Skip to content

chore(deps)(deps): bump the production-dependencies group across 1 directory with 15 updates - #1668

Merged
os-zhuang merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-598fba5516
Jun 9, 2026
Merged

chore(deps)(deps): bump the production-dependencies group across 1 directory with 15 updates#1668
os-zhuang merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-598fba5516

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJun 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 15 updates in the / directory:

PackageFromTo
@ai-sdk/anthropic3.0.793.0.81
@ai-sdk/gateway3.0.1213.0.126
@ai-sdk/google3.0.793.0.80
@ai-sdk/openai3.0.653.0.68
tar7.5.157.5.16
ai6.0.1936.0.198
@better-auth/core1.6.131.6.15
@better-auth/oauth-provider1.6.131.6.15
better-auth1.6.131.6.15
hono4.12.234.12.24
ioredis5.11.05.11.1
next16.2.616.2.7
react19.2.619.2.7
react-dom19.2.619.2.7
fumadocs-mdx15.0.1015.0.11

Updates @ai-sdk/anthropic from 3.0.79 to 3.0.81

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

3.0.81

Patch Changes

  • 4084fcd: feat(provider/anthropic): add support for claude-opus-4-8

3.0.80

Patch Changes

  • 263d3e6: fix(provider/anthropic): fix remaining errors with Anthropic code_execution tool dynamic calls from latest web_fetch or web_search
Commits

Updates @ai-sdk/gateway from 3.0.121 to 3.0.126

Release notes

Sourced from @​ai-sdk/gateway's releases.

@​ai-sdk/gateway@​3.0.126

Patch Changes

  • ff16d3b: feat(gateway): add GatewayFailedDependencyError (424)

@​ai-sdk/gateway@​3.0.125

Patch Changes

  • fef3b24: Backport: chore(provider/gateway): update gateway model settings files
Changelog

Sourced from @​ai-sdk/gateway's changelog.

3.0.126

Patch Changes

  • ff16d3b: feat(gateway): add GatewayFailedDependencyError (424)

3.0.125

Patch Changes

  • fef3b24: Backport: chore(provider/gateway): update gateway model settings files

3.0.124

Patch Changes

  • 286b7a2: Backport: chore(provider/gateway): update gateway model settings files

3.0.123

Patch Changes

  • 537a022: Backport: chore(provider/gateway): update gateway model settings files

3.0.122

Patch Changes

  • 9766034: Backport: chore(provider/gateway): update gateway model settings files
Commits

Updates @ai-sdk/google from 3.0.79 to 3.0.80

Changelog

Sourced from @​ai-sdk/google's changelog.

3.0.80

Patch Changes

  • f62ffe0: fix(google): auto-inject skip_thought_signature_validator for Gemini 3 tool-call replays without a signature

    Gemini 3 models reject requests when an assistant functionCall part lacks a thoughtSignature with HTTP 400 "Function call is missing a thought_signature in functionCall parts." This is easy to hit when application code persists/serializes messages and drops providerOptions.google.thoughtSignature (custom DB schemas, useChat server routes that rebuild messages, synthetic tool-call injection).

    The provider now detects this case (Gemini 3 model + missing signature under google, googleVertex, and vertex namespaces) and injects the documented skip_thought_signature_validator sentinel into the outbound functionCall, plus surfaces a one-shot warning per request listing the affected tool names so the developer can find and fix the upstream serialization. Non-Gemini-3 models are unaffected, and real signatures take precedence when present.

Commits

Updates @ai-sdk/openai from 3.0.65 to 3.0.68

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​3.0.68

Patch Changes

  • c65c952: fix(openai): round-trip namespace on function_call input items

    When tool_search dispatches a deferred tool, the resulting function_call carries a namespace field identifying which deferred-tool group the model picked. [#14789](https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/14789) preserved this on the read side (providerMetadata.openai.namespace), but the write side still serialized function_call input items without namespace. Multi-step / multi-turn conversations then failed with Missing namespace for function_call '<name>'. ... Round-trip the model's function_call item with its namespace field included.

    convert-to-openai-responses-input.ts now reads namespace from providerOptions.openai.namespace (or providerMetadata.openai.namespace) on tool-call parts and includes it on the serialized function_call item, mirroring how itemId is round-tripped.

Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.68

Patch Changes

  • c65c952: fix(openai): round-trip namespace on function_call input items

    When tool_search dispatches a deferred tool, the resulting function_call carries a namespace field identifying which deferred-tool group the model picked. [#14789](https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/14789) preserved this on the read side (providerMetadata.openai.namespace), but the write side still serialized function_call input items without namespace. Multi-step / multi-turn conversations then failed with Missing namespace for function_call '<name>'. ... Round-trip the model's function_call item with its namespace field included.

    convert-to-openai-responses-input.ts now reads namespace from providerOptions.openai.namespace (or providerMetadata.openai.namespace) on tool-call parts and includes it on the serialized function_call item, mirroring how itemId is round-tripped.

3.0.67

Patch Changes

  • c679fec: feat(provider/azure):web search tool in the Azure OpenAI Responses API.

3.0.66

Patch Changes

  • c82ab42: feat(openai): forward web_search_call.action.queries from Responses API
Commits
  • de852ab Version Packages (#15821)
  • c65c952 Backport: fix(openai): round-trip namespace on function_call input items (#15...
  • 7aca1fc backport: chore: update TypeScript references and fix `pnpm update-references...
  • d4893c4 Version Packages (#15700)
  • c679fec Backport: feat(provider/azure): web search tool in the Azure OpenAI Responses...
  • 52332bf Version Packages (#15637)
  • c82ab42 Backport: feat(openai): forward web_search_call.action.queries from Responses...
  • See full diff in compare view

Updates tar from 7.5.15 to 7.5.16

Commits

Updates ai from 6.0.193 to 6.0.198

Release notes

Sourced from ai's releases.

ai@6.0.198

Patch Changes

  • Updated dependencies [ff16d3b]
    • @​ai-sdk/gateway@​3.0.126

ai@6.0.197

Patch Changes

  • Updated dependencies [fef3b24]
    • @​ai-sdk/gateway@​3.0.125
Changelog

Sourced from ai's changelog.

6.0.198

Patch Changes

  • Updated dependencies [ff16d3b]
    • @​ai-sdk/gateway@​3.0.126

6.0.197

Patch Changes

  • Updated dependencies [fef3b24]
    • @​ai-sdk/gateway@​3.0.125

6.0.196

Patch Changes

  • Updated dependencies [286b7a2]
    • @​ai-sdk/gateway@​3.0.124

6.0.195

Patch Changes

  • Updated dependencies [537a022]
    • @​ai-sdk/gateway@​3.0.123

6.0.194

Patch Changes

  • Updated dependencies [9766034]
    • @​ai-sdk/gateway@​3.0.122
Commits

Updates @better-auth/core from 1.6.13 to 1.6.15

Release notes

Sourced from @​better-auth/core's releases.

v1.6.15

better-auth

Bug Fixes

  • Fixed the listSessions endpoint to properly enforce fresh-age session checks (#9865)
  • Fixed unbanUser, setRole, and adminUpdateUser to return USER_NOT_FOUND instead of a generic 500 when the target user does not exist (#9875)
  • Fixed Kysely migration constant import path to restore Kysely 0.28 and 0.29 compatibility (#9811)
  • Improved cookie regex character ranges for more accurate cookie parsing (#9879)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added POST support to the /oauth2/userinfo endpoint, allowing the access token to be passed in the Authorization header (#9937)

Bug Fixes

  • Fixed hooks.before and hooks.after to run correctly when OAuth authorization resumes after sign-in, account selection, or consent (#9919)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed Turbopack build failures by inlining migration table constants, also restoring compatibility with Kysely 0.28 and 0.29 (#9933)

For detailed changes, see CHANGELOG

@better-auth/passkey

Features

  • Added automatic resolution of authenticator names from AAGUID, exposing getAuthenticatorName(aaguid) and commonAuthenticatorNames so passkeys can display a friendly provider name like "1Password" or "Google Password Manager" (#9927)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed ERR_SUBJECT_UNCONFIRMED errors caused by clockSkew not being forwarded to samlify's ServiceProvider when validating SAML responses (#9748)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.6.15

1.6.14

Patch Changes

  • #984513abc79 Thanks @​gustavovalverde! - Harden redirect-URI validation across the OAuth provider plugins. isSafeUrlScheme and SafeUrlSchema no longer call URL.canParse, which is absent on some supported runtimes and could throw or silently disable the dangerous-scheme check. They now parse with a try/catch fallback. SafeUrlSchema also rejects redirect URIs that contain a fragment component, per RFC 6749 §3.1.2.
Commits

Updates @better-auth/oauth-provider from 1.6.13 to 1.6.15

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.6.15

better-auth

Bug Fixes

  • Fixed the listSessions endpoint to properly enforce fresh-age session checks (#9865)
  • Fixed unbanUser, setRole, and adminUpdateUser to return USER_NOT_FOUND instead of a generic 500 when the target user does not exist (#9875)
  • Fixed Kysely migration constant import path to restore Kysely 0.28 and 0.29 compatibility (#9811)
  • Improved cookie regex character ranges for more accurate cookie parsing (#9879)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added POST support to the /oauth2/userinfo endpoint, allowing the access token to be passed in the Authorization header (#9937)

Bug Fixes

  • Fixed hooks.before and hooks.after to run correctly when OAuth authorization resumes after sign-in, account selection, or consent (#9919)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed Turbopack build failures by inlining migration table constants, also restoring compatibility with Kysely 0.28 and 0.29 (#9933)

For detailed changes, see CHANGELOG

@better-auth/passkey

Features

  • Added automatic resolution of authenticator names from AAGUID, exposing getAuthenticatorName(aaguid) and commonAuthenticatorNames so passkeys can display a friendly provider name like "1Password" or "Google Password Manager" (#9927)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed ERR_SUBJECT_UNCONFIRMED errors caused by clockSkew not being forwarded to samlify's ServiceProvider when validating SAML responses (#9748)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.6.15

Patch Changes

  • #9919b0ddfd3 Thanks @​gustavovalverde! - Run configured hooks through the whole OAuth sign-in flow

    hooks.before / hooks.after configured on the auth instance now run for the OAuth authorization that continues after a user signs in, selects an account, or consents. They were being skipped there.

    Headers or cookies a hooks.before sets before returning its own response are no longer dropped, and a hooks.after that throws an APIError no longer loses either its cookies or the error's headers.

  • #9937fe9600b Thanks @​gustavovalverde! - The UserInfo endpoint (/oauth2/userinfo) now accepts POST with the access token in the Authorization header, in addition to GET.

  • Updated dependencies [1012b69, ad60333, 0933c05, b0ddfd3]:

    • better-auth@1.6.15
    • @​better-auth/core@​1.6.15

1.6.14

Patch Changes

  • #984513abc79 Thanks @​gustavovalverde! - Harden redirect-URI validation across the OAuth provider plugins. isSafeUrlScheme and SafeUrlSchema no longer call URL.canParse, which is absent on some supported runtimes and could throw or silently disable the dangerous-scheme check. They now parse with a try/catch fallback. SafeUrlSchema also rejects redirect URIs that contain a fragment component, per RFC 6749 §3.1.2.

  • Updated dependencies [2d9781a, 5a2d642, 13abc79, 9d3450a]:

    • better-auth@1.6.14
    • @​better-auth/core@​1.6.14
Commits

Updates better-auth from 1.6.13 to 1.6.15

Release notes

Sourced from better-auth's releases.

v1.6.15

better-auth

Bug Fixes

  • Fixed the listSessions endpoint to properly enforce fresh-age session checks (#9865)
  • Fixed unbanUser, setRole, and adminUpdateUser to return USER_NOT_FOUND instead of a generic 500 when the target user does not exist (#9875)
  • Fixed Kysely migration constant import path to restore Kysely 0.28 and 0.29 compatibility (#9811)
  • Improved cookie regex character ranges for more accurate cookie parsing (#9879)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

  • Added POST support to the /oauth2/userinfo endpoint, allowing the access token to be passed in the Authorization header (#9937)

Bug Fixes

  • Fixed hooks.before and hooks.after to run correctly when OAuth authorization resumes after sign-in, account selection, or consent (#9919)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

  • Fixed Turbopack build failures by inlining migration table constants, also restoring compatibility with Kysely 0.28 and 0.29 (#9933)

For detailed changes, see CHANGELOG

@better-auth/passkey

Features

  • Added automatic resolution of authenticator names from AAGUID, exposing getAuthenticatorName(aaguid) and commonAuthenticatorNames so passkeys can display a friendly provider name like "1Password" or "Google Password Manager" (#9927)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed ERR_SUBJECT_UNCONFIRMED errors caused by clockSkew not being forwarded to samlify's ServiceProvider when validating SAML responses (#9748)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.15

Patch Changes

  • #98751012b69 Thanks @​WilsonnnTan! - The admin plugin's unbanUser, setRole and adminUpdateUser endpoints used to call internalAdapter.updateUser without checking that the target user existed, so when the caller passed an unknown id the underlying database error (for example Prisma's P2025) bubbled up as a generic HTTP 500. those endpoints now mirror the existing guard in banUser: look the user up via findUserById, and throw a clean NOT_FOUND (USER_NOT_FOUND) when no row is returned. Closes #9800.

  • #9865ad60333 Thanks @​ping-maxwell! - list-session endpoint now requires a fresh-age session check.

  • #98110933c05 Thanks @​zeroknowledge0x! - Restore Kysely 0.28 and 0.29 compatibility for SQLite dialect introspection. The dialects now mirror Kysely's stable migration table names locally, avoiding strict ESM build failures in Turbopack without forcing consumers onto Kysely 0.29.

  • #9919b0ddfd3 Thanks @​gustavovalverde! - Run configured hooks through the whole OAuth sign-in flow

    hooks.before / hooks.after configured on the auth instance now run for the OAuth authorization that continues after a user signs in, selects an account, or consents. They were being skipped there.

    Headers or cookies a hooks.before sets before returning its own response are no longer dropped, and a hooks.after that throws an APIError no longer loses either its cookies or the error's headers.

  • Updated dependencies []:

    • @​better-auth/core@​1.6.15
    • @​better-auth/drizzle-adapter@​1.6.15
    • @​better-auth/kysely-adapter@​1.6.15
    • @​better-auth/memory-adapter@​1.6.15
    • @​better-auth/mongo-adapter@​1.6.15
    • @​better-auth/prisma-adapter@​1.6.15
    • @​better-auth/telemetry@​1.6.15

1.6.14

Patch Changes

  • #98772d9781a Thanks @​gustavovalverde! - Restore the normal emailed-invitation flow while documenting the stricter verification posture for organization invitations.

    Client-side listUserInvitations now always requires a verified session email because it enumerates invitation IDs from session.user.email. The requireEmailVerificationOnInvitation option now controls recipient calls that carry an invitation ID (acceptInvitation, rejectInvitation, getInvitation). When unset, Better Auth keeps the emailed-invitation sign-up flow for built-in opaque invitation IDs, including the default generator or advanced.database.generateId: "uuid", and requires verified email when invitation IDs are externally controlled or predictable, such as advanced.database.generateId: "serial" / false or custom ID generation. Apps that expose invitation IDs outside the invited user's mailbox, expose organization invitation lists to members, or require stricter ownership proof should set requireEmailVerificationOnInvitation: true or require verified email before sign-in.

  • #98415a2d642 Thanks @​bytaesu! - Optional fields (required: false) now accept null, not just omission. The generated input validation previously rejected null even though the column is nullable, so a nullable field could not be cleared by passing null.

  • #984513abc79 Thanks @​gustavovalverde! - Harden redirect-URI validation across the OAuth provider plugins. isSafeUrlScheme and SafeUrlSchema no longer call URL.canParse, which is absent on some supported runtimes and could throw or silently disable the dangerous-scheme check. They now parse with a try/catch fallback. SafeUrlSchema also rejects redirect URIs that contain a fragment component, per RFC 6749 §3.1.2.

  • #98069d3450a Thanks @​bytaesu! - getSessionCookie now prefers the __Secure- cookie when both it and a non-secure cookie are present, so the non-secure cookie no longer shadows the current session cookie.

  • Updated dependencies [13abc79]:

    • @​better-auth/core@​1.6.14
    • @​better-auth/drizzle-adapter@​1.6.14
    • @​better-auth/kysely-adapter@​1.6.14
    • @​better-auth/memory-adapter@​1.6.14
    • @​better-auth/mongo-adapter@​1.6.14
    • @​better-auth/prisma-adapter@​1.6.14
    • @​better-auth/telemetry@​1.6.14
Commits
  • 03e0e36 chore: release v1.6.15 (#9886)
  • b0ddfd3 fix(oauth-provider): run configured hooks when authorize resumes (#9919)
  • 1012b69 fix(admin): return USER_NOT_FOUND for missing users before update (#9875)
  • ad60333 fix: list-session fresh age session check (#9865)
  • e111d63 refactor(cookies): clarify cookie regex ranges (#9879)
  • 5038d41 chore: release v1.6.14 (#9846)
  • 2d9781a fix(organization): split invitation verification gates (#9877)
  • 5a2d642 fix: accept null for optional fields in generated schema (#9841)
  • 9d3450a fix(cookies): prefer __Secure- cookie in getSessionCookie (#9806)
  • See full diff in compare view

Updates hono from 4.12.23 to 4.12.24

Release notes

Sourced from hono's releases.

v4.12.24

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

Commits
  • 5fdde5a 4.12.24
  • c78932d fix(utils/ipaddr): render the unspecified address binary as "::" (#4998)
  • 5ef800e refactor(timing): Test/add test for middleware timing (#4991)
  • d743bb7 fix: clean up config files trailing comma, stale excludes, typesVersions gaps...
  • d22ff9c fix(utils/ipaddr): expand "::" to eight zero groups (#4973)
  • 8e2cccc refactor(language): Test/improve tests on languages middleware (#4980)
  • 413d3cb fix(bearer-auth): mention verifyToken in missing-options error message (#4987)
  • 2cbeadd chore: remove @​types/glob (#4978)
  • 9051d3e docs(contribution): simplifyAI Usage Policy (#4972)
  • See full diff in compare view

Updates ioredis from 5.11.0 to 5.11.1

Release notes

Sourced from ioredis's releases.

v5.11.1

5.11.1 (2026-06-04)

Bug Fixes

  • cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
  • parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)
Changelog

Sourced from ioredis's changelog.

5.11.1 (2026-06-04)

Bug Fixes

  • cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
  • parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)
Commits
  • fb224a7 chore(release): 5.11.1 [skip ci]
  • 131ee24 fix: parse protocol-relative Redis URLs as TCP connections (#2125)
  • c84b2ee fix(cluster): reconnect to nodes that restart without slot changes (#2096)
  • See full diff in compare view

Updates next from 16.2.6 to 16.2.7

Release notes

Sourced from next's releases.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Backport documentation fixes for v16.2 (#93804)
  • [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
  • [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
  • [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
  • [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
  • [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
  • [backport] Propagate adapter preferred regions (#94200)
  • [16.2.x] Don't drop FormData entries (#94240)
  • [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

Commits
  • 9bd3c26 v16.2.7
  • c63224f [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolut...
  • 63115c7 [16.2.x] Don't drop FormData entries (#94240)
  • aef22fd [backport] Propagate adapter preferred regions (#94200)
  • f126e72 [backport] Fix "type: module" in project dir when using standalone or adapter...
  • bda3e2a [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
  • 7e16e07 [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • 6139f4b [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • c021d10 [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • 9184ddb [backport] Fix catch-all router.query corruption with basePath + `rewrite...
  • Additional commits viewable in compare view

Updates react from 19.2.6 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.6 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates fumadocs-mdx from 15.0.10 to 15.0.11

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.0.11

Patch Changes

  • 2d65ceb: Support hot reload in source.config.ts with Vite plugin
Commits

@dependabot
chore(deps)(deps): bump the production-dependencies group across 1 di…
863cb57
…rectory with 15 updates
Bumps the production-dependencies group with 15 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `3.0.79` | `3.0.81` |
| [@ai-sdk/gateway](https://github.com/vercel/ai/tree/HEAD/packages/gateway) | `3.0.121` | `3.0.126` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `3.0.79` | `3.0.80` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.65` | `3.0.68` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.16` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.193` | `6.0.198` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.6.13` | `1.6.15` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.6.13` | `1.6.15` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.13` | `1.6.15` |
| [hono](https://github.com/honojs/hono) | `4.12.23` | `4.12.24` |
| [ioredis](https://github.com/luin/ioredis) | `5.11.0` | `5.11.1` |
| [next](https://github.com/vercel/next.js) | `16.2.6` | `16.2.7` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.0.10` | `15.0.11` |
Updates `@ai-sdk/anthropic` from 3.0.79 to 3.0.81
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/anthropic@3.0.81/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@3.0.81/packages/anthropic)
Updates `@ai-sdk/gateway` from 3.0.121 to 3.0.126
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/gateway@3.0.126/packages/gateway/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/gateway@3.0.126/packages/gateway)
Updates `@ai-sdk/google` from 3.0.79 to 3.0.80
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/google@3.0.80/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@3.0.80/packages/google)
Updates `@ai-sdk/openai` from 3.0.65 to 3.0.68
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@3.0.68/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@3.0.68/packages/openai)
Updates `tar` from 7.5.15 to 7.5.16
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.15...v7.5.16)
Updates `ai` from 6.0.193 to 6.0.198
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.198/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.198/packages/ai)
Updates `@better-auth/core` from 1.6.13 to 1.6.15
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/@better-auth/core@1.6.15/packages/core)
Updates `@better-auth/oauth-provider` from 1.6.13 to 1.6.15
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/@better-auth/oauth-provider@1.6.15/packages/oauth-provider)
Updates `better-auth` from 1.6.13 to 1.6.15
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.15/packages/better-auth)
Updates `hono` from 4.12.23 to 4.12.24
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.23...v4.12.24)
Updates `ioredis` from 5.11.0 to 5.11.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.11.0...v5.11.1)
Updates `next` from 16.2.6 to 16.2.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.6...v16.2.7)
Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)
Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)
Updates `fumadocs-mdx` from 15.0.10 to 15.0.11
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.0.10...fumadocs-mdx@15.0.11)
---
updated-dependencies:
- dependency-name: "@ai-sdk/anthropic"
dependency-version: 3.0.81
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@ai-sdk/gateway"
dependency-version: 3.0.126
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@ai-sdk/google"
dependency-version: 3.0.80
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
dependency-version: 3.0.68
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: tar
dependency-version: 7.5.16
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: ai
dependency-version: 6.0.198
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
dependency-version: 1.6.15
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
dependency-version: 1.6.15
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: better-auth
dependency-version: 1.6.15
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: hono
dependency-version: 4.12.24
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: ioredis
dependency-version: 5.11.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: next
dependency-version: 16.2.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: react
dependency-version: 19.2.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: react-dom
dependency-version: 19.2.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
dependency-version: 15.0.11
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript labels Jun 9, 2026
@vercel

vercelBot commented Jun 9, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
specReadyReadyPreview, CommentJun 9, 2026 3:30am

Request Review

@github-actionsgithub-actionsBot added documentation Improvements or additions to documentation size/s labels Jun 9, 2026
@os-zhuang
os-zhuang merged commit 7c00720 into mainJun 9, 2026
25 checks passed
@os-zhuang
os-zhuang deleted the dependabot/npm_and_yarn/production-dependencies-598fba5516 branch June 9, 2026 04:47
@os-zhuangos-zhuang mentioned this pull request Jun 12, 2026
Merged
os-zhuang added a commit that referenced this pull request Jun 12, 2026
@os-zhuang@claude
feat(metadata): metadata-service registrations carry package provenan…
b10aa78
…ce (#1776)
The metadata-service sync path (loadMetadataFromService) and
MetadataFacade.register called registry.registerItem without the 4th
packageId param, so applyProtection never stamped _packageId /
_provenance on synced items — GET /api/v1/meta/:type consumers
(objectui NavigationSyncEffect, objectui PR #1668) could not tell
package-shipped code-defined metadata from user-authored rows and fell
back to the sys_ name-prefix heuristic, misclassifying third-party
plugin pages.
Fix: pass through each item's own _packageId (stamped upstream by the
metadata plugin's artifact loader). Never synthesize an id like
'metadata-service' — isArtifactBacked() keys two-tier write
authorization (allowOrgOverride vs allowRuntimeCreate) off a truthy
_packageId, so a fake id would flip authorization for runtime-authored
items. The nearby bindHooks packageId is an unbind-grouping label, not
provenance.
Deliberately unchanged: protocol.ts DB-hydration registerItem calls
(loadMetaFromDb / getMetaItems hydration / overlay-delete refill) stay
bare-key — ADR-0005 overlay precedence relies on the bare runtime row
shadowing the composite pkg:name artifact entry.
Also closes the filesystem-scanner gap: new MetadataPluginOptions
.packageId (the project's defineStack manifest id) lets hand-wired
kernels stamp scanned source-file metadata via the same applyProtection
call the artifact path uses. Unset → unchanged behavior; the option is
never guessed from package.json (npm name ≠ manifest id, and the value
feeds write authorization).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
xuyushun441-sys added a commit that referenced this pull request Jun 12, 2026
@xuyushun441-sys@os-zhuang@claude
fix(cli): guard console resolution against stale out-of-workspace ins…
748e3eb
…talls (#1778)
* chore: bump objectui to e95cc25b2c0d
fix(app-shell): NavigationSyncEffect baseline race — readiness gate, sys_ filter, ADR-0010 lock filter (#1668)
objectui@e95cc25b2c0d2fa680e232151721e71c19630659
* fix(cli): guard console resolution against stale out-of-workspace installs
resolveConsolePath() resolves @objectstack/console via createRequire from
the consumer cwd, and Node module resolution climbs node_modules
directories past the workspace root. A stray install higher up the
filesystem (e.g. a leftover ~/node_modules/@objectstack/console@7.8.0
from an npm experiment) won over the version-locked bundle, so
`serve --dev` served a stale Console (browser-side OBJUI-001
"Unknown component type: marketplace:installed-list").
The vendored console package is version-locked to the framework release,
so a healthy install always shares the CLI's major version. Skip any
candidate from node resolution or the cwd/node_modules direct check
whose major differs from the CLI's own, and warn with the path and both
versions so the stray install is discoverable. The sibling-repo objectui
dev fallback is exempt (independent versioning, explicit opt-in). If the
CLI's own version can't be read the guard fails open.
resolveConsolePath() now takes optional { cwd, cliVersion, warn } for
testability; the serve.ts call site is unchanged. Also documents in
AGENTS.md that passing work must land via branch + PR, not sit in the
working tree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationsize/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@os-zhuang