chore(deps): bump the npm group across 1 directory with 24 updates by dependabot[bot] · Pull Request #18 · arsenstorm/extra-github-tools

dependabot · 2026-10-02T08:46:20Z

Bumps the npm group with 24 updates in the / directory:

Package	From	To
@cloudflare/vite-plugin	`1.53.0`	`1.62.0`
@tanstack/react-devtools	`0.10.12`	`0.10.13`
@tanstack/react-router	`1.170.31`	`1.170.40`
@tanstack/react-router-devtools	`1.167.1`	`1.167.2`
@tanstack/react-router-ssr-query	`1.167.1`	`1.167.3`
@tanstack/react-start	`1.168.48`	`1.168.59`
@tanstack/router-plugin	`1.168.34`	`1.168.41`
better-auth	`1.7.0`	`1.7.6`
framer-motion	`13.1.1`	`13.4.5`
lucide-react	`1.33.0`	`1.48.0`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.4`	`19.3.0`
@biomejs/biome	`2.5.9`	`2.5.14`
@testing-library/dom	`10.4.1`	`10.4.2`
@testing-library/react	`16.3.2`	`16.3.3`
@types/node	`26.2.0`	`26.6.3`
@types/react	`19.2.18`	`19.3.0`
@types/react-dom	`19.2.4`	`19.3.0`
@vitejs/plugin-react	`6.1.0`	`6.1.1`
jsdom	`30.0.1`	`30.1.1`
ultracite	`7.10.5`	`7.12.2`
vite	`8.2.2`	`8.3.1`
vitest	`4.1.11`	`5.0.2`
wrangler	`4.124.0`	`4.143.0`

Updates @cloudflare/vite-plugin from 1.53.0 to 1.62.0

Release notes

Sourced from @cloudflare/vite-plugin's releases.

@cloudflare/vite-plugin@1.62.0

Minor Changes

#15914 7f0734c Thanks @jamesopstad! - Use cf/config for cloudflare.config.ts authoring

Experimental cloudflare.config.ts projects must now import defineConfig, bindings, triggers, and related helpers from cf/config. Generated declarations from Wrangler and the Vite plugin also reference this package, so projects using the experimental configuration flow must add cf as a dependency.

The Vite plugin no longer exports @cloudflare/vite-plugin/experimental-config. wrangler/experimental-config remains available for defineWranglerConfig, but no longer re-exports Cloudflare configuration helpers.

Patch Changes

#15878 e7915c1 Thanks @dawNotPoi! - Keep dependency optimization caches stable on the first Vite dev server restart.

The first dev server restart no longer re-optimizes unchanged dependencies, including in projects without Containers. Container images are still cleaned up when the server closes, even after a config reload removes the Cloudflare plugin.

Updated dependencies [7f0734c]:

wrangler@4.143.0

@cloudflare/vite-plugin@1.61.0

Minor Changes
#15856 4c2993b Thanks @Naapperas! - Support Workflows declared in exports on ctx.exports in local development

A Workflow declared in a Worker's exports is now available on ctx.exports in wrangler dev, the Vite plugin and the Vitest plugin, with the same API as a Workflow binding:
const instance = await ctx.exports.MyWorkflow.create({
  params: { name: "World" },
});
ctx.exports and workflows bindings with the same Workflow name share their instances, including instances created before the Workflow was declared in exports. Two Workers can't export the same Workflow name, and a binding to an exported Workflow must refer to the Worker and class that export it. getPlatformProxy() ignores Workflows declared in exports, since it doesn't run the Worker's code.

wrangler workflows commands run with --local also work with Workflows declared only in exports, without a workflows binding.

In the Vitest plugin, introspectWorkflow() and introspectWorkflowInstance() still need a Workflow binding, and now explain how to add one when passed a Workflow from ctx.exports. Instances created through ctx.exports are introspected too. A workflows binding whose script_name is the Worker's own name now resolves to the Worker itself again.
Patch Changes

Updated dependencies [8dc53ae, 4c2993b]:

miniflare@5.20260926.0-alpha

wrangler@4.142.0

@cloudflare/vite-plugin@1.60.2

Patch Changes

Updated dependencies [ee2b200, c91279b, 8280086, bd56b98, 805af2f]:

miniflare@5.20260925.0-alpha

wrangler@4.141.0

... (truncated)

Changelog

Sourced from @cloudflare/vite-plugin's changelog.

1.62.0

Minor Changes

#15914 7f0734c Thanks @jamesopstad! - Use cf/config for cloudflare.config.ts authoring

Experimental cloudflare.config.ts projects must now import defineConfig, bindings, triggers, and related helpers from cf/config. Generated declarations from Wrangler and the Vite plugin also reference this package, so projects using the experimental configuration flow must add cf as a dependency.

The Vite plugin no longer exports @cloudflare/vite-plugin/experimental-config. wrangler/experimental-config remains available for defineWranglerConfig, but no longer re-exports Cloudflare configuration helpers.

Patch Changes

#15878 e7915c1 Thanks @dawNotPoi! - Keep dependency optimization caches stable on the first Vite dev server restart.

The first dev server restart no longer re-optimizes unchanged dependencies, including in projects without Containers. Container images are still cleaned up when the server closes, even after a config reload removes the Cloudflare plugin.

Updated dependencies [7f0734c]:

wrangler@4.143.0

1.61.0

Minor Changes
#15856 4c2993b Thanks @Naapperas! - Support Workflows declared in exports on ctx.exports in local development

A Workflow declared in a Worker's exports is now available on ctx.exports in wrangler dev, the Vite plugin and the Vitest plugin, with the same API as a Workflow binding:
const instance = await ctx.exports.MyWorkflow.create({
  params: { name: "World" },
});
ctx.exports and workflows bindings with the same Workflow name share their instances, including instances created before the Workflow was declared in exports. Two Workers can't export the same Workflow name, and a binding to an exported Workflow must refer to the Worker and class that export it. getPlatformProxy() ignores Workflows declared in exports, since it doesn't run the Worker's code.

wrangler workflows commands run with --local also work with Workflows declared only in exports, without a workflows binding.

In the Vitest plugin, introspectWorkflow() and introspectWorkflowInstance() still need a Workflow binding, and now explain how to add one when passed a Workflow from ctx.exports. Instances created through ctx.exports are introspected too. A workflows binding whose script_name is the Worker's own name now resolves to the Worker itself again.
Patch Changes

Updated dependencies [8dc53ae, 4c2993b]:

miniflare@5.20260926.0-alpha

wrangler@4.142.0

1.60.2

Patch Changes

Updated dependencies [ee2b200, c91279b, 8280086, bd56b98, 805af2f]:

... (truncated)

Commits

3bdcd0d Version Packages (#15909)
7f0734c Use cf/config for cloudflare.config.ts authoring (#15914)
e7915c1 [vite-plugin] Keep dependency optimizer hash stable on first restart (#15878)
f96458c Version Packages (#15882)
4c2993b Emit new Worker config for same-worker Workflows (#15856)
8d61ca8 Version Packages (#15867)
84c819f Version Packages (#15857)
c59dae6 Version Packages (#15828)
940c692 [workflows-shared] Emulate deterministic-ID uniqueness in the local Workflows...
52c0e9f Add backend support for cron triggers in local explorer (#15648)
Additional commits viewable in compare view

Updates @tanstack/react-devtools from 0.10.12 to 0.10.13

Changelog

Sourced from @tanstack/react-devtools's changelog.

0.10.13

Patch Changes

Updated dependencies [02a67f1, 589304f, dc61e1e, 45f39ee]:

@tanstack/devtools@0.15.0

Commits

a3d9877 ci: Version Packages (#328)
67be66c ci: Version Packages (#311)
cda3fc7 ci: Version Packages (#303)
cbe2d05 ci: Version Packages (#298)
bf1d590 feat: fix event bus port issues (#297)
831cf4c ci: Version Packages (#296)
ba7842e ci: Version Packages (#295)
f58a87b ci: prepare for trusted publishing (#288)
f4ae997 ci: Version Packages (#287)
946bfb2 ci: Version Packages (#285)
Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.31 to 1.170.40

Release notes

Sourced from @tanstack/react-router's releases.

@tanstack/react-router@1.170.40

Patch Changes

#8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

@tanstack/router-core@1.171.33

@tanstack/react-router@1.170.39

Patch Changes

#8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

Changelog

Sourced from @tanstack/react-router's changelog.

1.170.40

Patch Changes

#8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

@tanstack/router-core@1.171.33

1.170.39

Patch Changes

#8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

1.170.38

Patch Changes

Updated dependencies [cecae54, 0103578, ce10dcd, 84936cc, bbd2336]:

@tanstack/router-core@1.171.32

1.170.37

Patch Changes

#8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

#8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

Static server functions decode cached RawStream values with the client deserializer plugins.

SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

... (truncated)

Commits

f0e751d ci: Version Packages (#8497)
763ac8b test(react-router): regression for #2072 router context invalidation (#8499)
f5ffd38 perf(router): skip unused link preload cleanup across adapters (#8436)
ddad69a ci: Version Packages (#8486)
73bfc15 perf(react-router): avoid redundant link hydration updates (#8435)
84bde66 ci: Version Packages (#8457)
de023a7 ci: Version Packages (#8429)
cbbfbe3 optimize streaming (#8204)
8e164d2 refactor(react-router): drop the useLinkProps pass-through wrapper (#8420)
e561fa1 perf(router-core): pass deepEqual flags positionally (#8418)
Additional commits viewable in compare view

Updates @tanstack/react-router-devtools from 1.167.1 to 1.167.2

Changelog

Sourced from @tanstack/react-router-devtools's changelog.

1.167.2

Patch Changes

Updated dependencies [d76a332, b747fb8, 6cfb1e8, 700a714, 700a714, 6387d58, 7e349c3, 9b2adaf, 873c830, 7e349c3, 634da91, e9396c9, 634da91, f151ab0, bc57fa3, 6387d58, 9872d2a, d76a332, 634da91, 634da91, 7e349c3, 9448caa, e9396c9, 700a714, 634da91, 634da91]:

@tanstack/router-core@1.171.30

@tanstack/react-router@1.170.36

@tanstack/router-devtools-core@1.168.2

Commits

6954a37 ci: Version Packages (#8355)
49bcd4d chore: refresh Router and Start dependencies (#8300)
f97188f chore: localize package dependencies (#8078)
See full diff in compare view

Updates @tanstack/react-router-ssr-query from 1.167.1 to 1.167.3

Release notes

Sourced from @tanstack/react-router-ssr-query's releases.

@tanstack/solid-router-ssr-query@1.167.3

Patch Changes

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

Static server functions decode cached RawStream values with the client deserializer plugins.

SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

Updated dependencies [cbbfbe3]:

@tanstack/router-ssr-query-core@1.169.3

@tanstack/vue-router-ssr-query@1.167.3

Patch Changes

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

Static server functions decode cached RawStream values with the client deserializer plugins.

SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

Updated dependencies [cbbfbe3]:

... (truncated)

Changelog

Sourced from @tanstack/react-router-ssr-query's changelog.

1.167.3

Patch Changes

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

Static server functions decode cached RawStream values with the client deserializer plugins.

SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

Updated dependencies [cbbfbe3]:

@tanstack/router-ssr-query-core@1.169.3

1.167.2

Patch Changes

Updated dependencies [79e3533]:

@tanstack/router-ssr-query-core@1.169.2

Commits

de023a7 ci: Version Packages (#8429)
cbbfbe3 optimize streaming (#8204)
49bcd4d chore: refresh Router and Start dependencies (#8300)
0dbb77f ci: Version Packages (#8177)
ebf13ed add react-start-query-integration bundlesize benchmark scenario (#8153)
f97188f chore: localize package dependencies (#8078)
b5e540d docs: use the dynamic README header endpoint (#7940)
88f366a chore: migrate to typescript 7 (#7887)
See full diff in compare view

Updates @tanstack/react-start from 1.168.48 to 1.168.59

Release notes

Sourced from @tanstack/react-start's releases.

@tanstack/react-start@1.168.59

Patch Changes

Updated dependencies [f5ffd38, 488d046, e81845f, 76a7c0b]:

@tanstack/react-router@1.170.40

@tanstack/start-client-core@1.170.33

@tanstack/start-server-core@1.169.38

@tanstack/start-plugin-core@1.171.48

@tanstack/react-start-client@1.168.38

@tanstack/react-start-rsc@0.1.58

@tanstack/react-start-server@1.167.45

@tanstack/react-start@1.168.58

Patch Changes

Updated dependencies [73bfc15]:

@tanstack/react-router@1.170.39

@tanstack/react-start-client@1.168.37

@tanstack/react-start-rsc@0.1.57

@tanstack/react-start-server@1.167.44

@tanstack/react-start@1.168.57

Patch Changes

Updated dependencies [222300b]:

@tanstack/start-plugin-core@1.171.47

@tanstack/react-start-rsc@0.1.56

Changelog

Sourced from @tanstack/react-start's changelog.

1.168.59

Patch Changes

Updated dependencies [f5ffd38, 488d046, e81845f, 76a7c0b]:

@tanstack/react-router@1.170.40

@tanstack/start-client-core@1.170.33

@tanstack/start-server-core@1.169.38

@tanstack/start-plugin-core@1.171.48

@tanstack/react-start-client@1.168.38

@tanstack/react-start-rsc@0.1.58

@tanstack/react-start-server@1.167.45

1.168.58

Patch Changes

Updated dependencies [73bfc15]:

@tanstack/react-router@1.170.39

@tanstack/react-start-client@1.168.37

@tanstack/react-start-rsc@0.1.57

@tanstack/react-start-server@1.167.44

1.168.57

Patch Changes

Updated dependencies [222300b]:

@tanstack/start-plugin-core@1.171.47

@tanstack/react-start-rsc@0.1.56

1.168.56

Patch Changes

Updated dependencies []:

@tanstack/react-router@1.170.38

@tanstack/react-start-client@1.168.36

@tanstack/react-start-rsc@0.1.55

@tanstack/react-start-server@1.167.43

@tanstack/start-client-core@1.170.32

@tanstack/start-plugin-core@1.171.46

@tanstack/start-server-core@1.169.37

1.168.55

Patch Changes

Updated dependencies [e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, 8e164d2]:

@tanstack/react-router@1.170.37

... (truncated)

Commits

f0e751d ci: Version Packages (#8497)
ddad69a ci: Version Packages (#8486)
fe7f1fd ci: Version Packages (#8477)
84bde66 ci: Version Packages (#8457)
de023a7 ci: Version Packages (#8429)
a768f66 ci: Version Packages (#8413)
6954a37 ci: Version Packages (#8355)
6494e75 ci: Version Packages (#8330)
edeb199 ci: Version Packages (#8281)
49bcd4d chore: refresh Router and Start dependencies (#8300)
Additional commits viewable in compare view

Updates @tanstack/router-plugin from 1.168.34 to 1.168.41

Release notes

Sourced from @tanstack/router-plugin's releases.

@tanstack/router-plugin@1.168.41

Patch Changes

Updated dependencies [f5ffd38, 488d046, 0c1b5e3, 3cdd1af]:

@tanstack/react-router@1.170.40

@tanstack/router-core@1.171.33

@tanstack/router-generator@1.167.39

Changelog

Sourced from @tanstack/router-plugin's changelog.

1.168.41

Patch Changes

Updated dependencies [f5ffd38, 488d046, 0c1b5e3, 3cdd1af]:

@tanstack/react-router@1.170.40

@tanstack/router-core@1.171.33

@tanstack/router-generator@1.167.39

1.168.40

Patch Changes

Updated dependencies [cecae54, 0103578, ce10dcd, 84936cc, bbd2336]:

@tanstack/router-core@1.171.32

@tanstack/react-router@1.170.38

@tanstack/router-generator@1.167.38

1.168.39

Patch Changes

Updated dependencies [bc80866, e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, a0b2ad9, 8e164d2, 1ca361b]:

@tanstack/router-core@1.171.31

@tanstack/react-router@1.170.37

@tanstack/router-generator@1.167.37

1.168.38

Patch Changes

Updated dependencies [d76a332, b747fb8, 6cfb1e8, 700a714, 700a714, 6387d58, 7e349c3, 9b2adaf, 873c830, 7e349c3, 634da91, e9396c9, 634da91, f151ab0, bc57fa3, 6387d58, 9872d2a, d76a332, Description has been truncated

Bumps the npm group with 24 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.53.0` | `1.62.0` | | [@tanstack/react-devtools](https://github.com/TanStack/devtools/tree/HEAD/packages/react-devtools) | `0.10.12` | `0.10.13` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.31` | `1.170.40` | | [@tanstack/react-router-devtools](https://github.com/TanStack/router/tree/HEAD/packages/react-router-devtools) | `1.167.1` | `1.167.2` | | [@tanstack/react-router-ssr-query](https://github.com/TanStack/router/tree/HEAD/packages/react-router-ssr-query) | `1.167.1` | `1.167.3` | | [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.48` | `1.168.59` | | [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.34` | `1.168.41` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.0` | `1.7.6` | | [framer-motion](https://github.com/motiondivision/motion) | `13.1.1` | `13.4.5` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.48.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.14` | | [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.3` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` | | [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.1` | | [ultracite](https://github.com/haydenbleasel/ultracite) | `7.10.5` | `7.12.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.2` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.124.0` | `4.143.0` | Updates `@cloudflare/vite-plugin` from 1.53.0 to 1.62.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.62.0/packages/vite-plugin-cloudflare) Updates `@tanstack/react-devtools` from 0.10.12 to 0.10.13 - [Release notes](https://github.com/TanStack/devtools/releases) - [Changelog](https://github.com/TanStack/devtools/blob/main/packages/react-devtools/CHANGELOG.md) - [Commits](https://github.com/TanStack/devtools/commits/@tanstack/devtools@0.10.13/packages/react-devtools) Updates `@tanstack/react-router` from 1.170.31 to 1.170.40 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.40/packages/react-router) Updates `@tanstack/react-router-devtools` from 1.167.1 to 1.167.2 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router-devtools/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router-devtools@1.167.2/packages/react-router-devtools) Updates `@tanstack/react-router-ssr-query` from 1.167.1 to 1.167.3 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router-ssr-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router-ssr-query@1.167.3/packages/react-router-ssr-query) Updates `@tanstack/react-start` from 1.168.48 to 1.168.59 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.59/packages/react-start) Updates `@tanstack/router-plugin` from 1.168.34 to 1.168.41 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.41/packages/router-plugin) Updates `better-auth` from 1.7.0 to 1.7.6 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.6/packages/better-auth) Updates `framer-motion` from 13.1.1 to 13.4.5 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v13.1.1...v13.4.5) Updates `lucide-react` from 1.33.0 to 1.48.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.48.0/packages/lucide-react) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@biomejs/biome` from 2.5.9 to 2.5.14 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.14/packages/@biomejs/biome) Updates `@testing-library/dom` from 10.4.1 to 10.4.2 - [Release notes](https://github.com/testing-library/dom-testing-library/releases) - [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/dom-testing-library@v10.4.1...v10.4.2) Updates `@testing-library/react` from 16.3.2 to 16.3.3 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3) Updates `@types/node` from 26.2.0 to 26.6.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) Updates `jsdom` from 30.0.1 to 30.1.1 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.0.1...v30.1.1) Updates `ultracite` from 7.10.5 to 7.12.2 - [Release notes](https://github.com/haydenbleasel/ultracite/releases) - [Commits](https://github.com/haydenbleasel/ultracite/compare/ultracite@7.10.5...ultracite@7.12.2) Updates `vite` from 8.2.2 to 8.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.1/packages/vite) Updates `vitest` from 4.1.11 to 5.0.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest) Updates `wrangler` from 4.124.0 to 4.143.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.143.0/packages/wrangler) --- updated-dependencies: - dependency-name: "@cloudflare/vite-plugin" dependency-version: 1.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@tanstack/react-devtools" dependency-version: 0.10.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tanstack/react-router" dependency-version: 1.170.40 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tanstack/react-router-devtools" dependency-version: 1.167.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tanstack/react-router-ssr-query" dependency-version: 1.167.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tanstack/react-start" dependency-version: 1.168.59 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tanstack/router-plugin" dependency-version: 1.168.41 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: better-auth dependency-version: 1.7.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: framer-motion dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: lucide-react dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@biomejs/biome" dependency-version: 2.5.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@testing-library/dom" dependency-version: 10.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@testing-library/react" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 26.6.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: jsdom dependency-version: 30.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: ultracite dependency-version: 7.12.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: vite dependency-version: 8.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: vitest dependency-version: 5.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm - dependency-name: wrangler dependency-version: 4.143.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-02T08:47:08Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@types/react-dom@19.2.4 ⏵ 19.3.0	⁺¹	⁺¹
@tanstack/react-router-devtools@1.167.1 ⏵ 1.167.2			⁺²
@tanstack/router-plugin@1.168.34 ⏵ 1.168.41	⁺¹
@types/react@19.2.18 ⏵ 19.3.0			^-1
vitest@4.1.11 ⏵ 5.0.2	⁺¹	⁺¹
@tanstack/react-router-ssr-query@1.167.1 ⏵ 1.167.3		⁺⁵	⁺³
lucide-react@1.33.0 ⏵ 1.48.0		⁺¹
@types/node@26.2.0 ⏵ 26.6.3	⁺¹	⁺¹
vite@8.2.2 ⏵ 8.3.1	⁺¹	⁺¹
react@19.2.8 ⏵ 19.3.0	⁺¹	⁺¹
better-auth@1.7.0 ⏵ 1.7.6		⁺¹	^-1
@tanstack/react-router@1.170.31 ⏵ 1.170.40	⁺¹		⁺¹
@cloudflare/vite-plugin@1.53.0 ⏵ 1.62.0	⁺²	⁺²
@tanstack/react-start@1.168.48 ⏵ 1.168.59	⁺¹
@testing-library/react@16.3.2 ⏵ 16.3.3	⁺¹
@testing-library/dom@10.4.1 ⏵ 10.4.2	⁺¹
@vitejs/plugin-react@6.1.0 ⏵ 6.1.1	⁺¹	⁺¹
@tanstack/react-devtools@0.10.12 ⏵ 0.10.13			^-1
wrangler@4.124.0 ⏵ 4.143.0	⁺¹
react-dom@19.2.8 ⏵ 19.3.0		⁺¹
jsdom@30.0.1 ⏵ 30.1.1	⁺¹	⁺¹	^-2
ultracite@7.10.5 ⏵ 7.12.2		⁺¹
framer-motion@13.1.1 ⏵ 13.4.5		⁺¹
@biomejs/biome@2.5.9 ⏵ 2.5.14	⁺¹	⁺¹	^-1

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 2, 2026

dependabot Bot requested a review from arsenstorm as a code owner October 2, 2026 08:46

Navigation Menu

Repository navigation

chore(deps): bump the npm group across 1 directory with 24 updates - #18

chore(deps): bump the npm group across 1 directory with 24 updates#18
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/npm-a6a69a413b

dependabot Bot commented on behalf of github Oct 2, 2026

Uh oh!

socket-security Bot commented Oct 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 2, 2026

@​cloudflare/vite-plugin@​1.62.0

Minor Changes

Patch Changes

@​cloudflare/vite-plugin@​1.61.0

Minor Changes

Patch Changes

@​cloudflare/vite-plugin@​1.60.2

Patch Changes

1.62.0

Minor Changes

Patch Changes

1.61.0

Minor Changes

Patch Changes

1.60.2

Patch Changes

0.10.13

Patch Changes

@​tanstack/react-router@​1.170.40

Patch Changes

@​tanstack/react-router@​1.170.39

Patch Changes

1.170.40

Patch Changes

1.170.39

Patch Changes

1.170.38

Patch Changes

1.170.37

Patch Changes

1.167.2

Patch Changes

@​tanstack/solid-router-ssr-query@​1.167.3

Patch Changes

@​tanstack/vue-router-ssr-query@​1.167.3

Patch Changes

1.167.3

Patch Changes

1.167.2

Patch Changes

@​tanstack/react-start@​1.168.59

Patch Changes

@​tanstack/react-start@​1.168.58

Patch Changes

@​tanstack/react-start@​1.168.57

Patch Changes

1.168.59

Patch Changes

1.168.58

Patch Changes

1.168.57

Patch Changes

1.168.56

Patch Changes

1.168.55

Patch Changes

@​tanstack/router-plugin@​1.168.41

Patch Changes

1.168.41

Patch Changes

1.168.40

Patch Changes

1.168.39

Patch Changes

1.168.38

Patch Changes

Uh oh!

socket-security Bot commented Oct 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@cloudflare/vite-plugin@1`.62.0

`@cloudflare/vite-plugin@1`.61.0

`@cloudflare/vite-plugin@1`.60.2

`@tanstack/react-router@1`.170.40

`@tanstack/react-router@1`.170.39

`@tanstack/solid-router-ssr-query@1`.167.3

`@tanstack/vue-router-ssr-query@1`.167.3

`@tanstack/react-start@1`.168.59

`@tanstack/react-start@1`.168.58

`@tanstack/react-start@1`.168.57

`@tanstack/router-plugin@1`.168.41