build(deps): bump the minor-and-patch group with 15 updates by dependabot[bot] · Pull Request #8 · Synapsr/SaaS-Monitor

dependabot · 2026-10-19T07:21:07Z

Bumps the minor-and-patch group with 15 updates:

Package	From	To
better-auth	`1.7.6`	`1.7.10`
drizzle-orm	`0.45.3`	`0.45.4`
gleap	`19.3.0`	`19.3.2`
lucide-react	`1.48.0`	`1.58.0`
mysql2	`3.24.4`	`3.24.6`
next	`16.3.6`	`16.4.2`
radix-ui	`1.6.7`	`1.8.1`
react	`19.2.8`	`19.3.1`
react-dom	`19.2.8`	`19.3.1`
zod	`4.6.5`	`4.6.7`
@types/node	`24.19.0`	`24.19.2`
eslint-config-next	`16.3.6`	`16.4.2`
prettier	`3.9.9`	`3.9.10`
shadcn	`4.21.0`	`4.21.5`
vitest	`5.0.2`	`5.0.5`

Updates better-auth from 1.7.6 to 1.7.10

Release notes

Sourced from better-auth's releases.

v1.7.10

better-auth

Bug Fixes

Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)

Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)

Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)

Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)

Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)

Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)

Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)

Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)

Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)

Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)

Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)

Improved errors for unknown OAuth client_id values to say client not found. (#11799)

Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)

Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)

Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)

Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.10

Patch Changes

#11393 eebd47a Thanks @breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

#11821 09d07e6 Thanks @gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

#11819 eaecb72 Thanks @gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

#11820 88c9a37 Thanks @gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

#11696 0cf1f7c Thanks @drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

#11822 414e845 Thanks @gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

@better-auth/core@1.7.10

@better-auth/mongo-adapter@1.7.10

@better-auth/drizzle-adapter@1.7.10

@better-auth/kysely-adapter@1.7.10

@better-auth/memory-adapter@1.7.10

@better-auth/prisma-adapter@1.7.10

@better-auth/telemetry@1.7.10

1.7.9

Patch Changes

#11766 6edaa61 Thanks @bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

Updated dependencies []:

@better-auth/core@1.7.9

@better-auth/drizzle-adapter@1.7.9

@better-auth/kysely-adapter@1.7.9

@better-auth/memory-adapter@1.7.9

... (truncated)

Commits

b734a41 chore: release v1.7.10 (#11795)
eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
414e845 fix(better-auth): keep package subpaths in sync with build entries (#11822)
88c9a37 fix(one-tap): apply plugin-level autoSelect and cancelOnTapOutside (#11820)
09d07e6 fix(one-tap): stop calling prompt moment methods unsupported under FedCM (#11...
0cf1f7c fix(one-tap): add the better-auth/plugins/one-tap subpath export (#11696)
d2a5f83 chore: release v1.7.9 (#11761)
dbca311 test: fix test names in bearer and organization (#11768)
c03ced5 chore: bump @biomejs/biome (#11760)
Additional commits viewable in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
See full diff in compare view

Updates gleap from 19.3.0 to 19.3.2

Release notes

Sourced from gleap's releases.

19.3.2

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

19.3.1

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs. Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

Changelog

Sourced from gleap's changelog.

19.3.2

Fixed: screenshots showed dialogs and other content inside iframes as an empty box. The capture now includes the page of every same-origin iframe (frames in frames too, with the same masking and blocking rules) and stores it in the frame's srcdoc, so the screenshot shows what the user saw instead of loading the frame's URL without their session. Cross-origin iframes, and frames still loading their src, render as before. Canvases inside iframes are captured too. Typed values, scroll positions and canvases inside iframes need the matching screenshot renderer update.

19.3.1

Security: the default URL handler opens only http(s), mailto, tel and relative links (never javascript: or data:), new tabs open with noopener, banner and modal messages need an exact origin match, and messages to the widget, chatbar and agent conversation frames are pinned to their own origin. A custom Gleap.setUrlHandler still receives app deep links, never script URLs. Fixed: screenshot and recording logs are sent only once the capture is saved (none after a cancel, a retake replaces them), and recording logs leave out paused stretches. With a custom API URL (Gleap.setApiUrl) the SDK's own calls stay out of the network logs, and the Gleap-Hash session header is always masked. Screenshot downloads stay out of the network logs, images that can't be downloaded are tinted instead of breaking the screenshot, and switching users no longer races.

Commits

8aaf85c Merge pull request #184 from GleapSDK/fix-screenshot-iframes
daf2ef5 chore: version 19.3.2
372f193 fix(capture): screenshots include the page inside same-origin iframes
b6b7b4d Merge pull request #183 from GleapSDK/chore/release-19.3.1
2684929 chore: version 19.3.1
23d34d7 Merge pull request #182 from GleapSDK/fix-e2e-release-20261013
dc5ad19 Merge remote-tracking branches 'origin/fix-e2e1013-capture' and 'origin/fix-e...
7de87c9 fix(security): exact origin checks for banner/modal, pinned targetOrigin for ...
dba931b fix(security): default url handler opens only http(s), mailto, tel and relati...
1ba664f fix(capture): send capture logs only once the capture is saved, without pause...
Additional commits viewable in compare view

Updates lucide-react from 1.48.0 to 1.58.0

Release notes

Sourced from lucide-react's releases.

Version 1.58.0

What's Changed

feat(docs): add third-party package lucide-jte by @sgruendel in lucide-icons/lucide#5000

chore(integration-tests): Add Svelte integration tests for @ucide/svelte by @ericfennis in lucide-icons/lucide#5005

chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @dependabot[bot] in lucide-icons/lucide#5004

fix(site): Fix homepage animation by @ericfennis in lucide-icons/lucide#5015

feat(ci): auto-generate PR titles from added file paths by @ericfennis with @Copilot in lucide-icons/lucide#4790

fix(icons): changed barrel icon by @karsa-mistmere in lucide-icons/lucide#4639

ci(dev): fix "Generate PR Title" job by using REST API for changed files by @ericfennis with @Copilot in lucide-icons/lucide#5017

feat(icons): added certificate icon by @rrod497 in lucide-icons/lucide#4327

fix(icons): update music icons by @jamiemlaw in lucide-icons/lucide#4072

New Contributors

@sgruendel made their first contribution in lucide-icons/lucide#5000

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

Version 1.57.0

What's Changed

feat(icons): added folder-user and folder-user icons by @rrod497 in lucide-icons/lucide#4603

feat(icons): added calendar-chevrons-left icon by @karsa-mistmere in lucide-icons/lucide#5001

feat(icons): added users-collaboration icon by @rrod497 in lucide-icons/lucide#4922

feat(icons): added Belarusian ruble icon by @js-best in lucide-icons/lucide#4984

feat(icons): added circle-fading-play icon by @tatianatsiguleva in lucide-icons/lucide#4990

feat(icons): add cpu-ai icon by @signalgridco in lucide-icons/lucide#4992

feat(icons): added guitar-electric icon by @rrod497 in lucide-icons/lucide#4917

feat(icons): added graph-star icon by @Nitero in lucide-icons/lucide#4983

chore(deps-dev): bump the svelte-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#4996

chore(deps-dev): bump preact from 11.0.0 to 11.0.1 in the preact-deps group by @dependabot[bot] in lucide-icons/lucide#4999

chore(deps-dev): bump @vitejs/plugin-react from 6.1.1 to 6.1.2 in the react-deps group by @dependabot[bot] in lucide-icons/lucide#4995

feat(icons): added perfume icon by @rrod497 in lucide-icons/lucide#4426

New Contributors

@js-best made their first contribution in lucide-icons/lucide#4984

@tatianatsiguleva made their first contribution in lucide-icons/lucide#4990

@signalgridco made their first contribution in lucide-icons/lucide#4992

@Nitero made their first contribution in lucide-icons/lucide#4983

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

feat(icons): added server-nas icon by @benhaube in lucide-icons/lucide#4537

fix(icons,categories): fix notifications category name and refine circle-x tags by @Rachit315 in lucide-icons/lucide#4994

feat(icons): add message-circle-text icon by @ericfennis in lucide-icons/lucide#4898

New Contributors

@Rachit315 made their first contribution in lucide-icons/lucide#4994

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

... (truncated)

Commits

3f1255e chore(deps-dev): bump @vitejs/plugin-react (#4995)
949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
See full diff in compare view

Updates mysql2 from 3.24.4 to 3.24.6

Release notes

Sourced from mysql2's releases.

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

Changelog

Sourced from mysql2's changelog.

3.24.6 (2026-10-13)

Bug Fixes

allocate a new LOCAL INFILE terminator packet per write (#4580) (8c068ef), closes #4568

3.24.5 (2026-09-29)

Bug Fixes

strip the brackets from an IPv6 host in a connection URI (#4570) (b1c39c8)

Commits

7f65d9a chore(master): release 3.24.6 (#4592)
ded9be2 build(deps-dev): bump rollup from 4.64.0 to 4.64.4 in the rollup group (#4605)
30201a2 build(deps-dev): bump @types/node from 26.6.4 to 26.6.5 (#4606)
5eb21f4 build(deps-dev): bump prettier (#4604)
477ca97 build(deps): bump lucide-react from 1.52.0 to 1.55.0 in /website (#4609)
9ea9345 build(deps-dev): bump prettier from 3.9.9 to 3.9.10 in /website (#4608)
c52e961 build(deps-dev): bump @types/node from 26.6.4 to 26.6.5 in /website (#4607)
1cdba3c build(deps-dev): bump @biomejs/biome from 2.5.14 to 2.5.15 (#4585)
a270608 build(deps-dev): bump @types/node from 26.6.3 to 26.6.4 (#4584)
51e02b3 build(deps-dev): bump brace-expansion from 5.0.9 to 5.0.12 (#4601)
Additional commits viewable in compare view

Updates next from 16.3.6 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

docs: improve clarity and punctuation in README: #86096

Fix debug build paths Pages Router support entries: #93529

bundle-analyzer: record historical snapshots on each analyze run: #93520

fix: detect proxy.ts correctly with compound pageExtensions: #93246

feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624

docs: proxy event argument: #96435

docs: remove experimental note from runtime prefetching: #96615

Preserve per-segment prefetching after dynamic navigation: #96583

Rename static generation stream option to waitForAllReady: #96564

Remove obsolete static generation plumbing: #96563

[turbopack] Drop dead writes to exports: #96381

[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380

[turbopack] Add test for sideEffects with optimizePackageImports: #96549

[turbopack] Strip leading BOM before parsing CSS: #96678

Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates radix-ui from 1.6.7 to 1.8.1

Changelog

Sourced from radix-ui's changelog.

1.8.1

Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

Updated dependencies: @radix-ui/react-accordion@1.3.1, @radix-ui/react-avatar@1.3.1, @radix-ui/react-checkbox@1.4.1, @radix-ui/react-collapsible@1.2.1, @radix-ui/react-context-menu@2.4.1, @radix-ui/react-dialog@1.3.1, @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-dropdown-menu@2.2.1, @radix-ui/react-focus-scope@1.3.1, @radix-ui/react-hover-card@1.2.1, @radix-ui/react-menu@2.2.1, @radix-ui/react-menubar@1.2.1, @radix-ui/react-navigation-menu@1.4.1, @radix-ui/react-one-time-password-field@0.2.1, @radix-ui/react-password-toggle-field@0.2.1, @radix-ui/react-popover@1.3.1, @radix-ui/react-progress@1.2.1, @radix-ui/react-roving-focus@1.2.1, @radix-ui/react-select@2.4.1, @radix-ui/react-slider@1.6.1, @radix-ui/react-switch@1.4.1, @radix-ui/react-tabs@1.2.1, @radix-ui/react-toast@1.3.1, @radix-ui/react-toggle@1.2.1, @radix-ui/react-toggle-group@1.2.1, @radix-ui/react-tooltip@1.4.1, @radix-ui/react-alert-dialog@1.2.1, @radix-ui/react-radio-group@1.5.1, @radix-ui/react-toolbar@1.2.1

1.8.0

Context Menu

Allowed side, sideOffset, and align props to be overridden on ContextMenu.Content.

Navigation Menu

Added data-state attribute to the content element when using NavigationMenu.Viewport for consistency.

Popover

Fixed aria-controls being set on Popover.Trigger while the popover is closed.

Select

Fixed content alignment when all items are disabled.

Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.

Slider

Fixed a bug where updating a Slider value programmatically while inside a <form> would dispatch an input event that propagated to ancestor onInput handlers.

Slot

Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

Toast

Fixed Toast.Viewport forcing a still-hydrating Suspense boundary to client-render.

Tooltip

Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.

Other updates

Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.

Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.

Fixed timing bugs in useCallbackRef.

Fixed FocusScope throwing a TypeError in test environments after teardown.

Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.

Some small and breaking changes in unstable collection APIs. This package is an internal utility, undocumented, and unstable APIs may change without a major version bump. Capturing those changes here just in case you did a naughty and used them.

Renamed unstable_CollectionProps to unstable_CollectionSlotProps and unstable_CollectionItemMap to unstable_CollectionDict.

Added useGetCollection to the functions returned from unstable_createCollection.

... (truncated)

Commits

See full diff in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143,

Bumps the minor-and-patch group with 15 updates: | Package | From | To | | --- | --- | --- | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.6` | `1.7.10` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` | | [gleap](https://github.com/GleapSDK/JavaScript-SDK) | `19.3.0` | `19.3.2` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.58.0` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.24.4` | `3.24.6` | | [next](https://github.com/vercel/next.js) | `16.3.6` | `16.4.2` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.8.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.1` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.0` | `24.19.2` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.6` | `16.4.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.0` | `4.21.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.2` | `5.0.5` | Updates `better-auth` from 1.7.6 to 1.7.10 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/better-auth) Updates `drizzle-orm` from 0.45.3 to 0.45.4 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4) Updates `gleap` from 19.3.0 to 19.3.2 - [Release notes](https://github.com/GleapSDK/JavaScript-SDK/releases) - [Changelog](https://github.com/GleapSDK/JavaScript-SDK/blob/master/CHANGELOG.md) - [Commits](GleapSDK/JavaScript-SDK@19.3.0...19.3.2) Updates `lucide-react` from 1.48.0 to 1.58.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.58.0/packages/lucide-react) Updates `mysql2` from 3.24.4 to 3.24.6 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.24.4...v3.24.6) Updates `next` from 16.3.6 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.6...v16.4.2) Updates `radix-ui` from 1.6.7 to 1.8.1 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `react` from 19.2.8 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.2.8 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@types/node` from 24.19.0 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint-config-next` from 16.3.6 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-config-next) Updates `prettier` from 3.9.9 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `shadcn` from 4.21.0 to 4.21.5 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.5/packages/shadcn) Updates `vitest` from 5.0.2 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.7.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: drizzle-orm dependency-version: 0.45.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: gleap dependency-version: 19.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mysql2 dependency-version: 3.24.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: radix-ui dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: shadcn dependency-version: 4.21.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026

Navigation Menu

Repository navigation

build(deps): bump the minor-and-patch group with 15 updates - #8

build(deps): bump the minor-and-patch group with 15 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-0aa314716b

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026

v1.7.10

better-auth

Bug Fixes

@better-auth/oauth-provider

Features

Bug Fixes

@better-auth/core

Bug Fixes

@better-auth/mongo-adapter

Bug Fixes

1.7.10

Patch Changes

1.7.9

Patch Changes

0.45.4

19.3.2

19.3.1

19.3.2

19.3.1

Version 1.58.0

What's Changed

New Contributors

Version 1.57.0

What's Changed

New Contributors

Version 1.56.0

What's Changed

New Contributors

v3.24.6

3.24.6 (2026-10-13)

Bug Fixes

v3.24.5

3.24.5 (2026-09-29)

Bug Fixes

3.24.6 (2026-10-13)

Bug Fixes

3.24.5 (2026-09-29)

Bug Fixes

v16.4.2

What's Changed

v16.4.1

v16.4.0

Core Changes

Misc Changes

1.8.1

1.8.0

Context Menu

Navigation Menu

Popover

Select

Slider

Slot

Toast

Tooltip

Other updates

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/oauth-provider`

`@better-auth/core`

`@better-auth/mongo-adapter`