Skip to content

chore(deps): bump the bun-minor-and-patch group across 1 directory with 31 updates - #163

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/bun/dev/bun-minor-and-patch-5bbb06c1cb
Open

chore(deps): bump the bun-minor-and-patch group across 1 directory with 31 updates#163
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/bun/dev/bun-minor-and-patch-5bbb06c1cb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the bun-minor-and-patch group with 31 updates in the / directory:

Package From To
oxfmt 0.68.0 0.73.0
oxlint 1.83.0 1.88.0
turbo 2.10.13 2.11.8
convex 1.46.0 1.47.0
werift 0.24.4 0.25.0
mint 4.2.902 4.2.1047
hono 4.13.7 4.13.13
@react-three/fiber 9.8.1 9.8.2
@remotion/cli 4.0.530 4.0.535
@remotion/google-fonts 4.0.530 4.0.535
@remotion/motion-blur 4.0.530 4.0.535
@remotion/three 4.0.530 4.0.535
remotion 4.0.530 4.0.535
lenis 1.3.26 1.3.27
@convex-dev/resend 0.2.8 0.2.9
convex-helpers 0.1.124 0.1.128
resend 6.28.1 6.33.0
@types/bun 1.4.2 1.4.3
convex-test 0.0.59 0.0.62
vite 8.3.0 8.3.4
vitest 4.1.11 4.1.12
@clack/prompts 1.2.0 1.8.1
@types/node 22.19.17 22.20.5
next 16.3.8 16.4.2
posthog-js 1.428.3 1.438.12
posthog-node 5.30.4 5.56.1
react 19.2.4 19.3.1
@types/react 19.2.2 19.3.0
react-dom 19.2.4 19.3.1
@types/react-dom 19.2.2 19.3.0
zod 4.5.4 4.6.7

Updates oxfmt from 0.68.0 to 0.73.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.73.0

💥 BREAKING CHANGES

  • 1ef2888 oxfmt: [BREAKING] Improve --migrate prettier (#27444) (leaysgur)
  • c2e6d5f formatter_toml: [BREAKING] Add oxc_formatter_toml crate wrapping oxc-toml (#27365) (leaysgur)

🚀 Features

  • ce4e8dc oxfmt: Support overrides[].parser -> associations[].language migration (#27475) (leaysgur)
  • a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
  • 77f8156 oxfmt/lsp: Show root config errors to LSP client (#26014) (Sysix)
  • c1adce3 oxfmt/lsp: Support astro language (#27388) (leaysgur)
  • 4f024a1 oxfmt: Support astro plugin in --migrate prettier (#27387) (leaysgur)
  • 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

🐛 Bug Fixes

  • 76ec31b formatter_css: Support css-in-js placeholders in property names and conditions (#27640) (leaysgur)
  • 99bb268 formatter_css: Keep css-in-js placeholder as media type (#27639) (leaysgur)
  • 372849e formatter: Fix crash on css-in-js comment containing interpolation (#27638) (leaysgur)
  • da692b8 formatter: Wrap export default class|function consistently (#27628) (leaysgur)
  • 21dee96 formatter: Keep parens around TSInstantiationExpression before ! and export (#27626) (leaysgur)
  • b6eb914 oxfmt: Normalize symlink targets in CLI snapshots (#27498) (camc314)
  • 5dae56f oxfmt/lsp: Return error on config resolving error (#26003) (Sysix)
  • 676cc60 formatter/jsdoc: Preserve paragraphs by checking @description tag width (#27439) (leaysgur)
  • 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
  • db360de oxfmt: Load svelte plugin for svelte-in-mdx-in-md (#27369) (leaysgur)
  • 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)
  • d730fdd formatter_core: Leave blank frontmatter without dispatcher (#27359) (leaysgur)

📚 Documentation

  • 4a28c91 formatter_css: Clarify missed-semicolon-accepted divergence (#27433) (leaysgur)
  • 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
  • 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)
  • 37b3c48 formatter_markdown: Fix DIVERGENCES.md examples and slug to match behavior (#27358) (leaysgur)

oxfmt v0.72.0

💥 BREAKING CHANGES

  • e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

  • b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

  • 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
  • 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)

... (truncated)

Changelog

Sourced from oxfmt's changelog.

[0.73.0] - 2026-10-13

🚀 Features

  • a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
  • 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

📚 Documentation

  • 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
  • 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

[0.67.0] - 2026-09-07

🛡️ Security

  • 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

  • c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

  • fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

  • e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

  • 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

  • 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

... (truncated)

Commits
  • 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
  • a495e82 feat(oxfmt): support associations config to specify language over filepath ...
  • 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
  • 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
  • 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
  • 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
  • 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
  • f158bff chore(deps): update npm packages (#26865)
  • 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
  • f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
  • See full diff in compare view

Updates oxlint from 1.83.0 to 1.88.0

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

  • 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
  • c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

  • bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

  • 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
  • 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
  • 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
  • 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
  • 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

  • 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
  • c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
  • c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
  • 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
  • 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

  • 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
  • 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
  • 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

oxlint v1.87.0

🚀 Features

  • 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
  • cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
  • 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

  • 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
  • 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
  • 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
  • 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
  • e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
  • 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
  • f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
  • 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

  • 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
  • e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

  • ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
  • d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
  • 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

... (truncated)

Commits
  • 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
  • 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
  • 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
  • 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
  • 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
  • e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
  • 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
  • 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
  • f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
  • See full diff in compare view

Updates turbo from 2.10.13 to 2.11.8

Release notes

Sourced from turbo's releases.

Turborepo v2.11.8

What's Changed

Changelog

... (truncated)

Commits
  • 7663d6b publish 2.11.8 to registry
  • ad820cb fix: Disable agent guidance by default (#14490)
  • 6e9c65b fix: Prevent Git index refresh during dirty hash collection (#14489)
  • b5fe180 feat: Validate sealed native setup baselines (#14482)
  • cb615c3 chore: Add copyable Factory snapshot command (#14481)
  • 71d0766 fix: Upgrade turbo-gen Handlebars to 4.7.10 (#14471)
  • 2935202 docs: Explain declaring Cargo sources read from outside the crate (#14480)
  • 215637c fix: Report inferred framework env vars for deferred tasks in dry runs (#14478)
  • d6d63bd fix: Carry uv tool configuration into pruned workspaces (#14449)
  • 768d5ba fix: Hash Clippy configuration for Cargo lint tasks (#14448)
  • Additional commits viewable in compare view

Updates convex from 1.46.0 to 1.47.0

Changelog

Sourced from convex's changelog.

1.47.0

  • Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always failed because dev is reserved for your default dev deployment. It now suggests a dev/my-feature reference and passes --select.
  • npx convex deploy now asks for confirmation before creating or changing an index on a large table, since the deploy blocks until the index is backfilled. Stage the index (staged: true) to backfill it in the background instead, or pass the new --skip-large-indexes-check flag to proceed without confirmation. That flag also covers deleting large indexes, replacing the hidden --allow-deleting-large-indexes flag, which keeps working.
  • The envList MCP tool now returns only environment variable names by default, so secrets stay out of the agent's context. Pass includeValues: true to get the values too, or use envGet to read a single variable.
  • npx convex env list and npx convex env default list have a new --include-values flag for printing values explicitly. Values are still printed by default. The docs and help text now use --include-values wherever the values are needed, like npx convex env list --include-values > .env.convex, and --names-only for just listing variables.
  • Added .staged() to defineTable for validating a schema change in the background instead of blocking the deploy on a scan of the table. Pass the fields to add or change, set a field to undefined to remove it, or pass a full validator. The current validator stays enforced while Convex checks existing documents and new writes against the staged one. npx convex deploy and npx convex deploy --dry-run report each staged table as validating, validated, or failed, and the dry-run warning about scanning large tables now suggests staging the validator. Once a staged validator is validated, moving it into defineTable deploys without scanning the table. A deploy that would discard pending or completed staged validation asks for confirmation; pass --allow-unstaging-schema to skip the prompt in CI. See https://docs.convex.dev/database/schemas#staged-validators.
  • ctx.meta.getSnapshotTs() is now public API. It returns the database timestamp of the snapshot the current function reads from, in nanoseconds, on the same clock as db.vars.commitTs. See https://docs.convex.dev/database/advanced/commit-timestamp.
  • convex/server exports getServiceUrl, which returns the base URL of a Convex-managed service such as the AI gateway, to pair with getServiceToken, along with a ServiceName type. The client no longer rejects service names it doesn't know about, so libraries can adopt new services without requiring a newer convex version.
  • Fixed the Convex MCP server stalling permanently after overlapping tool calls.
  • Fixed the error reported when a function or symbol is passed where a Convex value is expected. It now names the unsupported type and its path, like Function "[Function]" is not a supported Convex type at .cb, instead of throwing Cannot read properties of undefined (reading 'length').
  • When a push fails because an environment variable used by auth.config.ts is not set on the deployment, the CLI now prints the npx convex env set commands to run and a link to the deployment's environment variable settings.

... (truncated)

Commits

Updates werift from 0.24.4 to 0.25.0

Release notes

Sourced from werift's releases.

v0.25.0

⚠️ Breaking changes

  • werift/polyfill fixed-codec sources no longer expand RTCPeerConnection codec capability implicitly (#729): A track from a polyfill MediaRegister (MP4/WebM, callback, RTP/RTCP, encoded binary) now treats its codec as a hard constraint — addTrack() / addTransceiver() throws NotSupportedError instead of silently adding the codec to the PeerConnection capability. The public adoptSenderTrackCodec helper was removed. Plain, non-polyfill MediaStreamTracks (e.g. ordinary live sources) are unaffected.
  • Removed getUserMedia({ path | buffer | stream }) from werift/nonstandard (#729). File playback now goes through werift/polyfill: installPolyfill({ mediaRegister: [createMp4WebmRegister({ path })] }) then navigator.mediaDevices.getUserMedia({ audio: true, video: true }).
  • m-line reuse behavior changed, default PeerConfig.mLineReuse: "compatible" (#705, #721): Accepted inactive m-lines now keep port 9 instead of port 0, and addTransceiver() / addTrack() no longer take over an inactive m-line left by removeTrack() — only a position whose port 0 stop/rejection has been negotiated is reused (with a new MID). To keep the pre-v0.25 behavior, set mLineReuse: "aggressive". Note that in "aggressive" mode a negotiated inactive m-line becomes permanently stopped and cannot resume with direction = "sendrecv", so pause/resume (mute/unmute, hold/resume) workflows should stay on "compatible". See the PeerConfig.mLineReuse entry under Features for the full compatibility matrix.

🚀 Features

  • PeerConfig.turnUdpFamily (#726, #731): preferred TURN/UDP socket family ("udp4" / "udp6") for hostname TURN servers, passed through RTCIceGatherer to IceOptions.turnUdpFamily and propagated by setConfiguration() before the next gathering. Defaults to undefined (udp4), so existing configurations are unchanged. An IP-literal server address still selects the UDP socket family directly; a conflicting turnUdpFamily is ignored with a debug log instead of making the configured server unreachable.
  • Polyfill codec integration (#729): installPolyfill() accepts peerConnectionConfig, and RTCRtpTransceiver.setCodecPreferences() now filters and orders codecs independently from fixed-source constraints.
  • Empty media tracks for werift/polyfill (#729): mediaRegister: [] now lets getUserMedia() return plain audio/video tracks instead of NotFoundError, and the new createEmptyRegister() exposes the same no-RTP, codec-unset behavior explicitly.
  • Configurable SCTP outbound MTU (#708, #716): SCTP and RTCPeerConnection({ sctp: { mtu } }) now accept an outbound packet MTU. The default is 1191 bytes, changing DATA fragmentation and congestion-control units from a 1200-byte payload to 1160 bytes (maximum serialized DATA packet: 1188 bytes).
  • werift/polyfill (#689): Opt-in installer that puts werift WebRTC constructors on globalThis (or a target sandbox) and implements navigator.mediaDevices.getUserMedia via mediaRegister (MP4/WebM, RTP/RTCP, encoded binary, or createCallbackRegister).
  • PeerConfig.mLineReuse (#705, #721): "compatible" (default) keeps accepted inactive m-lines on a non-zero port and uses port 0 only for rejected / stopped m-lines; "aggressive" keeps the legacy inactive port 0. The value is validated on construction and cannot be changed by setConfiguration().
  • RTCRtpTransceiver.stop() and m-line reuse (#705, #721): stop() is idempotent, releases the sender / receiver / router registrations immediately, and negotiates port 0 in the next local offer. A new addTransceiver() reuses a port 0 position of the same kind only after the rejection has been negotiated, with a new MID and a new transceiver.

🐛 Bug Fixes

  • TURN hostname resolution matches the bound UDP socket family (werift-ice, #731): TurnProtocol.request now resolves the server hostname with the same family preference as the udp4 socket createTurnClient binds. Previously, a dual-stack resolver that answered IPv6 first (e.g. turn.cloudflare.com) sent every Allocate to an address the socket could not reach, so the transaction retransmitted for ~6.4 s, timed out, and gathering silently fell back to TURN over TCP, holding setLocalDescription for the whole wait.
  • TURN server endpoint pinned and taken from the transport (werift-ice, #725, #726, #731): Transport gains optional public addressFamily / remoteAddress fields (reported by UdpTransport, TcpTransport, TlsTransport); STUN and TURN read these instead of casting to UdpTransport's private socket type. TurnProtocol resolves and pins one concrete server endpoint on the first request instead of re-resolving per request, which could previously drift to a different address.
  • IPv6 TURN/STUN transaction addresses compared in canonical form (werift-ice, #731): an IPv6 literal server written in non-canonical notation (e.g. 0:0:0:0:0:0:0:1) never matched the socket-reported source address, so valid responses were dropped until the transaction timed out.
  • ICE-TCP: both agents now select the same TCP connection (werift-ice, #721): the controlling agent no longer attaches USE-CANDIDATE to every TCP connectivity check (aggressive nomination). It waits until every higher-priority TCP pair has finished its check, then nominates the highest-priority valid TCP pair with a separate USE-CANDIDATE check (RFC 8445 regular nomination). Before this change, the two agents could each pick a different TCP connection and then close the connection the peer had picked while pruning, so the first send() failed with EPIPE / ECONNRESET. UDP and relay pairs, and connections to ICE-lite peers, keep their current nomination behavior.
  • ICE-TCP connectivity check timeout (werift-ice, #721): TCP checks are still sent once without retransmission (RFC 5389 §7.2.2), but the response timeout is now TCP_CHECK_RESPONSE_TIMEOUT_MS (3 s) instead of 50 ms, and that timeout also covers the TCP connect. A refused TCP connect or a failed write fails the check immediately instead of waiting for the timeout.
  • ICE-TCP selected connection loss (werift-ice, #721): a TCP socket that is already closed is discarded before reuse, and a failed write discards the socket and rejects send() with the socket error. When the selected TCP connection closes, the agent moves to failed right away (the same end state as a consent expiry) instead of waiting 30 s for consent to expire.
  • NodeTurnServer.listen() bind conflict (werift-ice-server, #721): with port: 0, UDP and TCP share one port number that UDP picks. If that number is already in use for TCP, listen() now picks a new number (up to 10 attempts) instead of failing with EADDRINUSE. If listen() fails, it now closes any socket it has already opened and resets its state.
  • Reject unsupported RTP m-lines in the answer instead of throwing (#705, #721): setRemoteDescription() no longer fails with negotiate codecs failed. when an audio/video section has no common codec. The answer keeps the m-line count, order, MID, type and proto, and rejects only that section with port 0 and one offered fmt token. Audio-only peers no longer need to add VP8 to accept a browser offer that bundles video.
    • The answer BUNDLE group contains only accepted offered members; an offerer-tagged section rejected in the initial answer moves the tag to the first accepted member, and a fully rejected group is omitted. An established tag is kept.
    • Accepted m-lines outside the offered BUNDLE group get their own transport and ICE credentials, including with bundlePolicy: "max-bundle". A re-offer that moves an established BUNDLE member out of its group or splits the members into different groups is rejected with InvalidAccessError before any state changes. For a remote offer, transport ownership follows only the offered BUNDLE groups regardless of bundlePolicy (max-bundle affects only local offers): each offered group gets its own transport, and m-lines outside any group (including an offer without BUNDLE) get independent transports. ICE / DTLS parameters come from the first accepted member of a group, not from a codec-rejected tag. A new independent transport gathers its own ICE candidates even when an established BUNDLE is connected, and each transport takes the DTLS role from the a=setup of the m-lines it serves. As an offerer, a remote answer that moves m-lines sharing one offered transport out of a common BUNDLE group with different ICE credentials is rejected with InvalidAccessError before any state changes. Local trickle candidates carry the MID / index of the accepted section that owns the ICE transport (not always m-line 0); remote candidates for rejected sections are recorded without throwing. SCTP before RTP keeps the original indexes.
    • A non-zero remote answer / pranswer without a common codec is rejected with InvalidAccessError before any state changes. An unsupported re-offer keeps the existing track and RTP pipeline while pending and after rollback, and is released only when the port 0 answer is applied.
    • removeTrack() detaches the track without stopping the sender, so the same sender can resume. addTrack() reuses only unsent, non-stopped, non-rejected senders. Re-offers no longer fire ontrack again for an already receiving transceiver, and remote-initiated stops do not fire negotiationneeded.
    • negotiationneeded is coalesced: changes in the same tick (including removeTrack()) fire it once, and an event queued before a local offer that already covers the change is dropped once that offer is answered. This avoids duplicate offers and InvalidStateError in onnegotiationneeded-driven signaling.
    • A local transceiver that reserved a stopped position before its own offer releases the reservation when a remote offer reuses that position (e.g. with another kind), and is appended in the next offer instead of taking the remote MID.
    • Design note: docs/design/705-media-rejection-and-removetrack.md.
  • Received audio RED tracks labeled with the delivered primary codec (packages/webrtc, #729): RTCRtpReceiver unwraps audio RED and delivers primary (e.g. Opus) packets to the track, but the remote track's codec was set to the first negotiated codec (audio/red). With fixed-source constraints this made replaceTrack() reject echoing a received RED track back on a RED sender (InvalidModificationError), breaking the red-record-gst and red-sendrecv example e2e flows. Remote audio tracks are now labeled with the primary codec referenced by RED (or the first primary codec) on creation and on codec resync.
Changelog

Sourced from werift's changelog.

v0.25.0

⚠️ Breaking changes

  • werift/polyfill fixed-codec sources no longer expand RTCPeerConnection codec capability implicitly (#729): A track from a polyfill MediaRegister (MP4/WebM, callback, RTP/RTCP, encoded binary) now treats its codec as a hard constraint — addTrack() / addTransceiver() throws NotSupportedError instead of silently adding the codec to the PeerConnection capability. The public adoptSenderTrackCodec helper was removed. Plain, non-polyfill MediaStreamTracks (e.g. ordinary live sources) are unaffected.
  • Removed getUserMedia({ path | buffer | stream }) from werift/nonstandard (#729). File playback now goes through werift/polyfill: installPolyfill({ mediaRegister: [createMp4WebmRegister({ path })] }) then navigator.mediaDevices.getUserMedia({ audio: true, video: true }).
  • m-line reuse behavior changed, default PeerConfig.mLineReuse: "compatible" (#705, #721): Accepted inactive m-lines now keep port 9 instead of port 0, and addTransceiver() / addTrack() no longer take over an inactive m-line left by removeTrack() — only a position whose port 0 stop/rejection has been negotiated is reused (with a new MID). To keep the pre-v0.25 behavior, set mLineReuse: "aggressive". Note that in "aggressive" mode a negotiated inactive m-line becomes permanently stopped and cannot resume with direction = "sendrecv", so pause/resume (mute/unmute, hold/resume) workflows should stay on "compatible". See the PeerConfig.mLineReuse entry under Features for the full compatibility matrix.

🚀 Features

  • PeerConfig.turnUdpFamily (#726, #731): preferred TURN/UDP socket family ("udp4" / "udp6") for hostname TURN servers, passed through RTCIceGatherer to IceOptions.turnUdpFamily and propagated by setConfiguration() before the next gathering. Defaults to undefined (udp4), so existing configurations are unchanged. An IP-literal server address still selects the UDP socket family directly; a conflicting turnUdpFamily is ignored with a debug log instead of making the configured server unreachable.
  • Polyfill codec integration (#729): installPolyfill() accepts peerConnectionConfig, and RTCRtpTransceiver.setCodecPreferences() now filters and orders codecs independently from fixed-source constraints.
  • Empty media tracks for werift/polyfill (#729): mediaRegister: [] now lets getUserMedia() return plain audio/video tracks instead of NotFoundError, and the new createEmptyRegister() exposes the same no-RTP, codec-unset behavior explicitly.
  • Configurable SCTP outbound MTU (#708, #716): SCTP and RTCPeerConnection({ sctp: { mtu } }) now accept an outbound packet MTU. The default is 1191 bytes, changing DATA fragmentation and congestion-control units from a 1200-byte payload to 1160 bytes (maximum serialized DATA packet: 1188 bytes).
  • werift/polyfill (#689): Opt-in installer that puts werift WebRTC constructors on globalThis (or a target sandbox) and implements navigator.mediaDevices.getUserMedia via mediaRegister (MP4/WebM, RTP/RTCP, encoded binary, or createCallbackRegister).
  • PeerConfig.mLineReuse (#705, #721): "compatible" (default) keeps accepted inactive m-lines on a non-zero port and uses port 0 only for rejected / stopped m-lines; "aggressive" keeps the legacy inactive port 0. The value is validated on construction and cannot be changed by setConfiguration().
  • RTCRtpTransceiver.stop() and m-line reuse (#705, #721): stop() is idempotent, releases the sender / receiver / router registrations immediately, and negotiates port 0 in the next local offer. A new addTransceiver() reuses a port 0 position of the same kind only after the rejection has been negotiated, with a new MID and a new transceiver.

🐛 Bug Fixes

  • TURN hostname resolution matches the bound UDP socket family (werift-ice,

@dependabot
chore(deps): bump the bun-minor-and-patch group across 1 directory wi…
85ac176 
…th 31 updates

Bumps the bun-minor-and-patch group with 31 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.68.0` | `0.73.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.83.0` | `1.88.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.13` | `2.11.8` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.46.0` | `1.47.0` |
| [werift](https://github.com/shinyoshiaki/werift-webrtc) | `0.24.4` | `0.25.0` |
| [mint](https://github.com/mintlify/mint/tree/HEAD/packages/mint) | `4.2.902` | `4.2.1047` |
| [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.13` |
| [@react-three/fiber](https://github.com/pmndrs/react-three-fiber) | `9.8.1` | `9.8.2` |
| [@remotion/cli](https://github.com/remotion-dev/remotion) | `4.0.530` | `4.0.535` |
| [@remotion/google-fonts](https://github.com/remotion-dev/remotion) | `4.0.530` | `4.0.535` |
| [@remotion/motion-blur](https://github.com/remotion-dev/remotion) | `4.0.530` | `4.0.535` |
| [@remotion/three](https://github.com/remotion-dev/remotion) | `4.0.530` | `4.0.535` |
| [remotion](https://github.com/remotion-dev/remotion) | `4.0.530` | `4.0.535` |
| [lenis](https://github.com/darkroomengineering/lenis) | `1.3.26` | `1.3.27` |
| [@convex-dev/resend](https://github.com/get-convex/resend) | `0.2.8` | `0.2.9` |
| [convex-helpers](https://github.com/get-convex/convex-helpers/tree/HEAD/packages/convex-helpers) | `0.1.124` | `0.1.128` |
| [resend](https://github.com/resend/resend-node) | `6.28.1` | `6.33.0` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.2` | `1.4.3` |
| [convex-test](https://github.com/get-convex/convex-test) | `0.0.59` | `0.0.62` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `4.1.12` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.2.0` | `1.8.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.17` | `22.20.5` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.2` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.428.3` | `1.438.12` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.30.4` | `5.56.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.4` | `19.3.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.2` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.3.1` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.2` | `19.3.0` |
| [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.7` |



Updates `oxfmt` from 0.68.0 to 0.73.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.73.0/npm/oxfmt)

Updates `oxlint` from 1.83.0 to 1.88.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.88.0/npm/oxlint)

Updates `turbo` from 2.10.13 to 2.11.8
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.13...v2.11.8)

Updates `convex` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/get-convex/convex-backend/releases)
- [Changelog](https://github.com/convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `werift` from 0.24.4 to 0.25.0
- [Release notes](https://github.com/shinyoshiaki/werift-webrtc/releases)
- [Changelog](https://github.com/shinyoshiaki/werift-webrtc/blob/develop/changelog.md)
- [Commits](shinyoshiaki/werift-webrtc@v0.24.4...v0.25.0)

Updates `mint` from 4.2.902 to 4.2.1047
- [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/mint)

Updates `hono` from 4.13.7 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.7...v4.13.13)

Updates `@react-three/fiber` from 9.8.1 to 9.8.2
- [Release notes](https://github.com/pmndrs/react-three-fiber/releases)
- [Commits](pmndrs/react-three-fiber@v9.8.1...v9.8.2)

Updates `@remotion/cli` from 4.0.530 to 4.0.535
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.530...v4.0.535)

Updates `@remotion/google-fonts` from 4.0.530 to 4.0.535
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.530...v4.0.535)

Updates `@remotion/motion-blur` from 4.0.530 to 4.0.535
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.530...v4.0.535)

Updates `@remotion/three` from 4.0.530 to 4.0.535
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.530...v4.0.535)

Updates `remotion` from 4.0.530 to 4.0.535
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.530...v4.0.535)

Updates `lenis` from 1.3.26 to 1.3.27
- [Release notes](https://github.com/darkroomengineering/lenis/releases)
- [Commits](darkroomengineering/lenis@v1.3.26...v1.3.27)

Updates `@convex-dev/resend` from 0.2.8 to 0.2.9
- [Changelog](https://github.com/convex/resend/blob/main/CHANGELOG.md)
- [Commits](convex/resend@v0.2.8...v0.2.9)

Updates `convex-helpers` from 0.1.124 to 0.1.128
- [Changelog](https://github.com/convex/convex-helpers/blob/main/packages/convex-helpers/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-helpers/commits/npm/0.1.128/packages/convex-helpers)

Updates `resend` from 6.28.1 to 6.33.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.28.1...v6.33.0)

Updates `@types/bun` from 1.4.2 to 1.4.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `convex-test` from 0.0.59 to 0.0.62
- [Changelog](https://github.com/convex/convex-test/blob/main/CHANGELOG.md)
- [Commits](convex/convex-test@v0.0.59...v0.0.62)

Updates `vite` from 8.3.0 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `vitest` from 4.1.11 to 4.1.12
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/vitest)

Updates `@clack/prompts` from 1.2.0 to 1.8.1
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.1/packages/prompts)

Updates `@types/node` from 22.19.17 to 22.20.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `next` from 16.3.8 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.2)

Updates `posthog-js` from 1.428.3 to 1.438.12
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.428.3...posthog-js@1.438.12)

Updates `posthog-node` from 5.30.4 to 5.56.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.56.1/packages/node)

Updates `react` from 19.2.4 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `@types/react` from 19.2.2 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.4 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/react-dom` from 19.2.2 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `zod` from 4.5.4 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.4...v4.6.7)

---
updated-dependencies:
- dependency-name: oxfmt
  dependency-version: 0.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.88.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.8
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: convex
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: werift
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: mint
  dependency-version: 4.2.1047
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@react-three/fiber"
  dependency-version: 9.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@remotion/cli"
  dependency-version: 4.0.535
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@remotion/google-fonts"
  dependency-version: 4.0.535
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@remotion/motion-blur"
  dependency-version: 4.0.535
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@remotion/three"
  dependency-version: 4.0.535
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: remotion
  dependency-version: 4.0.535
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: lenis
  dependency-version: 1.3.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@convex-dev/resend"
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: convex-helpers
  dependency-version: 0.1.128
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: resend
  dependency-version: 6.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@types/bun"
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: convex-test
  dependency-version: 0.0.62
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@clack/prompts"
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 22.20.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: next
  dependency-version: 16.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.438.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: posthog-node
  dependency-version: 5.56.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026
@vercel

vercel Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
wrapper-web Ready Ready Preview Oct 19, 2026 6:25am UTC

This branch was successfully deployed

1 active deployment
Preview — 85ac1763 Deployed Oct 19, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants