Skip to content

chore(deps): bump the dependencies group with 10 updates - #173

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-3e4a200c21
Open

chore(deps): bump the dependencies group with 10 updates#173
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-3e4a200c21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 10 updates:

Package From To
@biomejs/biome 2.6.3 2.6.4
dotenv-cli 11.0.0 11.1.0
@discordjs/core 2.6.0 2.7.0
bullmq 6.4.2 6.5.3
@types/node 26.6.5 26.6.6
@react-router/node 8.5.0 8.5.1
@react-router/serve 8.5.0 8.5.1
better-auth 1.7.12 1.7.15
react-router 8.5.0 8.5.1
@react-router/dev 8.5.0 8.5.1

Updates @biomejs/biome from 2.6.3 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

  • #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

    console.log("abc ", "def");

  • #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

    const items = array.flat(2);

  • #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

    let foo = null;

  • #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

    function add(item) {
  return items.push(item);
}

  • #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

    const foo = (bar => (bar ? bar.baz : baz))(getBar());

  • #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

    function findRoot(node) {
    if (node.parent) {
        return findRoot(node.parent);
    }
    return node;
}

  • #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Commits

Updates dotenv-cli from 11.0.0 to 11.1.0

Release notes

Sourced from dotenv-cli's releases.

v11.1.0

What's Changed

New Contributors

Full Changelog: entropitor/dotenv-cli@v11.0.0...v11.1.0

Commits

Updates @discordjs/core from 2.6.0 to 2.7.0

Release notes

Sourced from @​discordjs/core's releases.

@​discordjs/core@​2.7.0

Bug Fixes

Features

  • invites: Backport invite target users and role (#11590) (e779c1c)
Changelog

Sourced from @​discordjs/core's changelog.

@​discordjs/core@2.7.0 - (2026-10-30)

Bug Fixes

Features

  • invites: Backport invite target users and role (#11590) (e779c1c)
Commits

Updates bullmq from 6.4.2 to 6.5.3

Release notes

Sourced from bullmq's releases.

v6.5.3

6.5.3 (2026-10-31)

Bug Fixes

  • node-redis: clear ended status when connect() reopens the client (#4952) (0928d9f)

v6.5.2

6.5.2 (2026-10-30)

Bug Fixes

  • relay: format exclusive time bounds without precision loss (#5043) (19ae429)

v6.5.1

6.5.1 (2026-10-28)

Bug Fixes

  • flow: defer parent release until all children are added (python) (elixir) (rust) (dotnet) (#4988) fixes #4944 (0e1a990)

v6.5.0

6.5.0 (2026-10-26)

Features

  • enforce node: protocol for built-in module imports (#5016) (52255a9)
Commits

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates @react-router/node from 8.5.0 to 8.5.1

Release notes

Sourced from @​react-router/node's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

Changelog

Sourced from @​react-router/node's changelog.

v8.5.1

Patch Changes

Commits

Updates @react-router/serve from 8.5.0 to 8.5.1

Release notes

Sourced from @​react-router/serve's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

Changelog

Sourced from @​react-router/serve's changelog.

v8.5.1

Patch Changes

Commits

Updates better-auth from 1.7.12 to 1.7.15

Release notes

Sourced from better-auth's releases.

v1.7.15

better-auth

Bug Fixes

  • Fixed organization and API key metadata, and OAuth proxy sign-ins with a constructor field in additionalData, failing with a prototype pollution error (#12142)
  • Improved BETTER_AUTH_SECRETS error messages to report the entry position instead of including the entry value (#12098)
  • Fixed the admin update-user endpoint to reject data.id with a 400 error instead of attempting to change the user's primary key (#12099)
  • Fixed the admin plugin to reject banned users when a session is created outside an endpoint, such as through internalAdapter.createSession (#12100)
  • Fixed headers and cookies set by a non-returning hooks.before hook being dropped from the response, with the endpoint's value winning when both set the same header or cookie (#12145)
  • Fixed the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment (#12109)
  • Fixed the genericOAuth HubSpot helper truncating access tokens with reserved characters and now returning null instead of requesting /access-tokens/undefined when no token is present (#12108)
  • Fixed /sign-in/username and /is-username-available rejecting usernames that sign-up accepts when validationOrder.username is post-normalization (#12097)

For detailed changes, see CHANGELOG

auth

Bug Fixes

  • Fixed auth init for Remix and React Router v7 to generate an app/routes/api.auth.$.ts resource route that mounts auth.handler instead of a second auth instance with an unsupported database option (#12118)
  • Fixed auth ai overwriting MCP config files it cannot parse, such as those with comments or trailing commas, by leaving them unchanged and printing the config to add manually (#12111)
  • Fixed auth login and auth logout re-launching the CLI through npx auth@latest in an endless loop (#12110)
  • Fixed auth init hanging during database migration and removed a stray debug line about path aliases (#12148)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

  • Fixed /subscription/success returning a 500 for non-string callbackURL and checkoutSessionId query values by rejecting them with a 400 (#12105)
  • Fixed /subscription/success to validate callbackURL against trusted origins after replacing {CHECKOUT_SESSION_ID}, preventing redirects to untrusted origins via checkoutSessionId (#12102)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

  • Fixed API keys in secondary storage failing to verify, load, and list when the storage client returns already-parsed JSON, such as @upstash/redis (#12107)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

  • Fixed the Node metadata transport crashing the process on responses with an out-of-range status or invalid reason phrase by reporting the client as invalid_client (#12103)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.15

Patch Changes

  • #12100 7769e91 Thanks @​bytaesu! - The admin plugin now rejects banned users when a session is created outside an endpoint, such as through internalAdapter.createSession.

  • #12099 3f17193 Thanks @​bytaesu! - The admin update-user endpoint now rejects data.id with a 400 error instead of attempting to change the user's primary key.

  • #12145 804ba8a Thanks @​bytaesu! - Headers and cookies set by a hooks.before hook that does not return early now reach the response instead of being dropped. When the endpoint sets the same header or cookie, the endpoint's value wins.

  • #12108 1391673 Thanks @​bytaesu! - The HubSpot helper in genericOAuth now encodes the access token as a single path segment when fetching token info, so tokens containing reserved characters are no longer truncated, and it returns null instead of requesting /access-tokens/undefined when no access token is present.

  • #12142 f63fb0e Thanks @​bytaesu! - Organization and API key metadata, and OAuth proxy sign-ins whose additionalData contains a constructor field, no longer fail with "Potential prototype pollution attempt detected".

  • #12098 4cdcb1c Thanks @​bytaesu! - Error messages for a malformed BETTER_AUTH_SECRETS entry now report the entry position instead of including the entry value.

  • #12097 6e7fa27 Thanks @​bytaesu! - Fixed /sign-in/username and /is-username-available rejecting a username that sign-up accepts when validationOrder.username is post-normalization. Both endpoints now validate the same value as sign-up.

  • #12109 264de2b Thanks @​bytaesu! - Fix the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment.

  • Updated dependencies [9ef0c5b]:

    • @​better-auth/core@​1.7.15
    • @​better-auth/drizzle-adapter@​1.7.15
    • @​better-auth/kysely-adapter@​1.7.15
    • @​better-auth/memory-adapter@​1.7.15
    • @​better-auth/mongo-adapter@​1.7.15
    • @​better-auth/prisma-adapter@​1.7.15
    • @​better-auth/telemetry@​1.7.15

1.7.14

Patch Changes

  • #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

  • Updated dependencies [2947ab7]:

    • @​better-auth/core@​1.7.14
    • @​better-auth/drizzle-adapter@​1.7.14
    • @​better-auth/kysely-adapter@​1.7.14
    • @​better-auth/memory-adapter@​1.7.14
    • @​better-auth/mongo-adapter@​1.7.14
    • @​better-auth/prisma-adapter@​1.7.14
    • @​better-auth/telemetry@​1.7.14

1.7.13

Patch Changes

  • #11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

... (truncated)

Commits
  • e556c07 chore: release v1.7.15 (#12101)
  • 804ba8a fix(api): keep response headers set by before hooks (#12145)
  • f63fb0e fix: accept constructor keys in strict JSON parsing (#12142)
  • 95d158b test(session): stabilize refresh and expiration tests (#12116)
  • 264de2b fix(client): keep vue ssr session fetch relative without baseURL (#12109)
  • 1391673 fix(generic-oauth): encode HubSpot access token as a path parameter (#12108)
  • 6e7fa27 fix(username): honor validationOrder on sign-in and availability check (#12097)
  • 7769e91 fix(admin): reject banned users when creating sessions outside an endpoint (#...
  • 3f17193 fix(admin): reject id in update-user data (#12099)
  • 4cdcb1c fix: report position instead of value in BETTER_AUTH_SECRETS errors (#12098)
  • Additional commits viewable in compare view

Updates react-router from 8.5.0 to 8.5.1

Release notes

Sourced from react-router's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

Changelog

Sourced from react-router's changelog.

v8.5.1

Patch Changes

  • Fix URIError: URI malformed when an ssr: false dev server receives a URL path with a malformed percent-encoding (#15649)
  • Bound server route manifest processing for paths with expensive route expansion (#15703)
    • Fall back to initial route discovery during server rendering and RSC document/data requests
    • Account for the number and depth of candidate branches when using regex matching
  • Encode commas within paths sent to the lazy route discovery manifest endpoint so routes with commas in their paths are discovered correctly (#15640)
  • Fix fetcher revalidation errors bubbling to the root error boundary instead of the nearest boundary above the route that owns the fetcher (#15676)
  • Avoid duplicate history entries when posting a <Form> to the current URL with an encoded action (#15679)
    • Replace the current history entry when the action contains characters that get percent-encoded, such as spaces or non-ASCII characters
  • Fix an unhandled promise rejection when the browser skips a viewTransition navigation, for example in a hidden tab (#15582)
  • Bubble rejected lazy.Component imports on loader-less routes to the nearest error boundary (#15658)
    • Render the error boundary instead of a blank page
  • Preserve pending fetcher mutation revalidation when an older navigation or background reload completes to prevent stale loader data (#15686)
    • Keep newer fetcher loads cancellable and preserve them when earlier revalidations finish or abort, preventing older responses from overwriting fresh fetcher data
  • Retry rejected lazy route imports instead of caching failures permanently (#15689)
  • Revalidate loader data when a fetcher action redirect is not followed (#15557)
    • Revalidate when an action redirect is ignored because a newer navigation started or the fetcher unmounted while the action was running
    • Include shared parent loaders when another navigation completed while the action was running
    • Continue to respect shouldRevalidate
    • Return fetchers to idle when a revalidation completes a pending navigation started by another fetcher's redirect
  • Avoid adding an incompatible document.startViewTransition() overload to the global Document type (#15680)
    • Allow transition results to be assigned to the DOM ViewTransition type
  • Skip deleteData in destroySession when the session has no ID (#15639)
    • Avoid failures when destroying a session without a cookie on storage that rejects an empty key
  • Surface the host's 404 response when a SPA fallback route has no prerendered data (#15646)
    • Request single-fetch .data files for hydrating routes with a server loader in an ssr: false app with a prerender config
    • Avoid the internal "No result found for routeId" error for non-prerendered parameterized paths served via the SPA fallback
  • Improve turbo-stream decoding validation and object property handling (18e1fbd)

Unstable Changes

⚠️ Unstable features are not recommended for production use

  • Add an opt-in <Await unstable_promise={promise}> implementation based on React's use() API (#15678)
    • Use React.use instead of React Router's internal promise tracking
    • Accept promise-like values and retain errorElement, useAsyncValue, and useAsyncError support
    • Handle only promise rejections with errorElement when using unstable_promise, allowing child render errors to bubble to the nearest React error boundary
    • Track streamed promises during decoding so settled server content stays visible during hydration updates with either Await API or direct React.use()
  • Fix URIError: URI malformed when an API-only (ssr: "unstable_api-only") server receives a URL path with a malformed percent-encoding (#15649)
  • Fix duplicate headers when throwing a redirect from an RSC server function (#15667)
Commits
  • a2783e6 Release v8.5.1 (#15656)
  • 69465b0 docs: prepare 8.5.1 release notes
  • 393d7c1 Bound server route manifest processing (#15703)
  • 18e1fbd Improve turbo-stream decoding validation and object property handling
  • cc0b62e Add Await unstable_promise and preserve streamed content during hydration (#1...
  • a7db797 fix(react-router): retry rejected lazy route imports (#15689)
  • 3ef3def fix(react-router): preserve pending mutation revalidation (#15686)
  • 6cdc3fa fix(react-router): revalidate when an ignored fetcher action redirect is not ...
  • b0a4477 chore: format
  • 4f788db Fix 404 on hard load of non-prerendered param route served via SPA fallback (...
  • Additional commits viewable in compare view

Updates @react-router/dev from 8.5.0 to 8.5.1

Release notes

Sourced from @​react-router/dev's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

Changelog

Sourced from @​react-router/dev's changelog.

v8.5.1

Patch Changes

  • Use resolved Vite environment output directories when reading and writing build artifacts (#15480)
    • Finalize server-bundle manifest paths after asynchronous Vite configuration hooks complete
    • Preserve output-directory overrides applied when creating a Vite build environment
  • Run prerendering after other Vite plugins finish their application build hooks (#15481)
    • Close React Router's build resources when another plugin's application build hook fails during react-router build
  • Updated dependencies:
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dependencies group with 10 updates
3c33352 
Bumps the dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.6.3` | `2.6.4` |
| [dotenv-cli](https://github.com/entropitor/dotenv-cli) | `11.0.0` | `11.1.0` |
| [@discordjs/core](https://github.com/discordjs/discord.js/tree/HEAD/packages/core) | `2.6.0` | `2.7.0` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `6.4.2` | `6.5.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [@react-router/node](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-node) | `8.5.0` | `8.5.1` |
| [@react-router/serve](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-serve) | `8.5.0` | `8.5.1` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.12` | `1.7.15` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.5.0` | `8.5.1` |
| [@react-router/dev](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dev) | `8.5.0` | `8.5.1` |


Updates `@biomejs/biome` from 2.6.3 to 2.6.4
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.4/packages/@biomejs/biome)

Updates `dotenv-cli` from 11.0.0 to 11.1.0
- [Release notes](https://github.com/entropitor/dotenv-cli/releases)
- [Commits](entropitor/dotenv-cli@v11.0.0...v11.1.0)

Updates `@discordjs/core` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/discordjs/discord.js/releases)
- [Changelog](https://github.com/discordjs/discord.js/blob/@discordjs/core@2.7.0/packages/core/CHANGELOG.md)
- [Commits](https://github.com/discordjs/discord.js/commits/@discordjs/core@2.7.0/packages/core)

Updates `bullmq` from 6.4.2 to 6.5.3
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v6.4.2...v6.5.3)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@react-router/node` from 8.5.0 to 8.5.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-node/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/node@8.5.1/packages/react-router-node)

Updates `@react-router/serve` from 8.5.0 to 8.5.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-serve/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/serve@8.5.1/packages/react-router-serve)

Updates `better-auth` from 1.7.12 to 1.7.15
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.15/packages/better-auth)

Updates `react-router` from 8.5.0 to 8.5.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.5.1/packages/react-router)

Updates `@react-router/dev` from 8.5.0 to 8.5.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dev/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/dev@8.5.1/packages/react-router-dev)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: dotenv-cli
  dependency-version: 11.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@discordjs/core"
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: bullmq
  dependency-version: 6.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@react-router/node"
  dependency-version: 8.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@react-router/serve"
  dependency-version: 8.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: better-auth
  dependency-version: 1.7.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-router
  dependency-version: 8.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@react-router/dev"
  dependency-version: 8.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants