Bump the minor-and-patch group across 1 directory with 25 updates

[dependabot]

Bumps the minor-and-patch group with 25 updates in the / directory:

Package	From	To
@chakra-ui/charts	3.36.0	3.36.1
@chakra-ui/react	3.36.0	3.36.1
@neo4j-nvl/base	1.2.0	1.2.1
@neo4j-nvl/react	1.2.0	1.2.1
@vercel/blob	2.4.1	2.8.0
ai	7.0.0-beta.178	7.0.77
better-auth	1.6.20	1.7.1
neo4j-driver	6.1.0	6.2.0
next	16.2.9	16.3.2
pmtiles	4.4.1	4.5.0
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.4
react-icons	5.6.0	5.7.0
recharts	3.8.1	3.10.1
resend	6.14.0	6.22.0
satellite.js	7.0.1	7.1.0
workflow	4.5.0	4.8.4
@chakra-ui/cli	3.36.0	3.36.1
@playwright/test	1.61.0	1.62.1
csv-parse	7.0.0	7.0.2
microsandbox	0.5.7	0.6.14
tsx	4.22.4	4.23.12
vitest	4.1.9	4.1.11

Updates @chakra-ui/charts from 3.36.0 to 3.36.1

Changelog

Sourced from @​chakra-ui/charts's changelog.

3.36.1

Commits

• f813394 Version Packages (#10857)
• See full diff in compare view

Updates @chakra-ui/react from 3.36.0 to 3.36.1

Release notes

Sourced from @​chakra-ui/react's releases.

@​chakra-ui/react@​3.36.1

Patch Changes

• #10868 f32a160 Thanks @​WahabKhan7528! - OverlayManager: add has() method to createOverlay return

• #10885 e503f8d Thanks @​dfedoryshchev! - - Bleed: Fix incorrect css prop application

• 129c50f Thanks @​segunadebayo! - Fix issue where the checked ring of RadioCard and CheckboxCard (outline variant) gets clipped when a parent has overflow: hidden|auto|scroll. The ring is now drawn with an inset shadow instead of an outer shadow.

• #10859 6f10270 Thanks @​dfedoryshchev! - - Checkmark: Fix incorrect css prop application

• #10884 e7431f1 Thanks @​sanjibani! - - Docs: fix Stack.Separator references in the v3 migration guide. The standalone Separator component is now used in both the StackDivider and Stack Props examples.

• 0fe3055 Thanks @​segunadebayo! - Fix error when merging recipes (e.g. composing a recipe-based component through the chakra factory). Recipe merging now normalizes compiled and raw configs before combining them, and no longer throws or mutates the source configs.

• #10879 e882dc0 Thanks @​dfedoryshchev! - - Float: Fix incorrect css prop application

• 2ed9026 Thanks @​segunadebayo! - Add a default minSize of { width: 240, height: 100 } to FloatingPanel.Root to prevent the panel from being resized to zero. Pass your own minSize to override it.

• #10863 b5de5e2 Thanks @​dfedoryshchev! - - Image: Fix

... (truncated)

Changelog

Sourced from @​chakra-ui/react's changelog.

3.36.1

Patch Changes

• #10868 f32a160 Thanks @​WahabKhan7528! - OverlayManager: add has() method to createOverlay return

• #10885 e503f8d Thanks @​dfedoryshchev! - - Bleed: Fix incorrect css prop application

• 129c50f Thanks @​segunadebayo! - Fix issue where the checked ring of RadioCard and CheckboxCard (outline variant) gets clipped when a parent has overflow: hidden|auto|scroll. The ring is now drawn with an inset shadow instead of an outer shadow.

• #10859 6f10270 Thanks @​dfedoryshchev! - - Checkmark: Fix incorrect css prop application

• #10884 e7431f1 Thanks @​sanjibani! - - Docs: fix Stack.Separator references in the v3 migration guide. The standalone Separator component is now used in both the StackDivider and Stack Props examples.

• 0fe3055 Thanks @​segunadebayo! - Fix error when merging recipes (e.g. composing a recipe-based component through the chakra factory). Recipe merging now normalizes compiled and raw configs before combining them, and no longer throws or mutates the source configs.

• #10879 e882dc0 Thanks @​dfedoryshchev! - - Float: Fix incorrect css prop application

• 2ed9026 Thanks @​segunadebayo! - Add a default minSize of { width: 240, height: 100 } to FloatingPanel.Root to prevent the panel from being resized to zero. Pass your own minSize to override it.

• #10863 b5de5e2

... (truncated)

Commits

• f813394 Version Packages (#10857)
• e503f8d fix: correct css prop usage in Bleed component (#10885)
• 0fe3055 perf(react): cache compiled recipes and memoize variant resolution
• e882dc0 fix: correct css prop usage in Float component (#10879)
• ff2067e fix(deps): update non-major dependencies
• c4e79c1 fix: forward the rel attribute on LinkOverlay (#10873)
• f32a160 feat(overlay): add has() method to createOverlay return (#10868)
• a1548ba fix: correct misspelled "permuations" variable in breakpoints (#10864)
• b5de5e2 fix: correct className usage in Image component (#10863)
• 6f10270 fix: correct css prop usage in Checkmark component (#10859)
• Additional commits viewable in compare view

Updates @neo4j-nvl/base from 1.2.0 to 1.2.1

Updates @neo4j-nvl/react from 1.2.0 to 1.2.1

Updates @vercel/blob from 2.4.1 to 2.8.0

Release notes

Sourced from @​vercel/blob's releases.

@​vercel/blob@​2.8.0

Minor Changes

• 8b49164: Add putImage(pathname, bodyOrUrl, options): optimizes an image through Vercel Image Optimization and stores only the optimized output. The source can be the image content itself (string, File, Blob, Buffer or Stream) or a URL instance pointing at a public http(s) image, which is fetched server-side. Options mirror put (access, addRandomSuffix, allowOverwrite, cacheControlMaxAge, ifMatch) plus the required optimizeImage parameters (width, quality, format); contentType is not accepted since the stored content type always comes from the optimizer output. Deprecates the optimizeImage option on put and the putFromUrl function in favor of putImage; both keep working.

@​vercel/blob@​2.7.0

Minor Changes

• ad5a134: Add image optimization support: a new optimizeImage option on put and a new putFromUrl method. Both optimize the image through Vercel Image Optimization before storing it (only the optimized output is stored) and require OIDC authentication.

  const result = await put("avatars/foo.webp", body, {
    access: "public",
    optimizeImage: { width: 128, quality: 75, format: "webp" },
  });
  const result = await putFromUrl(
  "avatars/foo.webp",
  "https://example.com/photo.jpg",
  {
  access: "public",
  optimizeImage: { width: 128, quality: 75, format: "webp" },
  }
  );

@​vercel/blob@​2.6.1

Patch Changes

• d0118c4: Add a useCache option to presignUrl() for get operations. When useCache: false, the presigned URL includes a cache=0 query param so fetches bypass the CDN cache and read the latest content directly from origin storage. Like get(), the bypass only applies to private blobs. The param is not part of the signed payload, so holders of a presigned URL can also add or remove it manually.

@​vercel/blob@​2.6.0

Minor Changes

• c4976ba: Add rename(fromUrlOrPathname, toPathname, options) to move a blob to another pathname. The blob is copied to the new pathname and the source is deleted afterwards; if the copy fails the source is left untouched. By default renaming onto an existing blob throws — pass allowOverwrite: true to replace it, or addRandomSuffix: true to generate a unique destination. Requires a read-write token (client tokens are not supported).
• 89d94e9: Restore the useCache option on get(). Passing useCache: false bypasses the CDN cache and serves the blob directly from origin storage (via the cache=0 query parameter), guaranteeing the latest content at the cost of slower reads. Defaults to true.

@​vercel/blob@​2.5.0

Minor Changes

• 31a8b8f: Deprecate the useCache option on get(). The backend no longer honors the cache=0 query parameter it produced, so the option is now a no-op — reads always go through the standard caching path. The option is still accepted (and ignored) to avoid breaking existing callers, and will be removed in a future major version.

Patch Changes

• 9ac2586: Read the Vercel OIDC token via @vercel/oidc's refreshing getVercelOidcToken instead of the non-refreshing getVercelOidcTokenSync. This refreshes an expired token in development environments. In production with a valid token, behavior is unchanged. If a refresh is needed but fails, the token is treated as absent so callers still fall back to BLOB_READ_WRITE_TOKEN.

Changelog

Sourced from @​vercel/blob's changelog.

2.8.0

Minor Changes

• 8b49164: Add putImage(pathname, bodyOrUrl, options): optimizes an image through Vercel Image Optimization and stores only the optimized output. The source can be the image content itself (string, File, Blob, Buffer or Stream) or a URL instance pointing at a public http(s) image, which is fetched server-side. Options mirror put (access, addRandomSuffix, allowOverwrite, cacheControlMaxAge, ifMatch) plus the required optimizeImage parameters (width, quality, format); contentType is not accepted since the stored content type always comes from the optimizer output. Deprecates the optimizeImage option on put and the putFromUrl function in favor of putImage; both keep working.

2.7.0

Minor Changes

• ad5a134: Add image optimization support: a new optimizeImage option on put and a new putFromUrl method. Both optimize the image through Vercel Image Optimization before storing it (only the optimized output is stored) and require OIDC authentication.

  const result = await put("avatars/foo.webp", body, {
    access: "public",
    optimizeImage: { width: 128, quality: 75, format: "webp" },
  });
  const result = await putFromUrl(
  "avatars/foo.webp",
  "https://example.com/photo.jpg",
  {
  access: "public",
  optimizeImage: { width: 128, quality: 75, format: "webp" },
  }
  );

2.6.1

Patch Changes

• d0118c4: Add a useCache option to presignUrl() for get operations. When useCache: false, the presigned URL includes a cache=0 query param so fetches bypass the CDN cache and read the latest content directly from origin storage. Like get(), the bypass only applies to private blobs. The param is not part of the signed payload, so holders of a presigned URL can also add or remove it manually.

2.6.0

Minor Changes

• c4976ba: Add rename(fromUrlOrPathname, toPathname, options) to move a blob to another pathname. The blob is copied to the new pathname and the source is deleted afterwards; if the copy fails the source is left untouched. By default renaming onto an existing blob throws — pass allowOverwrite: true to replace it, or addRandomSuffix: true to generate a unique destination. Requires a read-write token (client tokens are not supported).
• 89d94e9: Restore the useCache option on get(). Passing useCache: false bypasses the CDN cache and serves the blob directly from origin storage (via the cache=0 query parameter), guaranteeing the latest content at the cost of slower reads. Defaults to true.

2.5.0

Minor Changes

• 31a8b8f: Deprecate the useCache option on get(). The backend no longer honors the cache=0 query parameter it produced, so the option is now a no-op — reads always go through the standard caching path. The option is still accepted (and ignored) to avoid breaking existing callers, and will be removed in a future major version.

Patch Changes

• 9ac2586: Read the Vercel OIDC token via @vercel/oidc's refreshing getVercelOidcToken instead of the non-refreshing getVercelOidcTokenSync. This refreshes an expired token in development environments. In production with a valid token, behavior is unchanged. If a refresh is needed but fails, the token is treated as absent so callers still fall back to BLOB_READ_WRITE_TOKEN.

Commits

• cdbac94 Version Packages (#1100)
• 8b49164 [blob] Add putImage, deprecate put optimizeImage option and putFromUrl (#1099)
• 7637604 Version Packages (#1097)
• ad5a134 [blob] Add optimizeImage option to put and new putFromUrl method (#1093)
• f5cb880 Version Packages (#1085)
• d0118c4 [@​vercel/blob] Add useCache option to presigned get URLs (#1084)
• 20e17d7 Version Packages (#1083)
• c4976ba [@​vercel/blob] Add rename operation (#1082)
• 89d94e9 [@​vercel/blob] Restore the useCache option on get() (#1081)
• 2c45378 [@​vercel/blob] Test OIDC token refresh between requests (#1078)
• Additional commits viewable in compare view

Updates ai from 7.0.0-beta.178 to 7.0.77

Changelog

Sourced from ai's changelog.

7.0.77

Patch Changes

• Updated dependencies [b74971f]
• Updated dependencies [a371615]
  • @​ai-sdk/provider-utils@​5.0.29
  • @​ai-sdk/gateway@​4.0.62

7.0.76

Patch Changes

• c6d57f3: fix(ai): prevent duplicate text and reasoning part ids
• 677a707: fix(ai): allow nullish metadata schemas for UI messages with branded IDs

7.0.75

Patch Changes

• 8978ad8: feat(ai): add experimental_startVideo and experimental_videoStatus — user-facing fire-and-forget wrappers over the video model doStart/doStatus spec methods, with the same sparse-options DX as generateVideo
• Updated dependencies [dedac59]
  • @​ai-sdk/gateway@​4.0.61

7.0.74

Patch Changes

• Updated dependencies [5941bd6]
• Updated dependencies [9a4337d]
  • @​ai-sdk/gateway@​4.0.60

7.0.73

Patch Changes

• Updated dependencies [f607a12]
  • @​ai-sdk/gateway@​4.0.59

7.0.72

Patch Changes

• Updated dependencies [fdcc814]
  • @​ai-sdk/gateway@​4.0.58

7.0.71

Patch Changes

... (truncated)

Commits

• ed857f5 Version Packages (#19296)
• a983d06 chore: update tsx to 4.23.12 (#19273)
• ab58156 Version Packages (#19266)
• c6d57f3 fix(ai): prevent duplicate text and reasoning part ids (#19269)
• 7c5162f Version Packages (#19262)
• 677a707 fix: allow nullish metadata schemas with branded UI message IDs (#17857)
• 8978ad8 feat(ai): experimental_startVideo + experimental_getVideoStatus — user-facing...
• c0fa76a Version Packages (#19235)
• eceb32a Version Packages (#19224)
• eac099e Version Packages (#19213)
• Additional commits viewable in compare view

Updates better-auth from 1.6.20 to 1.7.1

Release notes

Sourced from better-auth's releases.

v1.7.1

better-auth

Bug Fixes

• Added native database transaction support to test instances for PostgreSQL and MySQL.
• Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.
• Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
• Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.
• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.1

Patch Changes

• #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

  getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

  auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

  A required field whose database column is still nullable logs a warning instead of blocking the migration.

  A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

• Updated dependencies []:

  • @​better-auth/core@​1.7.1
  • @​better-auth/drizzle-adapter@​1.7.1
  • @​better-auth/kysely-adapter@​1.7.1
  • @​better-auth/memory-adapter@​1.7.1
  • @​better-auth/mongo-adapter@​1.7.1
  • @​better-auth/prisma-adapter@​1.7.1
  • @​better-auth/telemetry@​1.7.1

1.7.0

Minor Changes

• #8733 4e8e4c7 Thanks @​bytaesu! - Add hydrateSession to seed the client with a server-fetched session so useSession returns data on the first render.

• #9930 0cbaf81 Thanks @​gustavovalverde! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. onLinkAccount fires and the anonymous user is migrated; before, it was silently skipped.

  Plugins can now carry server-trusted data across an OAuth redirect with the new addOAuthServerContext API, read back on the callback via getOAuthState().serverContext. Unlike additionalData, it cannot be set from the request body, so it is the right place for values the server must trust.

  For @better-auth/oauth-provider, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through additionalData.

• #10004 b36c38f Thanks @​bytaesu! - The captcha plugin now requires endpoint entries to match full auth paths unless they use wildcard patterns. This prevents requests like /sign-in//email from bypassing captcha while preserving trailing-slash matches like /sign-in/email/. To protect multiple routes, replace partial paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/**.

• #10746 6782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10402 763a267 Thanks @​gustavovalverde! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.

• #9766 bf39cbf Thanks @​GautamBytes! - Add a server-only auth.api.consumePhoneNumberOTP API for custom phone OTP flows that need to verify and consume a code without creating or updating users or sessions.

• #10330 081d3c3 Thanks @​ping-maxwell! - Allow the username plugin's separate displayUsername field to be omitted by setting displayUsername: false on both the server and client plugins.

• #10059 49b5cf6 Thanks @​GautamBytes! - Device Authorization now creates unique database indexes for deviceCode and userCode, so each generated code must be unique in its column. Existing installations on every adapter must resolve duplicate values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters before running it.

... (truncated)

Commits

• 2344536 chore: release v1.7.1 (#10864)
• 845bbd1 fix(db): refuse adding required no-default columns to populated tables (#10863)
• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• e6e1b4e perf(db): replace sequential get-then-delete loop with parallel deletes in de...
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

Updates neo4j-driver from 6.1.0 to 6.2.0

Release notes

Sourced from neo4j-driver's releases.

v6.2.0

Adds support for the new protocol version Bolt 6.1 and adds API support for the new UUID database type.

⭐ New Features

---

• Support for Bolt 6.1 and the neo4j UUID type has been added. #1415
• Support for the UUID type has been added to Object Mapping #1442

Commits

• 631416f add UUID to object mapping (#1442)
• 0017123 add support for Bolt 6.1 and UUIDs (#1415)
• 085ff7d bump deno to 6.2.0 (#1430)
• See full diff in compare view

Updates next from 16.2.9 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

• docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
• Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
• Turbopack: rename to use turbopack: no side effects: #94427
• refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360

... (truncated)

Commits

• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
• eba236b [backport] Scope app-entry export validation to files inside the app director...
• 3d32eb8 v16.3.1
• 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
• 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
• Additional commits viewable in compare view

Updates pmtiles from 4.4.1 to 4.5.0

Commits

• See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Updates react-icons from 5.6.0 to 5.7.0

Release notes

Sourced from react-icons's releases.

v5.7.0

What's Changed

• update packages by @​kamijin-fanta in react-icons/react-icons#1153

Full Changelog: react-icons/react-icons@v5.6.0...v5.7.0

Description has been truncated

Icon Library	License	Version	Count
Circum Icons	MPL-2.0 license	1.0.0	288
Font Awesome 5	CC BY 4.0 License	5.15.4-3-gafecf2a	1612
Font Awesome 6	CC BY 4.0 License	6.7.2-1-g840c215	2060
Ionicons 4	MIT	4.6.3	696
Ionicons 5	MIT	5.5.4	1332
Material Design icons	Apache License Version 2.0	4.0.0-161-gf3fb4442b2	4341
Typicons	CC BY-SA 3.0	2.1.2	336
Github Octicons icons	MIT	18.3.0	264
Feather	MIT	4.29.2	287
Lucide	ISC	0.462.0	1541
Game Icons	CC BY 3.0	12920d6565588f0512542a3cb0cdfd36a497f910	4040
Weather Icons	SIL OFL 1.1	2.0.12	219
Devicons	MIT	1.8.0	192
Ant Design Icons	MIT	4.4.2	831
Bootstrap Icons	MIT	1.13.1	2754
Remix Icon	Apache License Version 2.0	4.9.1	3229
Flat Color Icons	MIT	1.0.2	329

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
trail-graph	Error		Aug 26, 2026 5:38pm

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.