Repository navigation
chore(deps): Update all non-major dependencies - #198
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 19, 2026 09:53
75d5d6f to
b3bec2f
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.7.7→^1.7.10^5.24.10→^5.28.0^1.1.20→^1.2.1^5.104.1→^5.104.3^5.104.1→^5.104.31.170.42→1.170.44^1.168.43→^1.168.46^3.3.13→^3.4.0^1.7.7→^1.7.10^2.10.2→^2.10.3^1.55.0→^1.58.0^14.1.0→^14.3.0^19.3.0→^19.3.1^19.3.0→^19.3.17.89.0→7.90.0^8.71.1→^8.71.2Release Notes
better-auth/better-auth (@better-auth/passkey)
v1.7.10Compare Source
v1.7.9Compare Source
v1.7.8Compare Source
Patch Changes
4175b34Thanks @bytaesu! - Align the installed@better-auth/utilsversion withbetter-callwhile accepting^0.4.2 || ^0.5.0across official package peers.Rel1cx/eslint-react (@eslint-react/eslint-plugin)
v5.28.0Compare Source
✨ New
@eslint-react/eslint-plugin: the general-purpose presets now enable JSX syntax support vialanguageOptions.parserOptions.ecmaFeatures.jsx: true, so you no longer need to configure it yourself. (#2049) Affected presets:recommendedrecommended-typescriptrecommended-type-checkedstrictstrict-typescriptstrict-type-checked🏗️ Internal
fumadocs-coreandfumadocs-uito16.17.5, andlucide-reactto1.58.0.Full Changelog: Rel1cx/eslint-react@v5.27.4...v5.28.0
v5.27.4Compare Source
🐞 Fixes
@eslint-react/jsx:resolveAttributeValuenow handles a parser-toleratedJSXFragmentin attribute value position (ex:<a href=<></> />), reporting it as kind"element"instead of falling through toundefined; as a result,react-dom/no-missing-iframe-sandboxnow reports<iframe sandbox=<></> />instead of silently skipping it. (#2048)Full Changelog: Rel1cx/eslint-react@v5.27.3...v5.27.4
v5.27.3Compare Source
🐞 Fixes
react-jsx/no-key-after-spread: the fast-path text check now matcheskeyassignments with whitespace around=(ex:<div {...props} key = {id} />or a newline before=), so such elements are no longer silently skipped. (#2043) Thanks to @amir-rahmanii!react-jsx/no-children-prop: achildrenprop alongside nested children content (ex:<div children="x">y</div>,createElement("div", { children: "x" }, "y")) is no longer reported by this rule — that conflict case belongs toreact-jsx/no-children-prop-with-children— removing the unsafe merge suggestion and the duplicate diagnostics. (#2044) Thanks to @amir-rahmanii!react-jsx/no-children-prop-with-children: empty expression containers (ex:{},{/* comment */}) are no longer treated as meaningful children, so<div children="x">{/* comment */}</div>is no longer reported. (#2045) Thanks to @amir-rahmanii!📝 Documentation
react-naming-convention/ref-name: corrected theadditionalRefHooksexample to use the/pattern/flagsRegExp string form; a bare(a|b)string is treated as exact equality and never matches. (#2042) Thanks to @amir-rahmanii!🏗️ Internal
@eslint-react/jsx:hasChildrennow treats empty expression containers as non-meaningful, aligned withgetChildren. (#2045)react-x: refactored the internals ofset-state-in-effect,set-state-in-render, andstatic-componentsfor readability; no behavior change. (#2041)vitestto5.0.5,nextto16.4.2,fumadocs-coreandfumadocs-uito16.17.4, andundicito8.12.2.Full Changelog: Rel1cx/eslint-react@v5.27.2...v5.27.3
v5.27.2Compare Source
🏗️ Internal
@tsconfig/node20and@types/nodedependencies to the workspace packages. (#2040)effectand@effect/platform-nodeto4.0.5,import-integrity-lintto1.3.1, andsort-package-jsonto4.1.0. (#2040)Full Changelog: Rel1cx/eslint-react@v5.27.1...v5.27.2
v5.27.1Compare Source
🐞 Fixes
componentDidMount = () => { this.setState(...) }, including type-expression-wrapped values) are now reported just like the method shorthand form. (#2039) Affected rules:react-x/no-set-state-in-component-did-mountreact-x/no-set-state-in-component-did-updatereact-x/no-set-state-in-component-will-updateuseEffectcall is nested in an outerreturn(ex:return useEffect(() => () => { ... })), so resources released there are no longer reported as leaked. (#2039) Affected rules:react-web-api/no-leaked-event-listenerreact-web-api/no-leaked-fetchreact-web-api/no-leaked-intersection-observerreact-web-api/no-leaked-intervalreact-web-api/no-leaked-resize-observerreact-web-api/no-leaked-timeout🏗️ Internal
@eslint-react/ast: added theCheck.isFunctionOrClassandCheck.isTypeOrChainExpressionhelpers; parent lookups acrossast,core, and the rules are now bounded at enclosing function/class boundaries. (#2039)@eslint-react/core:isUseEffectSetupCallbackandisUseEffectCleanupCallbackreimplemented on bounded parent lookups. (#2039)Full Changelog: Rel1cx/eslint-react@v5.27.0...v5.27.1
v5.27.0🐞 Fixes
react-web-api/no-leaked-event-listener: cleanups returned through conditional expressions (ex:return cond ? () => window.removeEventListener(...) : null) are now recognized and no longer reported. (#2038)react-web-api/no-leaked-fetch: effect setups wrapped in type expressions (ex:useEffect((() => { fetch(...) }) as any, [])) are now recognized. (#2038)react-debug/function-component: computed string-literaldisplayNamekeys (ex:App["displayName"] = "...") are now recognized. (#2038)📝 Documentation
🏗️ Internal
@eslint-react/core: accuracy and consistency fixes in detection helpers. (#2038)react-x: the customtslconfig now enforces the fact-based layer dependency order. (#2036)reactandreact-domto19.3.1, andnextto16.4.1.Full Changelog: Rel1cx/eslint-react@v5.26.7...v5.27.0
v5.26.7Compare Source
🏗️ Internal
@eslint-react/core: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. (#2033)Full Changelog: Rel1cx/eslint-react@v5.26.6...v5.26.7
v5.26.6Compare Source
🏗️ Internal
@eslint-react/core: component and hook collectors now use sequential integer keys instead of randomrandomByteshex keys, removingnode:cryptofrom the lint hot path. (#2032) Thanks to @kurtextrem!effectto4.0.4,ts-patternto5.9.2,fumadocs-coreandfumadocs-uito16.17.3,lucide-reactto1.57.0,oxlintto1.88.0,typedoc-plugin-markdownto4.14.0, andundicito8.12.1.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.26.5...v5.26.6
TanStack/query (@tanstack/eslint-plugin-query)
v5.104.3Compare Source
No changes in this release.
v5.104.2Compare Source
No changes in this release.
TanStack/query (@tanstack/react-query)
v5.104.3Compare Source
Patch Changes
0f15bc9]:v5.104.2Compare Source
Patch Changes
03e8c39]:TanStack/router (@tanstack/react-router)
v1.170.44Compare Source
Patch Changes
d6ba115]:v1.170.43Compare Source
Patch Changes
94d6d8e]:TanStack/router (@tanstack/router-plugin)
v1.168.46Compare Source
Patch Changes
923d98b]:glincker/thesvg (@thesvg/react)
v3.4.0Compare Source
Minor Changes
cd0d0ebThanks @thegdsks! - Brand families and 150+ new icons. theSVG now groups products by owner (Amazon, Google, Microsoft, Apple, Meta, Adobe and more) with a page per family, and the packages gain a large batch of self-hosted apps, cloud native projects and integration brands, refreshed marks, and corrected default colours for icons that were white-only.v3.3.15Compare Source
Patch Changes
v3.3.14Compare Source
Patch Changes
better-auth/better-auth (better-auth)
v1.7.10Compare Source
Patch Changes
#11393
eebd47aThanks @breken-ai! - If you use thelastLoginMethodplugin withoneTap, signing in through Google One Tap now records"google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: thebetter-auth.last_used_login_methodcookie kept its previous value or stayed unset, and so diduser.lastLoginMethodwithstoreInDatabase.If your
customResolveMethodincludes a/one-tap/callback→"google"workaround, remove that mapping; keep the resolver if it handles other routes.#11821
09d07e6Thanks @gustavovalverde! - The Google One Tap prompt (authClient.oneTap()withoutbutton) no longer callsgetSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under anypromptOptions.fedCMsetting.A skipped prompt now ends the flow and calls
onPromptNotificationright away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.Google Identity Services still logs its FedCM migration warning, because it does so whenever
prompt()receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.#11819
eaecb72Thanks @gustavovalverde! - Google One Tap now applies yoursocialProviders.google.mapProfileToUserand customgetUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token'sname,email,email_verified, andpictureclaims.If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from
given_name. Returning users are updated from it on each One Tap sign-in whensocialProviders.google.overrideUserInfoOnSignInis on, and so are existing users that One Tap links whenaccount.accountLinking.updateUserInfoOnLinkis on. Check that your mapper suits One Tap users too.If you set
socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.Setups that configure none of these, including
oneTap({ clientId })with no Google provider, are unaffected.#11820
88c9a37Thanks @gustavovalverde! - If you setautoSelectorcancelOnTapOutsideononeTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed toauthClient.oneTap()took effect, so withautoSelect: trueon the plugin, returning users still had to pick an account. Values passed tooneTap()still override the plugin's. Apps that set these options only ononeTap(), or not at all, are unaffected.#11696
0cf1f7cThanks @drewsephski! - You can now import the One Tap plugin frombetter-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports frombetter-auth/pluginsandbetter-auth/client/pluginsare unchanged.#11822
414e845Thanks @gustavovalverde! - You can now import the Captcha and OpenAPI plugins frombetter-auth/plugins/captchaandbetter-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports frombetter-auth/pluginsare unchanged.If your TypeScript config uses
"moduleResolution": "node"(ornode10),better-auth/plugins/multi-sessionandbetter-auth/testnow resolve their types. Previously TypeScript reported that it could not find their declarations. Projects usingbundler,node16, ornodenextresolution are unaffected.Updated dependencies [
fedd055,bbd0a19,99cdfe7]:v1.7.9Compare Source
Patch Changes
#11766
6edaa61Thanks @bytaesu! - AnonAPIError.onErrorhandler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.Updated dependencies []:
v1.7.8Compare Source
Patch Changes
#11512
4175b34Thanks @bytaesu! - Align the installed@better-auth/utilsversion withbetter-callwhile accepting^0.4.2 || ^0.5.0across official package peers.#11565
b1cfc1eThanks @bytaesu! - Omit non-returned custom fields from inferred output schema types.#11540
678c555Thanks @bytaesu! - Align cookie security attributes with RFC 6265bis.#10591
193efffThanks @kdelay! - Expired or revoked sessions now clear stale cookies when usingcustomSession.#11625
369176eThanks @gustavovalverde! - Fixed single-use checks for apps that setadvanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.private_key_jwtclient authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with aNOT NULLerror on theidcolumn. They now work. SIWE sign-in ignored theemailfield and used the wallet-derived address; it now uses the supplied email when no other account has it.With
generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.#11391
352d04cThanks @breken-ai! - FixcustomSessiontreating session lookup failures as signed-out users. Server-sidegetSessionnow throws an API error, and HTTP clients receive an error response.#11750
e9d9921Thanks @gustavovalverde! - Generic OAuth providers configured withdiscoveryUrlnow recover without a restart when discovery fails at startup. Since 1.7.3, a provider whose discovery request failed at boot (for example, because the identity provider was still starting) was skipped, and every sign-in returnedPROVIDER_NOT_FOUNDuntil the app restarted. Better Auth now retries discovery on the next sign-in, callback, or account-linking request for that provider, and the provider works as soon as discovery succeeds. While discovery keeps failing, sign-in and account linking still returnPROVIDER_NOT_FOUNDand callbacks redirect witherror=oauth_provider_not_found, and each request may wait up to 10 seconds for the retry.#11549
1bd5c37Thanks @bytaesu! - FixlastLoginMethodfailing sign-in whencookieNameormaxAgeis explicitlyundefined.#11174
766cfb3Thanks @Bekacru! - Stop double-decodingcallbackURL,newUserCallbackURLanderrorCallbackURLon magic link verify so percent-encoded characters in callback query params are preserved.#11505
c46992fThanks @bytaesu! - Preserve the referenced model and field keys when generating Kysely migrations, so custom table names that match another model key produce the intended foreign keys.#11718
1d95ebfThanks @bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction whenstoreSessionInDatabaseis enabled andpreserveSessionInDatabaseis disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.#10266
c68b2cdThanks @shiminshen! - Projects that enableexactOptionalPropertyTypescan use theoauthProvider()andmcp()plugins again. Since 1.7.0, adding either plugin tobetterAuth()failed to type-check with a TS2322 error.#11637
2627237Thanks @gustavovalverde! - Projects using the organization plugin withskipLibCheck: falseno longer getTS2536: Type '"role"' cannot be used to index type ...fromcrud-members.d.mts. Therolereturned bygetActiveMemberRoleis now typed as the organization's role names directly. Projects withskipLibCheck: true(the default in most templates) were unaffected.#10866
3d1f008Thanks @heliohm! - The organization plugin no longer pulls every zod locale into server bundles.#11626
67743edThanks @gustavovalverde! - Password resets and password changes no longer keep the new password when revoking the user's sessions fails. WithrevokeSessionsOnPasswordResetorrevokeOtherSessions, database sessions are revoked and the password is saved in one transaction when transactions are enabled for the adapter, so a failure leaves the old password and sessions in place. Sessions in secondary storage are still removed after commit, on a best-effort basis. This covers/reset-password, the email OTP and phone number reset endpoints, and/change-password.onPasswordResetnow runs after sessions are revoked, so a throwing callback no longer leaves them active, and a callback that lists the user's sessions no longer sees the revoked ones.#10698
f0ce580Thanks @jashkarangiya! - If you set the phone number plugin'sverifyOTPoption,/phone-number/reset-passwordnow checks the code with it, as/phone-number/verifyalready does. Before, password reset always compared the code with the one Better Auth generated, so apps that verify codes through a provider such as Twilio Verify could not reset passwords. If yoursendPasswordResetOTPsends the code Better Auth generates, make sureverifyOTPaccepts that code. Apps that don't setverifyOTPare unaffected.#11646
07a0938Thanks @gustavovalverde! - A failed password reset no longer spends the reset link or OTP./reset-password,/email-otp/reset-passwordand/phone-number/reset-passwordnow check the token or code without consuming it, validate and hash the new password, then consume it in the same transaction as the session revocation and password write. A rejected password, such as one refused byhaveIBeenPwned, always leaves the link or OTP usable. A later failure, such as a failed session revocation or password write, also leaves it usable when the adapter's transactions are enabled and verification values are stored in the database (the default without secondary storage, orverification.storeInDatabase: true). Wrong codes still count against the OTP attempt limit.#11643
92dfceaThanks @gustavovalverde! - A sign-up that fails after its session is created no longer leaves that session in secondary storage. WithstoreSessionInDatabaseenabled andpreserveSessionInDatabaseoff, the secondary-storage copy is written only after the sign-up commits, and listing a user's sessions now reads the database, so a session whose cached copy failed to write is still listed and revoked. With other secondary-storage settings, sign-up, passkey registration and SSO sign-in withresolveUserkeep the session write inside their transaction, so a storage failure rolls back the new user, passkey or account instead of keeping them without a session. A session revoked by asession.create.afterdatabase hook also stays revoked.#11488
e15625fThanks @Bekacru! - SvelteKit 3 projects can now install Better Auth without--legacy-peer-deps. The@sveltejs/kitpeer range now includes^3.0.0; SvelteKit 2 projects are unaffected.Updated dependencies [
4175b34,435645e,369176e,0cfe07d,9904b29,e78f15a,60525e0,8133265,ea85d13,916ef5c,1d95ebf,6214610,67743ed,c46d2a6,92dfcea,a9f455d,9725f1b]:lucide-icons/lucide (lucide-react)
v1.58.0: Version 1.58.0Compare Source
What's Changed
@ucide/svelteby @ericfennis in #5005barrelicon by @karsa-mistmere in #4639certificateicon by @rrod497 in #4327New Contributors
Full Changelog: lucide-icons/lucide@1.57.0...1.58.0
v1.57.0: Version 1.57.0Compare Source
What's Changed
folder-userandfolder-usericons by @rrod497 in #4603calendar-chevrons-lefticon by @karsa-mistmere in #5001users-collaborationicon by @rrod497 in #4922Belarusian rubleicon by @js-best in #4984circle-fading-playicon by @tatianatsiguleva in #4990cpu-aiicon by @signalgridco in #4992guitar-electricicon by @rrod497 in #4917graph-staricon by @Nitero in #4983perfumeicon by @rrod497 in #4426New Contributors
Full Changelog: lucide-icons/lucide@1.56.0...1.57.0
motiondivision/motion (motion)
v14.3.0Compare Source
Added
stagger: Newgrid,from: "edges" | "random"options.scaleZ.Fixed
useSpring: Ensure when switching targets we animate to the new target on switch.v14.2.0Compare Source
Added
x,y,scaleXetc.react/react (react)
v19.3.1: 19.3.1 (October 14th, 2026)Compare Source
React Server Components
react-hook-form/react-hook-form (react-hook-form)
v7.90.0Compare Source
Changed
watch,subscribe, scoped subscriptions, dirty field checks and form state fan-outFixed
Object.prototypemembers not being marked as touched on blur andsetValuehasOwnPropertycloneObjectdropping the length of sparse arrayscloneObjectfailing on objects with a null prototyperemove()mishandling duplicated indexes and mutating the indexes passed inuseFieldArrayunregistering fields while a parent array reindexesuseWatchnot updating watched objects after an<Activity>subtree reconnectsuseWatchpreferring its owndefaultValueover formdefaultValuesfor array namesresetwithout values andkeepDefaultValuessettingisDirtyto trueControllerblur validation not working afterresetwatchreading a staleshouldUnregisteroption when a field registersshouldUseNativeValidationoption when stopping at the first errorrefkey not being compared correctlysetError,clearErrorsand remaining error updates not producing a newerrorsreferenceConfiguration
📅 Schedule: (in timezone Europe/London)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.