build(deps): bump the all-version-updates group across 1 directory with 18 updates by dependabot[bot] · Pull Request #92 · arnabnandy7/openissue.dev

dependabot · 2026-10-14T20:02:01Z

Bumps the all-version-updates group with 18 updates in the / directory:

Package	From	To
@better-auth/drizzle-adapter	`1.7.3`	`1.7.7`
better-auth	`1.7.3`	`1.7.7`
drizzle-orm	`0.45.2`	`0.45.4`
lucide-react	`1.41.0`	`1.55.0`
next	`16.3.4`	`16.4.0`
nodemailer	`10.0.0`	`10.1.0`
radix-ui	`1.6.7`	`1.7.0`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.7`	`19.3.0`
shadcn	`4.21.0`	`4.21.4`
tailwind-merge	`3.6.0`	`3.7.0`
@testing-library/dom	`10.4.1`	`10.4.2`
@types/node	`26.4.1`	`26.6.5`
@types/nodemailer	`8.0.1`	`8.0.2`
@types/react	`19.2.18`	`19.3.0`
@types/react-dom	`19.2.7`	`19.3.0`
eslint-config-next	`16.3.4`	`16.4.0`
jsdom	`30.0.1`	`30.1.2`

Updates @better-auth/drizzle-adapter from 1.7.3 to 1.7.7

Release notes

Sourced from @better-auth/drizzle-adapter's releases.

v1.7.7

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

Fixed a critical Magic Link account-takeover vulnerability. (#11494)

Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)

Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

Fixed CAPTCHA errors missing the JSON Content-Type header. (#11476)

Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. (#11375)

Fixed rate-limit errors missing the JSON Content-Type header. (#11469)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs. (#8686)

Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page. (#11402)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. (#11331)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed consumeOne deleting a record after a concurrent write invalidates its original condition. (#11495)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @bytaesu, @gitmotion, @gustavovalverde, @lennondotw

Full changelog: v1.7.6...v1.7.7

... (truncated)

Changelog

Sourced from @better-auth/drizzle-adapter's changelog.

1.7.7

Patch Changes

#11331 35d7cd3 Thanks @gitmotion! - Drizzle incrementOne now rejects updates when a concurrent write makes the original where condition false. This prevents stale updates and counter limits from being exceeded on PostgreSQL. Both the default adapter and relations-v2 retain the single-row limit.

1.7.6

Patch Changes

#11333 631ac29 Thanks @bytaesu! - Preserve logical model identity when a custom model name matches another schema key.

1.7.5

Patch Changes

#11263 e18bc83 Thanks @bytaesu! - Defer Drizzle relation metadata access until a relational query runs, preserving lazy database initialization during application builds.

1.7.4

Patch Changes

#11213 b905bfe Thanks @bytaesu! - Run schema validation for the Drizzle Relations v2 adapter, including configurations that provide only relations, so schema mismatches are reported during initialization.

Commits

db02f23 chore: release v1.7.7 (#11413)
35d7cd3 fix(drizzle-adapter): re-check the incrementOne guard on the UPDATE (#11331)
229a02a chore: release v1.7.6 (#11322)
dcaa5a7 feat(cli): add check command for schema validation (#11314)
631ac29 fix(db): preserve model identity across adapters (#11333)
5468e6b chore: release v1.7.5 (#11245)
e18bc83 fix(drizzle-adapter): defer relation metadata access (#11263)
735008f chore: release v1.7.4 (#11216)
b905bfe fix(drizzle-adapter): validate schemas in relations v2 (#11213)
cfedf97 docs: update CLI references to auth (#11214)
See full diff in compare view

Updates better-auth from 1.7.3 to 1.7.7

Release notes

Sourced from better-auth's releases.

v1.7.7

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

Fixed a critical Magic Link account-takeover vulnerability. (#11494)

Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)

Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

Fixed CAPTCHA errors missing the JSON Content-Type header. (#11476)

Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. (#11375)

Fixed rate-limit errors missing the JSON Content-Type header. (#11469)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs. (#8686)

Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page. (#11402)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. (#11331)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed consumeOne deleting a record after a concurrent write invalidates its original condition. (#11495)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @bytaesu, @gitmotion, @gustavovalverde, @lennondotw

Full changelog: v1.7.6...v1.7.7

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.7

Patch Changes

#11476 4186e36 Thanks @bytaesu! - Return CAPTCHA errors with the correct JSON Content-Type header.

#11469 8620aa9 Thanks @aryan1306! - Return rate limit errors with a JSON Content-Type header.

#11491 55cb92e Thanks @bytaesu! - Respect social provider disableSignUp when signing in with an ID token.

#11375 69defbc Thanks @bytaesu! - Refresh the active organization after sign-in when a session hook selects the initial organization.

#11494 ac54bfd Thanks @gustavovalverde! - Isolate OAuth state cookies and each OAuth Proxy payload with purpose-specific encryption keys. The oAuthProxy options and supported configuration remain unchanged.

Upgrade all Better Auth nodes that handle the same cookie-backed OAuth or SAML relay-state flow together. Upgrade every OAuth Proxy participant, including production and preview or development deployments, in the same cutover. OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows started before the upgrade must be restarted. Mixed old and new participants cannot exchange existing state or proxy payloads, and there is no fallback to the previous shared key.

#11494 ac54bfd Thanks @gustavovalverde! - Magic Link verification now accepts only records issued for Magic Link. Magic Link records and database-backed OAuth or SAML state use separate verification identifier prefixes. Links and database-backed sign-ins started before the upgrade cannot complete; request new Magic Links and restart those sign-ins. Upgrade servers sharing verification storage together, and update verification.storeIdentifier.overrides rules for these flows to match the new magic-link: and auth-state: prefixes. The link token, callback state, endpoints, and public option types are unchanged.

Upgrade installed Better Auth adapters, plugins, and integrations released with better-auth alongside it so participating packages use the same release version.

Updated dependencies [35d7cd3, 07bdf7e]:

@better-auth/drizzle-adapter@1.7.7

@better-auth/kysely-adapter@1.7.7

@better-auth/core@1.7.7

@better-auth/memory-adapter@1.7.7

@better-auth/mongo-adapter@1.7.7

@better-auth/prisma-adapter@1.7.7

@better-auth/telemetry@1.7.7

1.7.6

Patch Changes

#11325 af88385 Thanks @Wadiou! - Admin plugin bannedUserMessage can now be a function that receives the banned user, so sign-in errors can include details such as the ban reason.

#11268 2fa501c Thanks @bytaesu! - Support linking social accounts through the OAuth Proxy plugin.

#11366 d41e2ca Thanks @bytaesu! - Use targeted PRAGMA queries when a Kysely dialect cannot introspect Cloudflare D1.

#11016 3d0efa3 Thanks @davbrito! - Support Vercel BotID checks on protected authentication routes in Vercel-hosted applications.

... (truncated)

Commits

db02f23 chore: release v1.7.7 (#11413)
ac54bfd fix(auth): isolate verification records and encryption purposes (#11494)
69defbc fix(organization): refresh active organization after email sign-in (#11375)
55cb92e fix(auth): honor social disableSignUp for ID token sign-in (#11491)
4186e36 fix(captcha): return JSON content type for errors (#11476)
8620aa9 fix(rate-limit): set JSON content type on 429 responses (#11469)
229a02a chore: release v1.7.6 (#11322)
dcaa5a7 feat(cli): add check command for schema validation (#11314)
fc45d08 fix(client): prevent stale query overwrites (#11376)
8853419 fix: enforce maxPasswordLength before hashing on password verification endpoi...
Additional commits viewable in compare view

Updates drizzle-orm from 0.45.2 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

Fixed postgres-js not using prepared queries on explicit .prepare(name)

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
Additional commits viewable in compare view

Updates lucide-react from 1.41.0 to 1.55.0

Release notes

Sourced from lucide-react's releases.

Version 1.55.0

What's Changed

feat(icons): added mail-dot icon by @elenakovelskikh in lucide-icons/lucide#3230

ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @ericfennis in lucide-icons/lucide#4982

chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @dependabot[bot] in lucide-icons/lucide#4987

chore(deps): bump next from 16.3.6 to 16.3.8 by @dependabot[bot] in lucide-icons/lucide#4988

test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @grzdev in lucide-icons/lucide#4967

feat(icons): added phone-log icon by @Levi-Bensley in lucide-icons/lucide#3598

chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @ericfennis in lucide-icons/lucide#4989

feat(icons): added wifi-lock icon by @benhaube in lucide-icons/lucide#4913

feat(icons): Add handle-bottom-right icon by @ocavue in lucide-icons/lucide#1793

test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by @grzdev in lucide-icons/lucide#4966

feat(icons): added screw icon by @edik17 in lucide-icons/lucide#4932

feat(icons): added user-round-star icon by @karsa-mistmere in lucide-icons/lucide#3469

feat(icons): added shield-house icon by @benhaube in lucide-icons/lucide#4602

New Contributors

@grzdev made their first contribution in lucide-icons/lucide#4967

@Levi-Bensley made their first contribution in lucide-icons/lucide#3598

@edik17 made their first contribution in lucide-icons/lucide#4932

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

feat(icons): added lens icon by @rrod497 in lucide-icons/lucide#4923

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

chore(deps-dev): bump preact from 10.29.8 to 11.0.0 in the preact-deps group by @dependabot[bot] in lucide-icons/lucide#4961

chore(deps): bump vue from 3.5.42 to 3.5.43 in the vue-deps group by @dependabot[bot] in lucide-icons/lucide#4958

fix(site): Fix reset button and rename absolute stroke width to non-scaling stroke by @ericfennis in lucide-icons/lucide#4956

chore(deps-dev): bump simple-git from 3.36.0 to 4.0.1 by @dependabot[bot] in lucide-icons/lucide#4968

chore(deps-dev): bump the angular-deps group across 1 directory with 11 updates by @dependabot[bot] in lucide-icons/lucide#4960

chore(categories): Add description field to categories by @ericfennis in lucide-icons/lucide#4909

feat(icons): added groceries icon by @rrod497 in lucide-icons/lucide#4907

fix(icons): changed pen-tool icon by @karsa-mistmere in lucide-icons/lucide#4972

feat(icons): added new hiking-stick icon by @kamilasw in lucide-icons/lucide#4711

feat(icons): added scratch-blocks icon by @mc20000-01 in lucide-icons/lucide#4969

fix(icons): changed soup and salad icons by @karsa-mistmere in lucide-icons/lucide#4971

New Contributors

@mc20000-01 made their first contribution in lucide-icons/lucide#4969

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

Version 1.52.0

... (truncated)

Commits

949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
94e4cb9 chore(dependencies): Update dependencies (#4806)
99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
See full diff in compare view

Updates next from 16.3.4 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

docs: improve clarity and punctuation in README: #86096

Fix debug build paths Pages Router support entries: #93529

bundle-analyzer: record historical snapshots on each analyze run: #93520

fix: detect proxy.ts correctly with compound pageExtensions: #93246

feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624

docs: proxy event argument: #96435

docs: remove experimental note from runtime prefetching: #96615

Preserve per-segment prefetching after dynamic navigation: #96583

Rename static generation stream option to waitForAllReady: #96564

Remove obsolete static generation plumbing: #96563

[turbopack] Drop dead writes to exports: #96381

[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380

[turbopack] Add test for sideEffects with optimizePackageImports: #96549

[turbopack] Strip leading BOM before parsing CSS: #96678

Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

docs: use relative doc links in instant-navigation error pages: #96672

Turbopack: terminate failed plugin worker threads: #96592

Fix HTML-limited bot matching in prerender bypass rules: #96584

[ci] Fix create_release_branch for new repo permissions: #96641

test: skip action module instance deploy test: #96629

docs: quote the dynamicParams build error in a blockquote: #96633

[react-sync] Open pull requests as the bot that authors the commits: #96682

[Bench] Fixes for pure Fizz bench: #96771

Derive foreground cache revalidation from the consumer: #96731

Fix race when navigating Back before hydration: #96252

docs: present each Skill as steps in the AI agents guide: #96751

Reuse completed cache entries for the rest of a request: #96727

Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735

Remove WorkStore execution mode: #96674

Remove cache revalidation execution mode reads: #96670

Separate App Route render and prerender pipelines: #96662

Remove App Page execution mode reads: #96660

test: fix missing await in css-chunking test: #96725

docs (Skills): stop assuming app/ at the root and port 3000: #96696

Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808

Use Tailwind Turbopack loader in create-next-app: #96606

docs: instant navigation quick start with an adoption prompt: #96663

Separate App Page render and prerender pipelines: #96659

Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits

e273d5b v16.4.0
fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
c3e76ad v16.4.0-canary.63
47c6cc8 Document next analyze export in the package bundling guide (#99735)
5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
f3a6f97 Preserve configured output directories during static export (#99507)
b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
ccf8c15 v16.4.0-canary.62
b8c7c7f Improve static route error guidance (#99724)
Additional commits viewable in compare view

Updates nodemailer from 10.0.0 to 10.1.0

Release notes

Sourced from nodemailer's releases.

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.

connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.

Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.

A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.

With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.

Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

do not read the environment or the interface table on import (094179d)

end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)

keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)

let the proxy handshake and the SMTP connection share one deadline (91ed683)

mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)

mime-node: finish an encoded part only after its output was read (ec97d8f)

qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)

smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)

smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)

smtp-connection: refuse a second connect() call (24ba2e0)

turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

encode base64 and quoted-printable without per-chunk delays (fd377bb)

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

addressparser: keep an escaped parenthesis inside a comment (c4ae20d)

fetch: keep the case of cookie names (#1888) (9f16eed)

fetch: read the cookie name-value pair by position (645e97c)

v10.0.15

10.0.15 (2026-10-05)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.0 (2026-10-10)

Features

harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

do not read the environment or the interface table on import (094179d)

end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)

keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)

let the proxy handshake and the SMTP connection share one deadline (91ed683)

mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)

mime-node: finish an encoded part only after its output was read (ec97d8f)

qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)

smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)

smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)

smtp-connection: refuse a second connect() call (24ba2e0)

turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

encode base64 and quoted-printable without per-chunk delays (fd377bb)

10.0.16 (2026-10-07)

Bug Fixes

addressparser: keep an escaped parenthesis inside a comment (c4ae20d)

fetch: keep the case of cookie names (#1888) (9f16eed)

fetch: read the cookie name-value pair by position (645e97c)

10.0.15 (2026-10-05)

Bug Fixes

errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884

errors: keep NodemailerError compatible with @types/node 26 ErrnoException (#1885) (b660328)

10.0.14 (2026-10-03)

Bug Fixes

addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)

... (truncated)

Commits

0780032 chore(master): release 10.1.0 (#1890)
42b91d9 fix(qp): encode a lone CR or LF in binary quoted-printable parts
b9b8c84 test(smtp-pool): fail the clear event test with the pool state instead of han...
4f1a34a test(smtp-connection): keep the scripted server silent after a stalled STARTTLS
f90fb04 fix(smtp-connection): drop the connection when DATA is taken after a refused ...
bdcd046 fix(smtp-connection): count the wait for the greeting against connectionTimeout
751330a test(smtp-pool): measure the rate limit against a window wider than connecting
ec97d8f fix(mime-node): finish an encoded part only after its output was read
24ba2e0 fix(smtp-connection): refuse a second connect() call
91ed683 fix: let the proxy handshake and the SMTP connection share one deadline
Additional commits viewable in compare view

Updates radix-ui from 1.6.7 to 1.7.0

Changelog

Sourced from radix-ui's changelog.

1.7.0

Dialog

Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.

Navigation Menu

Added a disableToggle prop to NavigationMenu.Sub.

true: Clicking the trigger of an already-open submenu item keeps it open. This is the default and matches existing behavior.

false: Clicking the trigger of a submenu item toggles it open or closed.

Added an activationMode prop to NavigationMenu.Root and NavigationMenu.Sub.

"automatic": Hovering or focusing a trigger opens its item, and moving away from the trigger closes it after a short delay. This is the default and matches existing behavior.

"manual": Pointer entry and focus never open an item. The item opens when its trigger is clicked.

When activationMode is omitted on NavigationMenu.Sub, it inherits the value from the parent NavigationMenu.Root, so setting "manual" on the root also applies to submenus unless a submenu opts back in to "automatic".

Fixed a bug where a submenu's defaultValue was reset when an external element was focused before the menu opened.

Fixed a bug where NavigationMenu.Viewport discarded its children and rendered the active content in their place. The active content is now rendered inside the consumer's element alongside any children it already had.

Popover

Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.

Scroll Area
Added a ScrollArea.Content part so consumers can own the wrapper element implicitly rendered by ScrollArea.Viewport. Pass disableImplicitContentElement to the viewport and render ScrollArea.Content as its child.
<ScrollArea.Root>
  <ScrollArea.Viewport disableImplicitContentElement>
    <ScrollArea.Content>{children}</ScrollArea.Content>
  </ScrollArea.Viewport>
  <ScrollArea.Scrollbar>
    <ScrollArea.Thumb />
  </ScrollArea.Scrollbar>
</ScrollArea.Root>
In the next major release, the viewport will no longer render this element implicitly. We recommend migrating to this API now for a smoother upgrade.
Fixed a bug where asChild on ScrollArea.Viewport merged props onto the implicit content element instead of the consumer's element.
Slider

Added a preserveThumbOrder prop to Slider that prevents thumbs from crossing over one another. When enabled, each thumb is constrained to the values of its neighbors instead of swapping positions when dragged past them.

Other updates

Added support for multiple aria-describedby attributes, so id strings from a component and its child are merged, normalized, and deduplicated instead of one replacing the other.

Fixed a bug where internal event handlers were still called on disabled Select.... Description has been truncated

…th 18 updates Bumps the all-version-updates group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@better-auth/drizzle-adapter](https://github.com/better-auth/better-auth/tree/HEAD/packages/drizzle-adapter) | `1.7.3` | `1.7.7` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.3` | `1.7.7` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.4` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.41.0` | `1.55.0` | | [next](https://github.com/vercel/next.js) | `16.3.4` | `16.4.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.0.0` | `10.1.0` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.7.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.0` | `4.21.4` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` | | [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.5` | | [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer) | `8.0.1` | `8.0.2` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.4` | `16.4.0` | | [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.2` | Updates `@better-auth/drizzle-adapter` from 1.7.3 to 1.7.7 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/drizzle-adapter/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/drizzle-adapter) Updates `better-auth` from 1.7.3 to 1.7.7 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/better-auth) Updates `drizzle-orm` from 0.45.2 to 0.45.4 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.4) Updates `lucide-react` from 1.41.0 to 1.55.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.55.0/packages/lucide-react) Updates `next` from 16.3.4 to 16.4.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.4...v16.4.0) Updates `nodemailer` from 10.0.0 to 10.1.0 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.0.0...v10.1.0) Updates `radix-ui` from 1.6.7 to 1.7.0 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `shadcn` from 4.21.0 to 4.21.4 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.4/packages/shadcn) Updates `tailwind-merge` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge) Updates `@testing-library/dom` from 10.4.1 to 10.4.2 - [Release notes](https://github.com/testing-library/dom-testing-library/releases) - [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/dom-testing-library@v10.4.1...v10.4.2) Updates `@types/node` from 26.4.1 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/nodemailer` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `eslint-config-next` from 16.3.4 to 16.4.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.0/packages/eslint-config-next) Updates `jsdom` from 30.0.1 to 30.1.2 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.0.1...v30.1.2) --- updated-dependencies: - dependency-name: "@better-auth/drizzle-adapter" dependency-version: 1.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-version-updates - dependency-name: better-auth dependency-version: 1.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-version-updates - dependency-name: drizzle-orm dependency-version: 0.45.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-version-updates - dependency-name: lucide-react dependency-version: 1.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: next dependency-version: 16.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: nodemailer dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: radix-ui dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: shadcn dependency-version: 4.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-version-updates - dependency-name: tailwind-merge dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: "@testing-library/dom" dependency-version: 10.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-version-updates - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: "@types/nodemailer" dependency-version: 8.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-version-updates - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: eslint-config-next dependency-version: 16.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates - dependency-name: jsdom dependency-version: 30.1.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-14T20:02:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openissue-dev	Ready	Preview	Oct 14, 2026 8:02pm UTC

sonarqubecloud · 2026-10-14T20:04:11Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot · 2026-10-21T05:16:06Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 14, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Oct 14, 2026

vercel Bot deployed to Preview October 14, 2026 20:02

View deployment

dependabot Bot closed this Oct 21, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/all-version-updates-49b12b64bd branch October 21, 2026 05:16

Navigation Menu

Repository navigation

build(deps): bump the all-version-updates group across 1 directory with 18 updates - #92

build(deps): bump the all-version-updates group across 1 directory with 18 updates#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-version-updates-49b12b64bd

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Oct 14, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 21, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.7

better-auth

Bug Fixes

@better-auth/oauth-provider

Features

@better-auth/drizzle-adapter

Bug Fixes

@better-auth/kysely-adapter

Bug Fixes

Contributors

1.7.7

Patch Changes

1.7.6

Patch Changes

1.7.5

Patch Changes

1.7.4

Patch Changes

v1.7.7

better-auth

Bug Fixes

@better-auth/oauth-provider

Features

@better-auth/drizzle-adapter

Bug Fixes

@better-auth/kysely-adapter

Bug Fixes

Contributors

1.7.7

Patch Changes

1.7.6

Patch Changes

0.45.4

0.45.3

New Netlify DB Driver

Version 1.55.0

What's Changed

New Contributors

Version 1.54.0

What's Changed

Version 1.53.0

What's Changed

New Contributors

Version 1.52.0

v16.4.0

Core Changes

Misc Changes

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

Features

Bug Fixes

Performance Improvements

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

v10.0.15

10.0.15 (2026-10-05)

10.1.0 (2026-10-10)

Features

Bug Fixes

Performance Improvements

10.0.16 (2026-10-07)

Bug Fixes

10.0.15 (2026-10-05)

Bug Fixes

10.0.14 (2026-10-03)

Bug Fixes

1.7.0

Dialog

Navigation Menu

Popover

Scroll Area

Slider

Other updates

Uh oh!

vercel Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

`better-auth`

`@better-auth/oauth-provider`

`@better-auth/drizzle-adapter`

`@better-auth/kysely-adapter`

`better-auth`

`@better-auth/oauth-provider`

`@better-auth/drizzle-adapter`

`@better-auth/kysely-adapter`

vercel Bot commented Oct 14, 2026 •

edited

Loading