Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 12 updates - #27

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-d7ef6c5c6a
Open

chore(deps): bump the minor-and-patch group across 1 directory with 12 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-d7ef6c5c6a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates in the / directory:

Package From To
@biomejs/biome 2.5.15 2.6.2
turbo 2.11.7 2.11.10
@cloudflare/workers-types 5.20261001.1 5.20261022.1
vitest 5.0.3 5.0.5
wrangler 4.147.0 4.151.3
better-auth 1.7.7 1.7.12
drizzle-orm 0.45.3 0.45.4
next 16.3.8 16.4.2
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@electric-sql/pglite 0.5.8 0.5.11
@electric-sql/pglite-socket 0.2.11 0.2.14

Updates @biomejs/biome from 2.5.15 to 2.6.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.2

2.6.2

Minor Changes

  • #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

  • #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

  • #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

    Invalid:

    type User {
  id: ID!
}
enum Role {
ADMIN
USER
}
directive @​auth on FIELD_DEFINITION

  • #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

  • #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

  • #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

    This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

    {
  "plugins": [
    { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
    { "path": "local-plugin.grit", "resolutionKind": "project" },
    { "path": "local-plugin.grit" }
  ]
}

    Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

  • #11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

    Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.6.2

Patch Changes

2.6.1

Patch Changes

2.6.0

Minor Changes

  • #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

  • #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

  • #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

    Invalid:

    type User {
  id: ID!
}
enum Role {
ADMIN
USER
}
directive @​auth on FIELD_DEFINITION

  • #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

  • #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

  • #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

    This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

    {
  "plugins": [
    { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
    { "path": "local-plugin.grit", "resolutionKind": "project" },

... (truncated)

Commits

Updates turbo from 2.11.7 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • e521641 publish 2.11.10 to registry
  • aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
  • 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
  • af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
  • b42cc68 chore: Remove CODEOWNERS file (#14810)
  • 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
  • 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
  • 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
  • 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
  • d926d6a fix: Match package configuration files and directory inputs in task-level aff...
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261001.1 to 5.20261022.1

Commits

Updates vitest from 5.0.3 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates wrangler from 4.147.0 to 4.151.3

Release notes

Sourced from wrangler's releases.

wrangler@4.151.3

Patch Changes

  • #15611 4508172 Thanks @​taylorlee! - Allow wrangler dev to start module Workers without a default export

    Previously, wrangler dev failed to start module Workers that exported only named entrypoints, such as RPC services, unless an unused default export was added. These Workers now start normally in local development without that workaround.

  • #16370 61fc739 Thanks @​WalshyDev! - Fetch the remote config diff from the configured compliance region

    When a Worker was last deployed from the dashboard, wrangler deploy and wrangler versions upload download its remote configuration to compare with the local one. These requests ignored the compliance_region field in the Wrangler configuration file and only honoured the CLOUDFLARE_COMPLIANCE_REGION environment variable. A FedRAMP High Worker configured through the config file would send them to api.cloudflare.com instead of api.fed.cloudflare.com, and the deploy would fail with authentication errors. They now use the same compliance region as the rest of the deploy.

  • #15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

    Bun's fetch() ignores the undici dispatcheroven-sh/bun#39247createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.

  • #16359 262021d Thanks @​tw4! - Stop --strict deploys and version uploads from aborting when the API omits optional binding fields

    Previously, wrangler deploy --strict and wrangler versions upload --strict could report a destructive change for an unchanged configuration, for example an R2 bucket in the default jurisdiction, because a field the API left out was compared as removed. Missing and unset optional fields are now treated as equal, so these commands proceed when the local configuration matches the deployed Worker.

  • Updated dependencies [3464abc]:

wrangler@4.151.2

Patch Changes

  • #16307 37ab91c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261006.1 ^5.20261016.1
    workerd 1.20261012.1 1.20261016.1

  • #16352 0ae7926 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261016.1 ^5.20261019.1
    workerd 1.20261016.1 1.20261019.1

  • Updated dependencies [37ab91c, 0ae7926]:

wrangler@4.151.1

Patch Changes

... (truncated)

Commits

Updates better-auth from 1.7.7 to 1.7.12

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

  • If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

  • Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
  • Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
  • Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
  • Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
  • Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
  • Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
  • Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

  • Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

  • #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

  • #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

  • #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

  • Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

    • @​better-auth/core@​1.7.12
    • @​better-auth/drizzle-adapter@​1.7.12
    • @​better-auth/kysely-adapter@​1.7.12
    • @​better-auth/memory-adapter@​1.7.12
    • @​better-auth/mongo-adapter@​1.7.12
    • @​better-auth/prisma-adapter@​1.7.12
    • @​better-auth/telemetry@​1.7.12

1.7.11

Patch Changes

  • #10719 bd65db0 Thanks @​rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

  • #11521 37a75c9 Thanks @​aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

  • Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

    • @​better-auth/core@​1.7.11
    • @​better-auth/drizzle-adapter@​1.7.11
    • @​better-auth/kysely-adapter@​1.7.11
    • @​better-auth/memory-adapter@​1.7.11
    • @​better-auth/mongo-adapter@​1.7.11
    • @​better-auth/prisma-adapter@​1.7.11
    • @​better-auth/telemetry@​1.7.11

1.7.10

Patch Changes

  • #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

    If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

  • #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

    A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

    Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

... (truncated)

Commits
  • f4260a9 chore: release v1.7.12 (#11922)
  • b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
  • fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
  • 681aa5c fix(session): keep the cause of session lookup failures (#11924)
  • 52ab801 c...

    Description has been truncated

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
30e9ebd 
…2 updates

Bumps the minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.15` | `2.6.2` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.7` | `2.11.10` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261001.1` | `5.20261022.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.147.0` | `4.151.3` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.7` | `1.7.12` |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.2` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.8` | `0.5.11` |
| [@electric-sql/pglite-socket](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite-socket) | `0.2.11` | `0.2.14` |



Updates `@biomejs/biome` from 2.5.15 to 2.6.2
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/@biomejs/biome@2.6.2/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.2/packages/@biomejs/biome)

Updates `turbo` from 2.11.7 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.7...v2.11.10)

Updates `@cloudflare/workers-types` from 5.20261001.1 to 5.20261022.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `vitest` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `wrangler` from 4.147.0 to 4.151.3
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.3/packages/wrangler)

Updates `better-auth` from 1.7.7 to 1.7.12
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/better-auth)

Updates `drizzle-orm` from 0.45.3 to 0.45.4
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4)

Updates `next` from 16.3.8 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.2)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@electric-sql/pglite` from 0.5.8 to 0.5.11
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.11/packages/pglite)

Updates `@electric-sql/pglite-socket` from 0.2.11 to 0.2.14
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite-socket/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite-socket@0.2.14/packages/pglite-socket)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261022.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.151.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: drizzle-orm
  dependency-version: 0.45.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@electric-sql/pglite-socket"
  dependency-version: 0.2.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 25, 2026
@vercel

vercel Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
copper-analytics Ready Ready Preview Oct 25, 2026 1:36am UTC

Request Review

This branch was successfully deployed

1 active deployment
Preview — 30e9ebd6 Deployed Oct 25, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants