fix(deps): update production dependency minor updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@aws-sdk/client-s3 (source)	^3.1092.0 → ^3.1093.0
@aws-sdk/s3-presigned-post (source)	^3.1092.0 → ^3.1093.0
@aws-sdk/s3-request-presigner (source)	^3.1092.0 → ^3.1093.0
@nosecone/next (source)	1.4.0 → 1.9.1
@opencoredev/email-sdk (source)	^0.5.0 → ^0.6.5
fumadocs-core	16.9.3 → 16.12.0
fumadocs-ui	16.9.3 → 16.12.0
lucide-react (source)	^1.25.0 → ^1.26.0
posthog-js (source)	^1.406.2 → ^1.407.1

---

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-s3)

v3.1093.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

aws/aws-sdk-js-v3 (@​aws-sdk/s3-presigned-post)

v3.1093.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-presigned-post

aws/aws-sdk-js-v3 (@​aws-sdk/s3-request-presigner)

v3.1093.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

arcjet/arcjet-js (@​nosecone/next)

v1.9.1

Compare Source

🧹 Miscellaneous Chores

• @​nosecone/next: Synchronize arcjet-js versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.9.0 to 1.9.1

v1.9.0

Compare Source

✅ Continuous Integration

• publish: pass dist-tag via --tag and drop publishConfig.tag (#​6133) (a429662)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.8.0 to 1.9.0

v1.8.0

Compare Source

🚀 New Features

• publish 1.8.0 overtop of erroneously published 1.8.0-rc.0 (#​6132) (3929316)

🧹 Miscellaneous Chores

• modernize build tooling (#​6093) (48b89ea)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.7.0 to 1.8.0

v1.7.0

Compare Source

🚀 New Features

• publish 1.7.0 overtop of erroneously published 1.7.0-rc.1 (#​6125) (2d239c5)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.6.1 to 1.7.0
  • devDependencies
    • @​arcjet/eslint-config bumped from 1.6.1 to 1.7.0
    • @​arcjet/rollup-config bumped from 1.6.1 to 1.7.0

v1.6.1

Compare Source

🧹 Miscellaneous Chores

• @​nosecone/next: Synchronize arcjet-js versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.6.0 to 1.6.1
  • devDependencies
    • @​arcjet/eslint-config bumped from 1.6.0 to 1.6.1
    • @​arcjet/rollup-config bumped from 1.6.0 to 1.6.1

v1.6.0

Compare Source

🚀 New Features

• nosecone-next: add nonce API to get the CSP nonce (#​6109) (165dc49)
• require Node.js >=22.21.0 and drop EOL Node.js 20 (#​6090) (d002118)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.5.0 to 1.6.0
  • devDependencies
    • @​arcjet/eslint-config bumped from 1.5.0 to 1.6.0
    • @​arcjet/rollup-config bumped from 1.5.0 to 1.6.0

v1.5.0

Compare Source

🔨 Build System

• deps-dev: bump next from 16.2.4 to 16.2.6 (#​6029) (dcf85e1)
• deps-dev: bump next from 16.2.4 to 16.2.6 in /arcjet-next (#​6028) (082c20f)
• deps-dev: bump next from 16.2.4 to 16.2.6 in /nosecone-next (#​6027) (29f3de1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • nosecone bumped from 1.4.0 to 1.5.0
  • devDependencies
    • @​arcjet/eslint-config bumped from 1.4.0 to 1.5.0
    • @​arcjet/rollup-config bumped from 1.4.0 to 1.5.0

opencoredev/email-sdk (@​opencoredev/email-sdk)

v0.6.5

Compare Source

Patch Changes

• 5614c4c: Add the Lettermint adapter (@opencoredev/email-sdk/lettermint) for Lettermint's European transactional email API. It posts the normalized EmailMessage to POST /v1/send over fetch, authenticates with the x-lettermint-token header, base64-encodes attachments, maps a single normalized tag plus string metadata, and forwards idempotencyKey as the Idempotency-Key header. An optional route targets a specific Lettermint route, and more than one tag fails fast with an EmailValidationError.

v0.6.4

Compare Source

Patch Changes

• 3ca47bb: Add the Primitive adapter (@opencoredev/email-sdk/primitive) for Primitive's email API for AI agents. It posts the normalized EmailMessage to POST /v1/send-mail over fetch, base64-encodes attachments, and forwards idempotencyKey as Primitive's Idempotency-Key header. Primitive's send API targets a single recipient and has no CC, BCC, reply-to, custom headers, tags, or metadata, so the adapter rejects those fields — and a second recipient — up front instead of silently dropping them, consistent with the SDK's fail-fast field support.

v0.6.3

Compare Source

Patch Changes

• 3c520c9: Add the JetEmail adapter (@opencoredev/email-sdk/jetemail) for the JetEmail transactional email API. It maps CC, BCC, reply-to, custom headers, and base64 attachments, forwards idempotencyKey as JetEmail's Idempotency-Key header, and fails fast with a clear error when from is missing a display name (JetEmail requires the "Name <email>" form). Tags and metadata are rejected before the request, consistent with the SDK's fail-fast field support.

v0.6.2

Compare Source

Patch Changes

• 9c8ff24: Reject SMTP envelope addresses and header names that contain control characters, whitespace, or angle brackets before connecting. This closes an SMTP command/header injection vector where a crafted recipient address or header name could smuggle extra SMTP commands or headers into the session.

v0.6.1

Compare Source

Patch Changes

• c80935f: Add the Convex Email component package with durable queued sends, retries, fallback adapters, idempotency, webhook ingestion, and test-mode delivery controls.

  Ship the component alongside a patch SDK release so the docs, package entrypoints, and provider surface move forward as 0.6.1 instead of a larger version jump.

v0.6.0

Compare Source

Minor Changes

• 4db1cd7: Add an official Iterable adapter for target campaign email sends.
• 2b1fbf1: Add the Sequenzy transactional email adapter, CLI support, docs, tests, and a local API-auth smoke check.

lucide-icons/lucide (lucide-react)

v1.26.0

Compare Source

PostHog/posthog-js (posthog-js)

v1.407.1

Compare Source

1.407.1

Patch Changes

• #​4218 33f0bd7 Thanks @​marandaneto! - Send ISO feature flag timestamps in request bodies, use numeric sent_at query timestamps for capture POSTs, and preserve _ cache busting for dynamic GET requests.
  (2026-07-23)

v1.407.0

Compare Source

1.407.0

Minor Changes

• #​4222 0f2407b Thanks @​turnipdabeets! - feat: add a default-value option to isFeatureEnabled

  isFeatureEnabled(key, { defaultValue: false }) now returns the given default when the flag has no value — flags not loaded yet, or no flag with that key — and the return type narrows to boolean. The option name is the same in posthog-js, posthog-js-lite, and posthog-react-native. Without defaultValue, behavior is unchanged: boolean | undefined. (2026-07-22)

Patch Changes

• #​4203 90e7483 Thanks @​posthog! - fix(conversations): let users start a new conversation while a ticket is still open

  The support widget now surfaces the ticket list navigation (and its "New conversation"
  button) whenever the user has any ticket, instead of only when they have multiple tickets
  or a single resolved one. Previously a user sitting on one open, unresolved ticket was
  locked into that conversation with no way to raise a second issue. (2026-07-22)

• #​4221 da6e082 Thanks @​posthog! - fix(exception-autocapture): don't throw when the page's onerror handler is non-callable

  The wrapped window.onerror, window.onunhandledrejection, and console.error handlers
  chained to the page's original handler using optional chaining, which only guards against
  null/undefined. When a page had one of these set to a truthy non-callable value (e.g.
  via Object.defineProperty, or clobbered by another script/extension), our wrapper threw a
  TypeError from inside its own handler. We now check the original handler is actually
  callable before invoking it and fall back to false otherwise. (2026-07-22)

• #​4209 569fc62 Thanks @​posthog! - Session recording no longer emits an uncaught TypeError: Illegal invocation from the input observer's synchronous native-setter call. The previous fix only guarded the deferred hooked setter; the synchronous original.set.call(this, value) still ran with a non-native this (a proxy, custom element, or cross-realm object) and threw inside the host page's own assignment. The recorder now probes the native getter — which fails the same internal-slot brand check as the setter — before forwarding: a non-native this is skipped, so the recorder no longer re-throws from its own frame, while genuine elements (including file inputs that legitimately throw on a programmatic value) keep their native behavior. The input event handler and getInputType are similarly guarded against reading native accessors on a non-native this.
  (2026-07-22)

• #​4068 d5e1188 Thanks @​posthog! - Fix event-triggered surveys re-displaying in a fresh session without their trigger firing. A non-repeatable event/action-triggered survey that was shown but never dismissed or answered had its activation persisted indefinitely, so it kept being treated as "triggered" on later page loads. The persisted activation is now scoped to the triggering session: it still survives a reload within that session, but a brand-new session drops it until the trigger fires again. Repeatable surveys are unaffected.
  (2026-07-22)

• #​4205 de3ad61 Thanks @​posthog! - Warn when session recording masking options in posthog.init shadow the project-level "Privacy and masking" setting. Client-side masking still intentionally takes precedence, but previously the override was silent — a developer could set masking in the dashboard and see it quietly ignored because their SDK config diverged. The recorder now logs a console warning (in debug mode) naming the diverging fields so the precedence is self-explaining.
  (2026-07-22)

• Updated dependencies [0f2407b]:

  • @​posthog/core@​1.45.0
  • @​posthog/types@​1.398.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 9am every weekday,before 5am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vazen-docs	Ready	Preview, Comment	Jul 28, 2026 12:06pm
vazen-web	Ready	Preview, Comment	Jul 28, 2026 12:06pm