Skip to content

build(deps): Bump the npm-production group across 1 directory with 6 updates - #129

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-64b0cd01a8
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-64b0cd01a8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the npm-production group with 6 updates in the / directory:

Package From To
better-auth 1.6.30 1.7.4
next 16.3.4 16.3.5
pg-boss 12.30.0 12.31.0
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
zod 4.4.3 4.6.4

Updates better-auth from 1.6.30 to 1.7.4

Release notes

Sourced from better-auth's releases.

v1.7.4

better-auth

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
  • Added support for additional session fields in testUtils auth helpers. (#11217)
  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

  • Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed multibyte session data storage in Expo SecureStore. (#11238)
  • Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

  • Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.4

Patch Changes

  • #11205 3f890eb Thanks @​bytaesu! - Support Vitest 5 in the testing utilities while retaining support for previously supported Vitest versions.

  • #11224 c1756a2 Thanks @​bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

  • #11217 9b9638e Thanks @​onmax! - Allow testUtils auth helpers to accept additional session fields through the session option, including required fields without defaults and per-session overrides of configured defaults.

  • Updated dependencies [3ff842a, b905bfe, c1756a2]:

    • @​better-auth/core@​1.7.4
    • @​better-auth/drizzle-adapter@​1.7.4
    • @​better-auth/kysely-adapter@​1.7.4
    • @​better-auth/memory-adapter@​1.7.4
    • @​better-auth/mongo-adapter@​1.7.4
    • @​better-auth/prisma-adapter@​1.7.4
    • @​better-auth/telemetry@​1.7.4

1.7.3

Patch Changes

  • #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

  • #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

  • #11120 7ec7146 Thanks @​onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

  • #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

  • #11188 c47b765 Thanks @​bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

  • #11084 2d5c63d Thanks @​bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

  • #11147 a9d8c12 Thanks @​bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

  • #10988 9fc7498 Thanks @​bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

  • #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

    Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

  • #11069 0bb0dbf Thanks @​bytaesu! - Improve dynamic organization role permission check performance.

  • #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

    If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

  • #10978 5fe5bc2 Thanks @​BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

... (truncated)

Commits

Updates next from 16.3.4 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)
Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • See full diff in compare view

Updates pg-boss from 12.30.0 to 12.31.0

Release notes

Sourced from pg-boss's releases.

12.31.0

What's Changed

Schema version: 41 (a migration runs on upgrade — see Upgrading).

  • Schedules gain RRULE expression format, can catch up after an outage, and can be read back without a query of your own.
  • Bun support

Highlights

Schedules take RRULE expressions

schedule() now accepts a recurrence rule (RFC 5545) anywhere a cron expression goes, for the schedules cron cannot express — the last Friday of the month, every second Monday, a schedule that stops on a date or after a number of runs.

// 5pm on the last Friday of the month, Chicago time
await boss.schedule('report', 'FREQ=MONTHLY;BYDAY=-1FR;BYHOUR=17', null, { tz: 'America/Chicago' })

The expression is either the rule on its own or the recurrence lines of a calendar entry — DTSTART, RRULE, and optional RDATE and EXDATE:

await boss.schedule('standup', [
  'DTSTART;TZID=Europe/Berlin:20260901T090000',
  'RRULE:FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR',
  'EXDATE;TZID=Europe/Berlin:20261224T090000'
].join('\n'))

An expression carrying FREQ=, or a line opening with an iCalendar property, is a rule; everything else is cron, which cannot be mistaken for one since no cron field contains =, : or ;. schedule() decides once and stores the answer in the schedule table's new kind column, so an expression is never validated as one format and evaluated as the other. getSchedules() returns it.

schedule() rejects the rules a parser would quietly read differently than they were meant, such as an unknown part or a value out of range, and the combinations RFC 5545 forbids outright. A finite rule with nothing left to send is also rejected rather than stored.

Schedules can catch up after an outage

When the Timekeeper does a schedule check, the pass sends the occurrences of the preceding 60 seconds, which is compared against the history to see if a job was missed. The new missed option decides what a schedule does about that.

missed What a schedule sends for a gap
skip Nothing. The default, and what every earlier release did
once One job, for the most recent missed occurrence, however many were missed
// a nightly report reads the current state of the world, so three missed nights are one report
await boss.schedule('report', '0 3 * * *', null, { missed: 'once' })

Worth knowing before choosing once: a caught-up job is indistinguishable from an on-time one, it names the most recent missed occurrence rather than each one, and it can arrive beside the occurrence due now — two jobs, filed under two minutes, unless queue policy or a singletonKey collapses them. The option applies to both expression formats.

New scheduling funcitons: getSchedule() and previewSchedule()

... (truncated)

Commits
  • 00e2dd2 added backend options to sql utils and test suite updates
  • b0cebbe post merge updates and fixes
  • 3f56ea6 Merge pull request #898 from kibertoad/feat/scheduling
  • 63daa62 ci: deploy docs on release publish instead of master merge
  • 3315d8c Merge pull request #900 from timgit/fix/bun-array-params
  • a802e37 refactor(schedule): drop the rule cache and the toad-cache dependency
  • 9d87a00 fix(schedule): let the v41 migration run on CockroachDB
  • 3133b36 fix bun ci db provisioning
  • 5cb1f36 added support for listen notify in bun
  • 1f9566a fix(schedule): make the empty-stretch regression tests fail on the old read
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Commits

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

…updates

Bumps the npm-production group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.30` | `1.7.4` |
| [next](https://github.com/vercel/next.js) | `16.3.4` | `16.3.5` |
| [pg-boss](https://github.com/timgit/pg-boss) | `12.30.0` | `12.31.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.4` |



Updates `better-auth` from 1.6.30 to 1.7.4
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.4/packages/better-auth)

Updates `next` from 16.3.4 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.4...v16.3.5)

Updates `pg-boss` from 12.30.0 to 12.31.0
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](timgit/pg-boss@12.30.0...12.31.0)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `zod` from 4.4.3 to 4.6.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.4)

---
updated-dependencies:
- dependency-name: better-auth
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: next
  dependency-version: 16.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: pg-boss
  dependency-version: 12.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: zod
  dependency-version: 4.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from SafetyMP as a code owner September 16, 2026 13:08
@vercel

vercel Bot commented Sep 16, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
autonomous-ehs-management Error Error Sep 16, 2026 1:10pm UTC

@dependabot @github

dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 20, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-production-64b0cd01a8 branch September 20, 2026 10:24

This branch had an error being deployed

1 failed deployment
Preview — e27395c1 Deployed Sep 16, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants