Skip to content

chore(deps): bump the npm-dependencies group with 8 updates - #80

Merged
Ediminator merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-c345f2c79f
Nov 14, 2026
Merged

chore(deps): bump the npm-dependencies group with 8 updates#80
Ediminator merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-c345f2c79f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 8 updates:

Package From To
@electric-sql/pglite 0.5.14 0.5.15
better-auth 1.7.15 1.7.18
lucide-react 1.66.0 1.69.0
next 16.4.3 16.4.5
@next/eslint-plugin-next 16.4.3 16.4.5
@playwright/test 1.64.1 1.65.0
@vitest/coverage-v8 5.0.5 5.1.0
vitest 5.0.5 5.1.0

Updates @electric-sql/pglite from 0.5.14 to 0.5.15

Release notes

Sourced from @​electric-sql/pglite's releases.

@​electric-sql/pglite@​0.5.15

Patch Changes

  • 649dc0e: Reject with TransactionAbortedError when committing an aborted transaction rolls it back instead of silently resolving.
  • fe8bdc2: Reduce initdb memory usage by passing a smaller WebAssembly.Memory object during initialization'
  • 7c62782: Upgrade tsup to 8.5.1
  • 84ce5ae: Upgrade emsdk to 6.0.13

@​electric-sql/pglite-prepopulatedfs@​0.5.15

Patch Changes

  • Updated dependencies [649dc0e]
  • Updated dependencies [fe8bdc2]
  • Updated dependencies [7c62782]
  • Updated dependencies [84ce5ae]
    • @​electric-sql/pglite@​0.5.15
Changelog

Sourced from @​electric-sql/pglite's changelog.

0.5.15

Patch Changes

  • 649dc0e: Reject with TransactionAbortedError when committing an aborted transaction rolls it back instead of silently resolving.
  • fe8bdc2: Reduce initdb memory usage by passing a smaller WebAssembly.Memory object during initialization'
  • 7c62782: Upgrade tsup to 8.5.1
  • 84ce5ae: Upgrade emsdk to 6.0.13
Commits

Updates better-auth from 1.7.15 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

  • #12259 9e2a0ec Thanks @​gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

  • #12244 85f4342 Thanks @​gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

  • #12250 278bb28 Thanks @​gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

  • Updated dependencies [9342a73]:

    • @​better-auth/core@​1.7.18
    • @​better-auth/drizzle-adapter@​1.7.18
    • @​better-auth/kysely-adapter@​1.7.18
    • @​better-auth/memory-adapter@​1.7.18
    • @​better-auth/mongo-adapter@​1.7.18
    • @​better-auth/prisma-adapter@​1.7.18
    • @​better-auth/telemetry@​1.7.18

1.7.17

Patch Changes

  • #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

  • #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

  • #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

  • #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

  • #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

  • #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

  • #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

  • Updated dependencies [fc2e00b]:

    • @​better-auth/kysely-adapter@​1.7.17
    • @​better-auth/core@​1.7.17
    • @​better-auth/drizzle-adapter@​1.7.17
    • @​better-auth/memory-adapter@​1.7.17
    • @​better-auth/mongo-adapter@​1.7.17
    • @​better-auth/prisma-adapter@​1.7.17
    • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

... (truncated)

Commits
  • 38f43e3 chore: release v1.7.18 (#12252)
  • 9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
  • 278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
  • 85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
  • e3ae9e1 chore: release v1.7.17 (#12214)
  • b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
  • fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
  • 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
  • 9150314 fix(phone-number): treat empty phone number as missing (#12219)
  • cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
  • Additional commits viewable in compare view

Updates lucide-react from 1.66.0 to 1.69.0

Release notes

Sourced from lucide-react's releases.

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

New Contributors

... (truncated)

Commits

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

  • [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
  • [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
  • [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
  • [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
  • [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
  • [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
  • [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits
  • 4e5335a v16.4.5
  • 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
  • 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
  • 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
  • 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
  • e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
  • d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
  • 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
  • b175f52 v16.4.4
  • ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
  • Additional commits viewable in compare view

Updates @next/eslint-plugin-next from 16.4.3 to 16.4.5

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

  • [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
  • [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
  • [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
  • [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
  • [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
  • [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
  • [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
  • Additional commits viewable in compare view

Updates @vitest/coverage-v8 from 5.0.5 to 5.1.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

@dependabot
chore(deps): bump the npm-dependencies group with 8 updates
73dd1bc 
Bumps the npm-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.14` | `0.5.15` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.15` | `1.7.18` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.66.0` | `1.69.0` |
| [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` |
| [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.4.3` | `16.4.5` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.5` | `5.1.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` |


Updates `@electric-sql/pglite` from 0.5.14 to 0.5.15
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.15/packages/pglite)

Updates `better-auth` from 1.7.15 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/better-auth)

Updates `lucide-react` from 1.66.0 to 1.69.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.69.0/packages/lucide-react)

Updates `next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.3...v16.4.5)

Updates `@next/eslint-plugin-next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-plugin-next)

Updates `@playwright/test` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `@vitest/coverage-v8` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: better-auth
  dependency-version: 1.7.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: lucide-react
  dependency-version: 1.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: next
  dependency-version: 16.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@next/eslint-plugin-next"
  dependency-version: 16.4.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Ediminator as a code owner November 9, 2026 04:19
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
@Ediminator
Ediminator merged commit 7bbdf23 into main Nov 14, 2026
8 checks passed
@Ediminator
Ediminator deleted the dependabot/npm_and_yarn/npm-dependencies-c345f2c79f branch November 14, 2026 23:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Ediminator Ediminator Ediminator approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Ediminator