Skip to content

build(deps): bump the dependencies group across 1 directory with 20 updates - #187

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-e9aa82376b
Open

build(deps): bump the dependencies group across 1 directory with 20 updates#187
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-e9aa82376b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 20 updates in the / directory:

Package From To
just-bash 3.4.2 3.6.0
lucide-react 1.47.0 1.58.0
zod 4.6.5 4.6.7
@modelcontextprotocol/sdk 1.30.0 1.32.1
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
better-auth 1.7.5 1.7.10
@next/env 16.3.5 16.4.2
execa 10.0.1 10.1.1
fs-extra 11.4.0 11.4.1
@shikijs/rehype 4.4.3 4.5.0
katex 0.18.7 0.19.0
shiki 4.4.3 4.5.0
next 16.3.5 16.4.2
mdast-util-from-markdown 2.0.3 2.1.0
mdast-util-to-markdown 2.1.2 2.2.0
micromark-factory-space 2.0.1 2.1.0
micromark-util-types 2.0.2 2.0.3
@base-ui/react 1.8.0 1.9.0
react-resizable-panels 4.12.4 4.14.5

Updates just-bash from 3.4.2 to 3.6.0

Release notes

Sourced from just-bash's releases.

just-bash@3.6.0

Minor Changes

  • #377 cc35fab Thanks @​trieloff! - Add the mktemp command. It creates a unique temporary file (mode 0600) or directory (-d, mode 0700) and prints its path, supporting -p/--tmpdir[=DIR], -t, -u/--dry-run, -q/--quiet, --suffix=SUFF, GNU-style TEMPLATE expansion, --help and --version. The default directory is $TMPDIR when set and non-empty, otherwise /tmp, so sandboxed embedders that point TMPDIR at a writable directory get a usable path. Random name characters come from the platform CSPRNG (crypto.getRandomValues), and existing paths are never returned.

    Adds an optional createExclusive(path, { mode, directory }) method to IFileSystem, which creates an entry only if the name is free and applies the mode at creation time rather than via a follow-up chmod. All built-in filesystems implement it. The member is optional, so external IFileSystem implementations remain source compatible; mktemp reports that such a filesystem cannot create atomically rather than substituting a non-atomic sequence. The accompanying CreateExclusiveOptions type is exported alongside the existing MkdirOptions/RmOptions.

  • #409 5d19cc3 Thanks @​trieloff! - Add the yes command. yes [STRING]... repeats a line built from its operands (y when there are none), so yes | head -3 and yes | some-prompt work instead of failing with exit 127. Because pipeline stages here run to completion rather than streaming, the stream is finite: it ends after executionLimits.maxLoopIterations lines, or earlier if the repeated line would exceed the output size limit.

Patch Changes

  • #445 7313062 Thanks @​trieloff! - interpreter: preserve complete associative-array values in declare -A compound assignments

    Quoted values containing whitespace were reconstructed without quoting before the declare builtin parsed them, so every value was silently truncated at its first space. Associative-array declarations now retain whitespace and other quoted content.

  • #346 52a5617 Thanks @​iroiro147! - fs: keep the Buffer-less fromBuffer fallback under the argument limit

    Without Buffer (for example in a Chrome extension service worker), fromBuffer converted base64, binary and latin1 content by spreading 64KB chunks into String.fromCharCode, which can exceed the engine's argument limit and throw RangeError: Maximum call stack size exceeded on a 64KB cat. The fallback now converts in 8KB chunks.

  • #443 a36c324 Thanks @​RyanGarber! - Handle accessor descriptors when installing module defense-in-depth proxies on Bun, preserving blocking behavior and original descriptors on teardown.

  • #414 31ac823 Thanks @​mutewinter! - find: report a directory it cannot read and keep going

    A readdir failure inside the traversal threw out of the whole search, so one unreadable directory ended find with no results: exit 1 and find: EACCES: permission denied, scandir '<path>' on its own, and exit 0 with nothing at all once piped through head with stderr silenced. Every macOS home directory holds such a directory (.Trash, several under Library), so a recursive find over a mounted home directory never returned anything.

    GNU find names the directory on stderr, continues with everything else, and exits 1 at the end. It now does the same here. The message is find: <path>: Permission denied, with the phrase taken from the errno alone, so nothing from the underlying error's text reaches the output. A failure that is not one of the errnos a directory read can produce (a cancellation, an execution limit, a filesystem policy refusal) still ends the search as before.

    Messages are emitted in traversal order beside the node's own output, whatever order the parallel batch settled in, and a failed read still counts toward the trace's readdirCalls and readdirTime.

  • #384 e0cca16 Thanks @​taoche! - Match real jq behavior for to_entries on arrays (numeric-key entries instead of null) and tonumber on empty or whitespace-only strings (error instead of 0).

  • #417 017a911 Thanks @​trieloff! - interpreter: give a loop left via break/continue status 0 instead of the last command's

    break and continue are builtins that return 0, and they are the last command a loop body runs. A loop exited through them reported the status of whatever ran before the break instead:

    while :; do false; break; done; echo $?            # was 1, bash says 0
for i in 1; do false; break; done; echo $?         # was 1, bash says 0
for i in 1 2; do false; continue; done; echo $?    # was 1, bash says 0

    All four loop forms were affected — for, C-style for, while, until — as was a break/continue in a while condition and a multi-level break 2 unwinding through an enclosing loop.

    The stale status is invisible until something reads $?, and under set -e the phantom failing loop ends the script with no output and no diagnostic:

    set -euo pipefail
while :; do
  [ 5 -eq 0 ] && break     # correctly exempt from errexit as the left operand of &&
  break

... (truncated)

Commits
  • 7537a26 chore: release (#504)
  • 632090a chore(deps): update undici and smol-toml to patched versions (#509)
  • e0cca16 Fix jq to_entries on arrays and tonumber on empty strings (#384)
  • d91dce8 refactor(expansion): share pattern-removal compilation (#518)
  • 2d79d8b refactor(fs): simplify mount storage and routing (#517)
  • e9bc741 chore(network): remove unused request-owned DNS transport (#516)
  • f77efbd chore: make CONTRIBUTING.md the source of truth for commands and labels (#511)
  • d959d9f fix(curl): support request data from stdin (#411)
  • 9503e06 fix(expansion): assign array-valued parameter defaults (#519)
  • 701f8e5 fix(expansion): reject default assignment to positional parameters (#520)
  • Additional commits viewable in compare view

Updates lucide-react from 1.47.0 to 1.58.0

Release notes

Sourced from lucide-react's releases.

Version 1.58.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

Version 1.57.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

... (truncated)

Commits
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
  • 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
  • e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
  • f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
  • See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why
Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates better-auth from 1.7.5 to 1.7.10

Release notes

Sourced from better-auth's releases.

v1.7.10

better-auth

Bug Fixes

  • Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
  • Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
  • Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
  • Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
  • Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
  • Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

  • Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
  • Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
  • Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
  • Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
  • Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
  • Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
  • Improved errors for unknown OAuth client_id values to say client not found. (#11799)
  • Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
  • Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
  • Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
  • Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

  • Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.10

Patch Changes

  • #11393 eebd47a Thanks @​breken-ai! - If you use the lastLoginMethod plugin with oneTap, signing in through Google One Tap now records "google", the same value as signing in with the Google button. Before, a One Tap sign-in recorded nothing: the better-auth.last_used_login_method cookie kept its previous value or stayed unset, and so did user.lastLoginMethod with storeInDatabase.

    If your customResolveMethod includes a /one-tap/callback → "google" workaround, remove that mapping; keep the resolver if it handles other routes.

  • #11821 09d07e6 Thanks @​gustavovalverde! - The Google One Tap prompt (authClient.oneTap() without button) no longer calls getSkippedReason(), which Google's FedCM migration guide says to remove. Before, it called it under any promptOptions.fedCM setting.

    A skipped prompt now ends the flow and calls onPromptNotification right away instead of retrying. Google doesn't report why a prompt was skipped, and a prompt the user closed stays hidden for Google's cooldown period, so the retries could not bring it back. Dismissed prompts still retry as before.

    Google Identity Services still logs its FedCM migration warning, because it does so whenever prompt() receives a listener. The plugin needs the listener to track dismissals and skips, so the warning is expected and safe to ignore.

  • #11819 eaecb72 Thanks @​gustavovalverde! - Google One Tap now applies your socialProviders.google.mapProfileToUser and custom getUserInfo, the same as the standard Google sign-in. Before, One Tap ignored both and always stored the token's name, email, email_verified, and picture claims.

    If you configured either one, users created through One Tap now get the fields it returns, including any extra fields such as a first name from given_name. Returning users are updated from it on each One Tap sign-in when socialProviders.google.overrideUserInfoOnSignIn is on, and so are existing users that One Tap links when account.accountLinking.updateUserInfoOnLink is on. Check that your mapper suits One Tap users too.

    If you set socialProviders.google.overrideUserInfoOnSignIn, One Tap sign-ins now update returning users' name, image, and email from Google, as the redirect sign-in already does.

    Setups that configure none of these, including oneTap({ clientId }) with no Google provider, are unaffected.

  • #11820 88c9a37 Thanks @​gustavovalverde! - If you set autoSelect or cancelOnTapOutside on oneTapClient(), the One Tap prompt and the Sign in with Google button now use them. Before, only values passed to authClient.oneTap() took effect, so with autoSelect: true on the plugin, returning users still had to pick an account. Values passed to oneTap() still override the plugin's. Apps that set these options only on oneTap(), or not at all, are unaffected.

  • #11696 0cf1f7c Thanks @​drewsephski! - You can now import the One Tap plugin from better-auth/plugins/one-tap, as you can for other plugins. Previously this import failed with a "not exported" error. Imports from better-auth/plugins and better-auth/client/plugins are unchanged.

  • #11822 414e845 Thanks @​gustavovalverde! - You can now import the Captcha and OpenAPI plugins from better-auth/plugins/captcha and better-auth/plugins/open-api, as you can for other plugins. Previously these imports failed with a "not exported" error. Imports from better-auth/plugins are unchanged.

    If your TypeScript config uses "moduleResolution": "node" (or node10), better-auth/plugins/multi-session and better-auth/test now resolve their types. Previously TypeScript reported that it could not find their declarations. Projects using bundler, node16, or nodenext resolution are unaffected.

  • Updated dependencies [fedd055, bbd0a19, 99cdfe7]:

    • @​better-auth/core@​1.7.10
    • @​better-auth/mongo-adapter@​1.7.10
    • @​better-auth/drizzle-adapter@​1.7.10
    • @​better-auth/kysely-adapter@​1.7.10
    • @​better-auth/memory-adapter@​1.7.10
    • @​better-auth/prisma-adapter@​1.7.10
    • @​better-auth/telemetry@​1.7.10

1.7.9

Patch Changes

  • #11766 6edaa61 Thanks @​bytaesu! - An onAPIError.onError handler that throws or rejects no longer fails the request or causes an unhandled promise rejection. The error is logged and the original error response is returned. Async handlers now finish before the response is sent.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.9
    • @​better-auth/drizzle-adapter@​1.7.9
    • @​better-auth/kysely-adapter@​1.7.9
    • @​better-auth/memory-adapter@​1.7.9

... (truncated)

Commits
  • b734a41 chore: release v1.7.10 (#11795)
  • eebd47a fix(last-login-method): record Google One Tap sign-ins (#11393)
  • eaecb72 fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo (#...
  • 414e845 fix(better-auth): keep package subpaths in sync with build entries (#11822)
  • 88c9a37 fix(one-tap): apply plugin-level autoSelect and cancelOnTapOutside (#11820)
  • 09d07e6 fix(one-tap): stop calling prompt moment methods unsupported under FedCM (#11...
  • 0cf1f7c fix(one-tap): add the better-auth/plugins/one-tap subpath export (#11696)
  • d2a5f83 chore: release v1.7.9 (#11761)
  • dbca311 test: fix test names in bearer and organization (#11768)
  • c03ced5 chore: bump @biomejs/biome (#11760)
  • Additional commits viewable in compare view

Updates @next/env from 16.3.5 to 16.4.2

Release notes

Sourced from @​next/env's releases.

v16.4.2

What's Changed

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

High:

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

@dependabot
build(deps): bump the dependencies group across 1 directory with 20 u…
6aceddc 
…pdates

Bumps the dependencies group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [just-bash](https://github.com/vercel-labs/just-bash) | `3.4.2` | `3.6.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.47.0` | `1.58.0` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.5` | `1.7.10` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.3.5` | `16.4.2` |
| [execa](https://github.com/sindresorhus/execa) | `10.0.1` | `10.1.1` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.4.0` | `11.4.1` |
| [@shikijs/rehype](https://github.com/shikijs/shiki/tree/HEAD/packages/rehype) | `4.4.3` | `4.5.0` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.18.7` | `0.19.0` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.4.3` | `4.5.0` |
| [next](https://github.com/vercel/next.js) | `16.3.5` | `16.4.2` |
| [mdast-util-from-markdown](https://github.com/syntax-tree/mdast-util-from-markdown) | `2.0.3` | `2.1.0` |
| [mdast-util-to-markdown](https://github.com/syntax-tree/mdast-util-to-markdown) | `2.1.2` | `2.2.0` |
| [micromark-factory-space](https://github.com/micromark/micromark) | `2.0.1` | `2.1.0` |
| [micromark-util-types](https://github.com/micromark/micromark) | `2.0.2` | `2.0.3` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.8.0` | `1.9.0` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.4` | `4.14.5` |



Updates `just-bash` from 3.4.2 to 3.6.0
- [Release notes](https://github.com/vercel-labs/just-bash/releases)
- [Commits](https://github.com/vercel-labs/just-bash/compare/just-bash@3.4.2...just-bash@3.6.0)

Updates `lucide-react` from 1.47.0 to 1.58.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.58.0/packages/lucide-react)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.1)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `better-auth` from 1.7.5 to 1.7.10
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/better-auth)

Updates `@next/env` from 16.3.5 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/next-env)

Updates `execa` from 10.0.1 to 10.1.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v10.0.1...v10.1.1)

Updates `fs-extra` from 11.4.0 to 11.4.1
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.4.0...11.4.1)

Updates `@shikijs/rehype` from 4.4.3 to 4.5.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/rehype)

Updates `katex` from 0.18.7 to 0.19.0
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.18.7...v0.19.0)

Updates `shiki` from 4.4.3 to 4.5.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/shiki)

Updates `next` from 16.3.5 to 16.4.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.5...v16.4.2)

Updates `mdast-util-from-markdown` from 2.0.3 to 2.1.0
- [Release notes](https://github.com/syntax-tree/mdast-util-from-markdown/releases)
- [Commits](syntax-tree/mdast-util-from-markdown@2.0.3...2.1.0)

Updates `mdast-util-to-markdown` from 2.1.2 to 2.2.0
- [Release notes](https://github.com/syntax-tree/mdast-util-to-markdown/releases)
- [Commits](syntax-tree/mdast-util-to-markdown@2.1.2...2.2.0)

Updates `micromark-factory-space` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/micromark/micromark/releases)
- [Commits](https://github.com/micromark/micromark/compare/micromark-build@2.0.1...micromark-factory-space@2.1.0)

Updates `micromark-util-types` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/micromark/micromark/releases)
- [Commits](https://github.com/micromark/micromark/compare/micromark-util-types@2.0.2...micromark-util-types@2.0.3)

Updates `@base-ui/react` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.9.0/packages/react)

Updates `react-resizable-panels` from 4.12.4 to 4.14.5
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.4...4.14.5)

---
updated-dependencies:
- dependency-name: just-bash
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: lucide-react
  dependency-version: 1.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: better-auth
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@next/env"
  dependency-version: 16.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: execa
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fs-extra
  dependency-version: 11.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@shikijs/rehype"
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: katex
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: shiki
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: next
  dependency-version: 16.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mdast-util-from-markdown
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mdast-util-to-markdown
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: micromark-factory-space
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: micromark-util-types
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react-resizable-panels
  dependency-version: 4.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Oct 19, 2026 1:37pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026

This branch was successfully deployed

1 active deployment
Preview — bdbd9ade Deployed Oct 19, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants