Skip to content

chore(deps): bump the npm group across 1 directory with 16 updates - #15

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/npm-87e886fd39
Closed

chore(deps): bump the npm group across 1 directory with 16 updates#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/npm-87e886fd39

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm group with 16 updates in the / directory:

Package From To
@cloudflare/vite-plugin 1.53.0 1.54.5
@tanstack/react-router 1.170.31 1.170.33
@tanstack/react-router-ssr-query 1.167.1 1.167.2
@tanstack/react-start 1.168.48 1.168.50
@tanstack/router-plugin 1.168.34 1.168.36
better-auth 1.7.0 1.7.3
framer-motion 13.1.1 13.2.0
lucide-react 1.33.0 1.42.0
@biomejs/biome 2.5.9 2.5.12
@testing-library/react 16.3.2 16.3.3
@types/node 26.2.0 26.5.0
@types/react-dom 19.2.4 19.2.7
@vitejs/plugin-react 6.1.0 6.1.1
ultracite 7.10.5 7.11.0
vitest 4.1.11 5.0.0
wrangler 4.124.0 4.129.1

Updates @cloudflare/vite-plugin from 1.53.0 to 1.54.5

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.54.5

Patch Changes

  • #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

    When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

  • Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

@​cloudflare/vite-plugin@​1.54.4

Patch Changes

@​cloudflare/vite-plugin@​1.54.3

Patch Changes

@​cloudflare/vite-plugin@​1.54.2

Patch Changes

@​cloudflare/vite-plugin@​1.54.1

Patch Changes

@​cloudflare/vite-plugin@​1.54.0

Minor Changes

  • #15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

    Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.54.5

Patch Changes

  • #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

    When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

  • Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

1.54.4

Patch Changes

1.54.3

Patch Changes

1.54.2

Patch Changes

1.54.1

Patch Changes

1.54.0

... (truncated)

Commits

Updates @tanstack/react-router from 1.170.31 to 1.170.33

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2

1.170.32

Patch Changes

Commits
  • a58e01c ci: Version Packages (#8182)
  • 08eff50 fix(router-core): fix dangling references in published declarations (#8207)
  • cf166d1 fix(react-router): avoid rewriting unchanged head assets (#8257)
  • 07b3bc9 test(react-router): cover pending and not-found context (#8243)
  • 2f20c00 fix(router-core): skip lifecycle callbacks below fallback boundaries (#8165)
  • 0497cae perf(router): use URL.canParse for absolute URL checks (#8251)
  • 28a5e45 fix(router): handle unknown error boundary values (#8209)
  • f0b5eda fix(router-core): retain not-found boundary during navigation (#8161)
  • 0caf6b9 fix: preserve shouldThrow in route-scoped hooks (#8169)
  • a5a5bac ci: Version Packages (#8133)
  • Additional commits viewable in compare view

Updates @tanstack/react-router-ssr-query from 1.167.1 to 1.167.2

Release notes

Sourced from @​tanstack/react-router-ssr-query's releases.

@​tanstack/react-router-ssr-query@​1.167.2

Patch Changes

  • Updated dependencies [79e3533]:
    • @​tanstack/router-ssr-query-core@​1.169.2
Changelog

Sourced from @​tanstack/react-router-ssr-query's changelog.

1.167.2

Patch Changes

  • Updated dependencies [79e3533]:
    • @​tanstack/router-ssr-query-core@​1.169.2
Commits

Updates @tanstack/react-start from 1.168.48 to 1.168.50

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.168.50

Patch Changes

Changelog

Sourced from @​tanstack/react-start's changelog.

1.168.50

Patch Changes

1.168.49

Patch Changes

  • Updated dependencies [cb281d7, a0041bb]:
    • @​tanstack/react-router@​1.170.32
    • @​tanstack/start-plugin-core@​1.171.39
    • @​tanstack/react-start-client@​1.168.30
    • @​tanstack/react-start-rsc@​0.1.48
    • @​tanstack/react-start-server@​1.167.37
    • @​tanstack/start-client-core@​1.170.27
    • @​tanstack/start-server-core@​1.169.31
Commits

Updates @tanstack/router-plugin from 1.168.34 to 1.168.36

Release notes

Sourced from @​tanstack/router-plugin's releases.

@​tanstack/router-plugin@​1.168.36

Patch Changes

Changelog

Sourced from @​tanstack/router-plugin's changelog.

1.168.36

Patch Changes

1.168.35

Patch Changes

  • Updated dependencies [fa65287, cb281d7]:
    • @​tanstack/router-core@​1.171.27
    • @​tanstack/react-router@​1.170.32
    • @​tanstack/router-generator@​1.167.33
Commits

Updates better-auth from 1.7.0 to 1.7.3

Release notes

Sourced from better-auth's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

  • Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
  • Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
  • Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

  • Aligned generated OpenAPI required fields with runtime validation. (#11066)
  • Handled malformed custom-scheme callback URLs without excessive processing. (#11060)
  • Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)
  • Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)
  • Tracked email OTP sign-ins in the last login method plugin. (#10963)
  • Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)
  • Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)
  • Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)
  • Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)
  • Improved dynamic organization role permission check performance. (#11069)
  • Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)
  • Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
  • Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)
  • Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
  • Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

  • Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)
  • Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)
  • Improved request IP validation performance. (#11068)
  • Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)
  • Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)
  • Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.3

Patch Changes

  • #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

  • #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

  • #11120 7ec7146 Thanks @​onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

  • #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

  • #11188 c47b765 Thanks @​bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

  • #11084 2d5c63d Thanks @​bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

  • #11147 a9d8c12 Thanks @​bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

  • #10988 9fc7498 Thanks @​bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

  • #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

    Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

  • #11069 0bb0dbf Thanks @​bytaesu! - Improve dynamic organization role permission check performance.

  • #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

    If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

  • #10978 5fe5bc2 Thanks @​BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

  • #10963 74a7369 Thanks @​thisismert! - Track email OTP sign-ins in the last login method plugin.

  • #11085 e16b40a Thanks @​bytaesu! - Provide type-safe Nuxt useFetch integration for the Vue client's useSession hook.

  • #11066 c0444dc Thanks @​bytaesu! - Upgrade the packaged Zod dependency to 4.5. Generated OpenAPI schemas now mark required request fields consistently with runtime validation, including passkey registration responses.

  • Updated dependencies [352d012, 76d311f, 3e9e197, 157ec8d, baa08f4, 9e36635, be0e007, a2bae0c, 1a1b7d5, 2220ee7]:

    • @​better-auth/core@​1.7.3
    • @​better-auth/drizzle-adapter@​1.7.3
    • @​better-auth/prisma-adapter@​1.7.3
    • @​better-auth/kysely-adapter@​1.7.3
    • @​better-auth/memory-adapter@​1.7.3
    • @​better-auth/mongo-adapter@​1.7.3
    • @​better-auth/telemetry@​1.7.3

1.7.2

Patch Changes

... (truncated)

Commits

@dependabot
chore(deps): bump the npm group across 1 directory with 16 updates
fd300ef 
Bumps the npm group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.53.0` | `1.54.5` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.31` | `1.170.33` |
| [@tanstack/react-router-ssr-query](https://github.com/TanStack/router/tree/HEAD/packages/react-router-ssr-query) | `1.167.1` | `1.167.2` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.48` | `1.168.50` |
| [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.34` | `1.168.36` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.0` | `1.7.3` |
| [framer-motion](https://github.com/motiondivision/motion) | `13.1.1` | `13.2.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.42.0` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.12` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.5.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.7` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |
| [ultracite](https://github.com/haydenbleasel/ultracite) | `7.10.5` | `7.11.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.124.0` | `4.129.1` |



Updates `@cloudflare/vite-plugin` from 1.53.0 to 1.54.5
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.54.5/packages/vite-plugin-cloudflare)

Updates `@tanstack/react-router` from 1.170.31 to 1.170.33
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.33/packages/react-router)

Updates `@tanstack/react-router-ssr-query` from 1.167.1 to 1.167.2
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router-ssr-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router-ssr-query@1.167.2/packages/react-router-ssr-query)

Updates `@tanstack/react-start` from 1.168.48 to 1.168.50
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.50/packages/react-start)

Updates `@tanstack/router-plugin` from 1.168.34 to 1.168.36
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.36/packages/router-plugin)

Updates `better-auth` from 1.7.0 to 1.7.3
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/better-auth)

Updates `framer-motion` from 13.1.1 to 13.2.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v13.1.1...v13.2.0)

Updates `lucide-react` from 1.33.0 to 1.42.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.42.0/packages/lucide-react)

Updates `@biomejs/biome` from 2.5.9 to 2.5.12
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.12/packages/@biomejs/biome)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@types/node` from 26.2.0 to 26.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `ultracite` from 7.10.5 to 7.11.0
- [Release notes](https://github.com/haydenbleasel/ultracite/releases)
- [Commits](https://github.com/haydenbleasel/ultracite/compare/ultracite@7.10.5...ultracite@7.11.0)

Updates `vitest` from 4.1.11 to 5.0.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest)

Updates `wrangler` from 4.124.0 to 4.129.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.129.1/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.54.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tanstack/react-router-ssr-query"
  dependency-version: 1.167.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.168.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tanstack/router-plugin"
  dependency-version: 1.168.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: better-auth
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: framer-motion
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: lucide-react
  dependency-version: 1.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 26.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: ultracite
  dependency-version: 7.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: wrangler
  dependency-version: 4.129.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@dependabot
dependabot Bot requested a review from arsenstorm as a code owner September 11, 2026 08:45
@socket-security

socket-security Bot commented Sep 11, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​react-dom@​19.2.4 ⏵ 19.2.7100 +110075 +193100
Updated@​tanstack/​router-plugin@​1.168.34 ⏵ 1.168.36991007897 -1100
Updatedvitest@​4.1.11 ⏵ 5.0.098 +110079 +199 +2100
Updated@​tanstack/​react-router-ssr-query@​1.167.1 ⏵ 1.167.29910080 +596 +2100
Updatedlucide-react@​1.33.0 ⏵ 1.42.010010098 +196 +180
Updated@​types/​node@​26.2.0 ⏵ 26.5.0100 +110081 +196100
Updatedbetter-auth@​1.7.0 ⏵ 1.7.39810085 +195 -1100
Updated@​tanstack/​react-router@​1.170.31 ⏵ 1.170.33921008797 -1100
Updated@​cloudflare/​vite-plugin@​1.53.0 ⏵ 1.54.598 +210087 +296 +1100
Updated@​tanstack/​react-start@​1.168.48 ⏵ 1.168.5099 +11008898100
Updated@​testing-library/​react@​16.3.2 ⏵ 16.3.3100 +110010091100
Updatedwrangler@​4.124.0 ⏵ 4.129.198 +110092 +196100
Updated@​vitejs/​plugin-react@​6.1.0 ⏵ 6.1.1100 +1100100 +194100
Updatedultracite@​7.10.5 ⏵ 7.11.09810097 +196 +1100
Updatedframer-motion@​13.1.1 ⏵ 13.2.099 +1100100 +197 +2100
Updated@​biomejs/​biome@​2.5.9 ⏵ 2.5.12100 +1100100 +199 +1100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 18, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/npm-87e886fd39 branch September 18, 2026 08:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arsenstorm arsenstorm Awaiting requested review from arsenstorm arsenstorm is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants