Skip to content

fix(deps): update bun minor and patch dependencies - #1233

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/bun-minor-and-patch-dependencies
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/bun-minor-and-patch-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@better-auth/api-key (source) 1.7.10 → 1.7.12 age confidence
@better-auth/passkey (source) ^1.7.10 → ^1.7.12 age confidence
@better-auth/sso (source) ^1.7.10 → ^1.7.12 age confidence
@cloudflare/vite-plugin (source) ^1.64.0 → ^1.65.0 age confidence
@inquirer/prompts (source) ^8.7.3 → ^8.7.4 age confidence
@scalar/hono-api-reference (source) ^0.12.13 → ^0.12.14 age confidence
@tanstack/react-hotkeys (source) ^0.15.0 → ^0.16.0 age confidence
@tanstack/react-query (source) ^5.104.4 → ^5.104.5 age confidence
@tanstack/react-query-devtools (source) ^5.104.4 → ^5.104.5 age confidence
@tanstack/react-router (source) ^1.170.45 → ^1.170.46 age confidence
@tanstack/react-start (source) ^1.169.3 → ^1.169.4 age confidence
@tanstack/router-plugin (source) ^1.168.47 → ^1.168.48 age confidence
@types/bun (source) ^1.4.3 → ^1.4.4 age confidence
better-auth (source) ^1.7.10 → ^1.7.12 age confidence
dotenv ^18.0.8 → ^18.0.9 age confidence
effect (source) ^4.0.5 → ^4.0.6 age confidence
electron ^44.9.0 → ^44.9.3 age confidence
electron-builder (source) ^26.15.3 → ^26.18.0 age confidence
fumadocs-core ^16.17.5 → ^16.17.8 age confidence
fumadocs-mdx ^15.4.7 → ^15.4.10 age confidence
fumadocs-ui ^16.17.5 → ^16.17.8 age confidence
lucide-react (source) ^1.59.0 → ^1.61.0 age confidence
oxlint (source) 1.88.0 → 1.89.0 age confidence
oxlint-tsgolint 7.0.2004 → 7.0.2005 age confidence
shadcn (source) ^4.22.0 → ^4.22.1 age confidence
vite (source) ^8.3.4 → ^8.3.5 age confidence
wrangler (source) ^4.151.1 → ^4.152.0 age confidence

Release Notes

better-auth/better-auth (@​better-auth/api-key)

v1.7.12

Compare Source

v1.7.11

Compare Source

better-auth/better-auth (@​better-auth/passkey)

v1.7.12

Compare Source

v1.7.11

Compare Source

better-auth/better-auth (@​better-auth/sso)

v1.7.12

Compare Source

Patch Changes
  • #​11935 f5ea731 Thanks @​bytaesu! - OIDC SSO sign-in now rejects ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in.

v1.7.11

Compare Source

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.65.0

Compare Source

Minor Changes
  • #​16363 d3240f2 Thanks @​jamesopstad! - Remove the experimental.newConfig option from Vite plugin v1

    Vite plugin v1 now supports Wrangler configuration files only. Projects using cloudflare.config.ts for configuration should upgrade to Vite plugin v2 beta.

Patch Changes
  • #​16373 8cc5f87 Thanks @​petebacondarwin! - Report unsupported remote bindings under Bun instead of hanging

    Starting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.

  • #​16334 9cecd09 Thanks @​petebacondarwin! - Fix Container setup guidance in Vite development and preview

    Container registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.

  • #​16333 68d6eec Thanks @​petebacondarwin! - Update the local Workers runtime to the October 19 release

    Include the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.

    The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.

  • #​16379 160e655 Thanks @​petebacondarwin! - Update the local Workflow runtime to use native storage cleanup

    Consume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.

  • #​16289 bbe822f Thanks @​petebacondarwin! - Retry remote preview token refreshes after transient failures

    Backport the retry fix to the private remote-bindings workspace package and require wrangler@4.151.1 so long-running remote development sessions recover after a network outage.

  • #​16291 0262f7d Thanks @​petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenance

    Pin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.

SBoudrias/Inquirer.js (@​inquirer/prompts)

v8.7.4

Compare Source

@​inquirer/prompts@8.7.4
What's new
  • checkbox() no longer accepts edits or submissions while an async validator is pending — the selection is captured at submit time, and repeated Enter presses don't run the validator more than once (@inquirer/checkbox, #​2296).
  • Prompt output no longer leaks when a prompt is cancelled or aborted before its first render — the deferred initial render is now cancelled during cleanup, so a settled prompt never writes to an ended output stream or reinstalls keypress listeners (@inquirer/core, #​2318, relates to #​1816).
  • number() now treats whitespace-only input as empty, so a space-padded submit resolves to the default/undefined answer instead of a validation error (@inquirer/number, #​2307).
  • Packages with only test-file changes are no longer version-bumped at release time (internal tooling; #​2319).
Included
  • @inquirer/checkbox@^5.2.7
  • @inquirer/confirm@^6.3.4
  • @inquirer/editor@^5.3.5
  • @inquirer/expand@^5.1.7
  • @inquirer/input@^5.1.8
  • @inquirer/number@^4.2.5
  • @inquirer/password@^5.2.4
  • @inquirer/rawlist@^5.3.7
  • @inquirer/search@^4.3.5
  • @inquirer/select@^5.2.7
scalar/scalar (@​scalar/hono-api-reference)

v0.12.14

TanStack/hotkeys (@​tanstack/react-hotkeys)

v0.16.0

Compare Source

Minor Changes
  • #​194 db47b22 - Ship TanStack Intent skills with each package, so coding agents use the library's own APIs instead of hand-written keydown listeners and wrappers. @tanstack/hotkeys includes hotkeys-core and app-hotkeys, and each framework package includes a skill for its bindings. List them with npx @tanstack/intent@latest list.
Patch Changes

v0.15.1

Compare Source

Patch Changes
TanStack/query (@​tanstack/react-query)

v5.104.5

Compare Source

Patch Changes
  • #​12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
TanStack/query (@​tanstack/react-query-devtools)

v5.104.5

Compare Source

Patch Changes
TanStack/router (@​tanstack/react-router)

v1.170.46

Compare Source

Patch Changes
  • #​8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

  • #​8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

  • Updated dependencies [32a3360]:

TanStack/router (@​tanstack/react-start)

v1.169.4

Compare Source

Patch Changes
TanStack/router (@​tanstack/router-plugin)

v1.168.48

Compare Source

Patch Changes
better-auth/better-auth (better-auth)

v1.7.12

Compare Source

Patch Changes

v1.7.11

Compare Source

Patch Changes
motdotla/dotenv (dotenv)

v18.0.9

Compare Source

Changed
  • Permit DOTENV_PATH being empty string with the CLI (#​1076)
Effect-TS/effect (effect)

v4.0.6

Compare Source

Patch Changes
  • #​9674 ce13a48 Thanks @​effect-bot! - Allow Response.AllParts, Response.Part and Response.StreamPart to be called without a toolkit, decoding tool call and tool result parts for any tool name with unknown parameters and results.

  • #​9696 f3bbbb4 Thanks @​gcanti! - Fix Array.unionWith calling custom equivalence callbacks with values from the wrong input or in the wrong order.

  • #​9511 5547315 Thanks @​sledorze! - Speed up field copying in Data.Class, Data.Error, Request.Class and Persistable constructors.

  • #​9743 6093cfb Thanks @​effect-bot! - Fix AsyncResult equality treating unrelated Equal values with a matching tag and hash as equal.

  • #​9607 30319d5 Thanks @​effect-bot! - Fix Effect atoms dropping the latest exposed success when an asynchronous run fails, so an initialValue or a success published with get.setSelf remains available as the failure's previous success.

  • #​9313 74a7596 Thanks @​effect-bot! - Preserve Reactivity and global layers when replacing an atom runtime layer through registry initial values, so injected test layers retain shared invalidation and global services.

