Skip to content

Bump the minor-and-patch group across 1 directory with 10 updates - #539

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-1681e7d3e9
Open

Bump the minor-and-patch group across 1 directory with 10 updates#539
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-1681e7d3e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 10 updates in the / directory:

Package From To
@better-auth/api-key 1.7.11 1.7.13
@cloudflare/vite-plugin 1.64.0 1.65.0
@tanstack/router-plugin 1.168.47 1.168.48
better-auth 1.7.11 1.7.13
lucide-react 1.60.0 1.61.0
posthog-js 1.438.12 1.438.23
posthog-node 5.56.2 5.57.2
@cloudflare/workers-types 5.20261019.1 5.20261026.1
@tanstack/router-cli 1.167.45 1.167.46
dotenv 18.0.8 18.0.9

Updates @better-auth/api-key from 1.7.11 to 1.7.13

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

  • Added support for Stripe SDK v23 in the Stripe plugin (#11954)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​allenzhou101, @​bytaesu, @​godwit-bo

Full changelog: v1.7.12...v1.7.13

v1.7.12

[!IMPORTANT] Action required

  • If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

  • Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
  • Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
  • Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.13

1.7.12

Commits

Updates @cloudflare/vite-plugin from 1.64.0 to 1.65.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.65.0

Minor Changes

  • #16363 d3240f2 Thanks @​jamesopstad! - Remove the experimental.newConfig option from Vite plugin v1

    Vite plugin v1 now supports Wrangler configuration files only. Projects using cloudflare.config.ts for configuration should upgrade to Vite plugin v2 beta.

Patch Changes

  • #16373 8cc5f87 Thanks @​petebacondarwin! - Report unsupported remote bindings under Bun instead of hanging

    Starting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.

  • #16334 9cecd09 Thanks @​petebacondarwin! - Fix Container setup guidance in Vite development and preview

    Container registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.

  • #16333 68d6eec Thanks @​petebacondarwin! - Update the local Workers runtime to the October 19 release

    Include the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.

    The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.

  • #16379 160e655 Thanks @​petebacondarwin! - Update the local Workflow runtime to use native storage cleanup

    Consume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.

  • #16289 bbe822f Thanks @​petebacondarwin! - Retry remote preview token refreshes after transient failures

    Backport the retry fix to the private remote-bindings workspace package and require wrangler@4.151.1 so long-running remote development sessions recover after a network outage.

  • #16291 0262f7d Thanks @​petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenance

    Pin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.65.0

Minor Changes

  • #16363 d3240f2 Thanks @​jamesopstad! - Remove the experimental.newConfig option from Vite plugin v1

    Vite plugin v1 now supports Wrangler configuration files only. Projects using cloudflare.config.ts for configuration should upgrade to Vite plugin v2 beta.

Patch Changes

  • #16373 8cc5f87 Thanks @​petebacondarwin! - Report unsupported remote bindings under Bun instead of hanging

    Starting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.

  • #16334 9cecd09 Thanks @​petebacondarwin! - Fix Container setup guidance in Vite development and preview

    Container registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.

  • #16333 68d6eec Thanks @​petebacondarwin! - Update the local Workers runtime to the October 19 release

    Include the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.

    The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.

  • #16379 160e655 Thanks @​petebacondarwin! - Update the local Workflow runtime to use native storage cleanup

    Consume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.

  • #16289 bbe822f Thanks @​petebacondarwin! - Retry remote preview token refreshes after transient failures

    Backport the retry fix to the private remote-bindings workspace package and require wrangler@4.151.1 so long-running remote development sessions recover after a network outage.

  • #16291 0262f7d Thanks @​petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenance

    Pin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.

Commits
  • 49a4610 [vite-plugin] Version v1 maintenance release (#16433)
  • d936c09 Revert "[vite-plugin] Version v1 maintenance release" (#16438)
  • 48737b5 [vite-plugin] Version v1 maintenance release (#16320)
  • 160e655 [vite-plugin] Backport Workflow storage cleanup to v1 (#16379)
  • 3f4259f [vite-plugin] Upgrade Vite in the v1 maintenance workspace (#16406)
  • f8af56a [vite-plugin] Use Vitest 5 in v1 maintenance tests (#16378)
  • 9cecd09 [vite-plugin] Backport caller-owned Container guidance to v1 (#16334)
  • 68d6eec [vite-plugin] Update v1 to the October 19 runtime release (#16333)
  • ef120cf [vite-plugin] Remove no-effect v1 backports (#16365)
  • d3240f2 Remove experimental.newConfig option in Vite plugin v1 (#16363)
  • Additional commits viewable in compare view

Updates @tanstack/router-plugin from 1.168.47 to 1.168.48

Release notes

Sourced from @​tanstack/router-plugin's releases.

@​tanstack/router-plugin@​1.168.48

Patch Changes

  • #8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

  • #8737 647cb73 - Remove the enableRouteGeneration option. Route generation now always runs, so autoCodeSplitting always has the route metadata it needs.

  • Updated dependencies [32a3360, 689a7c5]:

    • @​tanstack/react-router@​1.170.46
    • @​tanstack/router-core@​1.171.39
    • @​tanstack/router-generator@​1.167.46
Changelog

Sourced from @​tanstack/router-plugin's changelog.

1.168.48

Patch Changes

  • #8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

  • #8737 647cb73 - Remove the enableRouteGeneration option. Route generation now always runs, so autoCodeSplitting always has the route metadata it needs.

  • Updated dependencies [32a3360, 689a7c5]:

    • @​tanstack/react-router@​1.170.46
    • @​tanstack/router-core@​1.171.39
    • @​tanstack/router-generator@​1.167.46
Commits

Updates better-auth from 1.7.11 to 1.7.13

Release notes

Sourced from better-auth's releases.

v1.7.13

better-auth

Bug Fixes

  • Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

  • Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

  • Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

  • Added support for Stripe SDK v23 in the Stripe plugin (#11954)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​allenzhou101, @​bytaesu, @​godwit-bo

Full changelog: v1.7.12...v1.7.13

v1.7.12

[!IMPORTANT] Action required

  • If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

  • Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
  • Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
  • Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.13

Patch Changes

  • #11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

  • Updated dependencies [2712441, 1cf4b2c]:

    • @​better-auth/core@​1.7.13
    • @​better-auth/drizzle-adapter@​1.7.13
    • @​better-auth/kysely-adapter@​1.7.13
    • @​better-auth/memory-adapter@​1.7.13
    • @​better-auth/mongo-adapter@​1.7.13
    • @​better-auth/prisma-adapter@​1.7.13
    • @​better-auth/telemetry@​1.7.13

1.7.12

Patch Changes

  • #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

  • #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

  • #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

  • Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

    • @​better-auth/core@​1.7.12
    • @​better-auth/drizzle-adapter@​1.7.12
    • @​better-auth/kysely-adapter@​1.7.12
    • @​better-auth/memory-adapter@​1.7.12
    • @​better-auth/mongo-adapter@​1.7.12
    • @​better-auth/prisma-adapter@​1.7.12
    • @​better-auth/telemetry@​1.7.12
Commits

Updates lucide-react from 1.60.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Commits

Updates posthog-js from 1.438.12 to 1.438.23

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.23

1.438.23

Patch Changes

  • #5335 cb34fe0 Thanks @​hpouillot! - Enable synchronous session replay fetch capture by default for new SDK versions. (2026-10-26)
  • Updated dependencies [cb34fe0]:
    • @​posthog/types@​1.416.1

posthog-js@1.438.22

1.438.22

Patch Changes

  • #5429 1034948 Thanks @​pauldambra! - fix(browser): stop parsing the whole persistence entry on every capture() to refresh Meta identifiers. This made Interaction to Next Paint slower since 1.426.0, most of all on mobile and for projects with many feature flags. (2026-10-26)

posthog-js@1.438.21

1.438.21

Patch Changes

  • #5346 f91145d Thanks @​sebxt! - Reject a prefilled survey rating of 0 on rating scales that start at 1. (2026-10-23)

  • #5399 02616e1 Thanks @​ARXHHHH! - Ship the IE11 Math.trunc and Number.isInteger polyfills only in array.full.es5.js, so the modern bundles no longer trigger Lighthouse's "Legacy JavaScript" audit. (2026-10-23)

  • Updated dependencies [f827137, f91145d, 02616e1]:

    • @​posthog/core@​1.60.1
    • @​posthog/browser-common@​0.9.11

posthog-js@1.438.20

1.438.20

Patch Changes

  • #5292 d73e6c7 Thanks @​sarmah-rup! - Read query params with form-encoding rules: an encoded plus (%2B) is kept as + instead of becoming a space, and values that contain = are no longer cut off. This fixes UTM, click ID and search keyword properties such as utm_term=c%2B%2B. (2026-10-23)
  • Updated dependencies [d73e6c7]:
    • @​posthog/browser-common@​0.9.10

posthog-js@1.438.19

1.438.19

Patch Changes

  • #4994 bcd33ce Thanks @​dustinbyrne! - Share autocapture across browser SDKs while preserving existing event capture behavior. (2026-10-22)
  • Updated dependencies [bcd33ce]:

... (truncated)

Commits
  • dfff34b chore: update versions and lockfile [version bump]
  • cb34fe0 fix(replay): enable synchronous fetch by default for new cores (#5335)
  • 64f8a43 chore: update versions and lockfile [version bump]
  • 1034948 fix(browser): stop parsing persistence on every capture() for Meta identifier...
  • 2e98ca8 chore: clear the Coherence spec problems reported on every PR (#5303)
  • 196b7f9 chore: update versions and lockfile [version bump]
  • b5036c4 fix(node): stop esbuild failing when @​opentelemetry/api is not installed (#5422)
  • bd41fe4 fix(nextjs): restore accurate integration fixtures and cooldown compliance (#...
  • 670189f test(browser): run deployment compatibility engines in parallel (#5384)
  • 1fa1d9d chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates ...
  • Additional commits viewable in compare view

Updates posthog-node from 5.56.2 to 5.57.2

Release notes

Sourced from posthog-node's releases.

posthog-node@5.57.2

5.57.2

Patch Changes

  • #5422 b5036c4 Thanks @​posthog! - fix: esbuild no longer fails to bundle posthog-node when the optional @opentelemetry/api peer is not installed (2026-10-25)

posthog-node@5.57.1

5.57.1

Patch Changes

  • #5385 faacff0 Thanks @​carlos-marchal-ph! - Apply the client privacyMode option to AI integrations, keep prompts out of errors, provider metadata and OTel spans in privacy mode, and redact MCP tool credentials (2026-10-23)

  • #5354 f827137 Thanks @​marandaneto! - Fall back instead of returning inconsistent local regex flag results for Unicode and advanced patterns. (2026-10-23)

  • Updated dependencies [f827137]:

    • @​posthog/core@​1.60.1

posthog-node@5.57.0

5.57.0

Minor Changes

  • #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

    Behavior changes:

    • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
    • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
    • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

  • Updated dependencies [1991b99]:
    • @​posthog/core@​1.60.0

posthog-node@5.56.4

5.56.4

Patch Changes

  • #5350 17260e5 Thanks @​marandaneto! - Fall back from local flag evaluation when a required property value is undefined. (2026-10-21)
  • Updated dependencies [17260e5]:
    • @​posthog/core@​1.59.3

posthog-node@5.56.3

5.56.3

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.57.2

Patch Changes

  • #5422 b5036c4 Thanks @​posthog! - fix: esbuild no longer fails to bundle posthog-node when the optional @opentelemetry/api peer is not installed (2026-10-25)

5.57.1

Patch Changes

  • #5385 faacff0 Thanks @​carlos-marchal-ph! - Apply the client privacyMode option to AI integrations, keep prompts out of errors, provider metadata and OTel spans in privacy mode, and redact MCP tool credentials (2026-10-23)

  • #5354 f827137 Thanks @​marandaneto! - Fall back instead of returning inconsistent local regex flag results for Unicode and advanced patterns. (2026-10-23)

  • Updated dependencies [f827137]:

    • @​posthog/core@​1.60.1

5.57.0

Minor Changes

  • #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

    Behavior changes:

    • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
    • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
    • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

  • Updated dependencies [1991b99]:
    • @​posthog/core@​1.60.0

5.56.4

Patch Changes

  • #5350 17260e5 Thanks @​marandaneto! - Fall back from local flag evaluation when a required property value is undefined. (2026-10-21)
  • Updated dependencies [17260e5]:
    • @​posthog/core@​1.59.3

5.56.3

Patch Changes

  • #5307 189da75 Thanks @​quotentiroler! - Local flag evaluation now matches a null property with string operators like the flags service, so negated operators such as not_icontains match instead of failing. (2026-10-21)

... (truncated)

Commits
  • 196b7f9 chore: update versions and lockfile [version bump]
  • b5036c4 fix(node): stop esbuild failing when @​opentelemetry/api is not installed (#5422)
  • 0a532fa test(node): wait for flag enrichment before asserting delivery (#5400)
  • a0b18d4 chore: update versions and lockfile [version bump]
  • f827137 fix(flags): fall back for incompatible local regex matching (#5354)
  • faacff0 fix(aio): keep content out of ai events in privacy mode (#5385)
  • 6897dc8 chore: update versions and lockfile [version bump]
  • 1991b99 feat(node): report unresolved local flags on evaluateFlags snapshots (#5234)
  • a856dd2 chore: update versions and lockfile [version bump]
  • 17260e5 fix(flags): defer undefined property values to remote evaluation (#5350)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261019.1 to 5.20261026.1

Commits

Updates @tanstack/router-cli from 1.167.45 to 1.167.46

Release notes

Sourced from @​tanstack/router-cli's releases.

@​tanstack/router-cli@​1.167.46

Patch Changes

  • Updated dependencies []:
    • @​tanstack/router-generator@​1.167.46
Changelog

Sourced from @​tanstack/router-cli's changelog.

1.167.46

Patch Changes

  • Updated dependencies []:
    • @​tanstack/router-generator@​1.167.46
Commits

Updates dotenv from 18.0.8 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

  • Permit DOTENV_PATH being empty string with the CLI (#1076)
Commits
  • 8d1ab85 18.0.9
  • 59a40ce changelog
  • 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
  • bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
  • 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
  • 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 30, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs		 modelschemas a1dfe8f Nov 01 2026, 03:18 PM

@dependabot dependabot Bot changed the title Bump the minor-and-patch group with 10 updates Bump the minor-and-patch group across 1 directory with 10 updates Nov 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/bun/minor-and-patch-1681e7d3e9 branch from 6e2fe7e to a1dfe8f Compare November 1, 2026 15:17
@dependabot
Bump the minor-and-patch group across 1 directory with 10 updates
fe9e8d8 
Bumps the minor-and-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@better-auth/api-key](https://github.com/better-auth/better-auth/tree/HEAD/packages/api-key) | `1.7.11` | `1.7.13` |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.64.0` | `1.65.0` |
| [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.47` | `1.168.48` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.11` | `1.7.13` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.60.0` | `1.61.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.438.12` | `1.438.23` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.56.2` | `5.57.2` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261019.1` | `5.20261026.1` |
| [@tanstack/router-cli](https://github.com/TanStack/router/tree/HEAD/packages/router-cli) | `1.167.45` | `1.167.46` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.8` | `18.0.9` |



Updates `@better-auth/api-key` from 1.7.11 to 1.7.13
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/api-key/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.13/packages/api-key)

Updates `@cloudflare/vite-plugin` from 1.64.0 to 1.65.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vite-plugin@1.65.0/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.65.0/packages/vite-plugin-cloudflare)

Updates `@tanstack/router-plugin` from 1.168.47 to 1.168.48
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.48/packages/router-plugin)

Updates `better-auth` from 1.7.11 to 1.7.13
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.13/packages/better-auth)

Updates `lucide-react` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `posthog-js` from 1.438.12 to 1.438.23
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.438.12...posthog-js@1.438.23)

Updates `posthog-node` from 5.56.2 to 5.57.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.57.2/packages/node)

Updates `@cloudflare/workers-types` from 5.20261019.1 to 5.20261026.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@tanstack/router-cli` from 1.167.45 to 1.167.46
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-cli/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-cli@1.167.46/packages/router-cli)

Updates `dotenv` from 18.0.8 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.8...v18.0.9)

---
updated-dependencies:
- dependency-name: "@better-auth/api-key"
  dependency-version: 1.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261023.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/router-cli"
  dependency-version: 1.167.46
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/router-plugin"
  dependency-version: 1.168.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.438.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: posthog-node
  dependency-version: 5.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bun/minor-and-patch-1681e7d3e9 branch from a1dfe8f to fe9e8d8 Compare November 2, 2026 12:07
@changeset-bot

changeset-bot Bot commented Nov 2, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: fe9e8d8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Nov 2, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c36586a0-15d8-4c83-ad6f-09fd13735567

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@socket-security

socket-security Bot commented Nov 2, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​tanstack/​router-cli@​1.167.45 ⏵ 1.167.461001007098100
Updated@​better-auth/​api-key@​1.7.11 ⏵ 1.7.1310010078 +197 +1100
Updatedposthog-node@​5.56.2 ⏵ 5.57.29110079 +1100100
Updatedlucide-react@​1.60.0 ⏵ 1.61.0100 +110098 +19680
Updatedposthog-js@​1.438.12 ⏵ 1.438.2398 +110082100100
Updatedbetter-auth@​1.7.11 ⏵ 1.7.1398 +110085 +196 +1100
Updated@​cloudflare/​vite-plugin@​1.64.0 ⏵ 1.65.099 +11008798 +1100
Updateddotenv@​18.0.8 ⏵ 18.0.99910010095 -1100
Updated@​cloudflare/​workers-types@​5.20261019.1 ⏵ 5.20261102.110010096 +199100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants