Repository navigation
fix(deps): update bun minor and patch dependencies - #1233
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
|
renovate
Bot
force-pushed
the
renovate/bun-minor-and-patch-dependencies
branch
from
October 21, 2026 04:34
5cefd46 to
cd8a053
Compare
renovate
Bot
force-pushed
the
renovate/bun-minor-and-patch-dependencies
branch
24 times, most recently
from
October 25, 2026 13:17
8977df2 to
3f503eb
Compare
renovate
Bot
force-pushed
the
renovate/bun-minor-and-patch-dependencies
branch
from
October 25, 2026 17:38
3f503eb to
cca1668
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
1.7.10→1.7.12^1.7.10→^1.7.12^1.7.10→^1.7.12^1.64.0→^1.65.0^8.7.3→^8.7.4^0.12.13→^0.12.14^0.15.0→^0.16.0^5.104.4→^5.104.5^5.104.4→^5.104.5^1.170.45→^1.170.46^1.169.3→^1.169.4^1.168.47→^1.168.48^1.4.3→^1.4.4^1.7.10→^1.7.12^18.0.8→^18.0.9^4.0.5→^4.0.6^44.9.0→^44.9.3^26.15.3→^26.18.0^16.17.5→^16.17.8^15.4.7→^15.4.10^16.17.5→^16.17.8^1.59.0→^1.61.01.88.0→1.89.07.0.2004→7.0.2005^4.22.0→^4.22.1^8.3.4→^8.3.5^4.151.1→^4.152.0Release Notes
better-auth/better-auth (@better-auth/api-key)
v1.7.12Compare Source
v1.7.11Compare Source
better-auth/better-auth (@better-auth/passkey)
v1.7.12Compare Source
v1.7.11Compare Source
better-auth/better-auth (@better-auth/sso)
v1.7.12Compare Source
Patch Changes
f5ea731Thanks @bytaesu! - OIDC SSO sign-in now rejects ID tokens missingexporiatand providers with an empty client ID, matching social sign-in.v1.7.11Compare Source
cloudflare/workers-sdk (@cloudflare/vite-plugin)
v1.65.0Compare Source
Minor Changes
#16363
d3240f2Thanks @jamesopstad! - Remove theexperimental.newConfigoption from Vite plugin v1Vite plugin v1 now supports Wrangler configuration files only. Projects using
cloudflare.config.tsfor configuration should upgrade to Vite plugin v2 beta.Patch Changes
#16373
8cc5f87Thanks @petebacondarwin! - Report unsupported remote bindings under Bun instead of hangingStarting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.
#16334
9cecd09Thanks @petebacondarwin! - Fix Container setup guidance in Vite development and previewContainer registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.
#16333
68d6eecThanks @petebacondarwin! - Update the local Workers runtime to the October 19 releaseInclude the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.
The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.
#16379
160e655Thanks @petebacondarwin! - Update the local Workflow runtime to use native storage cleanupConsume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.
#16289
bbe822fThanks @petebacondarwin! - Retry remote preview token refreshes after transient failuresBackport the retry fix to the private remote-bindings workspace package and require
wrangler@4.151.1so long-running remote development sessions recover after a network outage.#16291
0262f7dThanks @petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenancePin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.
SBoudrias/Inquirer.js (@inquirer/prompts)
v8.7.4Compare Source
@inquirer/prompts@8.7.4
What's new
checkbox()no longer accepts edits or submissions while an async validator is pending — the selection is captured at submit time, and repeated Enter presses don't run the validator more than once (@inquirer/checkbox, #2296).@inquirer/core, #2318, relates to #1816).number()now treats whitespace-only input as empty, so a space-padded submit resolves to the default/undefined answer instead of a validation error (@inquirer/number, #2307).Included
@inquirer/checkbox@^5.2.7@inquirer/confirm@^6.3.4@inquirer/editor@^5.3.5@inquirer/expand@^5.1.7@inquirer/input@^5.1.8@inquirer/number@^4.2.5@inquirer/password@^5.2.4@inquirer/rawlist@^5.3.7@inquirer/search@^4.3.5@inquirer/select@^5.2.7scalar/scalar (@scalar/hono-api-reference)
v0.12.14TanStack/hotkeys (@tanstack/react-hotkeys)
v0.16.0Compare Source
Minor Changes
db47b22- Ship TanStack Intent skills with each package, so coding agents use the library's own APIs instead of hand-written keydown listeners and wrappers.@tanstack/hotkeysincludeshotkeys-coreandapp-hotkeys, and each framework package includes a skill for its bindings. List them withnpx @tanstack/intent@latest list.Patch Changes
db47b22]:v0.15.1Compare Source
Patch Changes
daecd95]:TanStack/query (@tanstack/react-query)
v5.104.5Compare Source
Patch Changes
1f8d134- RecomputeuseMutationStateanduseIsMutatingresults when their filters, selector, or query client change, without waiting for a mutation cache update.f608f93]:TanStack/query (@tanstack/react-query-devtools)
v5.104.5Compare Source
Patch Changes
1f8d134]:TanStack/router (@tanstack/react-router)
v1.170.46Compare Source
Patch Changes
#8670
32a3360- Reference agent skills in other packages by theirintent loadidentifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.#8671
689a7c5- Publish the@tanstack/react-routeragent skills (react-router,compositions/router-query,lifecycle/migrate-from-react-router), which were missing from the package'sfileslist.Updated dependencies [
32a3360]:TanStack/router (@tanstack/react-start)
v1.169.4Compare Source
Patch Changes
#8670
32a3360- Reference agent skills in other packages by theirintent loadidentifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.Updated dependencies [
32a3360,689a7c5,ed55775,63a886d,d9b07e8]:TanStack/router (@tanstack/router-plugin)
v1.168.48Compare Source
Patch Changes
#8670
32a3360- Reference agent skills in other packages by theirintent loadidentifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.#8737
647cb73- Remove theenableRouteGenerationoption. Route generation now always runs, soautoCodeSplittingalways has the route metadata it needs.Updated dependencies [
32a3360,689a7c5]:better-auth/better-auth (better-auth)
v1.7.12Compare Source
Patch Changes
#11925
fb48619Thanks @bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.#11924
681aa5cThanks @bytaesu! -auth.api.getSession()now keeps the original database error aserror.causewhen the session lookup fails, so server code can tell a transient failure from a bug.#11930
b18e3b8Thanks @bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.Updated dependencies [
681aa5c,4bc78ba,876608d,083a743,492134a]:v1.7.11Compare Source
Patch Changes
#10719
bd65db0Thanks @rendermani! - Recognize PostgreSQLint8as a valid number type in migration diffs. Kysely's introspector reportspg_type.typname, so Better Auth's ownbigintcolumns (such as the database-backed rate limiter'slastRequest) came back asint8and were reported as a type mismatch on every run.#11521
37a75c9Thanks @aryan1306! - Fix database-backed rate limiting returning an excessively largeX-Retry-Afterheader instead of the remaining seconds in the rate-limit window.Updated dependencies [
ce96569,2f6ca3f,dfd8dd2]:motdotla/dotenv (dotenv)
v18.0.9Compare Source
Changed
Effect-TS/effect (effect)
v4.0.6Compare Source
Patch Changes
#9674
ce13a48Thanks @effect-bot! - AllowResponse.AllParts,Response.PartandResponse.StreamPartto be called without a toolkit, decoding tool call and tool result parts for any tool name withunknownparameters and results.#9696
f3bbbb4Thanks @gcanti! - FixArray.unionWithcalling custom equivalence callbacks with values from the wrong input or in the wrong order.#9511
5547315Thanks @sledorze! - Speed up field copying inData.Class,Data.Error,Request.ClassandPersistableconstructors.#9743
6093cfbThanks @effect-bot! - FixAsyncResultequality treating unrelatedEqualvalues with a matching tag and hash as equal.#9607
30319d5Thanks @effect-bot! - Fix Effect atoms dropping the latest exposed success when an asynchronous run fails, so aninitialValueor a success published withget.setSelfremains available as the failure's previous success.#9313
74a7596Thanks @effect-bot! - Preserve Reactivity and global layers when replacing an atom runtime layer through registry initial values, so injected test layers retain shared invalidation and global services.#9190
bfb32a3Thanks @danieljvdm! - Log Atom scope finalizer failures atReferences.UnhandledLogLevelwhen an atom is disposed, using the atom runtime's logger. Interruption-only cleanup is not logged.#9522
f8bf7f4Thanks @tim-smart! - Add askipInitialRunoption toAtom.serializableandAtom.initialValue. A seeded effect or stream atom then keeps its hydrated or initial value instead of running on mount, until it is refreshed or a dependency changes. Factoryget(...)calls andwithReactivitykeys are still tracked; dependencies read inside the effect are tracked from its first real run.#9718
7f3d3dfThanks @fubhy! - AddBase64Url.encodePaddedand apaddingoption toSchemaGetter.encodeBase64Urlfor consumers that require padded URL-safe Base64.#9698
db1046dThanks @effect-bot! - EncodeHttpClientRequest.basicAuthcredentials as UTF-8 before base64 encoding, so non-ASCII usernames and passwords no longer throw or get mangled.#9326
3c4f88aThanks @effect-bot! - Block imports of nested internal modules in the development and published package exports. These implementation details are not public APIs; public entry points remain available.#9441
916e709Thanks @fubhy! - Add the unstableBytesmodule withconcat,Equivalence, andOrderforUint8Arrayvalues.Stream.mkUint8Arraynow returnsUint8Array<ArrayBuffer>. Browser HTTP clients collect streamed request bodies without repeatedly copying accumulated bytes.#9470
916f843Thanks @tim-smart! - Reduce EventLog remote replay overhead by reusing decoded conflict payloads within each batch.#9617
66ec757Thanks @Marve10s! - FixEffect.cachedInvalidateWithTTLcaching a stale result when invalidated while the effect is running.#9499
daac06fThanks @schutzelaars! - FixEffect.callbackretaining completed suspension state, such as values received byDeferred.awaitorPubSub.take, until the next full GC.#9727
c2552ecThanks @Marve10s! - FixCause.pretty,Cause.prettyErrors, loggers andrunMainoverflowing the stack when an error'scausechain is cyclic.#9540
b02c1cdThanks @Marve10s! - Preserve falsy nested error causes (0,false,"",null) inCause.prettyErrorsandCause.pretty.#9418
1855f1dThanks @jpowersdev! - FixChannel.fromTransformStreamso an upstream failure is reported when a read is pending, instead of the error raised by aborting the transform stream.#9602
683ed2cThanks @effect-bot! - PreservePrompt.FilePartbyte and URL data when chat history is exported or persisted as JSON. Encoding now produces tagged{ _tag: "Uint8Array", base64 }and{ _tag: "URL", href }objects that decode back to their original types, andChat.Persistencereports undecodable stored history as aPersistenceErrorinstead of a defect.#9238
ac68940Thanks @effect-bot! - Fix child-process cleanup withoutforceKillAfterto give remaining process-group members up to one second to exit after the leader exits. Clarify that waiting for the leader has no time limit and never escalates toSIGKILLwhenforceKillAfteris omitted.#9611
22a8401Thanks @itisrmk! - FixChunk.getandChunk.getUnsafethrowing on in-range fractional indexes of one-element chunks, and treatNaNand infinite indexes as out of bounds.#9287
c53c194Thanks @devangpratap! - Fix the CLI lexer treating a short option cluster with an inline value, such as-vn=3, as one unknown flag instead of-v -n=3. A single dash followed by a multi-character name, such as-num=3, is now also split into separate flags; use--num=3instead.#9655
ca6d1ccThanks @effect-bot! - AddCommand.validateandCliError.ValidationErrorto the unstable CLI.validatechecks the parsed input before the handler runs, for rules such as mutually exclusive flags. A failure is shown with the command help, like any parse error.#9650
47940c5Thanks @effect-bot! - AddFlag.withNegationandFlag.withoutNegation(withParamcounterparts) to rename or remove the--no-<name>form of boolean flags in parsing and shell completions.#9285
e8b24efThanks @okarin1511! - Fix the CLI treating--=valueas a flag with an empty name. The argument is now passed through unchanged as a plain value, so it no longer fails withUnrecognized flag: --.#9666
2e8aae0Thanks @effect-bot! - AllowCommand.withExamplesto take a function that receives{ commandPath }, so help examples match wherever a command is mounted.#8350
ad7497bThanks @ArjunCodess! - Add aTerminalCapabilitiesreference and layer toeffect/cli; built-inCommandhelp, version, and error output now follows it, soFORCE_COLORenables color off a TTY andTERM=dumbdisables it.#9248
7f504a3Thanks @bezff! - Fix the ClickHouse migrator creating its ledger with SQLite syntax and wrapping the run inBEGIN TRANSACTION.#9395
99e365dThanks @effect-bot! - PreventEffect.forkInandEffect.forkScopedfrom running work in an already-closed scope, even whenstartImmediatelyoruninterruptibleis enabled. They now return an interrupted fiber without executing the supplied effect.#9407
954067dThanks @effect-bot! - Log and retry failures when scheduling the initial ClusterCron run so transient failures no longer leave the cron stopped.#9677
3e1a035Thanks @effect-bot! - FixClusterCronwithcalculateNextRunFromPrevious: truenot resuming after its pending run was lost.In this mode every run is now processed by a single
executorentity per cron job, so a restart no longer starts a second chain: runs never overlap and missed runs are caught up in order. Pending runs scheduled by earlier releases join the executor's chain. As a result,Entity.CurrentAddressinsideexecuteno longer identifies the scheduled time; use the newClusterCron.CurrentScheduledTimeservice instead, which is available in both modes.Failed runs are still retried until they succeed or are older than
skipIfOlderThan, but in this mode a failing run now blocks later runs while it is retried, instead of later runs executing alongside it.#9577
41a1fe7Thanks @tim-smart! -ClusterMetrics.entitiesnow reads the active entity count when metrics are snapshotted, instead of being updated by a loop once a second. The series is recorded in theMetricRegistryof the entity manager's context and removed when the entity manager shuts down.#9475
bcb3a86Thanks @effect-bot! - Warn when a forced cluster shard release remains pending beyondshardLockExpiration, including the affected shards and pending entity types and singletons. Release failures now emit rate-limited warnings while preserving the requirement that teardown and lock release finish before reacquisition.#9336
739d3d1Thanks @effect-bot! - Answer fresh, locally owned persisted cluster requests from a reply handler registered before the request is saved, instead of reading every local reply back from storage or polling for it. Duplicates and streams still read their replies from storage, and a dropped reply handler now falls back to storage immediately instead of waiting for the next poll.MessageStorage.registerReplyHandlermust register its handler as soon as the effect starts.#9732
ed4da35Thanks @effect-bot! - Read persisted cluster messages from storage as soon as their entity type registers, instead of waiting for the nextentityMessagePollInterval.#9716
3d84e19Thanks @tim-smart! - Fix cluster shard releases waiting outentityTerminationTimeoutwhen the shard moves while an entity is waiting to restart after a defect.#9256
cc00906Thanks @Tanner-Scadden! - AddClusterMetrics.shardReleaseDuration, a timer recording how long each completed shard release takes.#9244
09ba1f5Thanks @effect-bot! - Keep the cluster shards gauge accurate when shards are released or shard locks are lost.#9513
9ff1a73Thanks @effect-bot! - Repeat the stalled forced shard release warning everymax(shardLockExpiration, 30 seconds)while the release stays pending, and add theClusterMetrics.shardsReleasinggauge (effect_cluster_shards_releasing) counting the shards a runner is still releasing.#9443
06bc532Thanks @effect-bot! - Fix a Sharding startup race that could access singleton synchronization before initialization, causing a ReferenceError and delaying shutdown.#6441
97bfd84Thanks @sbking! - Fix SQL Server support in clusterSqlMessageStorage. Message claims and duplicate checks now use valid T-SQL. The SQL Server tables use filtered unique indexes instead of nullableUNIQUEconstraints, andNVARCHAR(MAX)instead ofTEXT, so keyless messages and chunked replies can be stored.#9645
25efaefThanks @effect-bot! - FixClusterWorkflowEnginelosing aWorkflow.interruptsent while a run was still saving itsSuspendedreply.#9394
c10335bThanks @effect-bot! - Fix suspended cluster workflow scopes not being released when an execution completes. Earlier runs retain their resources through suspension and release them on completion or owner teardown, without running durable workflow finalizers on abandonment.#9490
a808972Thanks @tim-smart! - Remove regex lookbehind from ConfigProvider variable expansion to prevent module-loading syntax errors on Safari versions before 16.4, while preserving interpolation and escaping behavior.#9621
20e844cThanks @Marve10s! - FixConfig.schemadropping record entries for numeric key schemas such asSchema.IntorSchema.Number.#9539
b9f73f3Thanks @Marve10s! - FixCron.prevskipping an occurrence earlier in the same second as the input.#9719
5739878Thanks @Marve10s! - FixDateTime.formatIsoDateandDateTime.formatIsoDateUtcdropping the day for years before 0000 or after 9999.#9654
28acdf3Thanks @okarin1511! - Fix DateTime.zoneFromString rejecting "GMT" and accept compact UTC offsets without colon#9582
59b6396Thanks @itisrmk! - Accept lowercasezandgmtzone designators inDateTime.makeandDateTime.makeUnsafe. These strings previously had a secondZappended and were rejected.#9725
0bccc9cThanks @Marve10s! - FixDateTimevalues in named time zones turning year zero and BCE dates into CE years.#9437
fed70deThanks @effect-bot! - AddDecisionModel.decideSettledto retain valid answers alongside per-decisionResultfailures (Missing,Refused,NoDistribution, orInvalid). Provider failures still fail the effect;decideremains all-or-nothing.OpenRouter now passes missing distributions to core validation. OpenAI reports refusals per decision and wrong-kind score answers as invalid rather than missing.
Update hand-built services to implement
decideSettled, handle optional providerprobabilitiesand refusal answers, and use settled outcomes instead of the removedOpenAiContentPolicyMetadataandmetadata.openai.refusedDecisions.#9422
82648a2Thanks @candrewlee14! -DecisionModel.decidenow returns the responseid, themodelIdthat answered and providermetadata.OpenRouterDecisionModelreportscostand the serving provider undermetadata.openrouter.#9436
afb5f32Thanks @jpowersdev! - FixChannel.decodeTextandStream.decodeTextdropping incomplete trailing characters. Flush buffered bytes on normal completion, emitting U+FFFD by default or a defect with `fa