Bump the minor-and-patch group with 6 updates by dependabot[bot] · Pull Request #49 · monashcoding/monmap

dependabot · 2026-10-05T15:14:24Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the minor-and-patch group with 6 updates:

Package	From	To
dotenv	`18.0.4`	`18.0.5`
better-auth	`1.7.6`	`1.7.7`
lucide-react	`1.48.0`	`1.50.0`
posthog-js	`1.434.17`	`1.435.7`
posthog-node	`5.54.1`	`5.55.0`
eslint-config-next	`16.1.7`	`16.3.8`

Updates dotenv from 18.0.4 to 18.0.5

Changelog

Sourced from dotenv's changelog.

18.0.5 (2026-09-30)

Changed

Fix missing typescript module declaration (#1068)

Improve performance for large .env files (#1066)

Commits

05215e0 18.0.5
25bdd0a changelog
2d640d2 Merge pull request #1066 from AyanAta42/master
c84e2b4 Merge pull request #1068 from matzehecht/fix-typescript
570146a Optimize fast parser comment scanning
4aa0665 add typescript module declaration for dotenv/config
f1380ec Bound fast parser comment scans to the current line
a626f72 add link
b36a142 video links
See full diff in compare view

Updates better-auth from 1.7.6 to 1.7.7

Release notes

Sourced from better-auth's releases.

v1.7.7

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

Fixed a critical Magic Link account-takeover vulnerability. (#11494)

Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)

Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

Fixed CAPTCHA errors missing the JSON Content-Type header. (#11476)

Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. (#11375)

Fixed rate-limit errors missing the JSON Content-Type header. (#11469)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs. (#8686)

Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page. (#11402)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. (#11331)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed consumeOne deleting a record after a concurrent write invalidates its original condition. (#11495)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @bytaesu, @gitmotion, @gustavovalverde, @lennondotw

Full changelog: v1.7.6...v1.7.7

Changelog

Sourced from better-auth's changelog.

1.7.7

Patch Changes

#11476 4186e36 Thanks @bytaesu! - Return CAPTCHA errors with the correct JSON Content-Type header.

#11469 8620aa9 Thanks @aryan1306! - Return rate limit errors with a JSON Content-Type header.

#11491 55cb92e Thanks @bytaesu! - Respect social provider disableSignUp when signing in with an ID token.

#11375 69defbc Thanks @bytaesu! - Refresh the active organization after sign-in when a session hook selects the initial organization.

#11494 ac54bfd Thanks @gustavovalverde! - Isolate OAuth state cookies and each OAuth Proxy payload with purpose-specific encryption keys. The oAuthProxy options and supported configuration remain unchanged.

Upgrade all Better Auth nodes that handle the same cookie-backed OAuth or SAML relay-state flow together. Upgrade every OAuth Proxy participant, including production and preview or development deployments, in the same cutover. OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows started before the upgrade must be restarted. Mixed old and new participants cannot exchange existing state or proxy payloads, and there is no fallback to the previous shared key.

#11494 ac54bfd Thanks @gustavovalverde! - Magic Link verification now accepts only records issued for Magic Link. Magic Link records and database-backed OAuth or SAML state use separate verification identifier prefixes. Links and database-backed sign-ins started before the upgrade cannot complete; request new Magic Links and restart those sign-ins. Upgrade servers sharing verification storage together, and update verification.storeIdentifier.overrides rules for these flows to match the new magic-link: and auth-state: prefixes. The link token, callback state, endpoints, and public option types are unchanged.

Upgrade installed Better Auth adapters, plugins, and integrations released with better-auth alongside it so participating packages use the same release version.

Updated dependencies [35d7cd3, 07bdf7e]:

@better-auth/drizzle-adapter@1.7.7

@better-auth/kysely-adapter@1.7.7

@better-auth/core@1.7.7

@better-auth/memory-adapter@1.7.7

@better-auth/mongo-adapter@1.7.7

@better-auth/prisma-adapter@1.7.7

@better-auth/telemetry@1.7.7

Commits

db02f23 chore: release v1.7.7 (#11413)
ac54bfd fix(auth): isolate verification records and encryption purposes (#11494)
69defbc fix(organization): refresh active organization after email sign-in (#11375)
55cb92e fix(auth): honor social disableSignUp for ID token sign-in (#11491)
4186e36 fix(captcha): return JSON content type for errors (#11476)
8620aa9 fix(rate-limit): set JSON content type on 429 responses (#11469)
See full diff in compare view

Updates lucide-react from 1.48.0 to 1.50.0

Release notes

Sourced from lucide-react's releases.

Version 1.50.0

What's Changed

fix(shared): escape attribute values in buildLucideSvg by @Saadanjum0 in lucide-icons/lucide#4940

fix(github/actions): use canonical metadata instructions for PR suggestions by @karsa-mistmere in lucide-icons/lucide#4910

fix(icons): replaced nut & nut-off with compliant designs by @karsa-mistmere in lucide-icons/lucide#4840

chore(deps-dev): bump @angular/router from 22.1.7 to 22.2.0 by @dependabot[bot] in lucide-icons/lucide#4945

chore(deps): bump next from 16.3.4 to 16.3.6 by @dependabot[bot] in lucide-icons/lucide#4946

chore(deps-dev): bump the svelte-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#4918

test(integrations): add Vue integration fixtures for Vite, Nuxt and Vike by @ericfennis in lucide-icons/lucide#4882

feat(svelte): export context subpath by @vugarbbakhishov-hub in lucide-icons/lucide#4927

fix(lucide-preact): add Preact v11 compatibility by @JoviDeCroock in lucide-icons/lucide#4924

feat(icons): added layout-grid-circles icon by @karsa-mistmere in lucide-icons/lucide#4567

New Contributors

@Saadanjum0 made their first contribution in lucide-icons/lucide#4940

@JoviDeCroock made their first contribution in lucide-icons/lucide#4924

Full Changelog: lucide-icons/lucide@1.49.0...1.50.0

Version 1.49.0

What's Changed

feat(icons): added letters icon by @karsa-mistmere in lucide-icons/lucide#4779

fix(packages): declare @types/react as an optional peer dependency by @unrevised6419 in lucide-icons/lucide#4892

feat(icons): added bangladeshi-taka icon by @TanvirMahin24 in lucide-icons/lucide#4869

feat(icons): added printer-3d icon by @Azuzula in lucide-icons/lucide#4414

New Contributors

@unrevised6419 made their first contribution in lucide-icons/lucide#4892

@TanvirMahin24 made their first contribution in lucide-icons/lucide#4869

@Azuzula made their first contribution in lucide-icons/lucide#4414

Full Changelog: lucide-icons/lucide@1.48.0...1.49.0

Commits

e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
See full diff in compare view

Updates posthog-js from 1.434.17 to 1.435.7

Release notes

Sourced from posthog-js's releases.

posthog-js@1.435.7

1.435.7

Patch Changes

#5188 8a005ca Thanks @dustinbyrne! - Preserve shared identity while consent is pending and clear it after shared rejection in cookieless mode. (2026-10-02)

posthog-js@1.435.6

1.435.6

Patch Changes

#5046 c360da1 Thanks @luke-belton! - Capture the OpenAI Ads click identifier (oppref) as a campaign parameter, so it is set on events and as $initial_oppref like every other ad click ID. (2026-10-01)

#5175 c21f14d Thanks @marandaneto! - Fix cross-subdomain identity continuity when opting in after cookie consent. (2026-10-01)

Updated dependencies [c360da1]:

@posthog/browser-common@0.9.1

@posthog/core@1.55.3

posthog-js@1.435.5

1.435.5

Patch Changes

#5167 59b93a3 Thanks @dustinbyrne! - Preserve session attribution and registered properties across initialization and configuration updates when persistence writes are debounced. (2026-09-30)

posthog-js@1.435.4

1.435.4

Patch Changes

#5158 5c92e83 Thanks @posthog! - Fix a DataCloneError when session replay records network timing inside a cross-origin iframe. (2026-09-30)

posthog-js@1.435.3

1.435.3

Patch Changes

#4976 47db7ce Thanks @posthog! - Start session recording at DOMContentLoaded, so a page whose load event is late or never fires still records, and report $sdk_debug_rrweb_attached from rrweb's own recording state (2026-09-30)

posthog-js@1.435.2

1.435.2

Patch Changes

... (truncated)

Commits

ae7c453 chore: update versions and lockfile [version bump]
8a005ca fix(browser): preserve shared identity during pending cookieless consent (#5188)
041a0ad chore: update versions and lockfile [version bump]
80b9e5f perf(mcp): sanitize only the head of a long string that truncation keeps (#5186)
cfd635a fix(react-native): expose open choice text inputs to screen readers (#5183)
1087687 fix(react-native): wrap survey rating endpoint labels (#5181)
d2fa97f chore: update versions and lockfile [version bump]
e13bd2c fix(react-native): expose numeric survey rating semantics (#5182)
c7bf8ca chore: update versions and lockfile [version bump]
c360da1 feat(browser): capture the OpenAI Ads oppref click ID (#5046)
Additional commits viewable in compare view

Updates posthog-node from 5.54.1 to 5.55.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.55.0

5.55.0

Minor Changes

#5140 2d2560a Thanks @dustinbyrne! - Allow featureFlagsPollingInterval: null to disable automatic local flag polling while retaining initialization and manual refresh. (2026-09-30)

Changelog

Sourced from posthog-node's changelog.

5.55.0

Minor Changes

#5140 2d2560a Thanks @dustinbyrne! - Allow featureFlagsPollingInterval: null to disable automatic local flag polling while retaining initialization and manual refresh. (2026-09-30)

Commits

e1dd962 chore: update versions and lockfile [version bump]
2d2560a feat(node): allow disabling automatic feature flag polling (#5140)
bd66cee fix(replay): reduce debug properties without losing diagnostics (#5144)
3c24aa5 test(node): strengthen SDK regression coverage (#5105)
See full diff in compare view

Updates eslint-config-next from 16.1.7 to 16.3.8

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)

next/image: Reject empty images when reading/writing to the disk cache (#98186)

Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)

Add CSP nonce to script tags of loading and template files (#98403)

Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

... (truncated)

Commits

b0fad0d v16.3.8
4c20699 v16.3.7
a758ffc v16.3.6
ca2c75e v16.3.5
299180d v16.3.4
a9a1cb7 v16.3.3
d0ac882 v16.3.2
3d32eb8 v16.3.1
d73f562 v16.3.0
4fd843f v16.3.0-canary.107
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-config-next since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [dotenv](https://github.com/motdotla/dotenv) | `18.0.4` | `18.0.5` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.6` | `1.7.7` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.50.0` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.434.17` | `1.435.7` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.54.1` | `5.55.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.1.7` | `16.3.8` | Updates `dotenv` from 18.0.4 to 18.0.5 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.4...v18.0.5) Updates `better-auth` from 1.7.6 to 1.7.7 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/better-auth) Updates `lucide-react` from 1.48.0 to 1.50.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.50.0/packages/lucide-react) Updates `posthog-js` from 1.434.17 to 1.435.7 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.434.17...posthog-js@1.435.7) Updates `posthog-node` from 5.54.1 to 5.55.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.55.0/packages/node) Updates `eslint-config-next` from 16.1.7 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next) --- updated-dependencies: - dependency-name: dotenv dependency-version: 18.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: better-auth dependency-version: 1.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: posthog-js dependency-version: 1.435.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: posthog-node dependency-version: 5.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.3.8 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

jason301c merged commit 6586e3c into main Oct 5, 2026
2 checks passed

jason301c deleted the dependabot/npm_and_yarn/minor-and-patch-cfbedbb8be branch October 5, 2026 15:33

Navigation Menu

Repository navigation

Bump the minor-and-patch group with 6 updates - #49

Bump the minor-and-patch group with 6 updates#49
jason301c merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-cfbedbb8be

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

18.0.5 (2026-09-30)

Changed

v1.7.7

better-auth

Bug Fixes

@better-auth/oauth-provider

Features

@better-auth/drizzle-adapter

Bug Fixes

@better-auth/kysely-adapter

Bug Fixes

Contributors

1.7.7

Patch Changes

Version 1.50.0

What's Changed

New Contributors

Version 1.49.0

What's Changed

New Contributors

posthog-js@1.435.7

1.435.7

Patch Changes

posthog-js@1.435.6

1.435.6

Patch Changes

posthog-js@1.435.5

1.435.5

Patch Changes

posthog-js@1.435.4

1.435.4

Patch Changes

posthog-js@1.435.3

1.435.3

Patch Changes

posthog-js@1.435.2

1.435.2

Patch Changes

posthog-node@5.55.0

5.55.0

Minor Changes

5.55.0

Minor Changes

v16.3.8

v16.3.7

Core Changes

Credits

v16.3.6

v16.3.5

v16.3.4

Credits

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading

`better-auth`

`@better-auth/oauth-provider`

`@better-auth/drizzle-adapter`

`@better-auth/kysely-adapter`