Skip to content

chore(deps): bump the minor-and-patch group with 16 updates - #328

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-e3f264b10a
Closed

chore(deps): bump the minor-and-patch group with 16 updates#328
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-e3f264b10a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Bumps the minor-and-patch group with 16 updates:

Package From To
@commitlint/cli 21.2.3 21.2.4
@commitlint/config-conventional 21.2.3 21.2.4
@effect/platform-node 4.0.4 4.0.5
@oxlint/plugins 1.87.0 1.88.0
turbo 2.11.7 2.11.9
@cloudflare/vitest-plugin 1.4.2 1.4.5
@better-auth/core 1.7.7 1.7.11
@better-auth/sso 1.7.7 1.7.11
better-auth 1.7.7 1.7.11
samlify 2.13.1 2.14.0
@effect/atom-react 4.0.4 4.0.5
@tanstack/react-router 1.170.44 1.170.45
lucide-react 1.57.0 1.59.0
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@effect/vitest 4.0.4 4.0.5

Updates @commitlint/cli from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

Performance Improvements

Docs, etc

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/cli

Commits

Updates @commitlint/config-conventional from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

Performance Improvements

Docs, etc

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

Commits

Updates @effect/platform-node from 4.0.4 to 4.0.5

Release notes

Sourced from @​effect/platform-node's releases.

@​effect/platform-node@​4.0.5

Patch Changes

@​effect/platform-node-shared@​4.0.5

Patch Changes

Changelog

Sourced from @​effect/platform-node's changelog.

4.0.5

Patch Changes

Commits
  • 7f524e2 Version Packages (#9099)
  • 5951ac0 feat(platform-node): add typed unix socket and TLS options to NodeHttpClient ...
  • 12be65e Redact sensitive query params in spans, inspect output and errors (#9136)
  • 3abc63e Add HttpMiddleware.decompression for compressed request bodies (#9138)
  • 816575e Use bigint for 64-bit FileSystem stat metadata (#9112)
  • See full diff in compare view

Updates @oxlint/plugins from 1.87.0 to 1.88.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

  • 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
  • c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

  • bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

  • 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
  • 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
  • 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
  • 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
  • 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

  • 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
  • c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
  • c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
  • 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
  • 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

  • 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
  • 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
  • 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)
Commits

Updates turbo from 2.11.7 to 2.11.9

Release notes

Sourced from turbo's releases.

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • 64d5e48 publish 2.11.9 to registry
  • 78b039e fix(cache): Parallelize dry-run HEAD fallback (#14801)
  • 6834819 docs: Use .NET in the multi-language guide (#14793)
  • 679efb8 refactor: Remove setup lifecycle script controls (#14818)
  • 9c90852 fix: Allow native package manager configuration during setup (#14816)
  • a3bcc4a chore: Release Turborepo 2.11.9-canary.1 (#14817)
  • 9328416 fix: Stop installing the Unix shell hook automatically (#14813)
  • 74c9fbc fix: Attribute Cargo.lock changes to the crates whose dependencies changed (#...
  • a3ef52a chore: Update with-changesets example (#14638)
  • f05411f perf: Skip newline normalization copies for already-normalized TUI output (#1...
  • Additional commits viewable in compare view

Updates @cloudflare/vitest-plugin from 1.4.2 to 1.4.5

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.4.5

Patch Changes

  • #16135 329d757 Thanks @​Zyles! - Fix test runs slowing down file after file, and stalling, with isolate: false

    With isolate: false, Vitest hands a worker's module runner to the pool again for every test file the worker runs, and the pool wrapped the runner's module fetches in one more layer each time, so imports got slower with every file until runs stalled. The pool now patches each module runner once.

  • Updated dependencies [37ab91c, 0ae7926]:

@​cloudflare/vitest-plugin@​1.4.4

Patch Changes

@​cloudflare/vitest-plugin@​1.4.3

Patch Changes

  • #16248 ad01099 Thanks @​mattjohnsonpint! - Fix V8 coverage failing with Vitest 5.0.4

    Tests using V8 coverage with Vitest 5.0.4 no longer fail with an assertion error during teardown.

  • #16163 5f12934 Thanks @​edmundhung! - Fix Workers tests failing with Vitest's filesystem module cache

    This supports Vitest 4.1's test.experimental.fsModuleCache and Vitest 5's test.fsModuleCache.

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.4.5

Patch Changes

  • #16135 329d757 Thanks @​Zyles! - Fix test runs slowing down file after file, and stalling, with isolate: false

    With isolate: false, Vitest hands a worker's module runner to the pool again for every test file the worker runs, and the pool wrapped the runner's module fetches in one more layer each time, so imports got slower with every file until runs stalled. The pool now patches each module runner once.

  • Updated dependencies [37ab91c, 0ae7926]:

1.4.4

Patch Changes

1.4.3

Patch Changes

  • #16248 ad01099 Thanks @​mattjohnsonpint! - Fix V8 coverage failing with Vitest 5.0.4

    Tests using V8 coverage with Vitest 5.0.4 no longer fail with an assertion error during teardown.

  • #16163 5f12934 Thanks @​edmundhung! - Fix Workers tests failing with Vitest's filesystem module cache

    This supports Vitest 4.1's test.experimental.fsModuleCache and Vitest 5's test.fsModuleCache.

Commits

Updates @better-auth/core from 1.7.7 to 1.7.11

Release notes

Sourced from @​better-auth/core's releases.

v1.7.11

better-auth

Bug Fixes

  • Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
  • Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
  • Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
  • Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
  • Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​aryan1306, @​bytaesu, @​cpojer, @​gustavovalverde, @​noobnooc, @​rendermani, @​sahiljagtap08

Full changelog: v1.7.10...v1.7.11

v1.7.10

better-auth

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.11

Patch Changes

  • #11623 ce96569 Thanks @​cpojer! - Reduce installation size by removing the semantic conventions production dependency while preserving all instrumentation attribute keys.

  • #11907 2f6ca3f Thanks @​bytaesu! - Fix plugins whose init returns options: undefined, such as testUtils(), failing to typecheck when exactOptionalPropertyTypes is enabled.

  • #11884 dfd8dd2 Thanks @​bytaesu! - Twitch and Paybin sign-in now verify ID token signatures and identity claims before mapping profiles, with 30 seconds of clock tolerance. Custom Paybin issuers must expose RS256 signing keys at <issuer>/.well-known/jwks.json.

1.7.10

Patch Changes

  • #11612 fedd055 Thanks @​vhinayindia! - If your resource server verifies access tokens with verifyAccessTokenRequest or verifyBearerToken and a jwksUrl, including through the MCP plugin, a key set that cannot be reached at all, for example a refused connection, now throws an error. Before, the token was rejected as invalid with 401 "no token payload", which hid the outage. A key set that answers with an HTTP error already threw.

    With remoteVerify configured, such a failure no longer falls back to remote introspection.

    The OAuth provider's /oauth2/introspect, /oauth2/userinfo and /oauth2/revoke behave the same way with the JWT plugin's jwks.remoteUrl: they return 500 instead of reporting the token as invalid.

  • #11805 bbd0a19 Thanks @​gustavovalverde! - Servers that verify JWTs against a key set now refetch that key set at most once every 30 seconds per server process when a token names a key ID (kid) the cached set does not contain. This covers the OAuth provider plugin's introspection, revocation, UserInfo, and logout endpoints, and resource servers that call verifyAccessTokenRequest or verifyBearerToken with jwksUrl. Previously every such token caused a new fetch: a remote request with jwksUrl or jwks.remoteUrl, or otherwise a read of the jwks table. Anyone could send tokens with made-up kid values to force one fetch per request, and the UserInfo endpoint needs no client credentials.

    Concurrent verifications now share one fetch, and a key set fetch that takes longer than 5 seconds fails with a JWKSTimeout error instead of waiting indefinitely.

    A token signed with a newly published key still verifies without waiting for the 5-minute cache to expire. It can be rejected for up to 30 seconds if the key set was already refetched for another unknown kid in that time. No configuration change is needed.

1.7.9

1.7.8

Patch Changes

  • #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0Description has been truncated

@dependabot
chore(deps): bump the minor-and-patch group with 16 updates
6daf656 
Bumps the minor-and-patch group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.3` | `21.2.4` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.3` | `21.2.4` |
| [@effect/platform-node](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform/node) | `4.0.4` | `4.0.5` |
| [@oxlint/plugins](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugins) | `1.87.0` | `1.88.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.7` | `2.11.9` |
| [@cloudflare/vitest-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-plugin) | `1.4.2` | `1.4.5` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.7.7` | `1.7.11` |
| [@better-auth/sso](https://github.com/better-auth/better-auth/tree/HEAD/packages/sso) | `1.7.7` | `1.7.11` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.7` | `1.7.11` |
| [samlify](https://github.com/tngan/samlify) | `2.13.1` | `2.14.0` |
| [@effect/atom-react](https://github.com/Effect-TS/effect/tree/HEAD/packages/atom/react) | `4.0.4` | `4.0.5` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.44` | `1.170.45` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.57.0` | `1.59.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@effect/vitest](https://github.com/Effect-TS/effect/tree/HEAD/packages/vitest) | `4.0.4` | `4.0.5` |


Updates `@commitlint/cli` from 21.2.3 to 21.2.4
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.4/@commitlint/cli)

Updates `@commitlint/config-conventional` from 21.2.3 to 21.2.4
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.4/@commitlint/config-conventional)

Updates `@effect/platform-node` from 4.0.4 to 4.0.5
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/platform/node/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/platform-node@4.0.5/packages/platform/node)

Updates `@oxlint/plugins` from 1.87.0 to 1.88.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.88.0/npm/oxlint-plugins)

Updates `turbo` from 2.11.7 to 2.11.9
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.7...v2.11.9)

Updates `@cloudflare/vitest-plugin` from 1.4.2 to 1.4.5
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-plugin/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-plugin@1.4.5/packages/vitest-plugin)

Updates `@better-auth/core` from 1.7.7 to 1.7.11
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.11/packages/core)

Updates `@better-auth/sso` from 1.7.7 to 1.7.11
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/sso/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.11/packages/sso)

Updates `better-auth` from 1.7.7 to 1.7.11
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.11/packages/better-auth)

Updates `samlify` from 2.13.1 to 2.14.0
- [Release notes](https://github.com/tngan/samlify/releases)
- [Commits](tngan/samlify@v2.13.1...v2.14.0)

Updates `@effect/atom-react` from 4.0.4 to 4.0.5
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/atom/react/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/atom-react@4.0.5/packages/atom/react)

Updates `@tanstack/react-router` from 1.170.44 to 1.170.45
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.45/packages/react-router)

Updates `lucide-react` from 1.57.0 to 1.59.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.59.0/packages/lucide-react)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@effect/vitest` from 4.0.4 to 4.0.5
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/vitest/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/vitest@4.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@commitlint/cli"
  dependency-version: 21.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 21.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@effect/platform-node"
  dependency-version: 4.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@oxlint/plugins"
  dependency-version: 1.88.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/vitest-plugin"
  dependency-version: 1.4.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@better-auth/core"
  dependency-version: 1.7.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@better-auth/sso"
  dependency-version: 1.7.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: samlify
  dependency-version: 2.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@effect/atom-react"
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@effect/vitest"
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
@ian-pascoe ian-pascoe closed this Oct 31, 2026

This branch had an error being deployed

1 failed deployment
preview — 6daf6569 Deployed Oct 31, 2026 by ian-pascoe via destroy preview #606
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ian-pascoe