Bump the minor-and-patch group across 1 directory with 25 updates

[dependabot]

Bumps the minor-and-patch group with 25 updates in the / directory:

Package	From	To
@chakra-ui/charts	3.36.0	3.37.0
@chakra-ui/react	3.36.0	3.37.0
@neo4j-nvl/base	1.2.0	1.2.1
@neo4j-nvl/react	1.2.0	1.2.1
@vercel/blob	2.4.1	2.8.0
ai	7.0.0-beta.178	7.0.93
better-auth	1.6.20	1.7.3
neo4j-driver	6.1.0	6.2.0
next	16.2.9	16.3.4
pmtiles	4.4.1	4.5.0
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.7
react-icons	5.6.0	5.7.0
recharts	3.8.1	3.10.1
resend	6.14.0	6.26.0
satellite.js	7.0.1	7.1.0
workflow	4.5.0	4.8.5
zod	4.4.3	4.5.4
@chakra-ui/cli	3.36.0	3.37.0
@playwright/test	1.61.0	1.63.0
csv-parse	7.0.0	7.0.2
microsandbox	0.5.7	0.6.17
tsx	4.22.4	4.23.13

Updates @chakra-ui/charts from 3.36.0 to 3.37.0

Changelog

Sourced from @​chakra-ui/charts's changelog.

3.37.0

3.36.1

Commits

• 2e75177 Version Packages (#10913)
• f813394 Version Packages (#10857)
• See full diff in compare view

Updates @chakra-ui/react from 3.36.0 to 3.37.0

Release notes

Sourced from @​chakra-ui/react's releases.

@​chakra-ui/react@​3.37.0

Minor Changes

• #10877 afc8b48 Thanks @​kalisaNkevin! - [New] DateInput: Add a segmented date field for typing dates without a calendar.

  import { DateInput } from "@chakra-ui/react"

  <DateInput.Root>
    <DateInput.Label />
    <DateInput.Control>
      <DateInput.Segments />
    </DateInput.Control>
    <DateInput.HiddenInput />
  </DateInput.Root>

  Each part of the date is its own keyboard-navigable segment, ordered and formatted by locale. Supports selectionMode="range", min/max, and granularity with formatter for time-only input.

• #10939 7b027d4 Thanks @​segunadebayo! - - Accordion, Collapsible, Dialog, Drawer, TreeView: Add hideMode to choose how content that stays mounted is hidden when closed. The default, "display-none", uses the hidden attribute and keeps effects running, so a video keeps playing and a subscription stays open while closed. "activity" uses React 19 Activity to pause those effects instead.

  <Dialog.Root hideMode="activity" />

  It only applies while the content stays mounted. unmountOnExit removes the tree on close, so hideMode never runs.

  • Dialog, Drawer: Add data-autofocus and data-no-autofocus to pick what gets focus when the overlay opens, without reaching for initialFocusEl and a ref. Mark chrome like the close button to skip it, or mark the real target directly.

    <Dialog.Content>
      <Dialog.CloseTrigger data-no-autofocus />
      <input data-autofocus />

... (truncated)

Changelog

Sourced from @​chakra-ui/react's changelog.

3.37.0

Minor Changes

• #10877 afc8b48 Thanks @​kalisaNkevin! - [New] DateInput: Add a segmented date field for typing dates without a calendar.

  import { DateInput } from "@chakra-ui/react"

  <DateInput.Root>
    <DateInput.Label />
    <DateInput.Control>
      <DateInput.Segments />
    </DateInput.Control>
    <DateInput.HiddenInput />
  </DateInput.Root>

  Each part of the date is its own keyboard-navigable segment, ordered and formatted by locale. Supports selectionMode="range", min/max, and granularity with formatter for time-only input.

• #10939 7b027d4 Thanks @​segunadebayo! - - Accordion, Collapsible, Dialog, Drawer, TreeView: Add hideMode to choose how content that stays mounted is hidden when closed. The default, "display-none", uses the hidden attribute and keeps effects running, so a video keeps playing and a subscription stays open while closed. "activity" uses React 19 Activity to pause those effects instead.

  <Dialog.Root hideMode="activity" />

  It only applies while the content stays mounted. unmountOnExit removes the tree on close, so hideMode never runs.

  • Dialog, Drawer: Add data-autofocus and data-no-autofocus to pick what gets focus when the overlay opens, without reaching for initialFocusEl and a ref. Mark chrome like the close button to skip it, or mark the real target directly.

    <Dialog.Content>
      <Dialog.CloseTrigger data-no-autofocus />

... (truncated)

Commits

• 2e75177 Version Packages (#10913)
• 902fabc fix(dialog, drawer): drop preventDefault guard on ActionTrigger (#10954)
• c16188f fix: preserve user onClick on Dialog and Drawer ActionTrigger (#10951)
• 1f28ce9 Update Ark UI to 5.39.0 (#10949)
• 2da020e docs: add multiple trigger examples for popover, hover card, and dialog
• dd51da4 docs(date-picker): add Persian (Jalali) calendar example (#10946)
• af8076c docs(spinner): add custom indicator example (#10948)
• 6948541 fix(radio-card): preserve outline border-width when disabled (#10938)
• 7b027d4 chore(deps): update @​ark-ui/react to 5.38.2 (#10939)
• afc8b48 feat: add DateInput component (#10877)
• Additional commits viewable in compare view

Updates @neo4j-nvl/base from 1.2.0 to 1.2.1

Updates @neo4j-nvl/react from 1.2.0 to 1.2.1

Updates @vercel/blob from 2.4.1 to 2.8.0

Release notes

Sourced from @​vercel/blob's releases.

@​vercel/blob@​2.8.0

Minor Changes

• 8b49164: Add putImage(pathname, bodyOrUrl, options): optimizes an image through Vercel Image Optimization and stores only the optimized output. The source can be the image content itself (string, File, Blob, Buffer or Stream) or a URL instance pointing at a public http(s) image, which is fetched server-side. Options mirror put (access, addRandomSuffix, allowOverwrite, cacheControlMaxAge, ifMatch) plus the required optimizeImage parameters (width, quality, format); contentType is not accepted since the stored content type always comes from the optimizer output. Deprecates the optimizeImage option on put and the putFromUrl function in favor of putImage; both keep working.

@​vercel/blob@​2.7.0

Minor Changes

• ad5a134: Add image optimization support: a new optimizeImage option on put and a new putFromUrl method. Both optimize the image through Vercel Image Optimization before storing it (only the optimized output is stored) and require OIDC authentication.

  const result = await put("avatars/foo.webp", body, {
    access: "public",
    optimizeImage: { width: 128, quality: 75, format: "webp" },
  });
  const result = await putFromUrl(
  "avatars/foo.webp",
  "https://example.com/photo.jpg",
  {
  access: "public",
  optimizeImage: { width: 128, quality: 75, format: "webp" },
  }
  );

@​vercel/blob@​2.6.1

Patch Changes

• d0118c4: Add a useCache option to presignUrl() for get operations. When useCache: false, the presigned URL includes a cache=0 query param so fetches bypass the CDN cache and read the latest content directly from origin storage. Like get(), the bypass only applies to private blobs. The param is not part of the signed payload, so holders of a presigned URL can also add or remove it manually.

@​vercel/blob@​2.6.0

Minor Changes

• c4976ba: Add rename(fromUrlOrPathname, toPathname, options) to move a blob to another pathname. The blob is copied to the new pathname and the source is deleted afterwards; if the copy fails the source is left untouched. By default renaming onto an existing blob throws — pass allowOverwrite: true to replace it, or addRandomSuffix: true to generate a unique destination. Requires a read-write token (client tokens are not supported).
• 89d94e9: Restore the useCache option on get(). Passing useCache: false bypasses the CDN cache and serves the blob directly from origin storage (via the cache=0 query parameter), guaranteeing the latest content at the cost of slower reads. Defaults to true.

@​vercel/blob@​2.5.0

Minor Changes

• 31a8b8f: Deprecate the useCache option on get(). The backend no longer honors the cache=0 query parameter it produced, so the option is now a no-op — reads always go through the standard caching path. The option is still accepted (and ignored) to avoid breaking existing callers, and will be removed in a future major version.

Patch Changes

• 9ac2586: Read the Vercel OIDC token via @vercel/oidc's refreshing getVercelOidcToken instead of the non-refreshing getVercelOidcTokenSync. This refreshes an expired token in development environments. In production with a valid token, behavior is unchanged. If a refresh is needed but fails, the token is treated as absent so callers still fall back to BLOB_READ_WRITE_TOKEN.

Changelog

Sourced from @​vercel/blob's changelog.

2.8.0

Minor Changes

• 8b49164: Add putImage(pathname, bodyOrUrl, options): optimizes an image through Vercel Image Optimization and stores only the optimized output. The source can be the image content itself (string, File, Blob, Buffer or Stream) or a URL instance pointing at a public http(s) image, which is fetched server-side. Options mirror put (access, addRandomSuffix, allowOverwrite, cacheControlMaxAge, ifMatch) plus the required optimizeImage parameters (width, quality, format); contentType is not accepted since the stored content type always comes from the optimizer output. Deprecates the optimizeImage option on put and the putFromUrl function in favor of putImage; both keep working.

2.7.0

Minor Changes

• ad5a134: Add image optimization support: a new optimizeImage option on put and a new putFromUrl method. Both optimize the image through Vercel Image Optimization before storing it (only the optimized output is stored) and require OIDC authentication.

  const result = await put("avatars/foo.webp", body, {
    access: "public",
    optimizeImage: { width: 128, quality: 75, format: "webp" },
  });
  const result = await putFromUrl(
  "avatars/foo.webp",
  "https://example.com/photo.jpg",
  {
  access: "public",
  optimizeImage: { width: 128, quality: 75, format: "webp" },
  }
  );

2.6.1

Patch Changes

• d0118c4: Add a useCache option to presignUrl() for get operations. When useCache: false, the presigned URL includes a cache=0 query param so fetches bypass the CDN cache and read the latest content directly from origin storage. Like get(), the bypass only applies to private blobs. The param is not part of the signed payload, so holders of a presigned URL can also add or remove it manually.

2.6.0

Minor Changes

• c4976ba: Add rename(fromUrlOrPathname, toPathname, options) to move a blob to another pathname. The blob is copied to the new pathname and the source is deleted afterwards; if the copy fails the source is left untouched. By default renaming onto an existing blob throws — pass allowOverwrite: true to replace it, or addRandomSuffix: true to generate a unique destination. Requires a read-write token (client tokens are not supported).
• 89d94e9: Restore the useCache option on get(). Passing useCache: false bypasses the CDN cache and serves the blob directly from origin storage (via the cache=0 query parameter), guaranteeing the latest content at the cost of slower reads. Defaults to true.

2.5.0

Minor Changes

• 31a8b8f: Deprecate the useCache option on get(). The backend no longer honors the cache=0 query parameter it produced, so the option is now a no-op — reads always go through the standard caching path. The option is still accepted (and ignored) to avoid breaking existing callers, and will be removed in a future major version.

Patch Changes

• 9ac2586: Read the Vercel OIDC token via @vercel/oidc's refreshing getVercelOidcToken instead of the non-refreshing getVercelOidcTokenSync. This refreshes an expired token in development environments. In production with a valid token, behavior is unchanged. If a refresh is needed but fails, the token is treated as absent so callers still fall back to BLOB_READ_WRITE_TOKEN.

Commits

• cdbac94 Version Packages (#1100)
• 8b49164 [blob] Add putImage, deprecate put optimizeImage option and putFromUrl (#1099)
• 7637604 Version Packages (#1097)
• ad5a134 [blob] Add optimizeImage option to put and new putFromUrl method (#1093)
• f5cb880 Version Packages (#1085)
• d0118c4 [@​vercel/blob] Add useCache option to presigned get URLs (#1084)
• 20e17d7 Version Packages (#1083)
• c4976ba [@​vercel/blob] Add rename operation (#1082)
• 89d94e9 [@​vercel/blob] Restore the useCache option on get() (#1081)
• 2c45378 [@​vercel/blob] Test OIDC token refresh between requests (#1078)
• Additional commits viewable in compare view

Updates ai from 7.0.0-beta.178 to 7.0.93

Changelog

Sourced from ai's changelog.

7.0.93

Patch Changes

• df6c009: fix(ai): use new message ID when replacing a message in sendMessage
• 6ee74a3: fix(ai): preserve tool part titles when validating UI messages
• f13d371: fix(ai): preserve provider metadata when converting failed tool calls
• d4485fe: feat(ai): support minItems and maxItems in array outputs
• 4f201cc: chore(ai): formally include already supported onLanguageModelCallStart and onLanguageModelCallEnd in ToolLoopAgentSettings type
• 8cdb2a7: fix(ai): decode text data URLs in Node.js
• 0f2281e: fix(ai): reject embedding responses whose count does not match the input values
• fc8e8ac: fix(ai): preserve image call diagnostics when no image is generated
• ee8391e: fix(ai): support abort signals when the global AbortSignal is not a constructor
• Updated dependencies [3cfc1fc]
  • @​ai-sdk/gateway@​4.0.75

7.0.92

Patch Changes

• a51cc94: fix(ai): preserve provider metadata from empty smooth stream deltas
• d1904d3: fix(ai): surface fallback errors for empty HTTP response bodies
• 84e5a79: fix(ai): skip smoothStream delays while the document is hidden
• a8e8ad0: fix(ai): expose call ID and abort reason in streamText onAbort callbacks
• Updated dependencies [a7e324b]
  • @​ai-sdk/gateway@​4.0.74

7.0.91

Patch Changes

• 802af1e: Add configurable recovery for provider errors received after streamText response streaming begins. Explicitly configuring streamRetries enables isolated retry attempts, including one bounded callback-directed recovery through StreamTextOnErrorRetryCallback with streamRetries: 0; recovered results and metadata reflect only the successful attempt, while the existing StreamTextOnErrorCallback contract and logging-only observer behavior remain compatible.
• Updated dependencies [5484f27]
• Updated dependencies [36eb7ee]
• Updated dependencies [622fa7f]
  • @​ai-sdk/gateway@​4.0.73

7.0.90

Patch Changes

• Updated dependencies [4d25a08]
• Updated dependencies [6bcc0f8]
  • @​ai-sdk/gateway@​4.0.72
  • @​ai-sdk/provider-utils@​5.0.36

7.0.89

Patch Changes

... (truncated)

Commits

• 6359fd5 Version Packages (#20288)
• 6ee74a3 fix: tool-part titles disappearing during UI message validation (#20111)
• df6c009 fix(ai): use new message ID when replacing a message in sendMessage (#20379)
• 8cdb2a7 fix: decode valid text data URLs in Node.js (#20354)
• 0f2281e fix: embedMany accepts provider responses with mismatched embedding counts (#...
• fc8e8ac fix: NoImageGeneratedError discards per-call diagnostics for empty image resp...
• f13d371 fix: Preserve namespaces when replaying failed tool calls from UI messages (#...
• ee8391e fix: prevent valid abort signals from crashing WorkflowAgent in runtimes with...
• 4f201cc chore(ai): formally include already supported onLanguageModelCallStart and ...
• d4485fe feat: support minItems and maxItems constraints in Output.array() (#20270)
• Additional commits viewable in compare view

Updates better-auth from 1.6.20 to 1.7.3

Release notes

Sourced from better-auth's releases.

v1.7.3

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. (#11147)

Bug Fixes

• Aligned generated OpenAPI required fields with runtime validation. (#11066)
• Handled malformed custom-scheme callback URLs without excessive processing. (#11060)
• Improved Auth0 domain normalization to avoid slow trailing-slash processing. (#11188)
• Prevented generic OAuth discovery failures from taking down the authentication API. (#10978)
• Tracked email OTP sign-ins in the last login method plugin. (#10963)
• Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release. (#10988)
• Fixed getSession failures when cookie caching is disabled and cached session cookies remain. (#11120)
• Fixed TOTP re-enrollment replacing an active authenticator and its backup codes. (#11037)
• Prevented duplicate session requests and hydration mismatches in Nuxt useFetch. (#11084)
• Improved dynamic organization role permission check performance. (#11069)
• Added type-safe Nuxt useFetch integration for the Vue client's useSession hook. (#11085)
• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support. (#9908)
• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters. (#11179)
• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches. (#11178)
• Added custom token endpoint authentication strategies for providers with non-standard request parameters. (#11101)

Bug Fixes

• Restored optional consumeOne and incrementOne methods for custom database adapters. (#11189)
• Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options. (#11102)
• Improved request IP validation performance. (#11068)
• Improved PayPal authorization code and refresh token requests, including PKCE handling. (#11129)
• Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection. (#11134)
• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer. (#11153)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.3

Patch Changes

• #11060 3660f06 Thanks @​bytaesu! - Handle malformed custom-scheme callback URLs without excessive processing.

• #11037 5bd7096 Thanks @​bytaesu! - Prevent repeated TOTP enrollment from replacing an active authenticator and its backup codes.

• #11120 7ec7146 Thanks @​onmax! - Prevent getSession from failing when cookie caching is disabled while clients still have cached session cookies.

• #9908 76d311f Thanks @​harshil1712! - Add Cloudflare as a built-in social provider, with support for client-secret authentication and PKCE clients without a secret.

• #11188 c47b765 Thanks @​bytaesu! - Normalize Auth0 domains without a potentially slow trailing-slash regular expression.

• #11084 2d5c63d Thanks @​bytaesu! - Prevent duplicate session requests and hydration mismatches when using the Vue client with Nuxt useFetch.

• #11147 a9d8c12 Thanks @​bytaesu! - Add isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows, while ignoring padded response entries with zero occurrences.

• #10988 9fc7498 Thanks @​bytaesu! - Run callback hooks after proxied OAuth sign-ins and preserve server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

• #11178 be0e007 Thanks @​bytaesu! - Report missing tables, missing columns, and required columns Better Auth never writes during initialization, with guidance for fixing them. Kysely checks the live database schema. Authentication requests await the same check and are rejected if the schema does not match.

  Validation is enabled by default, including in production. Set advanced.database.validateSchema: false to disable runtime validation. auth migrate refuses to apply changes when required unwritten columns need manual repair.

• #11069 0bb0dbf Thanks @​bytaesu! - Improve dynamic organization role permission check performance.

• #11153 2220ee7 Thanks @​bytaesu! - Restore sign-in compatibility with 1.6 databases by identifying accounts with (providerId, accountId) and removing the issuer requirement introduced in 1.7.0. Upgrading from 1.6 no longer requires an account schema migration. Ambiguous account keys are rejected instead of selecting an arbitrary account.

  If you applied the 1.7.0 through 1.7.2 account schema, remove its issuer unique index before upgrading. For SQL databases, also make issuer nullable or remove the column so sign-ups and account linking can succeed. auth migrate does not perform this cleanup. Follow the upgrade guide for database-specific steps.

• #10978 5fe5bc2 Thanks @​BetterAndBetterII! - Skip a generic OAuth provider when discovery fails instead of taking down the rest of the auth API.

• #10963 74a7369 Thanks @​thisismert! - Track email OTP sign-ins in the last login method plugin.

• #11085 e16b40a Thanks @​bytaesu! - Provide type-safe Nuxt useFetch integration for the Vue client's useSession hook.

• #11066 c0444dc Thanks @​bytaesu! - Upgrade the packaged Zod dependency to 4.5. Generated OpenAPI schemas now mark required request fields consistently with runtime validation, including passkey registration responses.

• Updated dependencies [352d012, 76d311f, 3e9e197, 157ec8d, baa08f4, 9e36635, be0e007, a2bae0c, 1a1b7d5, 2220ee7]:

  • @​better-auth/core@​1.7.3
  • @​better-auth/drizzle-adapter@​1.7.3
  • @​better-auth/prisma-adapter@​1.7.3
  • @​better-auth/kysely-adapter@​1.7.3
  • @​better-auth/memory-adapter@​1.7.3
  • @​better-auth/mongo-adapter@​1.7.3
  • @​better-auth/telemetry@​1.7.3

1.7.2

Patch Changes

... (truncated)

Commits

• 597d39c chore: release v1.7.3 (#11032)
• 1a1b7d5 fix(core): restore optional atomic adapter methods (#11189)
• 76d311f feat: add Cloudflare social provider (#9908)
• 7ec7146 fix(session): skip cache cookie when disabled (#11120)
• c47b765 fix(generic-oauth): harden Auth0 domain normalization (#11188)
• be0e007 feat(db): check the database schema on initialization (#11178)
• 2220ee7 revert: drop the issuer column and resolve accounts by provider id (#11153)
• 5fe5bc2 fix(generic-oauth): skip providers whose discovery fails (#10978)
• a9d8c12 feat(haveibeenpwned): expose password compromise check (#11147)
• 74a7369 fix(last-login-method): handle email otp logins (#10963)
• Additional commits viewable in compare view

Updates neo4j-driver from 6.1.0 to 6.2.0

Release notes

Sourced from neo4j-driver's releases.

v6.2.0

Adds support for the new protocol version Bolt 6.1 and adds API support for the new UUID database type.

⭐ New Features

---

• Support for Bolt 6.1 and the neo4j UUID type has been added. #1415
• Support for the UUID type has been added to Object Mapping #1442

Commits

• 631416f add UUID to object mapping (#1442)
• 0017123 add support for Bolt 6.1 and UUIDs (#1415)
• 085ff7d bump deno to 6.2.0 (#1430)
• See full diff in compare view

Updates next from 16.2.9 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311

... (truncated)

Commits

• 299180d v16.3.4
• 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
• 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
• d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
• 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• Additional commits viewable in compare view

Updates pmtiles from 4.4.1 to 4.5.0

Commits

• See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.7

Commits

• See full diff in compare view

Updates react-icons from 5.6.0 to 5.7.0

Release notes

Sourced from react-icons's releases.

v5.7.0

What's Changed

• update packages by @​kamijin-fanta in react-icons/react-icons#1153

Full Changelog: react-icons/react-icons@v5.6.0...v5.7.0

Icon Library	License	Version	Count
Circum Icons	MPL-2.0 license	1.0.0	288
Font Awesome 5	CC BY 4.0 License	5.15.4-3-gafecf2a	1612
Font Awesome 6	CC BY 4.0 License	6.7.2-1-g840c215	2060
Ionicons 4	MIT	4.6.3	696
Ionicons 5	MIT	5.5.4	1332
Material Design icons	Apache License Version 2.0	4.0.0-161-gf3fb4442b2	4341
Typicons	CC BY-SA 3.0	2.1.2	336
Github Octicons icons	MIT	18.3.0	264
Feather	MIT	4.29.2	287
Lucide	ISC	0.462.0	1541
Game Icons	CC BY 3.0	12920d6565588f0512542a3cb0cdfd36a497f910	4040
Weather Icons	SIL OFL 1.1	2.0.12	219
Devicons	MIT	1.8.0	192
Ant Design Icons	MIT	4.4.2	831
Bootstrap Icons

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trail-graph	Error		Sep 9, 2026 5:37pm UTC