Skip to content

build(deps): bump the production-dependencies group across 1 directory with 8 updates - #7

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-92e64c9875
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-92e64c9875

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •

Copy link
Copy Markdown

Bumps the production-dependencies group with 8 updates in the / directory:

Package From To
zod 3.25.76 4.6.5
@clerk/backend 3.17.1 3.21.0
@clerk/react 6.15.1 6.17.3
@xyflow/react 12.11.6 12.12.0
lucide-react 1.33.0 1.48.0
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
@modelcontextprotocol/sdk 1.30.0 1.31.0

Updates zod from 3.25.76 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
  • 0f3f5ee 4.6.5
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Updates @clerk/backend from 3.17.1 to 3.21.0

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.20.1

Patch Changes

@​clerk/backend@​3.19.0

Minor Changes

    • Fixes an issue where OAuth token validation did not correctly validate audience (aud) claims. Previous usages that specified audience were falsely passing. This upgrade will cause those to start rejecting if the audience indeed does not match the OAuth token's aud claim, including cases where the aud claim is omitted. (#9724) by @​thiskevinwang

    • Adds an optional audience parameter to idPOAuthAccessToken.verify()

  • Expose the optional aud audience on verified OAuth access tokens. (#9585) by @​thiskevinwang

Patch Changes

Changelog

Sourced from @​clerk/backend's changelog.

3.21.0

Minor Changes

  • verifyWebhook() now returns the event's top-level timestamp (milliseconds since epoch when the event occurred) and instance_id, so webhook handlers can order events and identify the instance that sent them. (#9906) by @​manovotny

Patch Changes

3.20.1

Patch Changes

3.20.0

Minor Changes

  • Add an optional nameQuery filter to oauthApplications.list() to search OAuth applications by name or exact client ID. (#9904) by @​austincalvelage

Patch Changes

3.19.0

Minor Changes

    • Fixes an issue where OAuth token validation did not correctly validate audience (aud) claims. Previous usages that specified audience were falsely passing. This upgrade will cause those to start rejecting if the audience indeed does not match the OAuth token's aud claim, including cases where the aud claim is omitted. (#9724) by @​thiskevinwang

    • Adds an optional audience parameter to idPOAuthAccessToken.verify()

  • Expose the optional aud audience on verified OAuth access tokens. (#9585) by @​thiskevinwang

Patch Changes

... (truncated)

Commits

Updates @clerk/react from 6.15.1 to 6.17.3

Release notes

Sourced from @​clerk/react's releases.

@​clerk/react@​6.17.2

Patch Changes

@​clerk/react@​6.17.0

Minor Changes

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @​mauricioabreu

Patch Changes

@​clerk/react@​6.16.1

Patch Changes

@​clerk/react@​6.16.0

Minor Changes

  • Introduce self-serve Directory Sync (SCIM) capabilities and related functionality. (#9590) by @​kalafut

Patch Changes

  • Update docs deep links in JSDoc comments to match clerk.com's new heading anchors (#get-token is now #gettoken, #o-auth-strategy is now #oauthstrategy, and so on). (#9520) by @​manovotny

  • Updated dependencies [b5a3abe, ddf9afc, 39782e3]:

    • @​clerk/shared@​4.32.0
Changelog

Sourced from @​clerk/react's changelog.

6.17.3

Patch Changes

6.17.2

Patch Changes

6.17.1

Patch Changes

6.17.0

Minor Changes

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @​mauricioabreu

Patch Changes

6.16.1

Patch Changes

6.16.0

Minor Changes

  • Introduce self-serve Directory Sync (SCIM) capabilities and related functionality. (#9590) by @​kalafut

Patch Changes

... (truncated)

Commits

Updates @xyflow/react from 12.11.6 to 12.12.0

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.0

Minor Changes

  • #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

Changelog

Sourced from @​xyflow/react's changelog.

12.12.0

Minor Changes

  • #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

Commits

Updates lucide-react from 1.33.0 to 1.48.0

Release notes

Sourced from lucide-react's releases.

Version 1.48.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.47.0...1.48.0

Version 1.47.0

What's Changed

New Contributors

... (truncated)

Commits

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 2, 2026
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.6.5` |
| [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.17.1` | `3.21.0` |
| [@clerk/react](https://github.com/clerk/javascript/tree/HEAD/packages/react) | `6.15.1` | `6.17.3` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.6` | `12.12.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.48.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.31.0` |



Updates `zod` from 3.25.76 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.6.5)

Updates `@clerk/backend` from 3.17.1 to 3.21.0
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.21.0/packages/backend)

Updates `@clerk/react` from 6.15.1 to 6.17.3
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/react@6.17.3/packages/react)

Updates `@xyflow/react` from 12.11.6 to 12.12.0
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.0/packages/react)

Updates `lucide-react` from 1.33.0 to 1.48.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.48.0/packages/lucide-react)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.31.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.31.0)

---
updated-dependencies:
- dependency-name: "@clerk/backend"
  dependency-version: 3.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@clerk/react"
  dependency-version: 6.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@xyflow/react"
  dependency-version: 12.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-92e64c9875 branch from 7606c60 to 65b902b Compare October 2, 2026 20:32
@dependabot @github

dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 9, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-92e64c9875 branch October 9, 2026 11:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants