Skip to content

chore(deps): bump the npm-minor-patch group across 1 directory with 52 updates - #506

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-patch-6bf1c14b6d
Open

chore(deps): bump the npm-minor-patch group across 1 directory with 52 updates#506
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-patch-6bf1c14b6d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 52 updates in the / directory:

Package From To
@biomejs/biome 2.5.6 2.5.11
@testing-library/react 16.3.2 16.3.3
@testing-library/user-event 14.6.1 14.6.6
turbo 2.10.7 2.10.12
better-sqlite3 13.0.2 13.0.3
@better-auth/api-key 1.7.0-rc.2 1.7.2
@better-auth/electron 1.7.0-rc.2 1.7.2
better-auth 1.7.0-rc.2 1.7.2
@electron/asar 4.2.1 4.3.0
@hookform/resolvers 5.5.7 5.9.1
playwright-core 1.62.0 1.62.1
react-hook-form 7.83.0 7.87.0
@better-auth/expo 1.7.0-rc.2 1.7.2
heroui-native 1.0.6 1.0.8
lucide-react-native 1.27.0 1.37.0
posthog-react-native 4.60.0 4.66.2
tailwind-variants 3.3.0 3.3.1
uniwind 1.10.0 1.11.0
posthog-js 1.407.3 1.422.5
@noble/ed25519 3.0.0 3.2.0
@noble/hashes 2.2.0 2.4.0
smol-toml 1.7.1 1.8.0
p-map 7.0.6 7.0.7
@types/semver 7.7.1 7.8.0
@lexical/react 0.48.0 0.49.0
@lexical/selection 0.48.0 0.49.0
@lexical/utils 0.48.0 0.49.0
@pierre/diffs 1.2.12 1.3.6
@shikijs/core 4.3.1 4.4.3
@shikijs/engine-javascript 4.3.1 4.4.3
@shikijs/langs 4.3.1 4.4.3
@shikijs/themes 4.3.1 4.4.3
dompurify 3.4.12 3.4.14
lexical 0.48.0 0.49.0
lucide-react 1.27.0 1.37.0
mermaid 11.16.0 11.17.2
pretty-bytes 7.1.1 7.1.2
pretty-ms 9.3.0 9.3.1
remend 1.3.0 1.3.1
streamdown 2.5.0 2.6.0
virtua 0.50.0 0.50.6
@lexical/headless 0.48.0 0.49.0
@iconify-json/material-icon-theme 1.2.69 1.2.70
@iconify-json/simple-icons 1.2.92 1.2.94
@vitejs/plugin-react 6.0.4 6.1.1
react-router 8.3.0 8.3.1
swr 2.4.2 2.5.1
tsx 4.23.1 4.23.13
use-intl 4.13.4 4.14.1
vite 8.1.5 8.2.2
vitest 4.1.10 4.1.11
zustand 5.0.14 5.0.15

Updates @biomejs/biome from 2.5.6 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

  • #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

  • Avoid act() re-entrant when dispatching events (#1468) (20ce75f)
Commits

Updates @testing-library/user-event from 14.6.1 to 14.6.6

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

  • default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

  • tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

v14.6.2

14.6.2 (2026-08-03)

Commits
  • 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
  • 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
  • d7e80e3 fix: keyboard event repeat property (#1312)
  • 43d8e6c ci: remove broken npm backfill step (#1322)
  • 1d18b1f fix(release): manually release a patch version (#1321)
  • 232f3e6 docs: add migration note and clean up README badges (#1320)
  • 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
  • e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
  • 13fa4bc ci: stop lint errors from blocking release (#1316)
  • c3cec18 chore(ci): make releases work with full git history (#1315)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.


Updates turbo from 2.10.7 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates better-sqlite3 from 13.0.2 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

Commits

Updates @better-auth/api-key from 1.7.0-rc.2 to 1.7.2

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.2

1.7.1

1.7.0

1.7.0-rc.6

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Commits

Updates @better-auth/electron from 1.7.0-rc.2 to 1.7.2

Release notes

Sourced from @​better-auth/electron's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from @​better-auth/electron's changelog.

1.7.2

1.7.1

1.7.0

Minor Changes

  • #9645 e014029 Thanks @​ping-maxwell! - Harden the Electron OAuth flow and tighten custom-scheme trusted-origin matching.

    The Electron sign-in flow now mandates PKCE S256. Plain PKCE is rejected: the code_challenge_method parameter is gone and every authorization code is verified by hashing the verifier with SHA-256. The server no longer trusts an electron-origin header to set the request Origin. The Electron client now sends a real Origin (for example myapp:/), so upgrade the @better-auth/electron client and server together and make sure your app's scheme is in trustedOrigins. The unused disableOriginOverride option is removed.

    Custom-scheme entries in trustedOrigins now match by scheme and authority instead of string prefix. A host-less entry such as myapp:// or exp:// still trusts every host of that scheme, but a host-bearing entry such as myapp://callback matches that host exactly, so it is no longer satisfied by myapp://callback.attacker.tld.

  • #9069 c7d2253 Thanks @​gustavovalverde! - Rewrite the generic OAuth plugin as a first-class social provider with OAuth 2.1 security defaults. Providers now use signIn.social + callback/:id instead of dedicated plugin endpoints, with PKCE required by default (OAuth 2.1), RFC 9207 issuer validation, OIDC auto-discovery with openid scope injection, and typed provider IDs.

    Breaking changes:

    • signIn.oauth2({ providerId }) replaced by signIn.social({ provider })
    • oauth2.link() replaced by linkSocial()
    • Callback URL changed from /api/auth/oauth2/callback/:id to /api/auth/callback/:id
    • genericOAuthClient() removed; generic OAuth providers now use the standard social client APIs
    • pkce defaults to true (was false); set pkce: false for providers that reject PKCE
    • authorizationUrlParams and tokenUrlParams only accept Record<string, string>
    • issuer and requireIssuerValidation config fields removed; issuer validation is automatic via OIDC discovery
    • mapProfileToUser profile typed as OAuth2UserInfo & Record<string, unknown>

Patch Changes

  • #10505 d701f90 Thanks @​gustavovalverde! - One Tap, Electron, and Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.

1.7.0-rc.6

Patch Changes

  • #10794 2ad2928 Thanks @​bytaesu! - Restore client plugin declaration compatibility for downstream TypeScript consumers.

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Patch Changes

  • #10505 d701f90 Thanks @​gustavovalverde! - One Tap, Electron, and Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.
Commits

@dependabot
chore(deps): bump the npm-minor-patch group across 1 directory with 5…
bbedac9 
…2 updates

Bumps the npm-minor-patch group with 52 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.11` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.6` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.7` | `2.10.12` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` |
| [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.0-rc.2` | `1.7.2` |
| [@better-auth/electron](https://github.com/better-auth/better-auth/tree/HEAD/packages/electron) | `1.7.0-rc.2` | `1.7.2` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.0-rc.2` | `1.7.2` |
| [@electron/asar](https://github.com/electron/asar) | `4.2.1` | `4.3.0` |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.5.7` | `5.9.1` |
| [playwright-core](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.83.0` | `7.87.0` |
| [@better-auth/expo](https://github.com/better-auth/better-auth/tree/HEAD/packages/expo) | `1.7.0-rc.2` | `1.7.2` |
| [heroui-native](https://github.com/heroui-inc/heroui-native) | `1.0.6` | `1.0.8` |
| [lucide-react-native](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react-native) | `1.27.0` | `1.37.0` |
| [posthog-react-native](https://github.com/PostHog/posthog-js/tree/HEAD/packages/react-native) | `4.60.0` | `4.66.2` |
| [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.3.0` | `3.3.1` |
| [uniwind](https://github.com/uni-stack/uniwind) | `1.10.0` | `1.11.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.407.3` | `1.422.5` |
| [@noble/ed25519](https://github.com/paulmillr/noble-ed25519) | `3.0.0` | `3.2.0` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.2.0` | `2.4.0` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.8.0` |
| [p-map](https://github.com/sindresorhus/p-map) | `7.0.6` | `7.0.7` |
| [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` |
| [@lexical/react](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-react) | `0.48.0` | `0.49.0` |
| [@lexical/selection](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-selection) | `0.48.0` | `0.49.0` |
| [@lexical/utils](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils) | `0.48.0` | `0.49.0` |
| @pierre/diffs | `1.2.12` | `1.3.6` |
| [@shikijs/core](https://github.com/shikijs/shiki/tree/HEAD/packages/core) | `4.3.1` | `4.4.3` |
| [@shikijs/engine-javascript](https://github.com/shikijs/shiki/tree/HEAD/packages/engine-javascript) | `4.3.1` | `4.4.3` |
| [@shikijs/langs](https://github.com/shikijs/shiki/tree/HEAD/packages/langs) | `4.3.1` | `4.4.3` |
| [@shikijs/themes](https://github.com/shikijs/shiki/tree/HEAD/packages/themes) | `4.3.1` | `4.4.3` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.14` |
| [lexical](https://github.com/facebook/lexical/tree/HEAD/packages/lexical) | `0.48.0` | `0.49.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.27.0` | `1.37.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.0` | `11.17.2` |
| [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.1` | `7.1.2` |
| [pretty-ms](https://github.com/sindresorhus/pretty-ms) | `9.3.0` | `9.3.1` |
| [remend](https://github.com/vercel/streamdown/tree/HEAD/packages/remend) | `1.3.0` | `1.3.1` |
| [streamdown](https://github.com/vercel/streamdown/tree/HEAD/packages/streamdown) | `2.5.0` | `2.6.0` |
| [virtua](https://github.com/inokawa/virtua) | `0.50.0` | `0.50.6` |
| [@lexical/headless](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-headless) | `0.48.0` | `0.49.0` |
| [@iconify-json/material-icon-theme](https://github.com/iconify/icon-sets) | `1.2.69` | `1.2.70` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.92` | `1.2.94` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.4` | `6.1.1` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.3.0` | `8.3.1` |
| [swr](https://github.com/vercel/swr) | `2.4.2` | `2.5.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.13` |
| [use-intl](https://github.com/amannn/next-intl) | `4.13.4` | `4.14.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.14` | `5.0.15` |



Updates `@biomejs/biome` from 2.5.6 to 2.5.11
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.11/packages/@biomejs/biome)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@testing-library/user-event` from 14.6.1 to 14.6.6
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.1...v14.6.6)

Updates `turbo` from 2.10.7 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.7...v2.10.12)

Updates `better-sqlite3` from 13.0.2 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v13.0.2...v13.0.3)

Updates `@better-auth/api-key` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/api-key)

Updates `@better-auth/electron` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/electron/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/electron)

Updates `better-auth` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)

Updates `@electron/asar` from 4.2.1 to 4.3.0
- [Release notes](https://github.com/electron/asar/releases)
- [Changelog](https://github.com/electron/asar/blob/main/CHANGELOG.md)
- [Commits](electron/asar@v4.2.1...v4.3.0)

Updates `@hookform/resolvers` from 5.5.7 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.5.7...v5.9.1)

Updates `playwright-core` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `react-hook-form` from 7.83.0 to 7.87.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.83.0...v7.87.0)

Updates `@better-auth/expo` from 1.7.0-rc.2 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/expo)

Updates `heroui-native` from 1.0.6 to 1.0.8
- [Release notes](https://github.com/heroui-inc/heroui-native/releases)
- [Changelog](https://github.com/heroui-inc/heroui-native/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/heroui-native@v1.0.6...v1.0.8)

Updates `lucide-react-native` from 1.27.0 to 1.37.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react-native)

Updates `posthog-react-native` from 4.60.0 to 4.66.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/react-native/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-react-native@4.66.2/packages/react-native)

Updates `tailwind-variants` from 3.3.0 to 3.3.1
- [Release notes](https://github.com/heroui-inc/tailwind-variants/releases)
- [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/tailwind-variants@v3.3.0...v3.3.1)

Updates `uniwind` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/uni-stack/uniwind/releases)
- [Commits](uni-stack/uniwind@v1.10.0...v1.11.0)

Updates `posthog-js` from 1.407.3 to 1.422.5
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.407.3...posthog-js@1.422.5)

Updates `@noble/ed25519` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/paulmillr/noble-ed25519/releases)
- [Changelog](https://github.com/paulmillr/noble-ed25519/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-ed25519@3.0.0...3.2.0)

Updates `@noble/hashes` from 2.2.0 to 2.4.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Changelog](https://github.com/paulmillr/noble-hashes/blob/main/CHANGELOG.md)
- [Commits](paulmillr/noble-hashes@2.2.0...2.4.0)

Updates `smol-toml` from 1.7.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.7.1...v1.8.0)

Updates `p-map` from 7.0.6 to 7.0.7
- [Release notes](https://github.com/sindresorhus/p-map/releases)
- [Commits](sindresorhus/p-map@v7.0.6...v7.0.7)

Updates `@types/semver` from 7.7.1 to 7.8.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver)

Updates `@lexical/react` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-react)

Updates `@lexical/selection` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-selection)

Updates `@lexical/utils` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-utils)

Updates `@pierre/diffs` from 1.2.12 to 1.3.6

Updates `@shikijs/core` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/core)

Updates `@shikijs/engine-javascript` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/engine-javascript)

Updates `@shikijs/langs` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/langs)

Updates `@shikijs/themes` from 4.3.1 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/themes)

Updates `dompurify` from 3.4.12 to 3.4.14
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.14)

Updates `lexical` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical)

Updates `lucide-react` from 1.27.0 to 1.37.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react)

Updates `mermaid` from 11.16.0 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.17.2)

Updates `pretty-bytes` from 7.1.1 to 7.1.2
- [Release notes](https://github.com/sindresorhus/pretty-bytes/releases)
- [Commits](sindresorhus/pretty-bytes@v7.1.1...v7.1.2)

Updates `pretty-ms` from 9.3.0 to 9.3.1
- [Release notes](https://github.com/sindresorhus/pretty-ms/releases)
- [Commits](sindresorhus/pretty-ms@v9.3.0...v9.3.1)

Updates `remend` from 1.3.0 to 1.3.1
- [Release notes](https://github.com/vercel/streamdown/releases)
- [Changelog](https://github.com/vercel/streamdown/blob/main/packages/remend/CHANGELOG.md)
- [Commits](https://github.com/vercel/streamdown/commits/remend@1.3.1/packages/remend)

Updates `streamdown` from 2.5.0 to 2.6.0
- [Release notes](https://github.com/vercel/streamdown/releases)
- [Changelog](https://github.com/vercel/streamdown/blob/main/packages/streamdown/CHANGELOG.md)
- [Commits](https://github.com/vercel/streamdown/commits/streamdown@2.6.0/packages/streamdown)

Updates `virtua` from 0.50.0 to 0.50.6
- [Release notes](https://github.com/inokawa/virtua/releases)
- [Commits](inokawa/virtua@0.50.0...0.50.6)

Updates `@lexical/headless` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/facebook/lexical/releases)
- [Changelog](https://github.com/facebook/lexical/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/lexical/commits/v0.49.0/packages/lexical-headless)

Updates `@iconify-json/material-icon-theme` from 1.2.69 to 1.2.70
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.92 to 1.2.94
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@vitejs/plugin-react` from 6.0.4 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `react-router` from 8.3.0 to 8.3.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.3.1/packages/react-router)

Updates `swr` from 2.4.2 to 2.5.1
- [Release notes](https://github.com/vercel/swr/releases)
- [Commits](vercel/swr@v2.4.2...v2.5.1)

Updates `tsx` from 4.23.1 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.13)

Updates `use-intl` from 4.13.4 to 4.14.1
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.13.4...v4.14.1)

Updates `vite` from 8.1.5 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `zustand` from 5.0.14 to 5.0.15
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.14...v5.0.15)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@better-auth/api-key"
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@better-auth/electron"
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: better-auth
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@electron/asar"
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright-core
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: react-hook-form
  dependency-version: 7.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@better-auth/expo"
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: heroui-native
  dependency-version: 1.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lucide-react-native
  dependency-version: 1.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: posthog-react-native
  dependency-version: 4.66.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tailwind-variants
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: uniwind
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: posthog-js
  dependency-version: 1.422.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@noble/ed25519"
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@noble/hashes"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: p-map
  dependency-version: 7.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/semver"
  dependency-version: 7.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/react"
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/selection"
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/utils"
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@pierre/diffs"
  dependency-version: 1.3.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/core"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/engine-javascript"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/langs"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@shikijs/themes"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: lexical
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: mermaid
  dependency-version: 11.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: pretty-bytes
  dependency-version: 7.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: pretty-ms
  dependency-version: 9.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: remend
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: streamdown
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: virtua
  dependency-version: 0.50.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@lexical/headless"
  dependency-version: 0.49.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@iconify-json/material-icon-theme"
  dependency-version: 1.2.70
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.94
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: react-router
  dependency-version: 8.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: swr
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: use-intl
  dependency-version: 4.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: zustand
  dependency-version: 5.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@greptile-apps

greptile-apps Bot commented Sep 7, 2026

Copy link
Copy Markdown

Greptile Summary

This PR updates 52 direct and catalog-managed npm dependencies across the daemon, desktop, mobile, webview, shared workbench, foundation, host, and presentation packages.

  • Advances Better Auth clients from the 1.7 release candidate to 1.7.2.
  • Updates mobile, editor, rendering, build, testing, cryptography, and tooling dependencies.
  • Regenerates the pnpm lockfile, but leaves its Vitest importer inconsistent with the root catalog reference.

Confidence Score: 4/5

The PR is not safe to merge until the Vitest catalog entry and root lockfile importer are regenerated consistently so frozen dependency installation succeeds.

The dependency versions are otherwise internally aligned, but the changed lockfile no longer matches the root manifest’s Vitest catalog specifier, which blocks the frozen install used by CI and release workflows.

Files Needing Attention: pnpm-lock.yaml, package.json, pnpm-workspace.yaml

Important Files Changed
Filename Overview
pnpm-lock.yaml Regenerates direct and transitive resolutions, but incorrectly records the root Vitest dependency as an exact specifier instead of its catalog reference.
pnpm-workspace.yaml Updates shared catalog versions for routing, client data, build, test, and icon tooling, including Vitest 4.1.11.
apps/desktop/package.json Updates Better Auth, packaging, form, browser-automation, and React form dependencies.
apps/mobile/package.json Updates Better Auth Expo integration and several React Native UI, analytics, icon, and styling dependencies.
packages/presentation/ui/package.json Updates the shared editor, diff, syntax-highlighting, markdown, diagram, icon, formatting, and virtualization stack.
packages/foundation/common/package.json Updates the Noble Ed25519 and hashing dependencies used by shared cryptographic verification.
package.json Updates repository tooling and test dependencies while continuing to reference Vitest through the workspace catalog.

Reviews (1): Last reviewed commit: "chore(deps): bump the npm-minor-patch gr..." | Re-trigger Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Sep 7, 2026
View reviewed changes
Comment thread pnpm-lock.yaml
vitest:
specifier: 'catalog:'
version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@26.1.1)(happy-dom@20.10.6)(jsdom@29.1.1(@noble/hashes@2.2.0))(vite@8.1.5(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(tsx@4.23.1)(yaml@2.9.0))
specifier: 4.1.11

@greptile-apps greptile-apps Bot Sep 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Vitest lockfile specifier mismatch

The regenerated lockfile records Vitest with the exact specifier 4.1.11, while package.json still requests catalog: and the workspace catalog declares ^4.1.11. CI runs pnpm install --frozen-lockfile, so pnpm will reject this mismatch before tests or builds can run. Regenerate the lockfile so this importer retains specifier: 'catalog:' and Vitest remains represented in catalogs.default.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants