-adapter@​1.7.17
    • @​better-auth/memory-adapter@​1.7.17
    • @​better-auth/mongo-adapter@​1.7.17
    • @​better-auth/prisma-adapter@​1.7.17
    • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

... (truncated)

Commits
  • 38f43e3 chore: release v1.7.18 (#12252)
  • 9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
  • 278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
  • 85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
  • e3ae9e1 chore: release v1.7.17 (#12214)
  • b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
  • fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
  • 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
  • 9150314 fix(phone-number): treat empty phone number as missing (#12219)
  • cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
  • Additional commits viewable in compare view

Updates cn from 0.4.0 to 0.5.2

Release notes

Sourced from cn's releases.

cn@0.5.2

Patch Changes

  • #162 b8c5a1b Thanks @​nonhana! - Export CnFunction, Engine, and ClassNameValue from cn/config, and those plus ClassValue from cn/engine. Exporting an inferred createCn() result (export const cn = createCn({ ... })) no longer fails with TS2742 or TS2883 in projects that emit declarations.

  • #167 6ebb4ce Thanks @​RaphaelFakhri! - cn build keeps numeric spacing such as p-4 when a stylesheet declares --spacing after a --*: initial or --spacing-*: initial reset, and keeps p-px through the reset, as Tailwind does.

  • #160 a805c68 Thanks @​mehimanshupatil! - createCn, createTwMerge, and extendTailwindMerge from cn/config accept optional type arguments for custom class-group and theme ids, like tailwind-merge's extendTailwindMerge<ClassGroupIds, ThemeGroupIds>. With them, unknown group keys and conflict ids are type errors. Without them, any id is still accepted.

cn@0.5.1

Patch Changes

  • #165 5e65675 Thanks @​shadcn! - Group the legacy bg-gradient-to-* utilities as bg-color, the same as tailwind-merge. cn("bg-background", "bg-gradient-to-r") now returns bg-gradient-to-r, and bg-gradient-to-r no longer replaces bg-linear-to-r or an arbitrary bg-[...] image.

cn@0.5.0

Minor Changes

  • #157 663adea Thanks @​shadcn! - Drop Node 20, which reached end of life, and require Node 22 or later.

  • #164 64aa1d0 Thanks @​shadcn! - cn build now follows package @imports, reads @theme declarations after nested blocks such as @keyframes, and drops names declared before a --*: initial reset.

Changelog

Sourced from cn's changelog.

0.5.2

Patch Changes

  • #162 b8c5a1b Thanks @​nonhana! - Export CnFunction, Engine, and ClassNameValue from cn/config, and those plus ClassValue from cn/engine. Exporting an inferred createCn() result (export const cn = createCn({ ... })) no longer fails with TS2742 or TS2883 in projects that emit declarations.

  • #167 6ebb4ce Thanks @​RaphaelFakhri! - cn build keeps numeric spacing such as p-4 when a stylesheet declares --spacing after a --*: initial or --spacing-*: initial reset, and keeps p-px through the reset, as Tailwind does.

  • #160 a805c68 Thanks @​mehimanshupatil! - createCn, createTwMerge, and extendTailwindMerge from cn/config accept optional type arguments for custom class-group and theme ids, like tailwind-merge's extendTailwindMerge<ClassGroupIds, ThemeGroupIds>. With them, unknown group keys and conflict ids are type errors. Without them, any id is still accepted.

0.5.1

Patch Changes

  • #165 5e65675 Thanks @​shadcn! - Group the legacy bg-gradient-to-* utilities as bg-color, the same as tailwind-merge. cn("bg-background", "bg-gradient-to-r") now returns bg-gradient-to-r, and bg-gradient-to-r no longer replaces bg-linear-to-r or an arbitrary bg-[...] image.

0.5.0

Minor Changes

  • #157 663adea Thanks @​shadcn! - Drop Node 20, which reached end of life, and require Node 22 or later.

  • #164 64aa1d0 Thanks @​shadcn! - cn build now follows package @imports, reads @theme declarations after nested blocks such as @keyframes, and drops names declared before a --*: initial reset.

Commits
  • b6a8dbe chore(release): version packages (#170)
  • 6ebb4ce fix(build): keep numeric spacing after a theme reset that redeclares --spacin...
  • b8c5a1b fix: export CnFunction and Engine types from cn/config and cn/engine (#162)
  • a805c68 feat(config): typed group ids for createCn / extendTailwindMerge (#160)
  • 8e5cc59 chore(release): version packages (#168)
  • 5e65675 fix(config): group bg-gradient-to-* as bg-color like tailwind-merge (#165)
  • 8ebcbf0 chore(release): version packages (#158)
  • 64aa1d0 fix(build): read @​theme scales the way Tailwind builds them (#164)
  • c71bd53 chore: migrate tooling to Vite+ (#156)
  • 663adea chore: drop Node 20 (#157)
  • See full diff in compare view

Updates d3-scale from 4.0.2 to 4.0.3

Release notes

Sourced from d3-scale's releases.

v4.0.3

  • Update dependencies.
  • Adopt pnpm and vitest.
  • Adopt npm trusted publishing.
  • Publish an ES module bundle instead of separate source files.
  • Fix off by 1ms in scaleTime.invert. #281
  • Fix diverging scale to treat null input as unknown. Thanks, @​jheer! #290
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3-scale since your current version.


Updates d3-shape from 3.2.0 to 3.2.1

Release notes

Sourced from d3-shape's releases.

v3.2.1

  • Update dependencies.
  • Adopt pnpm and vitest.
  • Adopt npm trusted publishing.
  • Publish an ES module bundle instead of separate source files.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3-shape since your current version.


Updates d3-time from 3.1.0 to 3.1.1

Release notes

Sourced from d3-time's releases.

v3.1.1

  • Update dependencies.
  • Adopt pnpm and vitest.
  • Adopt npm trusted publishing.
  • Publish an ES module bundle instead of separate source files.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3-time since your current version.


Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

  • Fixed postgres-js not using prepared queries on explicit .prepare(name)
Commits
  • eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
  • See full diff in compare view

Updates geist from 1.7.2 to 1.9.1

Changelog

Sourced from geist's changelog.

1.9.1

Patch Changes

  • bace39d: Update Geist Serif to 1.002: adds ^ ¢ £, and the variable font is now named "Geist Serif" (was "Geist Serif VF").

1.9.0

Minor Changes

  • d33068f: Add Geist Serif variable and static fonts.

1.8.2

Patch Changes

  • 742b082: Center the horizontal bars in the Geist Sans yen sign across all weights.

1.8.1

Patch Changes

  • 3b58290: Align font binary versions with the package version. Geist and Geist Italic: 1.800 → 1.801. Geist Mono and Geist Mono Italic: 1.700 → 1.801.

    Geist Mono had stayed at 1.700 across v1.7.1 and v1.7.2, even though liga was reverted at source in #217, so pre- and post-revert binaries reported the same version (head.fontRevision / name ID 5). Geist Sans already reported 1.800, ahead of the 1.7.x package.

    The package skips from 1.7.2 to 1.8.1 so the package version and the font version follow the same rule, M.X.Y ↔ M.(X×100+Y) (see "Version Numbers" in CONTRIBUTING.md). 1.8.0 is skipped because a GitHub release named 1.8.0 already exists with different font files.

    Closes the second half of #231.

  • 339fffd: Geist Sans: stop mapping U+03C9 (small omega ω) to the capital Omega glyph; encode U+2126 OHM SIGN instead.

Commits

Updates gleap from 19.3.0 to 19.3.9

Release notes

Sourced from gleap's releases.

19.3.9

Fixed: a hotspot tooltip floated over the page while the panel around it scrolled, instead of staying next to its element. Since 19.3.7 the hotspot is absolutely positioned so it does not shift the element's layout; inside a scrolling panel without a positioned ancestor it was anchored outside the panel. The hotspot now uses its element as the anchor and scrolls with it.

19.3.8

Fixed: Gleap.identify with a userHash sent nothing when the browser already held a contact identified with the same user id and data without a hash (identified before identity verification was switched on, or before the app passed a hash). The server never received the hash, so the contact was never marked as verified. The SDK now sends the hashed identify once per contact and browser and skips unchanged identifies again afterwards. Only the user id is remembered, never the hash; logging out with Gleap.clearIdentity() clears it.

19.3.7

Fixed: the launcher could not be reached with the keyboard. It is now a focusable button with a name ("Open support chat" or your button text) and an expanded state; Enter and Space open the messenger and move focus into it, a focus ring shows on keyboard focus, and closing the messenger from inside returns focus to the launcher. Fixed: hotspot tooltips only appeared after a full reload in apps that navigate without one (Turbo Drive, SPAs). Tooltips now follow URL changes, re-attach to re-rendered elements and are removed when their page rules no longer match. A hotspot no longer shifts the element it points at.

19.3.6

Fixed: a language switch in the app never reached the contact. Gleap.identify and Gleap.updateContact skipped the request when the user data was unchanged, without looking at the language, so apps that change language without a full reload (Turbo, SPAs updating <html lang>) kept the old language on the contact and language-targeted outreach used it. The SDK now sends the update when the active language differs from the contact's. Fixed: Gleap.clearIdentity() called before the widget UI mounted (a queued call in the async snippet) left the previous contact's cached notifications in place, and a reload showed them to the next visitor. Cached notifications are now cleared regardless and are only shown to the contact that received them. Fixed: cached notification cards ignored disabled notifications and were still shown.

19.3.5

Fixed: a product tour step whose selector only matched a hidden element (display: none, such as the label of a collapsed menu or the hidden copy of a responsive menu) froze the page. The step pointed at the top-left corner, the overlay blocked every click, a click step had no way forward and reloading brought the step back. Steps now use the first visible match; with none, the tour waits up to 5 s for the element to appear and then ends, like a selector that matches nothing.

19.3.4

New: the widget can switch the visitor to a contact after the "Verify email" workflow step confirmed their email (adopt-session). The SDK checks the handed-over session with the server first and never replaces a user your app identified. New: custom actions from chat messages and message cards now pass their data to your Gleap.registerCustomAction callback as data (next to name and shareToken), with a Messenger that sends it. Callbacks that only read name keep working.

19.3.2

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

19.3.1

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs. Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

Changelog

Sourced from gleap's changelog.

19.3.9

Fixed: a hotspot tooltip floated over the page while the panel around it scrolled, instead of staying next to its element. Since 19.3.7 the hotspot is absolutely positioned so it does not shift the element's layout; inside a scrolling panel without a positioned ancestor it was anchored outside the panel. The hotspot now uses its element as the anchor and scrolls with it.

19.3.8

Fixed: Gleap.identify with a userHash sent nothing when the browser already held a contact identified with the same user id and data without a hash (identified before identity verification was switched on, or before the app passed a hash). The server never received the hash, so the contact was never marked as verified. The SDK now sends the hashed identify once per contact and browser and skips unchanged identifies again afterwards. Only the user id is remembered, never the hash; logging out with Gleap.clearIdentity() clears it.

19.3.7

Fixed: the launcher could not be reached with the keyboard. It is now a focusable button with a name ("Open support chat" or your button text) and an expanded state; Enter and Space open the messenger and move focus into it, a focus ring shows on keyboard focus, and closing the messenger from inside returns focus to the launcher. Fixed: hotspot tooltips only appeared after a full reload in apps that navigate without one (Turbo Drive, SPAs). Tooltips now follow URL changes, re-attach to re-rendered elements and are removed when their page rules no longer match. A hotspot no longer shifts the element it points at.

19.3.6

Fixed: a language switch in the app never reached the contact. Gleap.identify and Gleap.updateContact skipped the request when the user data was unchanged, without looking at the language, so apps that change language without a full reload (Turbo, SPAs updating <html lang>) kept the old language on the contact and language-targeted outreach used it. The SDK now sends the update when the active language differs from the contact's. Fixed: Gleap.clearIdentity() called before the widget UI mounted (a queued call in the async snippet) left the previous contact's cached notifications in place, and a reload showed them to the next visitor. Cached notifications are now cleared regardless and are only shown to the contact that received them. Fixed: cached notification cards ignored disabled notifications and were still shown.

19.3.5

Fixed: a product tour step whose selector only matched a hidden element (display: none, such as the label of a collapsed menu or the hidden copy of a responsive menu) froze the page. The step pointed at the top-left corner, the overlay blocked every click, a click step had no way forward and reloading brought the step back. Steps now use the first visible match; with none, the tour waits up to 5 s for the element to appear and then ends, like a selector that matches nothing.

19.3.4

New: the widget can switch the visitor to a contact after the "Verify email" workflow step confirmed their email (adopt-session). The SDK checks the handed-over session with the server first and never replaces a user your app identified. New: custom actions from chat messages and message cards now pass their data to your Gleap.registerCustomAction callback as data (next to name and shareToken), with a Messenger that sends it. Callbacks that only read name keep working.

19.3.3

Fixed: charts and other SVG graphics could be missing from screenshots. An empty <style> inside an <svg> was captured as a stylesheet link to null, and the screenshot then dropped everything in the svg after it. Inline style sheets now always stay <style> elements; linked style sheets whose rules can't be read are still linked.

19.3.2

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

19.3.1

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs. Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

Commits
  • 2c8f9f9 fix(227901): hotspot tooltips scroll with their panel; version 19.3.9 (#202)
  • 5109ec5 Merge pull request #201 from GleapSDK/chore/release-19.3.8
  • 33154aa chore: version 19.3.8
  • c75b120 Merge pull request #200 from GleapSDK/fix-identify-hash-resend
  • 7086553 fix(identify): send a userHash once even when the cached identity is unchange...
  • 6efdcfa chore: version 19.3.7 (#199)
  • c1a185e fix(a11y): keyboard-operable launcher (#198)
  • 005566b Merge pull request #196 from GleapSDK/fix-226629-226620-tooltips
  • 1ad62f6 fix(226629): tooltips survive SPA/Turbo navigation; hotspot no longer shifts ...
  • 925746e Merge pull request #195 from GleapSDK/chore/release-19.3.6-with-226492
  • Additional commits viewable in compare view

Updates lucide-react from 1.48.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

... (truncated)

Commits
  • b196797 Update deps (#5146)
  • 588113e test(build-icons): cover Windows file URL imports (#4862)
  • 14cab02 feat(site): Add sponsor page (#5132)
  • 1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
  • e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
  • 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
  • 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
  • 20aef31 chore(packages): Update sponsors (#5034)
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • Additional commits viewable in compare view

Updates mysql2 from 3.24.4 to 3.24.6

Release notes

Sourced from mysql2's releases.

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

  • allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

  • strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)
Changelog

Sourced from mysql2's changelog.

3.24.6 (2026-10-13)

Bug Fixes

  • allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

3.24.5 (2026-09-29)

Bug Fixes

  • strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)
Commits

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 2…
8dfa899 
…2 updates

Bumps the minor-and-patch group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.6` | `1.7.18` |
| [cn](https://github.com/shadcn-ui/cn/tree/HEAD/packages/cn) | `0.4.0` | `0.5.2` |
| [d3-scale](https://github.com/d3/d3-scale) | `4.0.2` | `4.0.3` |
| [d3-shape](https://github.com/d3/d3-shape) | `3.2.0` | `3.2.1` |
| [d3-time](https://github.com/d3/d3-time) | `3.1.0` | `3.1.1` |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` |
| [geist](https://github.com/vercel/geist-font/tree/HEAD/packages/next) | `1.7.2` | `1.9.1` |
| [gleap](https://github.com/GleapSDK/JavaScript-SDK) | `19.3.0` | `19.3.9` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.70.0` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.24.4` | `3.24.6` |
| [next](https://github.com/vercel/next.js) | `16.3.6` | `16.4.5` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.8.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.3` | `4.3.4` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.0` | `24.19.2` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.6` | `16.4.5` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.0` | `4.23.0` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.4` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.2` | `5.1.0` |



Updates `better-auth` from 1.7.6 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/better-auth)

Updates `cn` from 0.4.0 to 0.5.2
- [Release notes](https://github.com/shadcn-ui/cn/releases)
- [Changelog](https://github.com/shadcn-ui/cn/blob/main/packages/cn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/cn/commits/cn@0.5.2/packages/cn)

Updates `d3-scale` from 4.0.2 to 4.0.3
- [Release notes](https://github.com/d3/d3-scale/releases)
- [Commits](d3/d3-scale@v4.0.2...v4.0.3)

Updates `d3-shape` from 3.2.0 to 3.2.1
- [Release notes](https://github.com/d3/d3-shape/releases)
- [Commits](d3/d3-shape@v3.2.0...v3.2.1)

Updates `d3-time` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/d3/d3-time/releases)
- [Commits](d3/d3-time@v3.1.0...v3.1.1)

Updates `drizzle-orm` from 0.45.3 to 0.45.4
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4)

Updates `geist` from 1.7.2 to 1.9.1
- [Release notes](https://github.com/vercel/geist-font/releases)
- [Changelog](https://github.com/vercel/geist-font/blob/main/packages/next/CHANGELOG.md)
- [Commits](https://github.com/vercel/geist-font/commits/v1.9.1/packages/next)

Updates `gleap` from 19.3.0 to 19.3.9
- [Release notes](https://github.com/GleapSDK/JavaScript-SDK/releases)
- [Changelog](https://github.com/GleapSDK/JavaScript-SDK/blob/master/CHANGELOG.md)
- [Commits](GleapSDK/JavaScript-SDK@19.3.0...19.3.9)

Updates `lucide-react` from 1.48.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

Updates `mysql2` from 3.24.4 to 3.24.6
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.24.4...v3.24.6)

Updates `next` from 16.3.6 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.6...v16.4.5)

Updates `radix-ui` from 1.6.7 to 1.8.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui)

Updates `react` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@tailwindcss/postcss` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/@tailwindcss-postcss)

Updates `@types/node` from 24.19.0 to 24.19.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint-config-next` from 16.3.6 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `shadcn` from 4.21.0 to 4.23.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.23.0/packages/shadcn)

Updates `tailwindcss` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/tailwindcss)

Updates `vitest` from 5.0.2 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: better-auth
  dependency-version: 1.7.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: cn
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: d3-scale
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: d3-shape
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: d3-time
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: drizzle-orm
  dependency-version: 0.45.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: geist
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: gleap
  dependency-version: 19.3.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mysql2
  dependency-version: 3.24.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.4.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: radix-ui
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 24.19.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.4.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: shadcn
  dependency-version: 4.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants