chore(deps): bump the all-dependencies group across 1 directory with 19 updates by dependabot[bot] · Pull Request #35 · TrickfireRobotics/dashboard

dependabot · 2026-07-27T09:41:52Z

Bumps the all-dependencies group with 19 updates in the / directory:

Package	From	To
@hookform/resolvers	`5.4.0`	`5.5.7`
@radix-ui/react-slot	`1.3.0`	`1.3.3`
@sentry/nextjs	`10.66.0`	`10.68.0`
better-auth	`1.6.23`	`1.6.25`
better-sqlite3	`12.11.1`	`13.0.1`
lucide-react	`1.24.0`	`1.27.0`
next	`16.2.9`	`16.2.12`
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`
react-hook-form	`7.81.0`	`7.83.0`
resend	`6.17.2`	`6.18.0`
systeminformation	`5.31.17`	`5.33.1`
@types/node	`25.9.5`	`26.1.1`
eslint	`9.39.5`	`10.8.0`
eslint-config-next	`16.2.9`	`16.2.12`
lint-staged	`17.0.8`	`17.2.0`
prettier	`3.9.5`	`3.9.6`
shadcn	`4.13.0`	`4.15.0`
typescript	`6.0.3`	`7.0.2`

Updates @hookform/resolvers from 5.4.0 to 5.5.7

Release notes

Sourced from @hookform/resolvers's releases.

v5.5.7

5.5.7 (2026-07-26)

Bug Fixes

npm install fails with ERESOLVE conflict between @hookform/resolvers@5.4.3 and valibot versions (#865) (722ef6e)

v5.5.6

5.5.6 (2026-07-26)

Bug Fixes

module not found when importing zodResolver under Zod v3 (#864) (8df10b0)

v5.5.5

5.5.5 (2026-07-26)

Bug Fixes

yup resolver overrides ref property in errors object with validation metadata when using checkbox input (#863) (0f70063)

v5.5.4

5.5.4 (2026-07-26)

Bug Fixes

AJV Resolver - When ajv schema contains default for certain properties, getValues() returns the form data with properties overwritten (#862) (c4b6aab)

v5.5.3

5.5.3 (2026-07-26)

Bug Fixes

Conditional/dynamic schema resolution no longer working (#861) (f8d6533)

v5.5.2

5.5.2 (2026-07-26)

Bug Fixes

Zod v4 locale and global error customization not picked up (#860) (2126efc)

v5.5.1

5.5.1 (2026-07-25)

... (truncated)

Commits

722ef6e fix: npm install fails with ERESOLVE conflict between @hookform/resolvers@5.4...
8df10b0 fix: module not found when importing zodResolver under Zod v3 (#864)
75f2dcd close #773
0d2bdbf close #664
0f70063 fix: yup resolver overrides ref property in errors object with validation met...
c4b6aab fix: AJV Resolver - When ajv schema contains default for certain properties, ...
e2a8d16 close #760
f8d6533 fix: Conditional/dynamic schema resolution no longer working (#861)
2126efc fix: Zod v4 locale and global error customization not picked up (#860)
0721f88 add unit test (#859)
Additional commits viewable in compare view

Updates @radix-ui/react-slot from 1.3.0 to 1.3.3

Changelog

Sourced from @radix-ui/react-slot's changelog.

1.3.2, 1.3.3

Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

Commits

See full diff in compare view

Updates @sentry/nextjs from 10.66.0 to 10.68.0

Release notes

Sourced from @sentry/nextjs's releases.

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

fix(cloudflare,deno,node): Align types of vercelai (#22343)

fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)

fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)

fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)

fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)

fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)

fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)

fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

chore: Add external contributor to CHANGELOG.md (#22342)

chore: Add external contributor to CHANGELOG.md (#22405)

chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)

chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)

chore(size-limit): weekly auto-bump (#22182)

ci(v10): Add v10 to build and license-compliance branch filters (#22499)

feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)

ref(server-utils): Remove unneeded orchestrion config (#22384)

ref(server-utils): Small fastify cleanup (#22385)

test: Remove unnecessary test waits (#22383)

test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)

test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

Bundle size 📦

| Path | Size |

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

fix(cloudflare,deno,node): Align types of vercelai (#22343)

fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)

fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)

fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)

fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)

fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)

fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)

fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

chore: Add external contributor to CHANGELOG.md (#22342)

chore: Add external contributor to CHANGELOG.md (#22405)

chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)

chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)

chore(size-limit): weekly auto-bump (#22182)

ci(v10): Add v10 to build and license-compliance branch filters (#22499)

feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)

ref(server-utils): Remove unneeded orchestrion config (#22384)

ref(server-utils): Small fastify cleanup (#22385)

test: Remove unnecessary test waits (#22383)

test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)

test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

10.67.0

... (truncated)

Commits

b4396c3 release: 10.68.0
be21e8c meta(changelog): Update changelog for 10.68.0 (#22566)
fb0987f feat(v10): Add http.route attribute to http.server spans with parameteriz...
f7bd901 feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
ed3a8c8 feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
20227f9 feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
3e5625e feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
d924551 test(v10/cloudflare): Add Vite-build support to the integration-test runner (...
11fed03 feat(v10/cloudflare): Read wrangler config and resolve the Sentry options mod...
a540764 feat(v10): Add url.full and url.path to http.server spans (#22533)
Additional commits viewable in compare view

Updates better-auth from 1.6.23 to 1.6.25

Release notes

Sourced from better-auth's releases.

v1.6.25

better-auth

Bug Fixes

Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)

Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)

Fixed $fetch and $store not being exposed on the Solid client (#10444)

Fixed internal adapter queries being routed to the wrong table when a built-in table's modelName was set to another table's schema key (e.g. user.modelName = "account").

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@birkskyum, @jsj, @krish-vachhani

Full changelog: v1.6.24...v1.6.25

v1.6.24

better-auth

Features

Added request context (ctx) as a third argument to verifyIdToken, enabling custom ID token verifiers to read request headers (#10376)

Added beforeStoreCookie option to the last-login-method plugin for GDPR compliance (#5753)

Bug Fixes

Replaced flaky MongoDB where-coercion integration test with a direct unit test for more reliable test runs (#10369)

Fixed the get-session endpoint to include no-store cache control headers, preventing stale session data from being served (#10222)

Fixed SQLite migration diffs to recognize BIGINT as a valid number type, preventing spurious pending changes on rate limiter columns (#10316)

Fixed auth requests failing when request cloning throws an error inside verification callbacks (#10336)

Fixed useSession({ throw: true }) incorrectly excluding null from its data type (#9787)

Fixed auth query revalidation and signal listeners not being restored after a client component remounts (#10379)

Fixed the CookieAttributes index signature type to be more precise (#10442)

Fixed silent misrouting of adapter queries when user.modelName was set to a value that collides with another schema key (#10235)

Fixed Kysely migration generation producing duplicate indexes for fields marked both unique and index (#10357)

Fixed magic-link and email-OTP send endpoints to validate the Origin header on cookieless requests, preventing cross-origin abuse (#10368)

Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure (#10290)

Fixed OpenAPI schema to include plugin user fields (such as username and displayUsername) in /sign-up/email and /update-user request bodies (#10453)

Fixed organization.listMembers failing with "User not found for member" for organizations with more than ~100 members (#10342)

Fixed organization invitations to use database-generated IDs when advanced.database.generateId is configured, matching the behavior of other models (#10040)

Fixed getDefaultModelName to prefer exact schema key matches over modelName aliases, preventing adapter queries from being misrouted when a built-in table's name collides with another schema key

For detailed changes, see CHANGELOG

auth

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.25

Patch Changes

#10479 5124c34 Thanks @krish-vachhani! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.

#10444 7439359 Thanks @birkskyum! - Expose the real $fetch instance and $store atoms from the Solid client instead of resolving them as dynamic API routes.

Updated dependencies [0ffd1fb]:

@better-auth/core@1.6.25

@better-auth/drizzle-adapter@1.6.25

@better-auth/kysely-adapter@1.6.25

@better-auth/memory-adapter@1.6.25

@better-auth/mongo-adapter@1.6.25

@better-auth/prisma-adapter@1.6.25

@better-auth/telemetry@1.6.25

1.6.24

Patch Changes

#10235 03dc5a0 Thanks @ping-maxwell! - Fixes silent foreign-key and adapter-join misrouting when a user remaps a built-in model name to a string that collides with another schema key

#10357 7508940 Thanks @c-nicol! - Fixes Kysely migration generation for new-table fields that are both unique: true and index: true.

#10342 bae7198 Thanks @ping-maxwell! - Fix organization.listMembers failing with "User not found for member" for orgs with more than ~100 members by applying the same membership limit to the users query.

#10336 ef4d273 Thanks @Tushar-Khandelwal-2004! - Prevent verification callbacks from failing auth requests when cloning the request throws.

#10333 99dbdd7 Thanks @c-nicol! - Fixes Drizzle schema generation for fields that are both unique: true and index: true.

#10368 086ca91 Thanks @gaurav0107! - Force-validate the request Origin on the magic-link (/sign-in/magic-link) and email-otp (/email-otp/send-verification-otp) send endpoints, including cookieless requests, to match the built-in /sign-in/email and /sign-up/email routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests that carry no Origin (server-to-server) are unaffected.

#10290 8f2dedd Thanks @GautamBytes! - Expose the remote MCP auth client's 401 challenge headers to browser clients using CORS.

#10453 4e685ee Thanks @ping-maxwell! - OpenAPI now includes user.additionalFields and plugin user schema fields (e.g. username plugin username / displayUsername) on /sign-up/email and /update-user request bodies.

#10190 3bf0e49 Thanks @gaurav-init! - Pass the endpoint context as the second argument to beforeDeleteOrganization and afterDeleteOrganization hooks in the organization plugin, matching the signature shown in the docs and the existing databaseHooks pattern. The Stripe plugin's beforeDeleteOrganization wrapper now forwards the context to user-supplied hooks instead of dropping it.

#10040 f59a0ee Thanks @shiminshen! - Organization invitations now let the database generate their id when ID generation is delegated to the database (e.g. advanced.database.generateId: "uuid" with a UUID-capable adapter such as Postgres), matching every other model. Previously createInvitation always generated the invitation id in application code, so invitation rows received an app-generated value instead of a database-generated one while organizations, members and teams correctly deferred to the database (better-auth/better-auth#10024). A caller-provided id (e.g. via beforeCreateInvitation) is still honored.

#10302 0f2cc1b Thanks @momomuchu! - Prefer exact schema-key matches over modelName aliases in getDefaultModelName, so remapping a built-in table onto another table's schema key (e.g. user.modelName = "account") does not reroute internal adapter queries to the wrong table.

#9787 ae78109 Thanks @ping-maxwell! - Fixes an issue where useSession({ throw: true }) incorrectly excluded null from its data type.

#10222 46d2bf0 Thanks @ping-maxwell! - fix: add no-store cache-control headers to get-session route

#10316 29a373e Thanks @vinay-oppuri! - Recognize SQLite BIGINT as a valid number type in migration diffs so database-backed rate limiter columns like lastRequest no longer report spurious pending changes on every run.

#10379 f6d18fa Thanks @ping-maxwell! - fix(client): restore auth query revalidation and signal listeners after remount

... (truncated)

Commits

07a646e chore: release v1.6.25 (#10491)
7439359 fix(solid): expose $fetch and $store on the solid client (#10444)
dac701c chore(deps): bump next from 16.2.6 to 16.2.11 (#10493)
5124c34 fix(one-tap): enforce google provider signup restrictions (#10479)
9a661c7 chore: release v1.6.24 (#10323)
4e685ee fix(open-api): include plugin user fields on sign-up/update bodies (#10453)
d3ce782 fix(cookies): tighten CookieAttributes index signature type (#10441) (#10442)
ae78109 fix(client): preserve null in useSession().data type with throw:true (#9787)
f6d18fa fix(client): restore auth query lifecycle after remount (#10379)
086ca91 fix(magic-link, email-otp): force-validate Origin on cookieless send endpoint...
Additional commits viewable in compare view

Updates better-sqlite3 from 12.11.1 to 13.0.1

Release notes

Sourced from better-sqlite3's releases.

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

Refactored codebase to use node-addon-api by @JoshuaWise in WiseLibs/better-sqlite3#1498

Added a new db.explain() method, for running EXPLAIN queries without needing to supply bound parameters.

Added a new preparedStatement.toString() method, for getting the expanded SQL of a prepared statement.

Fix SqliteError cross-realm and Error.isError compatibility by @dennismutuku2005 in WiseLibs/better-sqlite3#1473

New Contributors

@dennismutuku2005 made their first contribution in WiseLibs/better-sqlite3#1473

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

Update SQLite to version 3.53.3 by @JoshuaWise in WiseLibs/better-sqlite3#1492

Utilize node:20-trixie for Electron v43 and onwards by @neoxpert in WiseLibs/better-sqlite3#1495

Full Changelog: WiseLibs/better-sqlite3@v12.11.2...v12.12.0

v12.11.2

What's Changed

Add support for electron v43 prebuilds by @m4heshd in WiseLibs/better-sqlite3#1490

Full Changelog: WiseLibs/better-sqlite3@v12.11.1...v12.11.2

Commits

6efdbc5 13.0.1
32ee0ab Merge remote-tracking branch 'origin/master'
bce8300 fixed overly strict regression in parameter binding
ecfe2f7 13.0.0
ae19080 fixed typos
57d4bbb implemented Database#explain()
49fd7e6 added docs for Statement#toString()
1cb18ec implemented Statement#toString()
af60f6b updated github workflow dep versions
6ffd750 fixed tests for SqliteError
Additional commits viewable in compare view

Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.

Updates lucide-react from 1.24.0 to 1.27.0

Release notes

Sourced from lucide-react's releases.

Version 1.27.0

What's Changed

feat(icons): removed brand names from tags & revised brand stopwords by @karsa-mistmere in lucide-icons/lucide#4575

fix(docs): Fix site build by @ericfennis in lucide-icons/lucide#4582

fix(icons): optimised square-scissors icons by @karsa-mistmere in lucide-icons/lucide#4581

fix(packages/angular): add more supported attributes for SVG nodes by @karsa-mistmere in lucide-icons/lucide#4570

feat(icons): added pending-cw icon by @NielsLazaroms in lucide-icons/lucide#4439

fix(icons): changed zap and zap-off icons by @kapowaz in lucide-icons/lucide#4536

feat(icons): add square-off icon by @october-learns in lucide-icons/lucide#4496

chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @dependabot[bot] in lucide-icons/lucide#4572

fix(icons): changed toolbox icon by @karsa-mistmere in lucide-icons/lucide#4571

feat(icons): add scan-square by @samuelalake in lucide-icons/lucide#4550

feat(icons): added user-shield icon by @MArtytraM99 in lucide-icons/lucide#3099

feat(icons): added mosque icon by @iskepr in lucide-icons/lucide#4494

fix(request-review): Remove pull_request_target by @ericfennis in lucide-icons/lucide#4593

fix(icons): changed feather icon by @karsa-mistmere in lucide-icons/lucide#4584

feat(ci): added custom prettier plugin for icon SVG files by @karsa-mistmere in lucide-icons/lucide#4576

ci(ci.yml): Remove concurrency in ci.yml by @ericfennis in lucide-icons/lucide#4595

fix(icons): changed barrel icon by @karsa-mistmere in lucide-icons/lucide#4592

feat(lab): Migrate lab to main repo. by @ericfennis in lucide-icons/lucide#4521

fix(icons): changed trophy icon by @karsa-mistmere in lucide-icons/lucide#4591

feat(analytics): add utm source and medium by @jguddas in lucide-icons/lucide#4596

feat(docs): Add lab requirement in pull_request_template.md by @danielbayley in lucide-icons/lucide#3651

feat(icons): replaces podcast icon with new mic-* icons by @karsa-mistmere in lucide-icons/lucide#4583

feat(icons): add layout-freeform by @samuelalake in lucide-icons/lucide#4543

New Contributors

@NielsLazaroms made their first contribution in lucide-icons/lucide#4439

@kapowaz made their first contribution in lucide-icons/lucide#4536

@october-learns made their first contribution in lucide-icons/lucide#4496

@samuelalake made their first contribution in lucide-icons/lucide#4550

@iskepr made their first contribution in lucide-icons/lucide#4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

fix(docs): fix home page package links & accessible labels by @karsa-mistmere in lucide-icons/lucide#4540

fix(icons): changed columns-3-cog icon by @kamilasw in lucide-icons/lucide#4578

fix(icons): extended metadata of ad icon by @karsa-mistmere in lucide-icons/lucide#4579

fix(icons): changed book-open icons by @karsa-mistmere in lucide-icons/lucide#4565

feat(icons): added shield-keyhole icon by @karsa-mistmere in lucide-icons/lucide#4580

New Contributors

@kamilasw made their first contribution in lucide-icons/lucide#4578

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

Version 1.25.0

What's Changed

... (truncated)

Commits

f229f83 chore(depedencies): Update dependencies (#4553)
See full diff in compare view

Updates next from 16.2.9 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)
...
Description has been truncated

…19 updates Bumps the all-dependencies group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.4.0` | `5.5.7` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.3.0` | `1.3.3` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.66.0` | `10.68.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.23` | `1.6.25` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.11.1` | `13.0.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.24.0` | `1.27.0` | | [next](https://github.com/vercel/next.js) | `16.2.9` | `16.2.12` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.81.0` | `7.83.0` | | [resend](https://github.com/resend/resend-node) | `6.17.2` | `6.18.0` | | [systeminformation](https://github.com/sebhildebrandt/systeminformation) | `5.31.17` | `5.33.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.1.1` | | [eslint](https://github.com/eslint/eslint) | `9.39.5` | `10.8.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.9` | `16.2.12` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.2.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.0` | `4.15.0` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | Updates `@hookform/resolvers` from 5.4.0 to 5.5.7 - [Release notes](https://github.com/react-hook-form/resolvers/releases) - [Commits](react-hook-form/resolvers@v5.4.0...v5.5.7) Updates `@radix-ui/react-slot` from 1.3.0 to 1.3.3 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `@sentry/nextjs` from 10.66.0 to 10.68.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.68.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.66.0...10.68.0) Updates `better-auth` from 1.6.23 to 1.6.25 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.25/packages/better-auth) Updates `better-sqlite3` from 12.11.1 to 13.0.1 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.1) Updates `lucide-react` from 1.24.0 to 1.27.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react) Updates `next` from 16.2.9 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.9...v16.2.12) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `react-hook-form` from 7.81.0 to 7.83.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.81.0...v7.83.0) Updates `resend` from 6.17.2 to 6.18.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.17.2...v6.18.0) Updates `systeminformation` from 5.31.17 to 5.33.1 - [Release notes](https://github.com/sebhildebrandt/systeminformation/releases) - [Changelog](https://github.com/sebhildebrandt/systeminformation/blob/master/CHANGELOG.md) - [Commits](sebhildebrandt/systeminformation@v5.31.17...v5.33.1) Updates `@types/node` from 25.9.5 to 26.1.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 9.39.5 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.5...v10.8.0) Updates `eslint-config-next` from 16.2.9 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next) Updates `lint-staged` from 17.0.8 to 17.2.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.2.0) Updates `prettier` from 3.9.5 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.5...3.9.6) Updates `shadcn` from 4.13.0 to 4.15.0 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.15.0/packages/shadcn) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: "@hookform/resolvers" dependency-version: 5.5.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@radix-ui/react-slot" dependency-version: 1.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: "@sentry/nextjs" dependency-version: 10.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: better-auth dependency-version: 1.6.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: better-sqlite3 dependency-version: 13.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: lucide-react dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: react-hook-form dependency-version: 7.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: resend dependency-version: 6.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: systeminformation dependency-version: 5.33.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: eslint-config-next dependency-version: 16.2.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: lint-staged dependency-version: 17.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: shadcn dependency-version: 4.15.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the all-dependencies group across 1 directory with 19 updates - #35

chore(deps): bump the all-dependencies group across 1 directory with 19 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-dependencies-319d6ec1fd

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v5.5.7

5.5.7 (2026-07-26)

Bug Fixes

v5.5.6

5.5.6 (2026-07-26)

Bug Fixes

v5.5.5

5.5.5 (2026-07-26)

Bug Fixes

v5.5.4

5.5.4 (2026-07-26)

Bug Fixes

v5.5.3

5.5.3 (2026-07-26)

Bug Fixes

v5.5.2

5.5.2 (2026-07-26)

Bug Fixes

v5.5.1

5.5.1 (2026-07-25)

1.3.2, 1.3.3

1.3.1

10.68.0

Bundle size 📦

10.68.0

10.67.0

v1.6.25

better-auth

Bug Fixes

Contributors

v1.6.24

better-auth

Features

Bug Fixes

auth

1.6.25

Patch Changes

1.6.24

Patch Changes

v13.0.1

v13.0.0

What's Changed

New Contributors

v12.12.0

What's Changed

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

v12.11.2

What's Changed

Version 1.27.0

What's Changed

New Contributors

Version 1.26.0

What's Changed

New Contributors

Version 1.25.0

What's Changed

v16.2.12

What's Changed

v16.2.11

v16.2.10

19.2.8 (July 21st, 2026)

React Server Components

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`better-auth`

`auth`