Skip to content

deps: bump the npm-minor-and-patch group across 1 directory with 12 updates - #545

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-9225b35a1b
Open

deps: bump the npm-minor-and-patch group across 1 directory with 12 updates#545
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-9225b35a1b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 12 updates in the / directory:

Package From To
@better-auth/passkey 1.7.14 1.7.18
better-auth 1.7.14 1.7.18
d3-geo 3.1.1 3.1.2
lucide-react 1.65.0 1.70.0
next 16.4.3 16.4.5
pdfjs-dist 6.4.299 6.5.438
tailwindcss 4.3.3 4.3.5
@electric-sql/pglite 0.5.13 0.5.15
@playwright/test 1.64.1 1.65.0
@tailwindcss/postcss 4.3.3 4.3.5
eslint-config-next 16.4.3 16.4.5
vitest 5.0.5 5.1.0

Updates @better-auth/passkey from 1.7.14 to 1.7.18

Release notes

Sourced from @​better-auth/passkey's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from @​better-auth/passkey's changelog.

1.7.18

1.7.17

Patch Changes

  • #12225 3ab3dbf Thanks @​bytaesu! - Passkey registration and sign-in now work when one passkey() plugin is shared between auth instances where some set baseURL and others do not. Previously one of the instances could fail with ORIGIN_NOT_CONFIGURED or verify against the other instance's origin settings.

1.7.16

Patch Changes

  • #12198 f25081a Thanks @​bytaesu! - Passkey registration, device authorization, two-factor enrollment and verification, social account linking, and phone number changes now reject a session revoked in the database or secondary storage, even when cookie caching is enabled. Sessions created from API keys are refused on these routes, except two-factor enrollment and phone number changes.

  • #12198 f25081a Thanks @​bytaesu! - The expected WebAuthn origin now comes from server configuration instead of the request: the origin option, or the baseURL origin plus a frontend origin listed exactly in trustedOrigins. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it.

  • #12198 f25081a Thanks @​bytaesu! - authenticatorSelection.userVerification now applies to authentication as well as registration: it is requested in authentication options, and with required passkey registration and sign-in reject responses without user verification.

1.7.15

Commits

Updates better-auth from 1.7.14 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

  • If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

  • Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
  • Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
  • Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

  • Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
  • Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
  • Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
  • Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
  • Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
  • Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
  • Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

  • #12259 9e2a0ec Thanks @​gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

  • #12244 85f4342 Thanks @​gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

  • #12250 278bb28 Thanks @​gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

  • Updated dependencies [9342a73]:

    • @​better-auth/core@​1.7.18
    • @​better-auth/drizzle-adapter@​1.7.18
    • @​better-auth/kysely-adapter@​1.7.18
    • @​better-auth/memory-adapter@​1.7.18
    • @​better-auth/mongo-adapter@​1.7.18
    • @​better-auth/prisma-adapter@​1.7.18
    • @​better-auth/telemetry@​1.7.18

1.7.17

Patch Changes

  • #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

  • #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

  • #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

  • #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

  • #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

  • #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

  • #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

  • Updated dependencies [fc2e00b]:

    • @​better-auth/kysely-adapter@​1.7.17
    • @​better-auth/core@​1.7.17
    • @​better-auth/drizzle-adapter@​1.7.17
    • @​better-auth/memory-adapter@​1.7.17
    • @​better-auth/mongo-adapter@​1.7.17
    • @​better-auth/prisma-adapter@​1.7.17
    • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

... (truncated)

Commits
  • 38f43e3 chore: release v1.7.18 (#12252)
  • 9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
  • 278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
  • 85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
  • e3ae9e1 chore: release v1.7.17 (#12214)
  • b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
  • fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
  • 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
  • 9150314 fix(phone-number): treat empty phone number as missing (#12219)
  • cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
  • Additional commits viewable in compare view

Updates d3-geo from 3.1.1 to 3.1.2

Release notes

Sourced from d3-geo's releases.

v3.1.2

  • Update dependencies.
  • Adopt pnpm and vitest.
  • Adopt npm trusted publishing.
  • Publish an ES module bundle instead of separate source files.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3-geo since your current version.


Updates lucide-react from 1.65.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

... (truncated)

Commits

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

  • [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
  • [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
  • [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
  • [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
  • [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
  • [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
  • [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits
  • 4e5335a v16.4.5
  • 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
  • 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
  • 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
  • 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
  • e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
  • d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
  • 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
  • b175f52 v16.4.4
  • ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
  • Additional commits viewable in compare view

Updates pdfjs-dist from 6.4.299 to 6.5.438

Release notes

Sourced from pdfjs-dist's releases.

v6.5.438

This release contains improvements for accessibility, annotation editing, annotation rendering, font conversion, image conversion, performance, scripting, tiling pattern rendering and the viewer.

Changes since v6.4.299

... (truncated)

Commits
  • 0a41533 Merge pull request #22371 from andrewfader/stream-reader-cancel-errored
  • 956f0cd Merge pull request #22375 from andrewfader/xref-discard-corrupt-state
  • 743422f Prevent unhandled rejections when cancelling an errored stream reader
  • 4794c39 Discard the state of a corrupt XRef table/stream before parsing the next one
  • ab3819f Merge pull request #22409 from Snuffleupagus/initAnnotationLayer-inline
  • b1b2849 Merge pull request #22402 from calixteman/truncated-rgb-image-data
  • 5b02155 Merge pull request #22386 from calixteman/bug2084610
  • 4ef78fe Inline the AnnotationLayerBuilder.prototype.#initAnnotationLayer method
  • 079921e Regenerate button appearances for NeedAppearances (bug 2084610)
  • 743102c Merge pull request #22408 from Snuffleupagus/AnnotationElement-shadow-svgFactory
  • Additional commits viewable in compare view

Updates tailwindcss from 4.3.3 to 4.3.5

Release notes

Sourced from tailwindcss's releases.

v4.3.5

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
  • Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563Description has been truncated

@dependabot
deps: bump the npm-minor-and-patch group across 1 directory with 12 u…
451d32c 
…pdates

Bumps the npm-minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/passkey](https://github.com/better-auth/better-auth/tree/HEAD/packages/passkey) | `1.7.14` | `1.7.18` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.14` | `1.7.18` |
| [d3-geo](https://github.com/d3/d3-geo) | `3.1.1` | `3.1.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.65.0` | `1.70.0` |
| [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `6.4.299` | `6.5.438` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.13` | `0.5.15` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.3` | `4.3.5` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.3` | `16.4.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` |



Updates `@better-auth/passkey` from 1.7.14 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/passkey/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/passkey)

Updates `better-auth` from 1.7.14 to 1.7.18
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.18/packages/better-auth)

Updates `d3-geo` from 3.1.1 to 3.1.2
- [Release notes](https://github.com/d3/d3-geo/releases)
- [Commits](d3/d3-geo@v3.1.1...v3.1.2)

Updates `lucide-react` from 1.65.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

Updates `next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.3...v16.4.5)

Updates `pdfjs-dist` from 6.4.299 to 6.5.438
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v6.4.299...v6.5.438)

Updates `tailwindcss` from 4.3.3 to 4.3.5
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss)

Updates `@electric-sql/pglite` from 0.5.13 to 0.5.15
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.15/packages/pglite)

Updates `@playwright/test` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `@tailwindcss/postcss` from 4.3.3 to 4.3.5
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-postcss)

Updates `eslint-config-next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@better-auth/passkey"
  dependency-version: 1.7.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: d3-geo
  dependency-version: 3.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: next
  dependency-version: 16.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: pdfjs-dist
  dependency-version: 6.5.438
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.4.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@catomean