Skip to content

fix(deps): update bun minor and patch dependencies - #1102

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/bun-minor-and-patch-dependencies
Open

fix(deps): update bun minor and patch dependencies#1102
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/bun-minor-and-patch-dependencies

Conversation

@renovate

@renovate renovate Bot commented Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@better-auth/api-key (source) 1.6.27 → 1.7.2 age confidence
@better-auth/passkey (source) ^1.6.27 → ^1.7.2 age confidence
@better-auth/sso (source) ^1.6.27 → ^1.7.2 age confidence
@better-auth/utils 0.4.2 → 0.5.0 age confidence
@cloudflare/vite-plugin (source) ^1.52.0 → ^1.54.1 age confidence
@faker-js/faker (source) ^10.5.0 → ^10.6.0 age confidence
@hookform/resolvers (source) ^5.7.1 → ^5.9.1 age confidence
@inquirer/prompts (source) ^8.5.2 → ^8.7.0 age confidence
@scalar/hono-api-reference (source) ^0.11.13 → ^0.11.16 age confidence
@tanstack/devtools-vite (source) ^0.8.3 → ^0.8.5 age confidence
@tanstack/react-devtools (source) ^0.10.10 → ^0.10.12 age confidence
@tanstack/react-query (source) ^5.101.4 → ^5.102.8 age confidence
@tanstack/react-query-devtools (source) ^5.101.4 → ^5.102.8 age confidence
@tanstack/react-router (source) ^1.170.27 → ^1.170.32 age confidence
@tanstack/react-router-ssr-query (source) ^1.167.1 → ^1.167.2 age confidence
@tanstack/react-start (source) ^1.168.44 → ^1.168.49 age confidence
@tanstack/react-table (source) ^9.1.2 → ^9.2.3 age confidence
@tanstack/router-plugin (source) ^1.168.30 → ^1.168.35 age confidence
@testing-library/react ^16.3.2 → ^16.3.3 age confidence
@testing-library/user-event ^14.6.4 → ^14.6.6 age confidence
@types/bun (source) ^1.3.14 → ^1.4.0 age confidence
@types/node (source) ^26.2.0 → ^26.4.0 age confidence
@types/react-dom (source) ^19.2.4 → ^19.2.5 age confidence
@vitejs/plugin-react (source) ^6.0.5 → ^6.1.0 age confidence
better-auth (source) ^1.6.27 → ^1.7.2 age confidence
cron-parser ^5.8.1 → ^5.10.0 age confidence
drizzle-kit (source) ^1.0.0-rc.4-ca0f029 → ^1.0.0-rc.5-ab785fc age confidence
drizzle-orm (source) 1.0.0-rc.4-5d5b77c → 1.0.0-rc.5-ab785fc age confidence
electron ^43.4.0 → ^43.4.1 age confidence
es-toolkit (source) ^1.50.0 → ^1.51.0 age confidence
fumadocs-core ^16.14.3 → ^16.15.4 age confidence
fumadocs-mdx ^15.2.3 → ^15.4.0 age confidence
fumadocs-ui ^16.14.3 → ^16.15.4 age confidence
happy-dom ^20.11.2 → ^20.11.12 age confidence
hono (source) ^4.13.1 → ^4.13.5 age confidence
input-otp (source) ^1.4.2 → ^1.5.0 age confidence
lucide-react (source) ^1.31.0 → ^1.34.0 age confidence
oxfmt (source) 0.63.0 → 0.65.0 age confidence
oxlint (source) 1.78.0 → 1.80.0 age confidence
react-hook-form (source) ^7.85.0 → ^7.86.0 age confidence
shadcn (source) ^4.17.0 → ^4.19.0 age confidence
vite (source) ^8.2.1 → ^8.2.2 age confidence
vite-plus (source) ^0.2.9 → ^0.3.0 age confidence
vitest (source) ^4.1.10 → ^4.1.11 age confidence
wrangler (source) ^4.122.0 → ^4.127.0 age confidence

Release Notes

better-auth/better-auth (@​better-auth/api-key)

v1.7.2

Compare Source

v1.7.1

v1.7.0

v1.6.30

Compare Source

Patch Changes

v1.6.29

Compare Source

Patch Changes

v1.6.28

Compare Source

Patch Changes
better-auth/better-auth (@​better-auth/passkey)

v1.7.2

Compare Source

v1.7.1

v1.7.0

Minor Changes
  • #​9873 2f3a714 Thanks @​GautamBytes! - Add the optional createSession setting to passkey registration. When enabled, successful registration signs the user in, sets the session cookie, and returns the session and user with the registered passkey.

v1.6.30

Compare Source

Patch Changes

v1.6.29

Compare Source

Patch Changes

v1.6.28

Compare Source

Patch Changes
better-auth/better-auth (@​better-auth/sso)

v1.7.2

Compare Source

Patch Changes
  • #​10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

v1.7.1

v1.7.0

Minor Changes

  • #​8805 602ec40 Thanks @​OscarCornish! - Rolling certificate rotation

    SAML signing certificates now accept an array of PEM strings, so administrators can publish a new IdP cert alongside the old one and complete the rotation without forcing every active session to re-authenticate. Responses signed by any listed cert are accepted.

    samlConfig: {
    idpMetadata: {
        cert: [currentPem, nextPem],
    },
}

    Both samlConfig.cert and samlConfig.idpMetadata.cert accept either a single PEM string or an array. When both are set, idpMetadata.cert wins.

    Breaking: response shape

    The management endpoints (getSSOProvider, listSSOProviders, updateSSOProvider) now return samlConfig.certificate as an array of parsed certificates in every case, even when a single cert is configured. The field is absent only when certs live inside idpMetadata.metadata. Update consumers to read an array; no more Array.isArray branching.

    Validation

    Registration now rejects SAML configs that supply no signing-cert source. samlify needs either an idpMetadata.metadata XML document (which embeds the certs) or an explicit PEM under cert or idpMetadata.cert. Configs missing both fail with CERT_SOURCE_MISSING.

    Fix

    SAML Single Logout could fail to decrypt encrypted LogoutResponse payloads because the IdP entity was constructed without privateKey, encPrivateKey, or encPrivateKeyPass on that code path. All three are now applied on every IdP construction.

  • #​10403 dbd302e Thanks @​gustavovalverde! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique (issuer, accountId) key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases.

    This release requires Account.issuer but preserves Account.accountId as the provider-assigned account identifier. Account-specific APIs select the local Account.id through the accountId request property; token and provider-profile APIs can instead select the signed account cookie with useAccountCookie: true. Credential accounts use local:credential and the linked user's stable id as their provider identity.

    OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses sub, plain OAuth uses id, and providers can declare accountSubject for another immutable field; Better Auth no longer switches between sub and id at runtime. getUserInfo().user no longer carries provider identity, and mapProfileToUser cannot return id. Read the selected identity from accountInfo.account.accountId instead of accountInfo.user.id. The generic microsoftEntraId helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities.

    SSO account subjects are now protocol-defined. OIDC uses the verified sub claim, and SAML uses the signed NameID; mapping.id is removed from both configurations. A manual SAML configuration without metadata XML must set idpMetadata.entityID, because samlConfig.issuer identifies the service provider and no longer acts as the IdP identity.

    Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically.

  • #​9305 e7eb45b Thanks @​gustavovalverde! - feat(oauth): per-request additionalParams and loginHint parity across signIn.social, linkSocial, and signIn.sso

    Unified escape hatch for customizing the provider authorization URL on a per-request basis. Previously, dynamic parameters like Google's access_type=offline / prompt=consent, Cognito's identity_provider=Google, or Microsoft's domain_hint could only be set as static server configuration.

New capabilities
  • signIn.social, linkSocial, and signIn.sso accept additionalParams: Record<string, string>. Values are appended to the authorization URL as query parameters.
  • linkSocial also accepts loginHint, matching the surface of signIn.social and signIn.sso.
  • OAuthProvider.createAuthorizationURL gains additionalParams in its input contract; every built-in provider forwards it to the shared helper.
  • Generic-OAuth providers merge call-time additionalParams with the config-level authorizationUrlParams; call-time wins on key collision.
  • Cognito exposes a typed identityProvider?: string config option that maps to the identity_provider query parameter, avoiding magic strings.
Security
  • The shared createAuthorizationURL helper silently drops any caller-supplied key in RESERVED_AUTHORIZATION_PARAMS (state, client_id, redirect_uri, response_type, code_challenge, code_challenge_method, nonce, scope). The request-body Zod schema rejects the same keys with 400, so misuse is visible at the edge rather than silently overriding security-critical parameters. nonce is reserved so a caller cannot replace the OIDC nonce Better Auth generates when binding a discovery provider's id_token to the authorization request.
  • Providers that use non-standard client identifiers (wechat → appid, tiktok → client_key) additionally filter those keys so a caller cannot swap the configured OAuth app.
  • Provider protocol constants that are required for the integration to function (atlassian → audience, notion → owner) are merged last so caller-supplied additionalParams cannot override them. Configured defaults that represent operator intent (e.g. Google include_granted_scopes, Cognito identityProvider) remain caller-overridable.
  • signIn.sso rejects additionalParams with 400 when the resolved provider is SAML; the SAML AuthnRequest is signed and cannot carry caller-supplied query parameters, so silently dropping them would mislead integrators.
OpenAPI
  • Added ZodRecord handling to the OpenAPI generator so z.record() fields emit type: object with typed additionalProperties. Incidentally fixes a long-standing bug where additionalData was rendered as type: string.
Refactors
  • discord, roblox, zoom, and slack providers now delegate to the shared createAuthorizationURL helper and inherit its RFC behavior and reserved-key guard.
  • tiktok and wechat keep their manual URL construction (non-standard OAuth2 parameter names and URL fragment requirements) but thread additionalParams with the same reserved-key filter.

Closes #​2351.
Closes #​5441.
Closes #​5592.
Closes #​5604.
Supersedes #​4992 and #​5443.

  • #​8836 93d3871 Thanks @​gustavovalverde! - Add client authentication configuration for token endpoint requests across the stack, including private_key_jwt (RFC 7523).

    Generic OAuth providers now accept tokenEndpointAuth for token endpoint client authentication. Use tokenEndpointAuth: { method: "private_key_jwt", getClientAssertion } for JWT client assertions, { method: "none" } for public clients, and { method: "client_secret_basic" } or { method: "client_secret_post" } with clientSecret for explicit secret-based client authentication. The existing authentication: "basic" | "post" option remains available for secret-based token requests.

    Use createPrivateKeyJwtClientAssertionGetter() to sign RFC 7523 assertions from a private key. The assertion getter receives { clientId, tokenEndpoint, grantType }, so integrations do not duplicate client ID or token endpoint values inside assertion helpers. Core OAuth2 now exports private-key JWT-specific helpers and types: signPrivateKeyJwtClientAssertion, createPrivateKeyJwtClientAssertionGetter, PrivateKeyJwtSigningAlgorithm, and PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.

    Token endpoint client authentication parameters are derived from clientId, clientSecret, and tokenEndpointAuth. Configured token endpoint authentication requires clientId; secret-based token endpoint authentication also requires clientSecret. Custom token parameters are for provider-specific fields and do not replace the configured client authentication values.

    refreshAccessToken() now forwards resource values to refresh-token requests, so RFC 8707 resource indicators work through both the high-level refresh helper and refreshAccessTokenRequest().

    The synchronous OAuth2 request builders createAuthorizationCodeRequest, createRefreshAccessTokenRequest, and createClientCredentialsTokenRequest have been removed. Use the async authorizationCodeRequest, refreshAccessTokenRequest, and clientCredentialsTokenRequest helpers instead.

    Servers verify JWT client assertions signed with asymmetric keys, and clients can use the same token endpoint authentication contract for authorization code, refresh, and client credentials token requests.

  • #​9055 b790144 Thanks @​gustavovalverde! - IdP-initiated SSO now defaults to disabled; set saml.allowIdpInitiated: true to opt in. SP-initiated flows now validate InResponseTo correctly, and SAML Single Logout stores and compares the actual SessionIndex string.

  • #​10473 ed61b47 Thanks @​gustavovalverde! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile.

  • #​9445 48070ad Thanks @​GautamBytes! - Add schema.ssoProvider.additionalFields support for storing and returning custom SSO provider fields.

  • #​9117 b70f025 Thanks @​gustavovalverde! - ### Breaking: SAML configuration changes

    callbackUrl no longer configures the ACS URL.
    The default ACS URL is derived from baseURL and providerId. Use callbackUrl
    as the provider-level post-auth redirect, or pass callbackURL to signIn.sso()
    for an SP-initiated request:

    await authClient.signIn.sso({
  providerId: "my-provider",
  callbackURL: "/dashboard",
});

    /sso/saml2/callback/:providerId endpoint removed.
    Update your IdP's ACS URL to /sso/saml2/sp/acs/:providerId. This endpoint handles both GET and POST requests.

    spMetadata is now optional.
    You no longer need to pass spMetadata: {} when registering a provider. SP metadata is auto-generated from your configuration.

    Removed unused fields from SAMLConfig:
    decryptionPvk, additionalParams, idpMetadata.entityURL, idpMetadata.redirectURL. These were stored but never read. Remove them from your configuration if present.

Bug fixes

  • Fix SLO SessionIndex matching: LogoutRequests with a SessionIndex were silently failing to delete the correct session.

  • Audience validation now defaults to the SP entity ID when audience is not configured, per SAML Core section 2.5.1.

  • Restore AllowCreate in AuthnRequests, required by IdPs that use JIT provisioning.

  • SP metadata endpoint now reflects actual SP capabilities (encryption, signing, SLO).

  • #​10621 59c4c83 Thanks @​gustavovalverde! - Extend resolveUser to SAML sign-ins. The callback now receives a discriminated protocol field: OIDC input keeps verifiedIdTokenClaims and providerClaims, while SAML input carries the verified assertion's providerAttributes. Both variants include a providerReference, an opaque reference to the accepted provider configuration that detects provider replacement or configuration changes mid-flow.

    Add guardProviderMutation, a callback that authorizes updates and deletions of a persisted SSO provider before Better Auth applies them.

Patch Changes

  • #​9930 0cbaf81 Thanks @​gustavovalverde! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. onLinkAccount fires and the anonymous user is migrated; before, it was silently skipped.

    Plugins can now carry server-trusted data across an OAuth redirect with the new addOAuthServerContext API, read back on the callback via getOAuthState().serverContext. Unlike additionalData, it cannot be set from the request body, so it is the right place for values the server must trust.

    For @better-auth/oauth-provider, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through additionalData.

  • #​9301 03e6c94 Thanks @​gustavovalverde! - Add allowIdpInitiated to GenericOAuthConfig and SSO OIDCConfig to support providers that initiate OAuth without a state parameter (e.g. Clever). When enabled, stateless callbacks restart the OAuth flow server-side with fresh state and PKCE, preserving CSRF protection. Also hardens parseState against undefined request bodies on GET callbacks.

  • #​9657 1e5b808 Thanks @​gustavovalverde! - Harden private_key_jwt and token endpoint client authentication, and add the helpers that make the fix structural.

    @better-auth/core/oauth2 now exposes encodeBasicCredentials and decodeBasicCredentials, a round-trip-tested pair that follows RFC 6749 §2.3.1 (application/x-www-form-urlencoded each value, split on the first : only). The decoder accepts the scheme case-insensitively and tolerates one or more spaces before the credentials per RFC 7235 §2.1. client_secret_basic on the client side and the Better Auth OAuth provider on the server side both go through these helpers, so credentials containing reserved characters round-trip cleanly across the stack and headers like basic xxx or Basic xxx are accepted.

    createPrivateKeyJwtClientAssertionGetter validates options eagerly. Unsupported algorithms (HS256, none), a JWK with no key material, and disagreement between an explicit algorithm and the JWK-embedded alg all throw at construction rather than on the first token request. signPrivateKeyJwtClientAssertion enforces the same checks for direct callers. Breaking: configurations that paired an unsupported JWK alg with a different explicit algorithm used to silently sign with the explicit option; they now fail at construction.

    Breaking: @better-auth/oauth-provider accepts client jwks metadata only as an RFC 7517 JWK Set object with a non-empty keys array. Replace jwks: [key] with jwks: { keys: [key] } in DCR payloads, administrative and user client creation, Client ID Metadata Documents, test fixtures, and generated client code. Remotely fetched jwks_uri responses must use the same object shape. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. When a key declares alg, it must be a supported private_key_jwt algorithm that matches the key type and curve; omit alg when the client chooses the algorithm in its assertion header. OAuth client rows previously written through oauthToSchema are already stored as JWK Set objects, so this is a request, configuration, and type migration rather than another database rewrite; audit rows written outside Better Auth separately.

    The SSO private_key_jwt flow redirects with error_description=no_private_key_available when a resolvePrivateKey callback returns no privateKeyJwk or privateKeyPem. The redirect path previously short-circuited only when the resolver was absent entirely; an empty resolver return fell through into an internal signing error.

    better-auth/test adds getHttpTestInstance, a counterpart to getTestInstance that binds a real HTTP listener on an OS-assigned port and constructs the auth instance against the discovered URL. It removes the temp-server-then-rebind race that test files have been individually copy-pasting.

  • #​9864 41cca60 Thanks @​GautamBytes! - Add a user.validateUserInfo provisioning gate that lets applications reject an identity before a user is created or a new account is linked. It runs once at the creation step for every method that provisions a user (OAuth, SSO/SAML, email/password, magic link, email OTP, anonymous, SIWE, phone number, admin-created users, and SCIM), including stateless setups with no persistent database.

    It also re-runs when an existing OAuth or SSO user signs in again (source.action is "sign-in"), where it receives the fresh provider email and profile so a domain or org policy can reject a user whose provider identity moved out of bounds. Non-provider returning sign-ins are not re-validated.

    The callback receives the mapped user plus a source describing the action (create-user, link-account, or sign-in), the method, and provider metadata: source.oauth for OAuth providers and source.sso for OIDC/SAML SSO providers. Return { error, errorDescription } to reject: browser flows redirect to the error URL and programmatic flows return a 403.

  • #​10072 4475f4a Thanks @​gustavovalverde! - OIDC SSO now works on Cloudflare Workers when discovery is enabled. Redirecting OIDC discovery, token, userinfo, and JWKS endpoints are rejected with a clear configuration error; configure the final endpoint URL instead.

  • #​10621 59c4c83 Thanks @​gustavovalverde! - Verify SAML assertion signatures directly instead of trusting an already-parsed response, and enforce a signing policy and size limit on SP metadata the same way IdP metadata is already enforced. wantAssertionsSigned now controls whether the SP requires signed assertions instead of signed response messages, matching how IdPs sign SAML responses in practice.

    A SAML callback that supplies RelayState now validates it unconditionally; a malformed or expired value is rejected even when enableInResponseToValidation is disabled. Service Provider metadata with an ACS location containing a URL fragment is rejected.

    Redact provider claims and resolver-thrown errors from log output on SAML and OIDC resolution failures.

  • #​10592 26b1949 Thanks @​gustavovalverde! - Allow SSO provider registration to reuse a SCIM connection ID. SCIM connections no longer participate in the authentication provider namespace.

  • #​9121 9603043 Thanks @​gustavovalverde! - ### Security: upgrade samlify to 2.12.0

    Upgrades the SAML XML processing library from 2.10.2 to 2.12.0:

    • XPath injection protection: all XPath expressions now use value escaping instead of string interpolation
    • XXE prevention: the XML parser defaults to strict mode that rejects entity references
    • Dependency reduction: removes node-forge, pako, uuid, and camelcase in favor of Node built-ins

    PEM keys and certificates with leading whitespace are now normalized automatically before being passed to samlify. This prevents DECODER routines::unsupported errors when keys are copied from indented config files or environment variables.

    Requires Node 20+.

v1.6.30

Compare Source

Patch Changes

v1.6.29

Compare Source

Patch Changes

v1.6.28

Compare Source

Patch Changes
better-auth/utils (@​better-auth/utils)

v0.5.0

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v0.4.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.54.1

Compare Source

Patch Changes

v1.54.0

Compare Source

Minor Changes

  • #​15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

    Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

  • #​15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

    The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

v1.53.1

Compare Source

Patch Changes

✂ Note

PR body was truncated to here.

@socket-security

socket-security Bot commented Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​types/​bun@​1.4.01001004890100
Updatednpm/​happy-dom@​20.11.2 ⏵ 20.11.126610088 +196 +1100
Updatednpm/​@​tanstack/​react-query-devtools@​5.101.4 ⏵ 5.102.81001007098 +1100
Updatednpm/​fumadocs-mdx@​15.2.3 ⏵ 15.4.098 +110073 +196 +1100
Updatednpm/​@​types/​react-dom@​19.2.4 ⏵ 19.2.5100 +110075 +191100
Updatednpm/​@​tanstack/​devtools-vite@​0.8.3 ⏵ 0.8.51001007698100
Updatednpm/​fumadocs-core@​16.14.3 ⏵ 16.15.498 +11007796 +1100
Updatednpm/​fumadocs-ui@​16.14.3 ⏵ 16.15.49810077 +196100
Updatednpm/​@​better-auth/​api-key@​1.6.27 ⏵ 1.7.21001007896 -1100
Updatednpm/​@​tanstack/​router-plugin@​1.168.30 ⏵ 1.168.35991007898 +1100
Updatednpm/​@​better-auth/​sso@​1.6.27 ⏵ 1.7.29910079 +196 -1100
Updatednpm/​vitest@​4.1.10 ⏵ 4.1.119810079 +198100
Updatednpm/​@​tanstack/​react-router-ssr-query@​1.167.1 ⏵ 1.167.29910080 +596 +2100
Updatednpm/​@​faker-js/​faker@​10.5.0 ⏵ 10.6.010010010093 +380
Updatednpm/​lucide-react@​1.31.0 ⏵ 1.34.0100 +110098 +19680
Updatednpm/​@​types/​node@​26.2.0 ⏵ 26.4.0100 +110081 +196100
Updatednpm/​vite@​8.1.4 ⏵ 8.2.29810082 +196100
Updatednpm/​@​scalar/​hono-api-reference@​0.11.13 ⏵ 0.11.1610010082100100
Updatednpm/​better-auth@​1.6.27 ⏵ 1.7.2981008596100
Updatednpm/​@​cloudflare/​vite-plugin@​1.52.0 ⏵ 1.54.197 -110085 -196100
Updatednpm/​oxfmt@​0.62.0 ⏵ 0.65.086 +110088 +196100
Updatednpm/​@​tanstack/​react-router@​1.170.27 ⏵ 1.170.3292 +110087 +197 -1100
Updatednpm/​@​better-auth/​passkey@​1.6.27 ⏵ 1.7.210010087 +197100
Updatednpm/​@​tanstack/​react-start@​1.168.44 ⏵ 1.168.49991008898100
Updatednpm/​drizzle-orm@​1.0.0-rc.4-5d5b77c ⏵ 1.0.0-rc.5-ab785fc9710088 +198 +1100
Updatednpm/​input-otp@​1.4.2 ⏵ 1.5.010010099 +189 +1100
Updatednpm/​@​tanstack/​react-query@​5.101.4 ⏵ 5.102.89910091 +498100
Updatednpm/​shadcn@​4.17.0 ⏵ 4.19.098 +110091 +196 -1100
Updatednpm/​oxlint@​1.77.0 ⏵ 1.80.099 +110091 +196 +1100
Updatednpm/​@​tanstack/​react-devtools@​0.10.10 ⏵ 0.10.121001009298 +1100
Updatednpm/​wrangler@​4.122.0 ⏵ 4.127.098 +110092 +196100
Updatednpm/​@​testing-library/​react@​16.3.2 ⏵ 16.3.3100 +110010093100
See 11 more rows in the dashboard

View full report

@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 27 times, most recently from c768856 to b2bc832 Compare August 23, 2026 05:57
@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 2 times, most recently from 4dd67dd to be17bf8 Compare August 23, 2026 12:15
@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 28 times, most recently from a557240 to 4de677c Compare August 30, 2026 14:34
@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch from 4de677c to d24850a Compare August 30, 2026 18:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants