chore(deps): bump the bun-dependencies group with 14 updates by dependabot[bot] · Pull Request #204 · Tutitoos/mailflow

dependabot · 2026-09-13T23:47:19Z

Bumps the bun-dependencies group with 14 updates:

Package	From	To
@biomejs/biome	`2.5.12`	`2.5.13`
@sentry/react	`10.73.0`	`10.74.0`
@simplewebauthn/browser	`13.3.0`	`14.0.0`
@tanstack/react-virtual	`3.14.10`	`3.14.11`
lucide-react	`1.41.0`	`1.44.0`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.7`	`19.3.0`
vite	`8.2.2`	`8.3.0`
@better-auth/passkey	`1.7.3`	`1.7.4`
auth	`1.7.3`	`1.7.4`
better-auth	`1.7.3`	`1.7.4`
@types/bun	`1.4.0`	`1.4.2`

Updates @biomejs/biome from 2.5.12 to 2.5.13

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes
#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
/* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@import 'foo.css' layer(base);
@layer base {
.my-style {
color: red;
}
}
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.13

Patch Changes
#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
/* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@import 'foo.css' layer(base);
@layer base {
.my-style {
color: red;
}
}
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
const kibibyte = 2 ^ 10; // 8, not 1024
#11670 4969ee1 Thanks @ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

810ea56 ci: release (#11614)
e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
c23e4c7 feat: noUnsafeIframeSandbox (#11622)
a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
611767f chore: update depot logo (#11602)
See full diff in compare view

Updates @sentry/react from 10.73.0 to 10.74.0

Release notes

Sourced from @sentry/react's releases.

10.74.0

feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)

fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)

fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)

fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)

fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)

fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)

fix(v10/core): Resolve MCP capture policy per operation (#23796)

fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)

fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)

fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)

fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)

fix(v10/profiling-node): Bump @sentry/node-cpu-profiler to 2.4.4 (#24238)

fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)

fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)

fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @halillusion and @zkasuran. Thank you for your contributions!

Bundle size 📦

Path Size

@sentry/browser 27.12 KB

@sentry/browser - with treeshaking flags 25.59 KB

@sentry/browser (incl. Tracing) 45.53 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.29 KB

@sentry/browser (incl. Tracing, Profiling) 50.18 KB

@sentry/browser (incl. Tracing, Replay) 83.87 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 100.82 KB

@sentry/browser (incl. Feedback) 43.89 KB

@sentry/browser (incl. sendFeedback) 31.8 KB

@sentry/browser (incl. FeedbackAsync) 36.82 KB

@sentry/browser (incl. Metrics) 28.19 KB

@sentry/browser (incl. Logs) 28.41 KB

@sentry/browser (incl. Metrics & Logs) 29.09 KB

@sentry/react 28.89 KB

@sentry/react (incl. Tracing) 47.74 KB

@sentry/vue 32.42 KB

@sentry/vue (incl. Tracing) 47.47 KB

@sentry/svelte 27.15 KB

... (truncated)

Changelog

Sourced from @sentry/react's changelog.

10.74.0

feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)

fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)

fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)

fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)

fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)

fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)

fix(v10/core): Resolve MCP capture policy per operation (#23796)

fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)

fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)

fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)

fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)

fix(v10/profiling-node): Bump @sentry/node-cpu-profiler to 2.4.4 (#24238)

fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)

fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)

fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @halillusion and @zkasuran. Thank you for your contributions!

Commits

ce5009a release: 10.74.0
4b24ddd meta(changelog): Update changelog for 10.74.0 (#24252)
371ed5d fix(v10/profiling-node): Bump @sentry/node-cpu-profiler to 2.4.4 (#24238)
9f38e48 fix(v10/browser): Set user_agent.original on all spans for consistent filte...
264f990 fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entr...
c89f6e6 fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundl...
de25dcb fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
b627037 feat(v10): Streamline isolation scope handling & reset in isolation scopes (#...
2ce0ea1 fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute f...
3e0eccc fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (...
Additional commits viewable in compare view

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @tanstack/react-virtual from 3.14.10 to 3.14.11

Release notes

Sourced from @tanstack/react-virtual's releases.

@tanstack/react-virtual@3.14.11

Patch Changes

Updated dependencies [4a0adf3]:

@tanstack/virtual-core@3.17.9

Changelog

Sourced from @tanstack/react-virtual's changelog.

3.14.11

Patch Changes

Updated dependencies [4a0adf3]:

@tanstack/virtual-core@3.17.9

Commits

171029d ci: Version Packages (#1269)
4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
See full diff in compare view

Updates lucide-react from 1.41.0 to 1.44.0

Release notes

Sourced from lucide-react's releases.

Version 1.44.0

What's Changed

feat(packages/icons): fixed @lucide/icons rollup config by @karsa-mistmere in lucide-icons/lucide#4824

fix(icons): changed door-open by @karsa-mistmere in lucide-icons/lucide#4826

fix(docs): replace missing LucideIcon icon names in guides by @karsa-mistmere in lucide-icons/lucide#4827

feat(docs): fixed fuse js search by @karsa-mistmere in lucide-icons/lucide#4825

fix(icons): changed satellite-dish icon by @karsa-mistmere in lucide-icons/lucide#4813

fix(icons): arcified flip icons & renamed them by @karsa-mistmere in lucide-icons/lucide#4833

fix(icons): improve legibility of credit card icons by @karsa-mistmere in lucide-icons/lucide#4831

feat(lab): add check-x icon by @ishanbagra18 in lucide-icons/lucide#4737

fix(icons): correct compromised tags in shield icons by @decknamec in lucide-icons/lucide#4835

feat(icons): added toothbrush icon by @karsa-mistmere in lucide-icons/lucide#4755

New Contributors

@ishanbagra18 made their first contribution in lucide-icons/lucide#4737

@decknamec made their first contribution in lucide-icons/lucide#4835

Full Changelog: lucide-icons/lucide@1.43.0...1.44.0

Version 1.43.0

What's Changed

feat(icons): added tic-tac-toe icon by @karsa-mistmere in lucide-icons/lucide#4772

fix(icons): changed id-card icon by @karsa-mistmere in lucide-icons/lucide#4820

fix(icons): changed id-card-lanyard icon by @karsa-mistmere in lucide-icons/lucide#4819

feat(icons): delegate carton/carton-off from lab by @karsa-mistmere in lucide-icons/lucide#4818

Full Changelog: lucide-icons/lucide@1.42.0...1.43.0

Version 1.42.0

What's Changed

feat(docs): added better contribution guide by @karsa-mistmere in lucide-icons/lucide#4746

fix(site): fix HomeHeroIconsCard.data.ts by @karsa-mistmere in lucide-icons/lucide#4805

fix(icons): deprecated swiss franc icons by @karsa-mistmere in lucide-icons/lucide#4799

feat(icons): add gap-horizontal and gap-vertical by @samuelalake in lucide-icons/lucide#4544

feat(icons): added trash-off icon by @lx3133584 in lucide-icons/lucide#4788

feat(icons): added circle-dashed-check icon by @karsa-mistmere in lucide-icons/lucide#4796

feat(icons): added equal-approximately-not icon by @ryck in lucide-icons/lucide#4802

feat(icons): added dome icons by @swastik7805 in lucide-icons/lucide#4261

chore(lucide-react): Add Lucide React integration tests by @ericfennis in lucide-icons/lucide#4804

feat(packages): extract icon build logic into @lucide/shared by @karsa-mistmere in lucide-icons/lucide#4409

fix(icons): changed computer icon by @karsa-mistmere in lucide-icons/lucide#4607

chore(dependencies): Update dependencies by @ericfennis with @Copilot in lucide-icons/lucide#4806

fix(icons): changed table-2 icon by @jguddas in lucide-icons/lucide#4810

feat(icons): added user-group icons by @karsa-mistmere in lucide-icons/lucide#4782

New Contributors

@lx3133584 made their first contribution in lucide-icons/lucide#4788

@ryck made their first contribution in lucide-icons/lucide#4802

... (truncated)

Commits

94e4cb9 chore(dependencies): Update dependencies (#4806)
99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
See full diff in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203,

Bumps the bun-dependencies group with 14 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.12` | `2.5.13` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `10.73.0` | `10.74.0` | | [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/browser) | `13.3.0` | `14.0.0` | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.11` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.41.0` | `1.44.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` | | [@better-auth/passkey](https://github.com/better-auth/better-auth/tree/HEAD/packages/passkey) | `1.7.3` | `1.7.4` | | [auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/cli) | `1.7.3` | `1.7.4` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.3` | `1.7.4` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.0` | `1.4.2` | Updates `@biomejs/biome` from 2.5.12 to 2.5.13 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.13/packages/@biomejs/biome) Updates `@sentry/react` from 10.73.0 to 10.74.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.74.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.73.0...10.74.0) Updates `@simplewebauthn/browser` from 13.3.0 to 14.0.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.0/packages/browser) Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.11 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.11/packages/react-virtual) Updates `lucide-react` from 1.41.0 to 1.44.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.44.0/packages/lucide-react) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `vite` from 8.2.2 to 8.3.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite) Updates `@better-auth/passkey` from 1.7.3 to 1.7.4 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/passkey/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/passkey) Updates `auth` from 1.7.3 to 1.7.4 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/cli) Updates `better-auth` from 1.7.3 to 1.7.4 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/better-auth) Updates `@types/bun` from 1.4.0 to 1.4.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-dependencies - dependency-name: "@sentry/react" dependency-version: 10.74.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: "@simplewebauthn/browser" dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: bun-dependencies - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-dependencies - dependency-name: lucide-react dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: vite dependency-version: 8.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bun-dependencies - dependency-name: "@better-auth/passkey" dependency-version: 1.7.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-dependencies - dependency-name: auth dependency-version: 1.7.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-dependencies - dependency-name: better-auth dependency-version: 1.7.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bun-dependencies - dependency-name: "@types/bun" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bun-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-20T23:44:53Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 13, 2026

dependabot Bot closed this Sep 20, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/bun-dependencies-812c6c2612 branch September 20, 2026 23:44

Navigation Menu

chore(deps): bump the bun-dependencies group with 14 updates - #204

chore(deps): bump the bun-dependencies group with 14 updates#204
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/bun-dependencies-812c6c2612

dependabot Bot commented on behalf of github Sep 13, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.12 KB
`@sentry/browser` - with treeshaking flags	25.59 KB
`@sentry/browser` (incl. Tracing)	45.53 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.29 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.18 KB
`@sentry/browser` (incl. Tracing, Replay)	83.87 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	88.49 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	100.82 KB
`@sentry/browser` (incl. Feedback)	43.89 KB
`@sentry/browser` (incl. sendFeedback)	31.8 KB
`@sentry/browser` (incl. FeedbackAsync)	36.82 KB
`@sentry/browser` (incl. Metrics)	28.19 KB
`@sentry/browser` (incl. Logs)	28.41 KB
`@sentry/browser` (incl. Metrics & Logs)	29.09 KB
`@sentry/react`	28.89 KB
`@sentry/react` (incl. Tracing)	47.74 KB
`@sentry/vue`	32.42 KB
`@sentry/vue` (incl. Tracing)	47.47 KB
`@sentry/svelte`	27.15 KB

Conversation

dependabot Bot commented on behalf of github Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.5.13

2.5.13

Patch Changes

2.5.13

Patch Changes

10.74.0

Bundle size 📦

10.74.0

v14.0.0 - The one after they go quantum

Breaking Changes

v13.3.3

v13.3.2

v13.3.1

v14.0.0 - The one after they go quantum

@​tanstack/react-virtual@​3.14.11

Patch Changes

3.14.11

Patch Changes

Version 1.44.0

What's Changed

New Contributors

Version 1.43.0

What's Changed

Version 1.42.0

What's Changed

New Contributors

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 13, 2026 •

edited

Loading

`@tanstack/react-virtual@3`.14.11