Skip to content

fix(deps): update bun minor and patch dependencies#937

Merged
nicotsx merged 3 commits into
mainfrom
renovate/bun-minor-and-patch-dependencies
Jun 12, 2026
Merged

fix(deps): update bun minor and patch dependencies#937
nicotsx merged 3 commits into
mainfrom
renovate/bun-minor-and-patch-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@better-auth/passkey (source) ^1.6.12 → ^1.6.15 age confidence
@better-auth/sso (source) ^1.6.12 → ^1.6.15 age confidence
@cloudflare/vite-plugin (source) ^1.39.0 → ^1.40.0 age confidence
@hey-api/openapi-ts (source) ^0.97.3 → ^0.98.2 age confidence
@inquirer/prompts (source) ^8.5.1 → ^8.5.2 age confidence
@radix-ui/react-alert-dialog (source) ^1.1.15 → ^1.1.16 age confidence
@radix-ui/react-checkbox (source) ^1.3.3 → ^1.3.4 age confidence
@radix-ui/react-dialog (source) ^1.1.15 → ^1.1.16 age confidence
@radix-ui/react-dropdown-menu (source) ^2.1.16 → ^2.1.17 age confidence
@radix-ui/react-hover-card (source) ^1.1.15 → ^1.1.16 age confidence
@radix-ui/react-label (source) ^2.1.8 → ^2.1.9 age confidence
@radix-ui/react-progress (source) ^1.1.8 → ^1.1.9 age confidence
@radix-ui/react-scroll-area (source) ^1.2.10 → ^1.2.11 age confidence
@radix-ui/react-select (source) ^2.2.6 → ^2.3.0 age confidence
@radix-ui/react-separator (source) ^1.1.8 → ^1.1.9 age confidence
@radix-ui/react-slot (source) ^1.2.4 → ^1.2.5 age confidence
@radix-ui/react-switch (source) ^1.2.6 → ^1.3.0 age confidence
@radix-ui/react-tabs (source) ^1.1.13 → ^1.1.14 age confidence
@radix-ui/react-tooltip (source) ^1.2.8 → ^1.2.9 age confidence
@scalar/hono-api-reference (source) ^0.10.19 → ^0.11.0 age confidence
@tailwindcss/typography ^0.5.19 → ^0.5.20 age confidence
@tanstack/react-query (source) ^5.100.14 → ^5.101.0 age confidence
@tanstack/react-query-devtools (source) ^5.100.14 → ^5.101.0 age confidence
@tanstack/react-router (source) ^1.170.10 → ^1.170.15 age confidence
@tanstack/react-start (source) ^1.168.18 → ^1.168.25 age confidence
@tanstack/router-plugin (source) ^1.168.13 → ^1.168.18 age confidence
@types/mdx (source) ^2.0.13 → ^2.0.14 age confidence
@types/node (source) ^25.9.1 → ^25.9.2 age confidence
@types/react (source) ^19.2.15 → ^19.2.17 age confidence
better-auth (source) ^1.6.12 → ^1.6.15 age confidence
effect (source) ^3.21.2 → ^3.21.3 age confidence
fumadocs-mdx (source) ^15.0.10 → ^15.0.11 age confidence
happy-dom ^20.9.0 → ^20.10.2 age confidence
hono (source) ^4.12.23 → ^4.12.25 age confidence
oxfmt (source) 0.52.0 → 0.54.0 age confidence
react (source) ^19.2.6 → ^19.2.7 age confidence
react-dom (source) ^19.2.6 → ^19.2.7 age confidence
react-hook-form (source) ^7.77.0 → ^7.78.0 age confidence
semver ^7.8.1 → ^7.8.3 age confidence
shadcn (source) ^4.8.3 → ^4.11.0 age confidence
vite (source) ^8.0.14 → ^8.0.16 age confidence
vite-plus (source) ^0.1.23 → ^0.1.24 age confidence
vitest (source) ^4.1.7 → ^4.1.8 age confidence
wrangler (source) ^4.95.0 → ^4.98.0 age confidence

Release Notes

better-auth/better-auth (@​better-auth/passkey)

v1.6.15

Compare Source

Patch Changes

  • #​9927 d23735b Thanks @​gustavovalverde! - Resolve a friendly label for a passkey from the authenticator that created it. Passkeys already store the authenticator aaguid; the plugin now exports getAuthenticatorName(aaguid) and an extensible commonAuthenticatorNames map so you can show a provider name (for example "1Password" or "Google Password Manager") when rendering passkeys, with full coverage available through the community AAGUID source. To set a server-side default, registration.afterVerification can now return a name used when the client supplies none. Passkey names are trimmed on registration and update.

  • Updated dependencies [1012b69, ad60333, 0933c05, b0ddfd3]:

v1.6.14

Compare Source

Patch Changes

v1.6.13

Compare Source

Patch Changes
better-auth/better-auth (@​better-auth/sso)

v1.6.15

Compare Source

Patch Changes

  • #​9748 bff65fd Thanks @​seebykilian! - When clockSkew is configured in the SSO plugin's SAML options, it was only
    applied to better-auth's internal validation but never passed down to samlify's
    ServiceProvider. As a result, samlify used its default [0, 0] clock drift,
    causing ERR_SUBJECT_UNCONFIRMED errors on valid SAML responses whenever there
    was any clock difference between the SP and the IdP.

    This affects any standard IdP (Auth0, Keycloak, Okta, etc.) even when the SAML
    response is fully valid and the server time is well within the
    NotBefore/NotOnOrAfter window.

    This is now fixed.

  • Updated dependencies [1012b69, ad60333, 0933c05, b0ddfd3]:

v1.6.14

Compare Source

Patch Changes

v1.6.13

Compare Source

Patch Changes

  • #​9818 43c08a2 Thanks @​gustavovalverde! - Fix SAML Single Logout leaving the user signed in. The logout handlers passed the session row id to a delete that matches on the session token, so the session was never removed. The stored SAML session record now carries the session token, and all three logout paths revoke the session by token.

  • #​9821 4c3bbc4 Thanks @​gustavovalverde! - Fix a high-severity XML injection in signed SAML assertions (GHSA-34r5-q4jw-r36m) by updating samlify from 2.10.2 to 2.13.1. A crafted AttributeValue could escalate privileges.

    samlify 2.11 replaced node-forge with Node's native crypto, which parses private keys through OpenSSL 3 and rejects PEM blocks that carry leading whitespace. SAML private keys are now normalized before they reach samlify, so a key pasted with indentation (for example from an indented YAML or JSON config) keeps loading.

    IdP-initiated Single Logout now derives its response from the parsed logout request, which fixes response generation under samlify 2.13. When mapping SAML attributes to user fields, a multi-valued attribute is read by its first value.

  • Updated dependencies [d3919dc, 5f282bd, 43c08a2, 43c08a2, be32012, 87c1a0c, 5c3e248, 9c8ded6, 23d7cbf]:

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.40.0

Compare Source

Minor Changes

  • #​14013 3cf9d0e Thanks @​jamesopstad! - Add experimental experimental.newConfig option to load the entry Worker's configuration from cloudflare.config.ts

    This is an experimental, opt-in feature. When enabled, the plugin loads the entry Worker's configuration from a cloudflare.config.ts file instead of the usual wrangler.json / wrangler.jsonc / wrangler.toml.

    Pass true to enable with defaults, or an object to customise behaviour. Currently the only sub-option is types.generate (defaults to true), which writes a worker-configuration.d.ts file next to the config. This enables typed env and exports for your Worker and currently assumes that you have @cloudflare/workers-types installed.

    // vite.config.ts
import { defineConfig } from "vite";
import { cloudflare } from "@​cloudflare/vite-plugin";

export default defineConfig({
  plugins: [
    cloudflare({
      experimental: {
        newConfig: true,
      },
    }),
  ],
});
    // cloudflare.config.ts
import {
	defineWorker,
	bindings,
} from "@​cloudflare/vite-plugin/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export default defineWorker((ctx) => ({
	name: "my-worker",
	entrypoint,
	compatibilityDate: "2026-05-18",
	env: {
		MY_TEXT: bindings.text(`The mode is ${ctx.mode}`),
		MY_KV: bindings.kv(),
	},
}));

    A few limitations apply while the feature is experimental:

    • configPath cannot be combined with experimental.newConfig. The entry Worker is always loaded from cloudflare.config.ts at the project root.
    • auxiliaryWorkers are not yet supported with experimental.newConfig.

    Because this is experimental, the option, the cloudflare.config.ts schema, and the @cloudflare/vite-plugin/experimental-config exports may change in any release.

Patch Changes

v1.39.2

Compare Source

Patch Changes

  • #​13893 d8a16e7 Thanks @​penalosa! - Add an experimental, internal cf-vite delegate binary

    This adds an experimental bin/cf-vite binary that is spawned by Cloudflare's own parent tooling to drive the plugin as a long-running dev-server subprocess. It is not part of the plugin's public API surface, is not intended to be invoked directly, and its contract may change at any time without notice.

  • #​14117 3c86121 Thanks @​aicayzer! - Forward response headers from the Worker on WebSocket upgrade responses

    Headers set on a new Response(null, { status: 101, webSocket, headers }) returned from the Worker are now propagated to the upgrade response sent to the browser during vite dev. Previously the headers were dropped, so cookies (Set-Cookie) and custom headers (X-*) on WebSocket handshake responses were invisible client-side — even though they were delivered correctly by wrangler dev.

  • Updated dependencies [b210c5e, aec1bb8, e06cbb7, 9a26191, 5565823, 4ef790b, 890fca7, 6fc9777, 337e912, 8e7b74f, e86489a, 42288d4, 65b5f9e, 3a746ac, 64ef9fd, 94b29f7]:

    • wrangler@​4.97.0
    • miniflare@​4.20260601.0

v1.39.1

Compare Source

Patch Changes
hey-api/openapi-ts (@​hey-api/openapi-ts)

v0.98.2

Compare Source

@​hey-api/openapi-ts 0.98.2

Plugins
@​hey-api/client-angular
  • reassign the result of HttpHeaders.delete() back to opts.headers (#​3988)
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/client-axios
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/client-fetch
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/client-ky
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/client-next
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/client-nuxt
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/client-ofetch
  • export augmentable ClientMeta interface (#​3996)
@​hey-api/sdk
  • don't expose SSE errors as iterator return types (#​3989)
  • support type-safe meta option via augmentable ClientMeta interface (#​3996)

@​hey-api/codegen-core 0.9.0

Updates
  • symbol: add event listeners (#​3998)
  • types: rename ProjectRenderMeta to ProjectMeta and key it by language (#​3984)
  • utils: expose Version class (#​3991)

@​hey-api/shared 0.4.8

Updates
  • types: update project meta types (#​3984)
  • utils: expose SymbolFactory (#​3991)

v0.98.1

Compare Source

@​hey-api/openapi-ts 0.98.1

Updates
  • cli: simplify generate command messages (#​3982)
Plugins
valibot
  • revert referencing TypeScript enums (#​3982)
zod
  • revert referencing TypeScript enums (#​3982)

@​hey-api/openapi-ts 0.98.0

⚠️ Breaking

This release has 1 breaking change. Please review the release notes carefully before upgrading.

Updates
  • ⚠️ Breaking: config: declarative configuration (#​3950)

This is an internal change that simplifies the configuration and plugin APIs. The generated output should be unaffected, please open an issue if that's not the case. If you have custom plugins, refer to the custom plugin guide for the latest instructions.

  • dsl: track extended class symbols (#​3945)
  • parser: preserve sort order when filtering input (#​3953)
Plugins
@​hey-api/client-angular
@​hey-api/client-axios
@​hey-api/client-fetch
@​hey-api/client-ky
@​hey-api/client-next
@​hey-api/client-nuxt
@​hey-api/client-ofetch
@​hey-api/sdk
  • add explicit return types (#​3880)
  • expose key on security schemes when their signatures collide (#​3935)
orpc
  • handle no-content success responses (#​3948)
valibot
  • improve boolean enum handling (#​3974)

@​hey-api/codegen-core 0.8.4

Updates

@​hey-api/codegen-core 0.8.3

Updates
  • symbol: add children and override property (#​3945)
  • symbols: export pythonNameConflictResolver, SymbolChild, SymbolKind, and SymbolRegistry (#​3945)

@​hey-api/json-schema-ref-parser 1.4.3

Updates
  • bundle: name whole-file $refs after the source filename (#​3936)

@​hey-api/shared 0.4.7

Updates
  • plugin: add generics support to querySymbol() and querySymbols() (#​3982)

@​hey-api/shared 0.4.6

Updates
  • plugin: add symbols property (#​3942)
  • parser: expose key on security schemes when their signatures collide (#​3935)
  • parser: preserve sort order when filtering input (#​3953)
  • config: valueToObject is recursive (#​3927)
  • plugin: do not stamp external symbols (#​3942)
  • plugin: export coerce, defineConfig, Coercer, CoercerMap, ConfigTable, PluginSymbols, PluginTag, TableDirectives, and WithCoercers (#​3927)

v0.98.0

Compare Source

@​hey-api/openapi-ts 0.98.1

Updates
  • cli: simplify generate command messages (#​3982)
Plugins
valibot
  • revert referencing TypeScript enums (#​3982)
zod
  • revert referencing TypeScript enums (#​3982)

@​hey-api/openapi-ts 0.98.0

⚠️ Breaking

This release has 1 breaking change. Please review the release notes carefully before upgrading.

Updates
  • ⚠️ Breaking: config: declarative configuration (#​3950)

This is an internal change that simplifies the configuration and plugin APIs. The generated output should be unaffected, please open an issue if that's not the case. If you have custom plugins, refer to the custom plugin guide for the latest instructions.

  • dsl: track extended class symbols (#​3945)
  • parser: preserve sort order when filtering input (#​3953)
Plugins
@​hey-api/client-angular
  • add explicit return types (#​3880)
  • use Object.create() to avoid prototype chain substitution. Report

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedhappy-dom@​20.9.0 ⏵ 20.10.26610088 +196100
Updated@​radix-ui/​react-label@​2.1.8 ⏵ 2.1.9100 +11006699100
Updated@​radix-ui/​react-separator@​1.1.8 ⏵ 1.1.9100 +11006799100
Updated@​radix-ui/​react-progress@​1.1.8 ⏵ 1.1.9100 +11006999 +1100
Updated@​radix-ui/​react-slot@​1.2.4 ⏵ 1.2.5100 +110069 +199100
Updated@​radix-ui/​react-tabs@​1.1.13 ⏵ 1.1.1499 +11007099100
Updated@​tanstack/​react-query-devtools@​5.100.14 ⏵ 5.101.01001007198100
Updated@​radix-ui/​react-switch@​1.2.6 ⏵ 1.3.099 +110071 +299100
Updated@​radix-ui/​react-hover-card@​1.1.15 ⏵ 1.1.1699 +11007199100
Updated@​radix-ui/​react-checkbox@​1.3.3 ⏵ 1.3.499 +11007199100
Updated@​radix-ui/​react-dropdown-menu@​2.1.16 ⏵ 2.1.1799 +11007199100
Updated@​radix-ui/​react-alert-dialog@​1.1.15 ⏵ 1.1.1699 +110071 +199100
Updated@​radix-ui/​react-dialog@​1.1.15 ⏵ 1.1.1699 +11007199100
Updated@​radix-ui/​react-tooltip@​1.2.8 ⏵ 1.2.999 +110072 +199100
Updatedfumadocs-mdx@​15.0.10 ⏵ 15.0.1198 +110072 +196 +1100
Added@​types/​mdx@​2.0.141001007286100
Updated@​radix-ui/​react-scroll-area@​1.2.10 ⏵ 1.2.1199 +110073 +199100
Updated@​radix-ui/​react-select@​2.2.6 ⏵ 2.3.09910074 +199100
Updated@​tanstack/​react-router@​1.170.10 ⏵ 1.170.1575 -11008499100
Updated@​scalar/​hono-api-reference@​0.10.19 ⏵ 0.11.010010078100100
Updated@​better-auth/​sso@​1.6.12 ⏵ 1.6.1599 +110078 +198 +1100
Updated@​tanstack/​router-plugin@​1.168.13 ⏵ 1.168.1899 +110078 +199100
Updated@​types/​react@​19.2.15 ⏵ 19.2.171001007996100
Updated@​types/​node@​25.9.1 ⏵ 25.9.210010081 +196100
Updatedeffect@​3.21.2 ⏵ 3.21.3821009197 +1100
Updated@​tanstack/​react-start@​1.168.18 ⏵ 1.168.25991008499100
Updatedbetter-auth@​1.6.12 ⏵ 1.6.1598 +110085 +196100
Updated@​cloudflare/​vite-plugin@​1.39.0 ⏵ 1.40.09910087 +1100100
Updated@​better-auth/​passkey@​1.6.12 ⏵ 1.6.15100 +110087 +197 +1100
Updated@​tanstack/​react-query@​5.100.14 ⏵ 5.101.0991008898100
Updatedsemver@​7.7.4 ⏵ 7.8.3100 +1100100 +195100
Updated@​inquirer/​prompts@​8.5.1 ⏵ 8.5.2991009895100
See 3 more rows in the dashboard

View full report

@renovate renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 18 times, most recently from ff9e717 to f28f9ed Compare June 7, 2026 01:02
@socket-security

socket-security Bot commented Jun 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm effect is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/agent/package.json → npm/effect@3.21.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/effect@3.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/happy-dom@20.10.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.10.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 10 times, most recently from bce1193 to 9f65b42 Compare June 9, 2026 06:35
@renovate renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch 14 times, most recently from a4d409a to c323173 Compare June 11, 2026 19:35
@renovate renovate Bot force-pushed the renovate/bun-minor-and-patch-dependencies branch from c323173 to a1c0028 Compare June 12, 2026 06:01
nicotsx added 2 commits June 12, 2026 08:44
@nicotsx
fix: require SSO flow for SSO org invitations
70185a0 
Manual enforcement since better-auth made the rule wider
@nicotsx
chore: re-generate api-client
8fe38b6
@nicotsx nicotsx merged commit bd46bd1 into main Jun 12, 2026
11 checks passed
@nicotsx nicotsx deleted the renovate/bun-minor-and-patch-dependencies branch June 12, 2026 06:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nicotsx nicotsx nicotsx approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nicotsx