Bump the minor-and-patch group across 1 directory with 26 updates

[dependabot]

Bumps the minor-and-patch group with 26 updates in the / directory:

Package	From	To
@chakra-ui/charts	3.36.0	3.37.0
@chakra-ui/react	3.36.0	3.37.0
@neo4j-nvl/base	1.2.0	1.2.1
@neo4j-nvl/react	1.2.0	1.2.1
@vercel/blob	2.4.1	2.8.0
ai	7.0.0-beta.178	7.0.85
better-auth	1.6.20	1.7.2
neo4j-driver	6.1.0	6.2.0
next	16.2.9	16.3.3
pmtiles	4.4.1	4.5.0
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.5
react-icons	5.6.0	5.7.0
recharts	3.8.1	3.10.1
resend	6.14.0	6.25.0
satellite.js	7.0.1	7.1.0
workflow	4.5.0	4.8.5
zod	4.4.3	4.5.4
@chakra-ui/cli	3.36.0	3.37.0
@playwright/test	1.61.0	1.62.1
csv-parse	7.0.0	7.0.2
microsandbox	0.5.7	0.6.16
tsx	4.22.4	4.23.13
vitest	4.1.9	4.1.11

Updates @chakra-ui/charts from 3.36.0 to 3.37.0

Changelog

Sourced from @​chakra-ui/charts's changelog.

3.37.0

3.36.1

Commits

• 2e75177 Version Packages (#10913)
• f813394 Version Packages (#10857)
• See full diff in compare view

Updates @chakra-ui/react from 3.36.0 to 3.37.0

Release notes

Sourced from @​chakra-ui/react's releases.

@​chakra-ui/react@​3.37.0

Minor Changes

• #10877 afc8b48 Thanks @​kalisaNkevin! - [New] DateInput: Add a segmented date field for typing dates without a calendar.

  import { DateInput } from "@chakra-ui/react"

  <DateInput.Root>
    <DateInput.Label />
    <DateInput.Control>
      <DateInput.Segments />
    </DateInput.Control>
    <DateInput.HiddenInput />
  </DateInput.Root>

  Each part of the date is its own keyboard-navigable segment, ordered and formatted by locale. Supports selectionMode="range", min/max, and granularity with formatter for time-only input.

• #10939 7b027d4 Thanks @​segunadebayo! - - Accordion, Collapsible, Dialog, Drawer, TreeView: Add hideMode to choose how content that stays mounted is hidden when closed. The default, "display-none", uses the hidden attribute and keeps effects running, so a video keeps playing and a subscription stays open while closed. "activity" uses React 19 Activity to pause those effects instead.

  <Dialog.Root hideMode="activity" />

  It only applies while the content stays mounted. unmountOnExit removes the tree on close, so hideMode never runs.

  • Dialog, Drawer: Add data-autofocus and data-no-autofocus to pick what gets focus when the overlay opens, without reaching for initialFocusEl and a ref. Mark chrome like the close button to skip it, or mark the real target directly.

    <Dialog.Content>
      <Dialog.CloseTrigger data-no-autofocus />
      <input data-autofocus />

... (truncated)

Changelog

Sourced from @​chakra-ui/react's changelog.

3.37.0

Minor Changes

• #10877 afc8b48 Thanks @​kalisaNkevin! - [New] DateInput: Add a segmented date field for typing dates without a calendar.

  import { DateInput } from "@chakra-ui/react"

  <DateInput.Root>
    <DateInput.Label />
    <DateInput.Control>
      <DateInput.Segments />
    </DateInput.Control>
    <DateInput.HiddenInput />
  </DateInput.Root>

  Each part of the date is its own keyboard-navigable segment, ordered and formatted by locale. Supports selectionMode="range", min/max, and granularity with formatter for time-only input.

• #10939 7b027d4 Thanks @​segunadebayo! - - Accordion, Collapsible, Dialog, Drawer, TreeView: Add hideMode to choose how content that stays mounted is hidden when closed. The default, "display-none", uses the hidden attribute and keeps effects running, so a video keeps playing and a subscription stays open while closed. "activity" uses React 19 Activity to pause those effects instead.

  <Dialog.Root hideMode="activity" />

  It only applies while the content stays mounted. unmountOnExit removes the tree on close, so hideMode never runs.

  • Dialog, Drawer: Add data-autofocus and data-no-autofocus to pick what gets focus when the overlay opens, without reaching for initialFocusEl and a ref. Mark chrome like the close button to skip it, or mark the real target directly.

    <Dialog.Content>
      <Dialog.CloseTrigger data-no-autofocus />

... (truncated)

Commits

• 2e75177 Version Packages (#10913)
• 902fabc fix(dialog, drawer): drop preventDefault guard on ActionTrigger (#10954)
• c16188f fix: preserve user onClick on Dialog and Drawer ActionTrigger (#10951)
• 1f28ce9 Update Ark UI to 5.39.0 (#10949)
• 2da020e docs: add multiple trigger examples for popover, hover card, and dialog
• dd51da4 docs(date-picker): add Persian (Jalali) calendar example (#10946)
• af8076c docs(spinner): add custom indicator example (#10948)
• 6948541 fix(radio-card): preserve outline border-width when disabled (#10938)
• 7b027d4 chore(deps): update @​ark-ui/react to 5.38.2 (#10939)
• afc8b48 feat: add DateInput component (#10877)
• Additional commits viewable in compare view

Updates @neo4j-nvl/base from 1.2.0 to 1.2.1

Updates @neo4j-nvl/react from 1.2.0 to 1.2.1

Updates @vercel/blob from 2.4.1 to 2.8.0

Release notes

Sourced from @​vercel/blob's releases.

@​vercel/blob@​2.8.0

Minor Changes

• 8b49164: Add putImage(pathname, bodyOrUrl, options): optimizes an image through Vercel Image Optimization and stores only the optimized output. The source can be the image content itself (string, File, Blob, Buffer or Stream) or a URL instance pointing at a public http(s) image, which is fetched server-side. Options mirror put (access, addRandomSuffix, allowOverwrite, cacheControlMaxAge, ifMatch) plus the required optimizeImage parameters (width, quality, format); contentType is not accepted since the stored content type always comes from the optimizer output. Deprecates the optimizeImage option on put and the putFromUrl function in favor of putImage; both keep working.

@​vercel/blob@​2.7.0

Minor Changes

• ad5a134: Add image optimization support: a new optimizeImage option on put and a new putFromUrl method. Both optimize the image through Vercel Image Optimization before storing it (only the optimized output is stored) and require OIDC authentication.

  const result = await put("avatars/foo.webp", body, {
    access: "public",
    optimizeImage: { width: 128, quality: 75, format: "webp" },
  });
  const result = await putFromUrl(
  "avatars/foo.webp",
  "https://example.com/photo.jpg",
  {
  access: "public",
  optimizeImage: { width: 128, quality: 75, format: "webp" },
  }
  );

@​vercel/blob@​2.6.1

Patch Changes

• d0118c4: Add a useCache option to presignUrl() for get operations. When useCache: false, the presigned URL includes a cache=0 query param so fetches bypass the CDN cache and read the latest content directly from origin storage. Like get(), the bypass only applies to private blobs. The param is not part of the signed payload, so holders of a presigned URL can also add or remove it manually.

@​vercel/blob@​2.6.0

Minor Changes

• c4976ba: Add rename(fromUrlOrPathname, toPathname, options) to move a blob to another pathname. The blob is copied to the new pathname and the source is deleted afterwards; if the copy fails the source is left untouched. By default renaming onto an existing blob throws — pass allowOverwrite: true to replace it, or addRandomSuffix: true to generate a unique destination. Requires a read-write token (client tokens are not supported).
• 89d94e9: Restore the useCache option on get(). Passing useCache: false bypasses the CDN cache and serves the blob directly from origin storage (via the cache=0 query parameter), guaranteeing the latest content at the cost of slower reads. Defaults to true.

@​vercel/blob@​2.5.0

Minor Changes

• 31a8b8f: Deprecate the useCache option on get(). The backend no longer honors the cache=0 query parameter it produced, so the option is now a no-op — reads always go through the standard caching path. The option is still accepted (and ignored) to avoid breaking existing callers, and will be removed in a future major version.

Patch Changes

• 9ac2586: Read the Vercel OIDC token via @vercel/oidc's refreshing getVercelOidcToken instead of the non-refreshing getVercelOidcTokenSync. This refreshes an expired token in development environments. In production with a valid token, behavior is unchanged. If a refresh is needed but fails, the token is treated as absent so callers still fall back to BLOB_READ_WRITE_TOKEN.

Changelog

Sourced from @​vercel/blob's changelog.

2.8.0

Minor Changes

• 8b49164: Add putImage(pathname, bodyOrUrl, options): optimizes an image through Vercel Image Optimization and stores only the optimized output. The source can be the image content itself (string, File, Blob, Buffer or Stream) or a URL instance pointing at a public http(s) image, which is fetched server-side. Options mirror put (access, addRandomSuffix, allowOverwrite, cacheControlMaxAge, ifMatch) plus the required optimizeImage parameters (width, quality, format); contentType is not accepted since the stored content type always comes from the optimizer output. Deprecates the optimizeImage option on put and the putFromUrl function in favor of putImage; both keep working.

2.7.0

Minor Changes

• ad5a134: Add image optimization support: a new optimizeImage option on put and a new putFromUrl method. Both optimize the image through Vercel Image Optimization before storing it (only the optimized output is stored) and require OIDC authentication.

  const result = await put("avatars/foo.webp", body, {
    access: "public",
    optimizeImage: { width: 128, quality: 75, format: "webp" },
  });
  const result = await putFromUrl(
  "avatars/foo.webp",
  "https://example.com/photo.jpg",
  {
  access: "public",
  optimizeImage: { width: 128, quality: 75, format: "webp" },
  }
  );

2.6.1

Patch Changes

• d0118c4: Add a useCache option to presignUrl() for get operations. When useCache: false, the presigned URL includes a cache=0 query param so fetches bypass the CDN cache and read the latest content directly from origin storage. Like get(), the bypass only applies to private blobs. The param is not part of the signed payload, so holders of a presigned URL can also add or remove it manually.

2.6.0

Minor Changes

• c4976ba: Add rename(fromUrlOrPathname, toPathname, options) to move a blob to another pathname. The blob is copied to the new pathname and the source is deleted afterwards; if the copy fails the source is left untouched. By default renaming onto an existing blob throws — pass allowOverwrite: true to replace it, or addRandomSuffix: true to generate a unique destination. Requires a read-write token (client tokens are not supported).
• 89d94e9: Restore the useCache option on get(). Passing useCache: false bypasses the CDN cache and serves the blob directly from origin storage (via the cache=0 query parameter), guaranteeing the latest content at the cost of slower reads. Defaults to true.

2.5.0

Minor Changes

• 31a8b8f: Deprecate the useCache option on get(). The backend no longer honors the cache=0 query parameter it produced, so the option is now a no-op — reads always go through the standard caching path. The option is still accepted (and ignored) to avoid breaking existing callers, and will be removed in a future major version.

Patch Changes

• 9ac2586: Read the Vercel OIDC token via @vercel/oidc's refreshing getVercelOidcToken instead of the non-refreshing getVercelOidcTokenSync. This refreshes an expired token in development environments. In production with a valid token, behavior is unchanged. If a refresh is needed but fails, the token is treated as absent so callers still fall back to BLOB_READ_WRITE_TOKEN.

Commits

• cdbac94 Version Packages (#1100)
• 8b49164 [blob] Add putImage, deprecate put optimizeImage option and putFromUrl (#1099)
• 7637604 Version Packages (#1097)
• ad5a134 [blob] Add optimizeImage option to put and new putFromUrl method (#1093)
• f5cb880 Version Packages (#1085)
• d0118c4 [@​vercel/blob] Add useCache option to presigned get URLs (#1084)
• 20e17d7 Version Packages (#1083)
• c4976ba [@​vercel/blob] Add rename operation (#1082)
• 89d94e9 [@​vercel/blob] Restore the useCache option on get() (#1081)
• 2c45378 [@​vercel/blob] Test OIDC token refresh between requests (#1078)
• Additional commits viewable in compare view

Updates ai from 7.0.0-beta.178 to 7.0.85

Changelog

Sourced from ai's changelog.

7.0.85

Patch Changes

• 55a9981: Ensure canonical hashes preserve undefined array element positions.
• dd32de2: fix(ai): sum Gateway image-generation costs across split requests
• aa45741: fix(provider/anthropic): preserve native message batch request counts in provider metadata and support the full language-model option surface in batch requests
• cc29073: feat(ai): expose individual image generation calls
• Updated dependencies [d2507af]
• Updated dependencies [aa45741]
  • @​ai-sdk/gateway@​4.0.69
  • @​ai-sdk/provider@​4.0.9
  • @​ai-sdk/provider-utils@​5.0.34

7.0.84

Patch Changes

• 6669d69: Expose parsed structured output in streamText end callbacks.
• a6463ca: fix(ai): allow tool approval secrets in ToolLoopAgent settings and prepareCall
• e604532: fix(ai): handle stateful and empty-match regular expressions in smoothStream
• Updated dependencies [805bbfc]
• Updated dependencies [90192f1]
  • @​ai-sdk/gateway@​4.0.68
  • @​ai-sdk/provider-utils@​5.0.33

7.0.83

Patch Changes

• 8dd86a9: Validate persisted typed tool calls against current input and output schemas. Schema-incompatible empty or error inputs and terminal history from unavailable tools remain loadable as dynamic tool parts instead of exposing unvalidated values under current static tool types.
• fda13b3: Allow chats to continue automatically after tool approval denials reach the output-denied state.
• 957146c: add operation-level outcomes to UI message stream end callbacks
• ce6849a: fix(ai): handle stitchable stream cancellation before an inner stream is registered

7.0.82

Patch Changes

• 3e125ba: Allow manual tool approval statuses to include a reason and preserve it across core, model, and UI approval requests. OPA requires-approval decisions now surface their reason to human approvers. UI request chunks serialize the optional reason, while UI messages retain it as approval.requestReason separately from an approver's response reason.
• Updated dependencies [0e7994c]
• Updated dependencies [3e125ba]
  • @​ai-sdk/gateway@​4.0.67

... (truncated)

Commits

• 69428b1 Version Packages (#19931)
• cc29073 feat(ai): expose individual image generation calls (#19959)
• aa45741 feat(anthropic): preserve message batch metadata (#19643)
• 55a9981 fix: prevent canonical hash collisions between empty arrays and arrays contai...
• 01743eb fix(ai): remove tsup build warning (#19947)
• dd32de2 fix(ai): sum Gateway image-generation costs across split requests (#19936)
• 0a0f271 Version Packages (#19857)
• e604532 fix: prevent smoothStream custom RegExp chunking from merging chunks or loopi...
• 6669d69 fix: include parsed structured output in streamText end callbacks (#17717)
• a6463ca fix: ToolLoopAgent types reject supported tool approval secrets (#19883)
• Additional commits viewable in compare view

Updates better-auth from 1.6.20 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

• #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

• #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

• #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

• #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

• #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

• #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

• #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

• #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

• #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

• Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

  • @​better-auth/core@​1.7.2
  • @​better-auth/kysely-adapter@​1.7.2
  • @​better-auth/drizzle-adapter@​1.7.2
  • @​better-auth/memory-adapter@​1.7.2
  • @​better-auth/mongo-adapter@​1.7.2
  • @​better-auth/prisma-adapter@​1.7.2
  • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

• #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

  getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

  auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

  A required field whose database column is still nullable logs a warning instead of blocking the migration.

  A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

• Updated dependencies []:

  • @​better-auth/core@​1.7.1
  • @​better-auth/drizzle-adapter@​1.7.1

... (truncated)

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
• c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
• e1d4011 fix(logger): respect configured logger in auth request context (#10939)
• 557e19b refactor(context): clarify auth endpoint context access (#10938)
• b4ad5a1 refactor: centralize placeholder email generation (#10982)
• fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
• f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
• ce8a3ab fix(admin): ban without a duration should clear the previous expiration (#10823)
• a021eaf fix(client): a client with more plugins fits a narrower client type again (#1...
• Additional commits viewable in compare view

Updates neo4j-driver from 6.1.0 to 6.2.0

Release notes

Sourced from neo4j-driver's releases.

v6.2.0

Adds support for the new protocol version Bolt 6.1 and adds API support for the new UUID database type.

⭐ New Features

---

• Support for Bolt 6.1 and the neo4j UUID type has been added. #1415
• Support for the UUID type has been added to Object Mapping #1442

Commits

• 631416f add UUID to object mapping (#1442)
• 0017123 add support for Bolt 6.1 and UUIDs (#1415)
• 085ff7d bump deno to 6.2.0 (#1430)
• See full diff in compare view

Updates next from 16.2.9 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• 528c1cd [16.3.x] Stop generating error codes (#97780)
• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• Additional commits viewable in compare view

Updates pmtiles from 4.4.1 to 4.5.0

Commits

• See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

• See full diff in compare view

Updates react-icons from 5.6.0 to 5.7.0

Release notes

Sourced from react-icons's releases.

v5.7.0

What's Changed

• update packages by @​kamijin-fanta in react-icons/react-icons#1153

Full Changelog: react-icons/react-icons@v5.6.0...v5.7.0

Icon Library	License	Version	Count
Circum Icons	MPL-2.0 license	1.0.0	288
Font Awesome 5	CC BY 4.0 License	5.15.4-3-gafecf2a	1612
Font Awesome 6	CC BY 4.0 License	6.7.2-1-g840c215	2060
Ionicons 4	MIT	4.6.3	696
Ionicons 5	MIT	5.5.4	1332
Material Design icons	Apache License Version 2.0	4.0.0-161-gf3fb4442b2	4341
Typicons	CC BY-SA 3.0	2.1.2	336
Github Octicons icons	MIT	18.3.0	264
Feather	MIT	4.29.2	287
Lucide	ISC	0.462.0	1541
Game Icons	CC BY 3.0	12920d6565588f0512542a3cb0cdfd36a497f910	4040
Weather Icons	SIL OFL 1.1	2.0.12	219
Devicons	MIT	1.8.0	192
Ant Design Icons	MIT	4.4.2	831
Bootstrap Icons	MIT	1.13.1	2754
Remix Icon	Apache License Version 2.0	4.9.1	3229
Flat Color Icons	MIT	1.0.2	329
Grommet-Icons	Apache License Version 2.0	4.14... Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trail-graph	Error		Sep 2, 2026 5:38pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.