Skip to content

build(deps): bump the npm-minor-and-patch group across 1 directory with 22 updates - #22

Merged
Orazen merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-b1986833c3
Sep 19, 2026
Merged

build(deps): bump the npm-minor-and-patch group across 1 directory with 22 updates#22
Orazen merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-b1986833c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 22 updates in the / directory:

Package From To
@lottiefiles/dotlottie-react 0.19.15 0.19.16
@trycua/cua-driver 0.20.0 0.28.2
better-auth 1.7.1 1.7.5
framer-motion 13.1.1 13.4.0
jose 6.2.9 6.2.12
lucide-react 1.47.0 1.46.0
posthog-js 1.415.6 1.433.7
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.4 19.3.0
react-router-dom 7.18.2 7.18.4
tailwind-merge 3.6.0 3.7.0
zod 4.4.3 4.6.5
@oxlint/plugins 1.78.0 1.83.0
@playwright/test 1.62.1 1.63.0
@trycua/cua-driver-darwin-x64 0.20.0 0.28.2
@types/react 19.2.18 19.3.0
@types/react-dom 19.2.4 19.3.0
electron 44.4.3 44.4.1
oxlint 1.78.0 1.83.0
playwright 1.62.1 1.63.0
wrangler 4.123.0 4.133.0
yaml 2.9.0 2.9.1

Updates @lottiefiles/dotlottie-react from 0.19.15 to 0.19.16

Release notes

Sourced from @​lottiefiles/dotlottie-react's releases.

@​lottiefiles/dotlottie-react@​0.19.16

Patch Changes

  • Updated dependencies [0874fae]
  • Updated dependencies [727add3]
    • @​lottiefiles/dotlottie-web@​0.80.0
Changelog

Sourced from @​lottiefiles/dotlottie-react's changelog.

0.19.16

Patch Changes

  • Updated dependencies [0874fae]
  • Updated dependencies [727add3]
    • @​lottiefiles/dotlottie-web@​0.80.0
Commits

Updates @trycua/cua-driver from 0.20.0 to 0.28.2

Release notes

Sourced from @​trycua/cua-driver's releases.

cua-driver-rs: v0.28.2

Cua Driver 0.28.2

Summary

This release includes 4 fixes.

Fixes

  • preserve semantic Hyprland AX scrolling. (#3820)
  • unify desktop snapshot identity and payload ownership. (#3616)
  • capture macOS desktops without relying on PATH. (#3755)
  • route background text through Hyprland input. (#3877)

Contributors

This release contains maintainer changes only.

Install

macOS and Linux:

/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"

Windows:

irm https://cua.ai/driver/install.ps1 | iex

Cua Driver ships universal macOS binaries, x86_64 and arm64 Windows builds, and Linux preview builds. Release assets also include tag-pinned installer and uninstaller scripts.

Why GitHub says “Pre-release”

GitHub's label is used only to keep this monorepo's repository-wide “Latest” pointer from switching between independently released products. A plain Cua Driver SemVer is a stable release; npm and PyPI publish it on their normal stable channels, and the installers resolve the versioned cua-driver-rs-v* releases directly.

SHA256 Checksums

c3b4423dd4290f65f03579013f2c350e5a08b03458c9ae34ac4904865ec3f833  _install-rust.sh
448fbf0f9b6ca13dc0bdd3adb0f0f8432293abb0519efd2fe77be90e816e6539  checksums.txt
818ddefa0fa8ba2ec9cba837c7aa634a4b064221c748752cf49c5b08e2c94e8c  cua-driver-rs-0.28.2-darwin-arm64.tar.gz
</tr></table>

... (truncated)

Commits
  • fc18825 chore(main): release cua-driver-rs 0.28.2 (#3821)
  • 2d8eb12 ci: make macOS E2E log filenames artifact-safe (#3893)
  • 42d764b fix(cua-driver): route background text through Hyprland input (#3877)
  • 14dd8cf docs(sandbox): drop the unreleased notice from the OSWorld on Fleet guide (#3...
  • 6be0aae chore(main): release sandbox 0.8.0 (#3840)
  • 5fcd673 fix(ci): validate attribution configuration changes against their ancestor (#...
  • d740aa8 docs: add Codex native Computer Use Windows Fleet guide (#3865)
  • 05a0358 feat(growth): restore daily reporting and campaign attribution (#7832)
  • 1c554ed test(cua-driver): isolate uninstall autostart process discovery (#3854)
  • db8ba21 feat(sandbox): OSWorld disks on Fleet via agent_type="osworld" + "Run OSWorld...
  • Additional commits viewable in compare view

Updates better-auth from 1.7.1 to 1.7.5

Release notes

Sourced from better-auth's releases.

v1.7.5

better-auth

Features

  • Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

  • Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)
  • Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)
  • Fixed MySQL index validation for existing string columns. (#11272)
  • Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

  • Fixed database option type inference outside Cloudflare Workers. (#11290)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

  • Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached. (#11161)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed lazy database initialization when using Drizzle relations. (#11263)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

  • Added database.schemaName support for direct PostgreSQL connections. (#11203)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.5

Patch Changes

  • #11283 e56c45b Thanks @​bytaesu! - Log Cloudflare Turnstile error codes and binding mismatches on the server so CAPTCHA verification failures can be diagnosed.

  • #11209 8d37cc3 Thanks @​siam923! - Remove the unused optional better-sqlite3 peer dependency to prevent installation conflicts.

  • #11272 348fc26 Thanks @​bytaesu! - Use MySQL's reported byte lengths when validating indexes on existing string columns.

  • #11203 cb627eb Thanks @​dshukertjr! - Add a database.schemaName option for direct PostgreSQL connections. When set, the adapter and the CLI qualify every statement with that schema, so auth generate writes a schema-qualified migration that creates the schema before its tables instead of relying on the connection's search_path.

  • #11270 133f6a2 Thanks @​bytaesu! - Prevent PostgreSQL migrations from treating tables in other schemas or views in the active schema as Better Auth tables.

  • Updated dependencies [e18bc83, cb627eb, dae97ed]:

    • @​better-auth/drizzle-adapter@​1.7.5
    • @​better-auth/kysely-adapter@​1.7.5
    • @​better-auth/core@​1.7.5
    • @​better-auth/memory-adapter@​1.7.5
    • @​better-auth/mongo-adapter@​1.7.5
    • @​better-auth/prisma-adapter@​1.7.5
    • @​better-auth/telemetry@​1.7.5

1.7.4

Patch Changes

  • #11205 3f890eb Thanks @​bytaesu! - Support Vitest 5 in the testing utilities while retaining support for previously supported Vitest versions.

  • #11224 c1756a2 Thanks @​bytaesu! - Add experimental.instrumentation.enabled to disable Better Auth OpenTelemetry span creation per auth instance. Instrumentation remains enabled by default and independent of usage reporting.

  • #11217 9b9638e Thanks @​onmax! - Allow testUtils auth helpers to accept additional session fields through the session option, including required fields without defaults and per-session overrides of configured defaults.

  • Updated dependencies [3ff842a, b905bfe, c1756a2]:

    • @​better-auth/core@​1.7.4
    • @​better-auth/drizzle-adapter@​1.7.4
    • @​better-auth/kysely-adapter@​1.7.4
    • @​better-auth/memory-adapter@​1.7.4
    • @​better-auth/mongo-adapter@​1.7.4
    • @​better-auth/prisma-adapter@​1.7.4
    • @​better-auth/telemetry@​1.7.4

1.7.3

Patch Changes

  • #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

  • #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

... (truncated)

Commits
  • 5468e6b chore: release v1.7.5 (#11245)
  • e56c45b fix(captcha): log Turnstile verification failures (#11283)
  • cb627eb feat(postgres): add support for custom schema name in PostgreSQL connections ...
  • 348fc26 fix(db): use reported MySQL index byte bounds (#11272)
  • b93f73d refactor(db): model migration targets by dialect (#11271)
  • 133f6a2 fix(db): use Kysely metadata for PostgreSQL schema introspection (#11270)
  • 34ad3be refactor(cookies): centralize cookie cache version validation (#11254)
  • 8d37cc3 fix(deps): remove unused better-sqlite3 peer dependency (#11209)
  • 735008f chore: release v1.7.4 (#11216)
  • 80b1d64 chore(deps): bump next (#11226)
  • Additional commits viewable in compare view

Updates framer-motion from 13.1.1 to 13.4.0

Changelog

Sourced from framer-motion's changelog.

[13.4.0] 2026-09-14

Added

  • AnimateView: View transitions for React 19.3, built on React's ViewTransition.

[13.3.0] 2026-09-14

Added

  • Hooks for Motion Editor.

Changed

  • springValue/useSpring: 80% reduction in time when retargeting.
  • animate: 10% smaller.
  • animate: 20% reduction in startup time.
  • animate: 10% reduction in per-frame JS.
  • frame: Frame scheduling 10% faster.

Fixed

  • animate: Fixed path drawing calculations.

[13.2.0] 2026-09-03

Added

  • animate.addEffect() for registering effects that lets animate drive non-DOM subjects alongside DOM elements.
  • threeEffect (motion/three) supporting Three.js objects, materials, shader uniforms, TSL uniform nodes and more.
  • vgpuEffect (motion/vgpu) supporting shared uniforms, Effect/Draw/Compute bindings ("params.time"), scene nodes, cameras, lights, materials, orbit controls, CSS colors and vector components.
  • createEffect now accepts test, read and step options and exposes bound motion values via effect.get().

Changed

  • Reduced filesize and improved performance of spring.
  • MotionValueState no longer caches values in latest; effect renders read their motion values directly. set() drops its useDefaultValueType argument.
Commits
  • a6ea2f9 v13.4.0
  • d6ef844 Changelog
  • 75c4dcf Merge pull request #3824 from motiondivision/codex/react-animate-view
  • a5a7856 Co-locate AnimateView layer animation in framer-motion
  • 5c8bc09 Keep AnimateView group morph with custom values; gate view tests in Playwright
  • 12018e8 Add AnimateView via motion/react-animate-view
  • 939c267 Updating changelog
  • 16cf742 Latest
  • 49f1fe1 v13.3.0
  • f777c92 Updating changelog
  • Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates lucide-react from 1.47.0 to 1.46.0

Commits

Updates posthog-js from 1.415.6 to 1.433.7

Release notes

Sourced from posthog-js's releases.

posthog-js@1.433.7

1.433.7

Patch Changes

  • #4979 c767b98 Thanks @​darkopia! - fix(surveys): keep URL prefill working when localStorage is unavailable, such as on a page with an opaque origin or in private browsing (2026-09-16)
  • Updated dependencies [2828b6b]:
    • @​posthog/browser-common@​0.9.0

posthog-js@1.433.6

1.433.6

Patch Changes

  • #4926 ec4062b Thanks @​posthog! - Stop treating a <link rel=preload as=style> resource hint as a stylesheet when recording. Because it carries the URL of the sheet it preloads, the recorder matched it to the loaded stylesheet and inlined the whole sheet onto it, putting the CSS in every full snapshot twice and reporting a failed stylesheet deferral on every snapshot. (2026-09-16)

posthog-js@1.433.5

1.433.5

Patch Changes

  • #4962 85b775a Thanks @​posthog! - Docstrings for identity_hash and setIdentity() now say the hash is signed with the Secret API key from Support settings, not a project secret API key or a personal API key. (2026-09-15)
  • Updated dependencies [85b775a]:
    • @​posthog/types@​1.412.1

posthog-js@1.433.4

1.433.4

Patch Changes

  • #4941 07c1045 Thanks @​marandaneto! - Capture causes and AggregateError members with relationship metadata and individual stacks, limiting output to 50 entries and 1,000 member inspections. (2026-09-15)

  • #4898 372afba Thanks @​posthog! - Contain a throw from a third-party patched AbortController.abort() when our own fetch timeout fires, so it is retried instead of escaping as an uncaught error, and report a single outcome per request. (2026-09-15)

  • #4910 38b61f9 Thanks @​posthog! - Keep the end of a session recording when one replay event is too large to stringify: that event is dropped and the rest of the buffer still ships, instead of the size estimate throwing and stopping the unload flush. (2026-09-15)

  • #4909 5d4f1f7 Thanks @​posthog! - Keep the session recording observers that started when one of them fails to initialize, and report the failed observers in the recorder debug properties. (2026-09-15)

  • Updated dependencies [07c1045]:

    • @​posthog/core@​1.54.1

posthog-js@1.433.3

1.433.3

... (truncated)

Commits
  • aa7ab7f chore: update versions and lockfile [version bump]
  • 437164d refactor(browser-next): give analytics permanent buffer ownership (#4963)
  • fec440c feat(browser-next): add immediate capture delivery (#4676)
  • 2828b6b feat(browser): make shared capture synchronous (#4675)
  • c767b98 fix(surveys): keep URL prefill working when localStorage is unavailable (#4979)
  • e96852d chore: update versions and lockfile [version bump]
  • d14b608 chore: add semantic type checks for every SDK (#4985)
  • d59ac46 feat(react-native): let JS own consent by disabling native opt-out persistenc...
  • ec4062b fix(replay): do not treat a stylesheet preload link as a stylesheet (#4926)
  • d086f89 test(ai): add Anthropic HTTP record and replay pilot (#4971)
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

@dependabot @github

dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@tharunramagiri
bump 21 minors/patches + declare better-sqlite3 directly
d95bef5 
better-auth 1.7.5 dropped its better-sqlite3 peer declaration,
removing the native module from the pnpm graph and breaking vaultgram
at require time (every real-server harness died on ERR_MODULE_NOT_FOUND).
Declaring better-sqlite3 ^12.11.1 at the root satisfies the peer
independently of better-auth metadata. Bisected and proven: control
clean, auth-bump-only reproduces 38 failures, jose-only clean, fix
restores them; focused 49/49, tsc/lint/build clean, zero regressions
vs base (the one onboarding-draft red pre-exists on main).
@Orazen
Orazen force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-b1986833c3 branch from c9bd54b to d95bef5 Compare September 19, 2026 23:46
@Orazen
Orazen merged commit c69d7fe into main Sep 19, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-b1986833c3 branch September 19, 2026 23:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Orazen @tharunramagiri