Skip to content

chore(deps): bump the npm-dependencies group across 1 directory with 13 updates - #76

Merged
Ediminator merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-371a01939a
Nov 4, 2026
Merged

chore(deps): bump the npm-dependencies group across 1 directory with 13 updates#76
Ediminator merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-371a01939a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 13 updates in the / directory:

Package From To
@electric-sql/pglite 0.5.11 0.5.14
altcha-lib 2.7.0 2.8.0
better-auth 1.7.12 1.7.15
lucide-react 1.61.0 1.66.0
next 16.4.2 16.4.3
nodemailer 10.2.1 10.3.1
@next/eslint-plugin-next 16.4.2 16.4.3
@secretlint/secretlint-rule-preset-recommend 13.0.7 13.1.0
autoprefixer 10.6.1 10.6.2
eslint-plugin-security 4.2.0 4.2.1
postcss 8.5.31 8.5.32
secretlint 13.0.7 13.1.0
typescript-eslint 8.72.0 8.72.1

Updates @electric-sql/pglite from 0.5.11 to 0.5.14

Release notes

Sourced from @​electric-sql/pglite's releases.

@​electric-sql/pglite@​0.5.14

Patch Changes

  • 1cf7e86: Only build the pglite.wasm, initdb.wasm and pglite.data URLs when PGlite has to load them. Passing pgliteWasmModule, initdbWasmModule and fsBundle now works in bundles where import.meta.url is undefined, such as an esbuild IIFE build.
  • 48dd3fb: Use PROXYFS instead of dumping the data dir from the scratch PGlite used for initdb when the data dir is in memory.
  • 268929b: do not copy parsers on each query

@​electric-sql/pglite-prepopulatedfs@​0.5.14

Patch Changes

  • Updated dependencies [1cf7e86]
  • Updated dependencies [48dd3fb]
  • Updated dependencies [268929b]
    • @​electric-sql/pglite@​0.5.14

@​electric-sql/pglite-prepopulatedfs@​0.5.13

Patch Changes

  • Updated dependencies [c7dc39e]
  • Updated dependencies [8364675]
  • Updated dependencies [a4cfd4d]
  • Updated dependencies [2db5d2d]
    • @​electric-sql/pglite@​0.5.13

@​electric-sql/pglite@​0.5.13

Patch Changes

  • c7dc39e: close() now waits for queries, execs and transactions that were issued before it, so they complete instead of failing with Cannot read properties of undefined after teardown.
  • 8364675: Added support for node-postgres through createPgConfig()
  • a4cfd4d: Added MemfsFrontendFS which allows other filesystems be implemented on top of a MEMFS. Example: added Memfs2OpfsFS which is backed by an OPFS fs.
  • 2db5d2d: Upgrade emsdk to 6.0.5

@​electric-sql/pglite@​0.5.12

Patch Changes

  • 0641b37: Fix custom filesystems not receiving times set with FS.utime. Emscripten's FS.utime calls setattr with atime and mtime, but the BaseFilesystem bridge only handled the older timestamp field, so utimes was never called on OPFS AHP or any other BaseFilesystem. Files restored from a tarball kept the time they were written instead of the time stored in the tarball.
  • e752dbe: Run initdb with TZ=UTC, like the backend, so a new database gets timezone = 'UTC' in postgresql.conf. Before, initdb wrote the host's zone as a fixed offset without daylight saving (e.g. Etc/GMT+5 for America/New_York), so timestamptz input without an offset was stored at a different instant on each non-UTC machine.
  • c31130c: Start under the Node.js permission model (node --permission). Emscripten's NODEFS read the fs open flags with process.binding('constants'), which Node always denies in that mode, so new PGlite() threw ERR_ACCESS_DENIED even for memory://. The bundled build now reads them from require('fs').constants, which holds the same values.
  • 0641b37: Fix files restored from a tarball getting a January 1970 modification time. loadTar passed the tar header's time to Emscripten's FS.utime in seconds, but FS.utime takes milliseconds. This affected every new database (initdb's data dir is restored from a tarball) and every loadDataDir. With the Node filesystem the files on disk got those dates too.

@​electric-sql/pglite-prepopulatedfs@​0.5.12

Patch Changes

  • Updated dependencies [0641b37]
  • Updated dependencies [e752dbe]
  • Updated dependencies [c31130c]
  • Updated dependencies [0641b37]
    • @​electric-sql/pglite@​0.5.12
Changelog

Sourced from @​electric-sql/pglite's changelog.

0.5.14

Patch Changes

  • 1cf7e86: Only build the pglite.wasm, initdb.wasm and pglite.data URLs when PGlite has to load them. Passing pgliteWasmModule, initdbWasmModule and fsBundle now works in bundles where import.meta.url is undefined, such as an esbuild IIFE build.
  • 48dd3fb: Use PROXYFS instead of dumping the data dir from the scratch PGlite used for initdb when the data dir is in memory.
  • 268929b: do not copy parsers on each query

0.5.13

Patch Changes

  • c7dc39e: close() now waits for queries, execs and transactions that were issued before it, so they complete instead of failing with Cannot read properties of undefined after teardown.
  • 8364675: Added support for node-postgres through createPgConfig()
  • a4cfd4d: Added MemfsFrontendFS which allows other filesystems be implemented on top of a MEMFS. Example: added Memfs2OpfsFS which is backed by an OPFS fs.
  • 2db5d2d: Upgrade emsdk to 6.0.5

0.5.12

Patch Changes

  • 0641b37: Fix custom filesystems not receiving times set with FS.utime. Emscripten's FS.utime calls setattr with atime and mtime, but the BaseFilesystem bridge only handled the older timestamp field, so utimes was never called on OPFS AHP or any other BaseFilesystem. Files restored from a tarball kept the time they were written instead of the time stored in the tarball.
  • e752dbe: Run initdb with TZ=UTC, like the backend, so a new database gets timezone = 'UTC' in postgresql.conf. Before, initdb wrote the host's zone as a fixed offset without daylight saving (e.g. Etc/GMT+5 for America/New_York), so timestamptz input without an offset was stored at a different instant on each non-UTC machine.
  • c31130c: Start under the Node.js permission model (node --permission). Emscripten's NODEFS read the fs open flags with process.binding('constants'), which Node always denies in that mode, so new PGlite() threw ERR_ACCESS_DENIED even for memory://. The bundled build now reads them from require('fs').constants, which holds the same values.
  • 0641b37: Fix files restored from a tarball getting a January 1970 modification time. loadTar passed the tar header's time to Emscripten's FS.utime in seconds, but FS.utime takes milliseconds. This affected every new database (initdb's data dir is restored from a tarball) and every loadDataDir. With the Node filesystem the files on disk got those dates too.
Commits

Updates altcha-lib from 2.7.0 to 2.8.0

Release notes

Sourced from altcha-lib's releases.

v2.8.0

This release adds support for Nuxt 4 (#22). The H3 plugin (altcha-lib/frameworks/h3) works with both h3 v1 (Nuxt 4, Nitro 2) and h3 v2 (Nitro 3). It no longer fails with event.req.headers.get is not a function in Nuxt 4 projects.

Compatibility: no changes to challenges, payloads or verification results. The H3 plugin's handlers have new TypeScript types, and its errors are no longer instances of h3's HTTPError class; see Upgrade notes. Other framework plugins are unchanged.

Fixes

  • Nuxt 4 / h3 v1 support. Nuxt 4 runs on h3 v1, but the plugin only supported h3 v2 and listed h3: ^2.0.0 as a peer dependency. Package managers such as pnpm therefore installed a second copy of h3 (v2) for altcha-lib. The plugin then used h3 v2 helpers on the h3 v1 events created by Nuxt, which failed. The plugin no longer imports h3 at runtime and handles both event formats itself, so it works whichever h3 version is installed for altcha-lib. The optional h3 peer dependency now accepts ^1.15.0 || ^2.0.0.
  • Request body stays readable. The middleware reads the payload without consuming the request body, so handlers that run after it can still call readBody. On h3 v1, the body is cached where h3 v1's own readBody looks for it. On h3 v2, the middleware reads from a clone of the request. Before, the middleware used up the body on h3 v2.
  • Errors are recognized by both h3 versions. Failed verification responds with 403, and an invalid JSON or form data body responds with 400. Both h3 v1 and v2 recognize these errors as HTTP errors. Before, h3 v1 treated them as unhandled errors: it logged them, and Nitro hid their message. An invalid multipart body used to cause an unhandled 500 error and now returns 400.
  • Nuxt docs. The example in docs/nuxt.md puts route files under server/routes/, which Nuxt registers automatically. It imports from ~~/server/utils/altcha, because ~ points to app/ in Nuxt 4, and uses createError, which works in h3 v1 and v2.

Changes

  • H3 handler types. challengeHandler, verifyHandler and the function returned by middleware() are plain async functions that take an H3EventLike (H3WebEvent | H3NodeEvent), all exported from altcha-lib/frameworks/h3. Before, they were typed as h3 v2's EventHandler. They can still be passed directly to h3 v1 and v2 routers and used as Nuxt or Nitro route handlers. getPayloadFromEvent also takes an H3EventLike.
  • TypeScript 6. The library is built with TypeScript 6. The CommonJS build keeps moduleResolution: "node", with ignoreDeprecations: "6.0" in tsconfig.cjs.json. The emitted .d.ts files use the same import paths as before.

Upgrade notes

Most deployments need no changes.

  • Nuxt 4. Upgrade altcha-lib. If you added h3@2 to your project, or an overrides/resolutions entry, to work around the error, remove it.
  • Checking errors with instanceof HTTPError. The plugin's errors are no longer created with h3's HTTPError. If your error handler checks error instanceof HTTPError, use HTTPError.isError(error) (h3 v2) or isError(error) (h3 v1) instead, or check error.statusCode. Both return true for the plugin's errors.

Full changelog: altcha-org/altcha-lib@v2.7.0...v2.8.0

Changelog

Sourced from altcha-lib's changelog.

[2.8.0] - 2026-10-24

Fixed

  • Nuxt 4 support: altcha-lib/frameworks/h3 works with h3 v1 (Nuxt 4, Nitro 2) as well as h3 v2 (Nitro 3), and the h3 peer dependency accepts ^1.15.0 || ^2.0.0 (#22). The plugin no longer imports h3 at runtime, so it no longer fails with event.req.headers.get is not a function when the package manager installs h3 v2 for altcha-lib next to Nuxt's h3 v1.
  • altcha-lib/frameworks/h3 middleware leaves the request body readable for later handlers on both h3 majors.
  • altcha-lib/frameworks/h3 errors (403 on failed verification, 400 on an invalid JSON or form data body) are recognized as HTTP errors by both h3 v1 and v2. h3 v1 previously treated them as unhandled errors.
  • docs/nuxt.md: route files live under server/routes/, imports use ~~/server/... (Nuxt 4's ~ points to app/), and the example uses createError, which exists in h3 v1 and v2.

Changed

  • The build uses TypeScript 6. tsconfig.cjs.json sets ignoreDeprecations: "6.0" to keep moduleResolution: "node" for the CommonJS build, which TypeScript 6 deprecates and TypeScript 7 removes.
Commits

Updates better-auth from 1.7.12 to 1.7.15

Release notes

Sourced from better-auth's releases.

v1.7.15

better-auth

Bug Fixes

  • Fixed organization and API key metadata, and OAuth proxy sign-ins with a constructor field in additionalData, failing with a prototype pollution error (#12142)
  • Improved BETTER_AUTH_SECRETS error messages to report the entry position instead of including the entry value (#12098)
  • Fixed the admin update-user endpoint to reject data.id with a 400 error instead of attempting to change the user's primary key (#12099)
  • Fixed the admin plugin to reject banned users when a session is created outside an endpoint, such as through internalAdapter.createSession (#12100)
  • Fixed headers and cookies set by a non-returning hooks.before hook being dropped from the response, with the endpoint's value winning when both set the same header or cookie (#12145)
  • Fixed the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment (#12109)
  • Fixed the genericOAuth HubSpot helper truncating access tokens with reserved characters and now returning null instead of requesting /access-tokens/undefined when no token is present (#12108)
  • Fixed /sign-in/username and /is-username-available rejecting usernames that sign-up accepts when validationOrder.username is post-normalization (#12097)

For detailed changes, see CHANGELOG

auth

Bug Fixes

  • Fixed auth init for Remix and React Router v7 to generate an app/routes/api.auth.$.ts resource route that mounts auth.handler instead of a second auth instance with an unsupported database option (#12118)
  • Fixed auth ai overwriting MCP config files it cannot parse, such as those with comments or trailing commas, by leaving them unchanged and printing the config to add manually (#12111)
  • Fixed auth login and auth logout re-launching the CLI through npx auth@latest in an endless loop (#12110)
  • Fixed auth init hanging during database migration and removed a stray debug line about path aliases (#12148)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

  • Fixed /subscription/success returning a 500 for non-string callbackURL and checkoutSessionId query values by rejecting them with a 400 (#12105)
  • Fixed /subscription/success to validate callbackURL against trusted origins after replacing {CHECKOUT_SESSION_ID}, preventing redirects to untrusted origins via checkoutSessionId (#12102)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

  • Fixed API keys in secondary storage failing to verify, load, and list when the storage client returns already-parsed JSON, such as @upstash/redis (#12107)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

  • Fixed the Node metadata transport crashing the process on responses with an out-of-range status or invalid reason phrase by reporting the client as invalid_client (#12103)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.15

Patch Changes

  • #12100 7769e91 Thanks @​bytaesu! - The admin plugin now rejects banned users when a session is created outside an endpoint, such as through internalAdapter.createSession.

  • #12099 3f17193 Thanks @​bytaesu! - The admin update-user endpoint now rejects data.id with a 400 error instead of attempting to change the user's primary key.

  • #12145 804ba8a Thanks @​bytaesu! - Headers and cookies set by a hooks.before hook that does not return early now reach the response instead of being dropped. When the endpoint sets the same header or cookie, the endpoint's value wins.

  • #12108 1391673 Thanks @​bytaesu! - The HubSpot helper in genericOAuth now encodes the access token as a single path segment when fetching token info, so tokens containing reserved characters are no longer truncated, and it returns null instead of requesting /access-tokens/undefined when no access token is present.

  • #12142 f63fb0e Thanks @​bytaesu! - Organization and API key metadata, and OAuth proxy sign-ins whose additionalData contains a constructor field, no longer fail with "Potential prototype pollution attempt detected".

  • #12098 4cdcb1c Thanks @​bytaesu! - Error messages for a malformed BETTER_AUTH_SECRETS entry now report the entry position instead of including the entry value.

  • #12097 6e7fa27 Thanks @​bytaesu! - Fixed /sign-in/username and /is-username-available rejecting a username that sign-up accepts when validationOrder.username is post-normalization. Both endpoints now validate the same value as sign-up.

  • #12109 264de2b Thanks @​bytaesu! - Fix the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment.

  • Updated dependencies [9ef0c5b]:

    • @​better-auth/core@​1.7.15
    • @​better-auth/drizzle-adapter@​1.7.15
    • @​better-auth/kysely-adapter@​1.7.15
    • @​better-auth/memory-adapter@​1.7.15
    • @​better-auth/mongo-adapter@​1.7.15
    • @​better-auth/prisma-adapter@​1.7.15
    • @​better-auth/telemetry@​1.7.15

1.7.14

Patch Changes

  • #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

  • Updated dependencies [2947ab7]:

    • @​better-auth/core@​1.7.14
    • @​better-auth/drizzle-adapter@​1.7.14
    • @​better-auth/kysely-adapter@​1.7.14
    • @​better-auth/memory-adapter@​1.7.14
    • @​better-auth/mongo-adapter@​1.7.14
    • @​better-auth/prisma-adapter@​1.7.14
    • @​better-auth/telemetry@​1.7.14

1.7.13

Patch Changes

  • #11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

... (truncated)

Commits
  • e556c07 chore: release v1.7.15 (#12101)
  • 804ba8a fix(api): keep response headers set by before hooks (#12145)
  • f63fb0e fix: accept constructor keys in strict JSON parsing (#12142)
  • 95d158b test(session): stabilize refresh and expiration tests (#12116)
  • 264de2b fix(client): keep vue ssr session fetch relative without baseURL (#12109)
  • 1391673 fix(generic-oauth): encode HubSpot access token as a path parameter (#12108)
  • 6e7fa27 fix(username): honor validationOrder on sign-in and availability check (#12097)
  • 7769e91 fix(admin): reject banned users when creating sessions outside an endpoint (#...
  • 3f17193 fix(admin): reject id in update-user data (#12099)
  • 4cdcb1c fix: report position instead of value in BETTER_AUTH_SECRETS errors (#12098)
  • Additional commits viewable in compare view

Updates lucide-react from 1.61.0 to 1.66.0

Release notes

Sourced from lucide-react's releases.

Version 1.66.0

What's Changed

Full Changelog: lucide-icons/lucide@1.65.0...1.66.0

Version 1.65.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.64.0...1.65.0

Version 1.64.0

What's Changed

... (truncated)

Commits
  • 1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
  • e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
  • 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
  • 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
  • 20aef31 chore(packages): Update sponsors (#5034)
  • See full diff in compare view

Updates next from 16.4.2 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

Commits
  • 29bbeab v16.4.3
  • 5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
  • 37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
  • cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
  • 3f6a632 [lts-active] test: Pin react-virtualized (#100545)
  • f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
  • c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • See full diff in compare view

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

  • apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

  • Anyone sending one-time passcodes by email who wants them to be machine-readable.
  • Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
  • Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

  • New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
  • A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
  • OTP-Token is included in the DKIM signature by default.
  • A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
  • Groundmail added to the well-known services.

Features

  • add the otp option for the OTP-Token header (7789e15)

Bug Fixes

  • encode a Content-ID header as a message id (#1904) (47f2b25)
Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

  • apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

  • add the otp option for the OTP-Token header (7789e15)

Bug Fixes

  • encode a Content-ID header as a message id (#1904) (47f2b25)
Commits
  • 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
  • 3e5bb55 chore(master): release 10.3.1
  • 1d4087f fix: apply the otp option in MailComposer too
  • 488ce9c chore(deps): update development dependencies
  • 41eda65 chore(deps): update development dependencies
  • 5de343d chore(master): release 10.3.0 (#1905)
  • 7789e15 feat: add the otp option for the OTP-Token header
  • 47f2b25 fix: encode a Content-ID header as a message id (#1904)
  • a6e7a70 chore(services): add Groundmail (#1903)
  • a0cea19 chore(deps): update development dependencies [skip ci]
  • Additional commits viewable in compare view

Updates @next/eslint-plugin-next from 16.4.2 to 16.4.3

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

Commits

Updates @secretlint/secretlint-rule-preset-recommend from 13.0.7 to 13.1.0

Release notes

Sourced from @​secretlint/secretlint-rule-preset-recommend's releases.

v13.1.0

What's Changed

Security Fixes

Features

Bug Fixes

CI

Dependency Updates

@dependabot
chore(deps): bump the npm-dependencies group across 1 directory with …
6d5b103 
…13 updates

Bumps the npm-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.11` | `0.5.14` |
| [altcha-lib](https://github.com/altcha-org/altcha-lib) | `2.7.0` | `2.8.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.12` | `1.7.15` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.61.0` | `1.66.0` |
| [next](https://github.com/vercel/next.js) | `16.4.2` | `16.4.3` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.2.1` | `10.3.1` |
| [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.4.2` | `16.4.3` |
| [@secretlint/secretlint-rule-preset-recommend](https://github.com/secretlint/secretlint) | `13.0.7` | `13.1.0` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.6.1` | `10.6.2` |
| [eslint-plugin-security](https://github.com/eslint-community/eslint-plugin-security) | `4.2.0` | `4.2.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.31` | `8.5.32` |
| [secretlint](https://github.com/secretlint/secretlint) | `13.0.7` | `13.1.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.72.0` | `8.72.1` |



Updates `@electric-sql/pglite` from 0.5.11 to 0.5.14
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.14/packages/pglite)

Updates `altcha-lib` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/altcha-org/altcha-lib/releases)
- [Changelog](https://github.com/altcha-org/altcha-lib/blob/main/CHANGELOG.md)
- [Commits](altcha-org/altcha-lib@v2.7.0...v2.8.0)

Updates `better-auth` from 1.7.12 to 1.7.15
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.15/packages/better-auth)

Updates `lucide-react` from 1.61.0 to 1.66.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.66.0/packages/lucide-react)

Updates `next` from 16.4.2 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.2...v16.4.3)

Updates `nodemailer` from 10.2.1 to 10.3.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.2.1...v10.3.1)

Updates `@next/eslint-plugin-next` from 16.4.2 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-plugin-next)

Updates `@secretlint/secretlint-rule-preset-recommend` from 13.0.7 to 13.1.0
- [Release notes](https://github.com/secretlint/secretlint/releases)
- [Commits](secretlint/secretlint@v13.0.7...v13.1.0)

Updates `autoprefixer` from 10.6.1 to 10.6.2
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.6.1...10.6.2)

Updates `eslint-plugin-security` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/eslint-community/eslint-plugin-security/releases)
- [Changelog](https://github.com/eslint-community/eslint-plugin-security/blob/main/CHANGELOG.md)
- [Commits](eslint-community/eslint-plugin-security@eslint-plugin-security-v4.2.0...eslint-plugin-security-v4.2.1)

Updates `postcss` from 8.5.31 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.31...8.5.32)

Updates `secretlint` from 13.0.7 to 13.1.0
- [Release notes](https://github.com/secretlint/secretlint/releases)
- [Commits](secretlint/secretlint@v13.0.7...v13.1.0)

Updates `typescript-eslint` from 8.72.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: altcha-lib
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: better-auth
  dependency-version: 1.7.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: lucide-react
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: nodemailer
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@next/eslint-plugin-next"
  dependency-version: 16.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@secretlint/secretlint-rule-preset-recommend"
  dependency-version: 13.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: autoprefixer
  dependency-version: 10.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: eslint-plugin-security
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: secretlint
  dependency-version: 13.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Ediminator as a code owner November 4, 2026 22:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 4, 2026
@Ediminator
Ediminator merged commit 14a8d9f into main Nov 4, 2026
8 checks passed
@Ediminator
Ediminator deleted the dependabot/npm_and_yarn/npm-dependencies-371a01939a branch November 4, 2026 23:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Ediminator Ediminator Awaiting requested review from Ediminator Ediminator is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Ediminator