  • #​9190 bfb32a3 Thanks @​danieljvdm! - Log Atom scope finalizer failures at References.UnhandledLogLevel when an atom is disposed, using the atom runtime's logger. Interruption-only cleanup is not logged.

  • #​9522 f8bf7f4 Thanks @​tim-smart! - Add a skipInitialRun option to Atom.serializable and Atom.initialValue. A seeded effect or stream atom then keeps its hydrated or initial value instead of running on mount, until it is refreshed or a dependency changes. Factory get(...) calls and withReactivity keys are still tracked; dependencies read inside the effect are tracked from its first real run.

  • #​9718 7f3d3df Thanks @​fubhy! - Add Base64Url.encodePadded and a padding option to SchemaGetter.encodeBase64Url for consumers that require padded URL-safe Base64.

  • #​9698 db1046d Thanks @​effect-bot! - Encode HttpClientRequest.basicAuth credentials as UTF-8 before base64 encoding, so non-ASCII usernames and passwords no longer throw or get mangled.

  • #​9326 3c4f88a Thanks @​effect-bot! - Block imports of nested internal modules in the development and published package exports. These implementation details are not public APIs; public entry points remain available.

  • #​9441 916e709 Thanks @​fubhy! - Add the unstable Bytes module with concat, Equivalence, and Order for Uint8Array values. Stream.mkUint8Array now returns Uint8Array<ArrayBuffer>. Browser HTTP clients collect streamed request bodies without repeatedly copying accumulated bytes.

  • #​9470 916f843 Thanks @​tim-smart! - Reduce EventLog remote replay overhead by reusing decoded conflict payloads within each batch.

  • #​9617 66ec757 Thanks @​Marve10s! - Fix Effect.cachedInvalidateWithTTL caching a stale result when invalidated while the effect is running.

  • #​9499 daac06f Thanks @​schutzelaars! - Fix Effect.callback retaining completed suspension state, such as values received by Deferred.await or PubSub.take, until the next full GC.

  • #​9727 c2552ec Thanks @​Marve10s! - Fix Cause.pretty, Cause.prettyErrors, loggers and runMain overflowing the stack when an error's cause chain is cyclic.

  • #​9540 b02c1cd Thanks @​Marve10s! - Preserve falsy nested error causes (0, false, "", null) in Cause.prettyErrors and Cause.pretty.

  • #​9418 1855f1d Thanks @​jpowersdev! - Fix Channel.fromTransformStream so an upstream failure is reported when a read is pending, instead of the error raised by aborting the transform stream.

  • #​9602 683ed2c Thanks @​effect-bot! - Preserve Prompt.FilePart byte and URL data when chat history is exported or persisted as JSON. Encoding now produces tagged { _tag: "Uint8Array", base64 } and { _tag: "URL", href } objects that decode back to their original types, and Chat.Persistence reports undecodable stored history as a PersistenceError instead of a defect.

  • #​9238 ac68940 Thanks @​effect-bot! - Fix child-process cleanup without forceKillAfter to give remaining process-group members up to one second to exit after the leader exits. Clarify that waiting for the leader has no time limit and never escalates to SIGKILL when forceKillAfter is omitted.

  • #​9611 22a8401 Thanks @​itisrmk! - Fix Chunk.get and Chunk.getUnsafe throwing on in-range fractional indexes of one-element chunks, and treat NaN and infinite indexes as out of bounds.

  • #​9287 c53c194 Thanks @​devangpratap! - Fix the CLI lexer treating a short option cluster with an inline value, such as -vn=3, as one unknown flag instead of -v -n=3. A single dash followed by a multi-character name, such as -num=3, is now also split into separate flags; use --num=3 instead.

  • #​9655 ca6d1cc Thanks @​effect-bot! - Add Command.validate and CliError.ValidationError to the unstable CLI. validate checks the parsed input before the handler runs, for rules such as mutually exclusive flags. A failure is shown with the command help, like any parse error.

  • #​9650 47940c5 Thanks @​effect-bot! - Add Flag.withNegation and Flag.withoutNegation (with Param counterparts) to rename or remove the --no-<name> form of boolean flags in parsing and shell completions.

  • #​9285 e8b24ef Thanks @​okarin1511! - Fix the CLI treating --=value as a flag with an empty name. The argument is now passed through unchanged as a plain value, so it no longer fails with Unrecognized flag: --.

  • #​9666 2e8aae0 Thanks @​effect-bot! - Allow Command.withExamples to take a function that receives { commandPath }, so help examples match wherever a command is mounted.

  • #​8350 ad7497b Thanks @​ArjunCodess! - Add a TerminalCapabilities reference and layer to effect/cli; built-in Command help, version, and error output now follows it, so FORCE_COLOR enables color off a TTY and TERM=dumb disables it.

  • #​9248 7f504a3 Thanks @​bezff! - Fix the ClickHouse migrator creating its ledger with SQLite syntax and wrapping the run in BEGIN TRANSACTION.

  • #​9395 99e365d Thanks @​effect-bot! - Prevent Effect.forkIn and Effect.forkScoped from running work in an already-closed scope, even when startImmediately or uninterruptible is enabled. They now return an interrupted fiber without executing the supplied effect.

  • #​9407 954067d Thanks @​effect-bot! - Log and retry failures when scheduling the initial ClusterCron run so transient failures no longer leave the cron stopped.

  • #​9677 3e1a035 Thanks @​effect-bot! - Fix ClusterCron with calculateNextRunFromPrevious: true not resuming after its pending run was lost.

    In this mode every run is now processed by a single executor entity per cron job, so a restart no longer starts a second chain: runs never overlap and missed runs are caught up in order. Pending runs scheduled by earlier releases join the executor's chain. As a result, Entity.CurrentAddress inside execute no longer identifies the scheduled time; use the new ClusterCron.CurrentScheduledTime service instead, which is available in both modes.

    Failed runs are still retried until they succeed or are older than skipIfOlderThan, but in this mode a failing run now blocks later runs while it is retried, instead of later runs executing alongside it.

  • #​9577 41a1fe7 Thanks @​tim-smart! - ClusterMetrics.entities now reads the active entity count when metrics are snapshotted, instead of being updated by a loop once a second. The series is recorded in the MetricRegistry of the entity manager's context and removed when the entity manager shuts down.

  • #​9475 bcb3a86 Thanks @​effect-bot! - Warn when a forced cluster shard release remains pending beyond shardLockExpiration, including the affected shards and pending entity types and singletons. Release failures now emit rate-limited warnings while preserving the requirement that teardown and lock release finish before reacquisition.

  • #​9336 739d3d1 Thanks @​effect-bot! - Answer fresh, locally owned persisted cluster requests from a reply handler registered before the request is saved, instead of reading every local reply back from storage or polling for it. Duplicates and streams still read their replies from storage, and a dropped reply handler now falls back to storage immediately instead of waiting for the next poll. MessageStorage.registerReplyHandler must register its handler as soon as the effect starts.

  • #​9732 ed4da35 Thanks @​effect-bot! - Read persisted cluster messages from storage as soon as their entity type registers, instead of waiting for the next entityMessagePollInterval.

  • #​9716 3d84e19 Thanks @​tim-smart! - Fix cluster shard releases waiting out entityTerminationTimeout when the shard moves while an entity is waiting to restart after a defect.

  • #​9256 cc00906 Thanks @​Tanner-Scadden! - Add ClusterMetrics.shardReleaseDuration, a timer recording how long each completed shard release takes.

  • #​9244 09ba1f5 Thanks @​effect-bot! - Keep the cluster shards gauge accurate when shards are released or shard locks are lost.

  • #​9513 9ff1a73 Thanks @​effect-bot! - Repeat the stalled forced shard release warning every max(shardLockExpiration, 30 seconds) while the release stays pending, and add the ClusterMetrics.shardsReleasing gauge (effect_cluster_shards_releasing) counting the shards a runner is still releasing.

  • #​9443 06bc532 Thanks @​effect-bot! - Fix a Sharding startup race that could access singleton synchronization before initialization, causing a ReferenceError and delaying shutdown.

  • #​6441 97bfd84 Thanks @​sbking! - Fix SQL Server support in cluster SqlMessageStorage. Message claims and duplicate checks now use valid T-SQL. The SQL Server tables use filtered unique indexes instead of nullable UNIQUE constraints, and NVARCHAR(MAX) instead of TEXT, so keyless messages and chunked replies can be stored.

  • #​9645 25efaef Thanks @​effect-bot! - Fix ClusterWorkflowEngine losing a Workflow.interrupt sent while a run was still saving its Suspended reply.

  • #​9394 c10335b Thanks @​effect-bot! - Fix suspended cluster workflow scopes not being released when an execution completes. Earlier runs retain their resources through suspension and release them on completion or owner teardown, without running durable workflow finalizers on abandonment.

  • #​9490 a808972 Thanks @​tim-smart! - Remove regex lookbehind from ConfigProvider variable expansion to prevent module-loading syntax errors on Safari versions before 16.4, while preserving interpolation and escaping behavior.

  • #​9621 20e844c Thanks @​Marve10s! - Fix Config.schema dropping record entries for numeric key schemas such as Schema.Int or Schema.Number.

  • #​9539 b9f73f3 Thanks @​Marve10s! - Fix Cron.prev skipping an occurrence earlier in the same second as the input.

  • #​9719 5739878 Thanks @​Marve10s! - Fix DateTime.formatIsoDate and DateTime.formatIsoDateUtc dropping the day for years before 0000 or after 9999.

  • #​9654 28acdf3 Thanks @​okarin1511! - Fix DateTime.zoneFromString rejecting "GMT" and accept compact UTC offsets without colon

  • #​9582 59b6396 Thanks @​itisrmk! - Accept lowercase z and gmt zone designators in DateTime.make and DateTime.makeUnsafe. These strings previously had a second Z appended and were rejected.

  • #​9725 0bccc9c Thanks @​Marve10s! - Fix DateTime values in named time zones turning year zero and BCE dates into CE years.

  • #​9437 fed70de Thanks @​effect-bot! - Add DecisionModel.decideSettled to retain valid answers alongside per-decision Result failures (Missing, Refused, NoDistribution, or Invalid). Provider failures still fail the effect; decide remains all-or-nothing.

    OpenRouter now passes missing distributions to core validation. OpenAI reports refusals per decision and wrong-kind score answers as invalid rather than missing.

    Update hand-built services to implement decideSettled, handle optional provider probabilities and refusal answers, and use settled outcomes instead of the removed OpenAiContentPolicyMetadata and metadata.openai.refusedDecisions.

  • #​9422 82648a2 Thanks @​candrewlee14! - DecisionModel.decide now returns the response id, the modelId that answered and provider metadata. OpenRouterDecisionModel reports cost and the serving provider under metadata.openrouter.

  • #​9436 afb5f32 Thanks @​jpowersdev! - Fix Channel.decodeText and Stream.decodeText dropping incomplete trailing characters. Flush buffered bytes on normal completion, emitting U+FFFD by default or a defect with `fa

[!IMPORTANT]
✂ PR body was truncated to here.

@coderabbitai

coderabbitai Bot commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4ecbd7b5-6dbe-46e2-af41-9b9916dd4c2f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch from 5cefd46 to cd8a053 Compare October 21, 2026 04:34
@renovate renovate Bot changed the title fix(deps): update dependency shadcn to ^4.22.1 fix(deps): update bun minor and patch dependencies Oct 21, 2026
@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 24 times, most recently from 8977df2 to 3f503eb Compare October 25, 2026 13:17
@renovate
renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch from 3f503eb to cca1668 Compare October 25, 2026 17:38

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants