Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 16 updates - #92

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-274de65600
Open

chore(deps): bump the minor-and-patch group across 1 directory with 16 updates#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-274de65600

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 16 updates in the / directory:

Package From To
@auth0/nextjs-auth0 4.29.0 4.31.0
@modelcontextprotocol/sdk 1.30.0 1.32.0
drizzle-orm 0.45.2 0.45.3
lucide-react 1.43.0 1.50.0
next 16.3.4 16.3.8
posthog-js 1.428.8 1.435.8
posthog-node 5.51.8 5.55.0
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.7 19.3.0
tailwind-merge 3.6.0 3.7.0
@types/react 19.2.18 19.3.0
@types/react-dom 19.2.7 19.3.0
drizzle-kit 0.31.10 0.31.11
eslint-config-next 16.3.4 16.3.8
prettier 3.9.6 3.9.9
tsx 4.23.13 4.23.15

Updates @auth0/nextjs-auth0 from 4.29.0 to 4.31.0

Release notes

Sourced from @​auth0/nextjs-auth0's releases.

v4.31.0

Added

  • feat(anonymous-sessions): anonymous sessions with Session Transfer Ticket linking (EA) #2865 (tusharpandey13)

v4.30.0

Added

Fixed

  • fix: bind middleware to the Auth0Client instance #2840 (sleitor)

Summary by CodeRabbit

  • New Features

    • Added Enterprise Connect support for enterprise SSO flows.
    • Added federated-domain detection and login helpers.
    • Added Experiment Center parameters for selecting login experiments and variations.
    • Added route support for federated-domain checks.

  • Documentation

    • Updated API documentation and changelog for v4.30.0.
    • Added documentation for Enterprise Connect, federated domains, and experiment parameters.
Changelog

Sourced from @​auth0/nextjs-auth0's changelog.

v4.31.0 (2026-10-01)

Full Changelog

Added

  • feat(anonymous-sessions): anonymous sessions with Session Transfer Ticket linking (EA) #2865 (tusharpandey13)

v4.30.0 (2026-09-16)

Full Changelog

Added

Fixed

  • fix: bind middleware to the Auth0Client instance #2840 (sleitor)
Commits
  • f342ba5 Release v4.31.0 (#2877)
  • 5798ee5 feat(anonymous-sessions): anonymous sessions with Session Transfer Ticket lin...
  • 1795509 chore(deps-dev): bump typescript-eslint from 8.70.0 to 8.70.1 (#2867)
  • 84f1242 chore(deps): bump the codeql-action group across 1 directory with 3 updates (...
  • bf34667 chore(deps-dev): bump @​types/node from 22.20.2 to 22.20.4 (#2863)
  • 4af8b8c chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 (#2862)
  • c3d9a94 chore(deps): bump js-yaml from 4.1.1 to 4.3.2 in /examples/with-mrrt (#2859)
  • f907d0b chore(deps): bump js-yaml from 4.1.1 to 4.3.2 in /examples/with-next-intl (#2...
  • 0445d66 chore(deps): bump nanoid from 3.3.17 to 3.3.19 in /examples/with-enterprise-c...
  • e6ff27a Release v4.30.0 (#2858)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
  • 30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
  • 4b0051f chore: bump version to 1.31.0 (#2890)
  • Additional commits viewable in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');
Commits
  • 15454db +
  • 54e436f exclude gel from pull
  • 0fd1cc6 remove gel
  • d028db7 skip gel
  • 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
  • b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
  • f9fc5bf Add drizzle-kit announcement manifest and schema doc
  • 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
  • 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
  • 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
  • Additional commits viewable in compare view

Updates lucide-react from 1.43.0 to 1.50.0

Release notes

Sourced from lucide-react's releases.

Version 1.50.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.49.0...1.50.0

Version 1.49.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.48.0...1.49.0

Version 1.48.0

What's Changed

... (truncated)

Commits
  • e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
  • f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
  • See full diff in compare view

Updates next from 16.3.4 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)
Commits
  • b0fad0d v16.3.8
  • 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
  • e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
  • 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
  • 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
  • bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
  • 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
  • e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
  • 4c20699 v16.3.7
  • 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
  • Additional commits viewable in compare view

Updates posthog-js from 1.428.8 to 1.435.8

Release notes

Sourced from posthog-js's releases.

posthog-js@1.435.8

1.435.8

Patch Changes

posthog-js@1.435.7

1.435.7

Patch Changes

  • #5188 8a005ca Thanks @​dustinbyrne! - Preserve shared identity while consent is pending and clear it after shared rejection in cookieless mode. (2026-10-02)

posthog-js@1.435.6

1.435.6

Patch Changes

  • #5046 c360da1 Thanks @​luke-belton! - Capture the OpenAI Ads click identifier (oppref) as a campaign parameter, so it is set on events and as $initial_oppref like every other ad click ID. (2026-10-01)

  • #5175 c21f14d Thanks @​marandaneto! - Fix cross-subdomain identity continuity when opting in after cookie consent. (2026-10-01)

  • Updated dependencies [c360da1]:

    • @​posthog/browser-common@​0.9.1
    • @​posthog/core@​1.55.3

posthog-js@1.435.5

1.435.5

Patch Changes

  • #5167 59b93a3 Thanks @​dustinbyrne! - Preserve session attribution and registered properties across initialization and configuration updates when persistence writes are debounced. (2026-09-30)

posthog-js@1.435.4

1.435.4

Patch Changes

  • #5158 5c92e83 Thanks @​posthog! - Fix a DataCloneError when session replay records network timing inside a cross-origin iframe. (2026-09-30)

posthog-js@1.435.3

1.435.3

Patch Changes

... (truncated)

Commits
  • c9d890a chore: update versions and lockfile [version bump]
  • 2bdc8eb fix(surveys): use new PostHog logo in survey footer branding (#5152)
  • 2ef9d36 chore: update versions and lockfile [version bump]
  • e4672b6 fix(react-native-plugin): require posthog-ios 3.88.2 (#5193)
  • a89ab25 chore: update versions and lockfile [version bump]
  • 9e42cc2 perf(mcp): skip truncation depths that collapse nothing (#5161)
  • ae7c453 chore: update versions and lockfile [version bump]
  • 8a005ca fix(browser): preserve shared identity during pending cookieless consent (#5188)
  • 041a0ad chore: update versions and lockfile [version bump]
  • 80b9e5f perf(mcp): sanitize only the head of a long string that truncation keeps (#5186)
  • Additional commits viewable in compare view

Updates posthog-node from 5.51.8 to 5.55.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.55.0

5.55.0

Minor Changes

  • #5140 2d2560a Thanks @​dustinbyrne! - Allow featureFlagsPollingInterval: null to disable automatic local flag polling while retaining initialization and manual refresh. (2026-09-30)

posthog-node@5.54.1

5.54.1

Patch Changes

  • #4832 ac479db Thanks @​dustinbyrne! - Support snake_case feature flag cache payloads while preserving compatibility with camelCase providers and cached data. (2026-09-25)

posthog-node@5.54.0

5.54.0

Minor Changes

  • #5099 e3955f8 Thanks @​marandaneto! - Expose feature flag evaluation reasons and preserve them in OpenFeature resolution metadata. (2026-09-25)

posthog-node@5.53.0

5.53.0

Minor Changes

  • #5050 31dd1ad Thanks @​posthog! - Read a feature flag's evaluation runtime with getFeatureFlagEvaluationRuntime(key) and getFeatureFlagKeysByEvaluationRuntime(runtime) (2026-09-23)

posthog-node@5.52.6

5.52.6

Patch Changes

  • #5078 f4704ac Thanks @​rubychilds! - Honor filters.holdout during local feature flag evaluation. A user in an experiment holdout now receives the holdout-<id> variant instead of being bucketed into a regular variant, matching how the server evaluates the same flag. The holdout is resolved before the release conditions, so a held-out user never reaches the flag's targeting — including when those conditions would have excluded them, so isFeatureEnabled can return true where it previously returned false. Experiments with an active holdout will see variant assignment change for the held-out share of traffic on upgrade, bringing locally evaluated assignments in line with server-evaluated ones. (2026-09-23)
  • Updated dependencies [f4704ac]:
    • @​posthog/core@​1.55.2
Changelog

Sourced from posthog-node's changelog.

5.55.0

Minor Changes

  • #5140 2d2560a Thanks @​dustinbyrne! - Allow featureFlagsPollingInterval: null to disable automatic local flag polling while retaining initialization and manual refresh. (2026-09-30)

5.54.1

Patch Changes

  • #4832 ac479db Thanks @​dustinbyrne! - Support snake_case feature flag cache payloads while preserving compatibility with camelCase providers and cached data. (2026-09-25)

5.54.0

Minor Changes

  • #5099 e3955f8 Thanks @​marandaneto! - Expose feature flag evaluation reasons and preserve them in OpenFeature resolution metadata. (2026-09-25)

5.53.0

Minor Changes

  • #5050 31dd1ad Thanks @​posthog! - Read a feature flag's evaluation runtime with getFeatureFlagEvaluationRuntime(key) and getFeatureFlagKeysByEvaluationRuntime(runtime) (2026-09-23)

5.52.6

Patch Changes

  • #5078 f4704ac Thanks @​rubychilds! - Honor filters.holdout during local feature flag evaluation. A user in an experiment holdout now receives the holdout-<id> variant instead of being bucketed into a regular variant, matching how the server evaluates the same flag. The holdout is resolved before the release conditions, so a held-out user never reaches the flag's targeting — including when those conditions would have excluded them, so isFeatureEnabled can return true where it previously returned false. Experiments with an active holdout will see variant assignment change for the held-out share of traffic on upgrade, bringing locally evaluated assignments in line with server-evaluated ones. (2026-09-23)
  • Updated dependencies [f4704ac]:
    • @​posthog/core@​1.55.2

5.52.5

Patch Changes

  • #5018 9cd8ebd Thanks @​turnipdabeets! - Stop dropping long spans that end: maxSpanAgeMs now evicts spans only once maxLiveSpans is reached, so a span that runs past the age limit and then ends is exported, and its children are no longer orphaned. (2026-09-21)

  • #4800 aad7464 Thanks @​marandaneto! - Respect the definitions response's property_matching_version during local feature flag evaluation. Version 2 uses explicit boolean/string equality and per-member array matching, while missing or other versions retain service legacy matching (including empty-array truthiness). Preserve the version in Node definition caches and Convex persisted definitions, and propagate it through person, group, cohort and dependency evaluation without mixing snapshots during reloads. Existing numeric ambiguity fallback and SemVer parsing policies are unchanged. (2026-09-21)

  • Updated dependencies [9cd8ebd, aad7464]:

    • @​posthog/core@​1.55.1

5.52.4

... (truncated)

Commits
  • e1dd962 chore: update versions and lockfile [version bump]
  • 2d2560a feat(node): allow disabling automatic feature flag polling (#5140)
  • bd66cee fix(replay): reduce debug properties without losing diagnostics (#5144)
  • 3c24aa5 test(node): strengthen SDK regression coverage (#5105)
  • 490ffe8 chore: update versions and lockfile [version bump]
  • ac479db fix(node): support snake_case flag definition caches (#4832)
  • 518ae78 chore: update versions and lockfile [version bump]
  • e3955f8 feat: expose feature flag reasons in the Node OpenFeature provider (#5099)
  • 7b3121f chore: update versions and lockfile [version bump]
  • 31dd1ad feat(node): expose a flag's evaluation runtime through the SDK (#5050)
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@...

    Description has been truncated

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
e3242d3 
…6 updates

Bumps the minor-and-patch group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@auth0/nextjs-auth0](https://github.com/auth0/nextjs-auth0) | `4.29.0` | `4.31.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.0` |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.43.0` | `1.50.0` |
| [next](https://github.com/vercel/next.js) | `16.3.4` | `16.3.8` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.428.8` | `1.435.8` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.51.8` | `5.55.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |
| [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.31.10` | `0.31.11` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.4` | `16.3.8` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |



Updates `@auth0/nextjs-auth0` from 4.29.0 to 4.31.0
- [Release notes](https://github.com/auth0/nextjs-auth0/releases)
- [Changelog](https://github.com/auth0/nextjs-auth0/blob/main/CHANGELOG.md)
- [Commits](auth0/nextjs-auth0@v4.29.0...v4.31.0)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.0)

Updates `drizzle-orm` from 0.45.2 to 0.45.3
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3)

Updates `lucide-react` from 1.43.0 to 1.50.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.50.0/packages/lucide-react)

Updates `next` from 16.3.4 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.4...v16.3.8)

Updates `posthog-js` from 1.428.8 to 1.435.8
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.428.8...posthog-js@1.435.8)

Updates `posthog-node` from 5.51.8 to 5.55.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.55.0/packages/node)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `drizzle-kit` from 0.31.10 to 0.31.11
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.10...drizzle-kit@0.31.11)

Updates `eslint-config-next` from 16.3.4 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next)

Updates `prettier` from 3.9.6 to 3.9.9
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.9)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

---
updated-dependencies:
- dependency-name: "@auth0/nextjs-auth0"
  dependency-version: 4.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: drizzle-orm
  dependency-version: 0.45.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.435.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-node
  dependency-version: 5.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: drizzle-kit
  dependency-version: 0.31.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.3.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from adamsoffer as a code owner October 10, 2026 00:50
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 10, 2026
Copilot AI balanced review requested due to automatic review settings October 10, 2026 00:50
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 10, 2026
@vercel

vercel Bot commented Oct 10, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
console Ready Ready Preview Oct 10, 2026 12:51am UTC

Request Review

Copilot AI reviewed Oct 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

Manifest and lockfile versions are aligned, with compatible peer requirements and no identified regressions.

0 open findings

What changed in this PR

Updates 16 runtime and development dependencies, including security fixes for Next.js.

Changes:

  • Upgrades React, Next.js, Auth0, MCP, PostHog, Drizzle, and UI tooling.
  • Regenerates the pnpm lockfile with compatible transitive dependencies.
File Description
package.json Updates dependency version ranges.
pnpm-lock.yaml Locks updated direct and transitive packages.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

This branch was successfully deployed

1 active deployment
Preview — e3242d35 Deployed Oct 10, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@adamsoffer adamsoffer Awaiting requested review from adamsoffer adamsoffer is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant