Skip to content

Bump the minor-and-patch group across 1 directory with 15 updates - #73

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-0d431465c9
Open

Bump the minor-and-patch group across 1 directory with 15 updates#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-0d431465c9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Bumps the minor-and-patch group with 15 updates in the / directory:

Package From To
@types/node 24.19.1 24.19.2
dotenv 18.0.6 18.0.9
@base-ui/react 1.8.0 1.9.0
better-auth 1.7.7 1.7.12
jose 6.2.12 6.2.13
lucide-react 1.53.0 1.61.0
next 16.4.0 16.4.2
posthog-js 1.438.3 1.438.19
posthog-node 5.55.1 5.57.0
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@next/bundle-analyzer 16.4.0 16.4.2
eslint-config-next 16.3.8 16.4.2
postcss 8.5.29 8.5.31
prettier 3.9.9 3.9.10

Updates @types/node from 24.19.1 to 24.19.2

Commits

Updates dotenv from 18.0.6 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

  • Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)
Commits
  • 8d1ab85 18.0.9
  • 59a40ce changelog
  • 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
  • bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
  • 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
  • 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • Additional commits viewable in compare view

Updates @base-ui/react from 1.8.0 to 1.9.0

Release notes

Sourced from @​base-ui/react's releases.

v1.9.0

General changes

Accordion

  • Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
  • Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
  • Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

  • Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

  • Fix autoHighlight for asynchronous results (#5818) by @​atomiks
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

Collapsible

Combobox

Dialog

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

Accordion

  • Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
  • Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
  • Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

  • Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

  • Fix autoHighlight for asynchronous results (#5818) by @​atomiks
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

Collapsible

Combobox

  • Fix stale chip focus after returning to the input (#5879) by @​mdm317
  • Fix autoHighlight for asynchronous results (#5818) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
  • Fix label focus in Shadow DOM (#5871) by @​lyzno1
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
  • Reset typeahead state when closing without moving focus (#5816) by @​mdm317
  • Accept readonly arrays for multiple values (#5710) by @​MonstraG

... (truncated)

Commits
  • ad7ecda [release] v1.9.0 (#5906)
  • 3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
  • 69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
  • 51b70db [menu] Strip internal filter components from public types (#5923)
  • 8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
  • aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
  • ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
  • 1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
  • bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
  • 147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
  • Additional commits viewable in compare view

Updates better-auth from 1.7.7 to 1.7.12

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

  • If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

  • Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
  • Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
  • Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
  • Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
  • Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
  • Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
  • Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

  • Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

  • #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

  • #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

  • #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

  • Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

    • @​better-auth/core@​1.7.12
    • @​better-auth/drizzle-adapter@​1.7.12
    • @​better-auth/kysely-adapter@​1.7.12
    • @​better-auth/memory-adapter@​1.7.12
    • @​better-auth/mongo-adapter@​1.7.12
    • @​better-auth/prisma-adapter@​1.7.12
    • @​better-auth/telemetry@​1.7.12

1.7.11

Patch Changes

  • #10719 bd65db0 Thanks @​rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

  • #11521 37a75c9 Thanks @​aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

  • Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

    • @​better-auth/core@​1.7.11
    • @​better-auth/drizzle-adapter@​1.7.11
    • @​better-auth/kysely-adapter@​1.7.11
    • @​better-auth/memory-adapter@​1.7.11
    • @​better-auth/mongo-adapter@​1.7.11
    • @​better-auth/prisma-adapter@​1.7.11
    • @​better-auth/telemetry@​1.7.11

1.7.10

Patch Changes

  • #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

    If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

  • #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

    A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

    Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

... (truncated)

Commits
  • f4260a9 chore: release v1.7.12 (#11922)
  • b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
  • fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
  • 681aa5c fix(session): keep the cause of session lookup failures (#11924)
  • 52ab801 chore: release v1.7.11 (#11827)
  • 37a75c9 fix(rate-limit): convert a string lastRequest before computing X-Retry-After ...
  • bd65db0 fix(db): recognize postgres int8 as a number type in migration diffs (#10719)
  • b734a41 chore: release v1.7.10 (#11795)
  • eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
  • eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
  • Additional commits viewable in compare view

Updates jose from 6.2.12 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

  • align terminology with JOSE specifications (bafcb74)
  • preserve underlying error causes (724ba24), closes #908
Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

  • align terminology with JOSE specifications (bafcb74)
  • preserve underlying error causes (724ba24), closes #908
Commits
  • 316b7f2 chore(release): 6.2.13
  • 8106395 chore: bump packages
  • 724ba24 refactor: preserve underlying error causes
  • b112a5e chore: bump packages
  • 2a3a525 chore(deps-dev): bump workerd in /tap/workerd
  • 8f540d8 chore(deps): bump the actions group with 3 updates
  • 8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
  • 55c959f ci: use gh run rerun for retries
  • 5b00c64 ci: address zizmor findings and bump shared workflows
  • 1761d7f chore: bump packages
  • Additional commits viewable in compare view

Updates lucide-react from 1.53.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

... (truncated)

Commits
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • See full diff in compare view

Updates next from 16.4.0 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

High:

Commits
  • 2864b17 v16.4.2
  • a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
  • f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
  • 845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
  • 6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
  • a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
  • 8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
  • 29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
  • 3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
  • 9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
  • Additional commits viewable in compare view

Updates posthog-js from 1.438.3 to 1.438.19

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.19

1.438.19

Patch Changes

  • #4994 bcd33ce Thanks @​dustinbyrne! - Share autocapture across browser SDKs while preserving existing event capture behavior. (2026-10-22)
  • Updated dependencies [bcd33ce]:
    • @​posthog/browser-common@​0.9.9

posthog-js@1.438.18

1.438.18

Patch Changes

  • #5189 2aacdcb Thanks @​posthog! - Log why capture() dropped an event (capturing disabled or a bot user agent) when debug: true is set (2026-10-22)

  • #5383 0faf643 Thanks @​sarankumar1325! - Conversations: the widget now comes back after reset(), and after a cookieless (on_reject) visitor calls opt_in_capturing(), instead of staying unavailable until the next page load. (2026-10-22)

posthog-js@1.438.17

1.438.17

Patch Changes

  • #5367 23b287f Thanks @​sarankumar1325! - Session replay records mouse movement inside same-origin iframes as mouse movement instead of touch movement, so the replay cursor stays visible. (2026-10-22)

  • #5348 45f6cd6 Thanks @​ayushjhanwar-png! - Keep session replay data URI filtering output valid JSON and match svg+xml and parameterised data URIs. (2026-10-22)

  • #5325 21a2559 Thanks @​Majny! - Session replay no longer installs the network plugin when the client sets session_recording.recordHeaders and recordBody to false and turns network timing off, even if the project enables network payload capture. Previously request URLs and timings were still recorded. (2026-10-22)

posthog-js@1.438.16

1.438.16

Patch Changes

  • #5370 a50fa7a Thanks @​sarankumar1325! - Conversations: a reset() or opt-out that happens while the widget is still loading its tickets (or a restore link) no longer brings the widget back, restarts polling, or writes the old ticket id back to storage. (2026-10-22)

  • #5365 964e736 Thanks @​gustavohstrassburger! - Feature flags read before the user opts in to capturing now send $feature_flag_called the next time they are read after opt in. (2026-10-22)

  • #5256 e7c87fa Thanks @​jakesciotto! - Session replay: a scroll on a scroll-snap-type container now lands instantly during real-time playback, so a sheet or carousel that a scroll reveals shows the same content in Safari as in Chrome. Scrolls on other elements still animate. (2026-10-22)

  • Updated dependencies [964e736]:

    • @​posthog/browser-common@​0.9.8

... (truncated)

Commits
  • effd8ee chore: update versions and lockfile [version bump]
  • e027825 fix(ai): keep the refusal of OpenAI chat completions in the captured output (...
  • 9d20861 feat(browser-next): integrate dynamically loaded autocapture (#4995)
  • bcd33ce refactor(browser-common): extract autocapture extension (#4994)
  • 3e91597 chore: update versions and lockfile [version bump]
  • 2aacdcb fix(browser): log why capture drops an event and clarify cookieless opt-out d...
  • 0faf643 fix(conversations): reload the widget after reset() and cookieless opt-in (#5...
  • fc606c8 chore(llma): bump @​modelcontextprotocol/server from 2.0.0 to 2.3.0 (#5343)
  • 6897dc8 chore: update versions and lockfile [version bump]
  • 1991b99 feat(node): report unresolved local flags on evaluateFlags snapshots (#5234)
  • Additional commits viewable in compare view

Updates posthog-node from 5.55.1 to 5.57.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.57.0

5.57.0

Minor Changes

  • #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

    Behavior changes:

    • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
    • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
    • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

  • Updated dependencies [1991b99]:
    • @​posthog/core@​1.60.0

posthog-node@5.56.4

5.56.4

Patch Changes

@dependabot
Bump the minor-and-patch group across 1 directory with 15 updates
b6dcb47 
Bumps the minor-and-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.1` | `24.19.2` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.6` | `18.0.9` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.8.0` | `1.9.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.7` | `1.7.12` |
| [jose](https://github.com/panva/jose) | `6.2.12` | `6.2.13` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.53.0` | `1.61.0` |
| [next](https://github.com/vercel/next.js) | `16.4.0` | `16.4.2` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.438.3` | `1.438.19` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.55.1` | `5.57.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) | `16.4.0` | `16.4.2` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.8` | `16.4.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.29` | `8.5.31` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |



Updates `@types/node` from 24.19.1 to 24.19.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `dotenv` from 18.0.6 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.6...v18.0.9)

Updates `@base-ui/react` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.9.0/packages/react)

Updates `better-auth` from 1.7.7 to 1.7.12
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.12/packages/better-auth)

Updates `jose` from 6.2.12 to 6.2.13
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.12...v6.2.13)

Updates `lucide-react` from 1.53.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `next` from 16.4.0 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.0...v16.4.2)

Updates `posthog-js` from 1.438.3 to 1.438.19
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.438.3...posthog-js@1.438.19)

Updates `posthog-node` from 5.55.1 to 5.57.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.57.0/packages/node)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@next/bundle-analyzer` from 16.4.0 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/next-bundle-analyzer)

Updates `eslint-config-next` from 16.3.8 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-config-next)

Updates `postcss` from 8.5.29 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.29...8.5.31)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 24.19.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@base-ui/react"
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.438.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: posthog-node
  dependency-version: 5.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@next/bundle-analyzer"
  dependency-version: 16.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants