chore(deps): bump the npm_and_yarn group across 1 directory with 18 updates by dependabot[bot] · Pull Request #119 · CodeStorm-Hub/StormCom

dependabot · 2026-07-27T20:00:34Z

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package	From	To
better-auth	`1.3.34`	`1.6.22`
js-yaml	`4.1.1`	`4.3.0`
next	`16.0.3`	`16.2.12`
next-auth	`4.24.13`	`4.24.15`
sharp	`0.34.5`	`0.35.0`
postcss	`8.5.6`	`8.5.18`
vite	`7.2.2`	`8.1.5`
vitest	`3.2.4`	`4.1.10`
body-parser	`2.2.0`	`2.3.0`
defu	`6.1.4`	`6.1.7`
dompurify	`3.3.0`	`3.4.12`
fast-uri	`3.1.0`	`3.1.4`
form-data	`4.0.4`	`4.0.6`
undici	`5.29.0`	`6.28.0`
ws	`8.18.3`	`8.21.1`

Updates better-auth from 1.3.34 to 1.6.22

Release notes

Sourced from better-auth's releases.

v1.6.22

better-auth

Bug Fixes

Fixed unproven credentials not being revoked during magic link and email OTP sign-in (#10239)

Fixed server-side OAuth requests to refuse redirect responses instead of following them (#10241)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

Fixed SCIM write-path operations to be properly scoped and to correctly honor the active attribute (#10242)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

Added account-level verification lockout for two-factor authentication (#10240)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.6.21...v1.6.22

v1.6.21

better-auth

Bug Fixes

Fixed rate limits to be enforced before plugin request handlers run (#10191)

Fixed admin permission changes and bans to take effect immediately, even when session cookie cache is enabled (#10187)

Fixed deviceAuthorization() throwing a ZodError when called without a schema option under Zod v4 (#9939)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.22

Patch Changes

#10239 c06a56d Thanks @gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

#10240 3a035e9 Thanks @gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

Updated dependencies [8bd43d9]:

@better-auth/core@1.6.22

@better-auth/drizzle-adapter@1.6.22

@better-auth/kysely-adapter@1.6.22

@better-auth/memory-adapter@1.6.22

@better-auth/mongo-adapter@1.6.22

@better-auth/prisma-adapter@1.6.22

@better-auth/telemetry@1.6.22

1.6.21

Patch Changes

#10212 e0762a1 Thanks @bytaesu! - In root-mounted deployments, requests whose path does not start with the configured basePath now return 404 instead of resolving to an endpoint.

#10187 882cf9e Thanks @ping-maxwell! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.

#9939 f52e1ab Thanks @benpsnyder! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option

#10196 b5bec19 Thanks @Paola3stefania! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked input: false. Input-allowed additional fields still persist from mapProfileToUser, and schema defaults still apply when OAuth creates a user. Apps that used mapProfileToUser to fill input: false fields should set those fields in server-side provisioning code instead.

#10197 816d7f9 Thanks @Paola3stefania! - Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim.

Google One Tap now applies the configured Google hosted-domain restriction before creating a session.

#10192 239bcc8 Thanks @bytaesu! - Validate PayPal user info against the verified ID token subject during social sign-in.

#10228 1bc370a Thanks @gustavovalverde! - The SIWE plugin no longer binds a provided email that already belongs to another account. With anonymous set to false, /siwe/verify previously created the new account using that email even when it was already in use; it now keeps the wallet-derived address in that case, so one email cannot be attached to two accounts.

#10198 570267c Thanks @rachit367! - Honor disableMigration on plugin schema tables. Tables flagged with disableMigration: true are now skipped by better-auth generate (Drizzle and Prisma output) and by the runtime migrator, instead of being emitted and created anyway. The flag was previously dropped while assembling the table list, so it had no effect.

#10182 461ca6f Thanks @bytaesu! - Only store display username fallbacks as usernames when they pass username validation during email sign-up.

#10183 88409b0 Thanks @bytaesu! - Require OAuth proxy profile callbacks to match an issued OAuth state before creating sessions.

#10203 5953157 Thanks @bytaesu! - Rate limiting no longer trusts multi-hop X-Forwarded-For chains, preventing a client behind an appending proxy from spoofing the leftmost hop to bypass the per-IP rate limit. Single-value IP headers continue to work. To key the real client behind a proxy chain, set advanced.ipAddress.trustedProxies to your reverse-proxy IPs or CIDR ranges (the chain is walked right to left, skipping trusted hops), or point advanced.ipAddress.ipAddressHeaders at a single trusted client-IP header.

... (truncated)

Commits

a90d061 chore: release v1.6.22 (#10245)
3a035e9 fix(two-factor): add account-level verification lockout (#10240)
c06a56d fix: revoke unproven credentials on magic-link/email-OTP sign-in (#10239)
414169d chore: release v1.6.21 (#10184)
f52e1ab fix(device-authorization): make schema option optional under Zod v4 (#9939)
882cf9e fix(admin): use authoritative session reads for authorization (#10187)
b5bec19 fix(oauth): apply user input rules to provider profiles (#10196)
471f81c refactor: centralize request IP resolver in core (#10216)
816d7f9 fix(one-tap): apply configured Google hosted domain (hd) on the callback (#10...
1bc370a fix(siwe): reject sign-in when the provided email already belongs to another ...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for better-auth since your current version.

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
Additional commits viewable in compare view

Updates next from 16.0.3 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.13 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
See full diff in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates sharp from 0.34.5 to 0.35.0

Release notes

Sourced from sharp's releases.

v0.35.0

Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

Breaking: Add limitInputChannels with a default value of 5.

Breaking: Remove deprecated failOnError constructor property.

Breaking: Remove deprecated paletteBitDepth from metadata response.

Breaking: Remove deprecated properties from sharpen operation.

Breaking: Rename format.jp2k as format.jp2 for API consistency.

Upgrade to libvips v8.18.3 for upstream bug fixes.

Remove experimental status from WebAssembly binaries.

Add prebuilt binaries for FreeBSD (WebAssembly).

Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

Add AVIF/HEIF tune option for control over quality metrics. #4227

Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps. #4314

Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer. #4355

Require prebuilt binaries using static paths to aid code bundling. #4380

TypeScript: Ensure FormatEnum keys match reality. #4475

Add margin option to trim operation. #4480 @eddienubes

Ensure HEIF primary item is used as default page/frame. #4487

... (truncated)

Commits

2ed5af4 Release v0.35.0
4475cf1 Tests: update locator hash for sharp-libvips v1.3.0
deb22dd Upgrade to sharp-libvips v1.3.0
07f1be9 Prerelease v0.35.0-rc.8
df1109b Prerelease v0.35.0-rc.7
aca49b3 Upgrade to libvips v8.18.3
e9e86f5 Type-check density option before range validation (#4536)
2f0bcf0 Docs: update supported image formats
98e03b8 Revert "Guard heif bitdepth property for prebuilt binaries"
e4ea2f3 CI: Ignore package minimum age in smoke tests
Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

... (truncated)

Commits

4c0d194 Release 8.5.18 version
92b4e78 Update dependencies
95663d3 Limit where source map can be loaded for security reasons
74e25ae Release 8.5.17 version
d1518af Fix Maximum call stack size exceeded error
2421312 Fix linter
a50352c Fix CI
33948f0 Prevent prototype hijacking in fromJSON
2131909 Update dependencies
93440ab Fix non-closed \<div align="center"> in README (#2110)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 7.2.2 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

bundled-dev: avoid duplicated buildEnd (#22931) (8100320)

client: overlay error message format align rolldown (#22869) (5a72b87)

deps: update all non-major dependencies (#22921) (fef682d)

deps: update rolldown-related dependencies (#22922) (3c345e4)

module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)

optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)

ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

build: fix incorrect @default for build.cssMinify (#22948) (c88c236)

build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

avoid scanner scanning all files under __tests__ (#22912) (c961cae)

8.1.4 (2026-07-09)

Features

legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

build: add workaround for building on stackblitz (#22840) (575c32c)

build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)

deps: update all non-major dependencies (#22865) (d4295a9)

deps: update rolldown-related dependencies (#22866) (7cf07e4)

html: avoid backtracking in import-only check (#22848) (b5868c0)

optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)

ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)

strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

... (truncated)

Commits

5e7fe12 release: v8.1.5
6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
5a72b87 fix(client): overlay error message format align rolldown (#22869)
f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
fef682d fix(deps): update all non-major dependencies (#22921)
3c345e4 fix(deps): update rolldown-related dependencies (#22922)
369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
Additional commits viewable in compare view

Updates vitest from 3.2.4 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.3.34` | `1.6.22` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` | | [next](https://github.com/vercel/next.js) | `16.0.3` | `16.2.12` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.13` | `4.24.15` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.18` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.2.2` | `8.1.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.10` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.3.0` | | [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.0` | `3.4.12` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.4` | | [form-data](https://github.com/form-data/form-data) | `4.0.4` | `4.0.6` | | [undici](https://github.com/nodejs/undici) | `5.29.0` | `6.28.0` | | [ws](https://github.com/websockets/ws) | `8.18.3` | `8.21.1` | Updates `better-auth` from 1.3.34 to 1.6.22 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.22/packages/better-auth) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `next` from 16.0.3 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.0.3...v16.2.12) Updates `next-auth` from 4.24.13 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.13...next-auth@4.24.15) Updates `sharp` from 0.34.5 to 0.35.0 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.0) Updates `postcss` from 8.5.6 to 8.5.18 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.18) Updates `vite` from 7.2.2 to 8.1.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite) Updates `vitest` from 3.2.4 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `vitest` from 3.2.4 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `body-parser` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.3.0) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `dompurify` from 3.3.0 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.0...3.4.12) Updates `fast-uri` from 3.1.0 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.4) Updates `form-data` from 4.0.4 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.4...v4.0.6) Updates `kysely` from 0.28.8 to 0.29.4 - [Release notes](https://github.com/kysely-org/kysely/releases) - [Commits](kysely-org/kysely@v0.28.8...v0.29.4) Updates `qs` from 6.14.0 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.15.3) Updates `undici` from 5.29.0 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v6.28.0) Updates `uuid` from 8.3.2 to 11.1.1 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/v11.1.1/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.3.2...v11.1.1) Updates `ws` from 8.18.3 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.1) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.22 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: kysely dependency-version: 0.29.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 11.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-27T20:00:45Z

👋 Thanks for opening your first pull request in StormCom!

A maintainer will review your PR soon. Please make sure:

Your PR follows our
Contributing Guidelines
All CI checks pass
You've added appropriate tests
Documentation has been updated (if needed)

We appreciate your contribution to making StormCom better! 🚀

dependabot Bot added dependencies javascript Pull requests that update javascript code labels Jul 27, 2026

dependabot Bot requested a review from syed-reza98 as a code owner July 27, 2026 20:00

dependabot Bot added dependencies javascript Pull requests that update javascript code labels Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 18 updates - #119

chore(deps): bump the npm_and_yarn group across 1 directory with 18 updates#119
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-30b39b1715

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v1.6.22

better-auth

Bug Fixes

@better-auth/scim

Bug Fixes

@better-auth/stripe

Bug Fixes

auth

Bug Fixes

Contributors

v1.6.21

better-auth

Bug Fixes

1.6.22

Patch Changes

1.6.21

Patch Changes

4.3.0, 3.15.0 - 2026-06-27

Security

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

Added

Changed

[5.0.0] - 2026-06-20

Added

Changed

v16.2.12

What's Changed

v16.2.11

v16.2.10

v16.2.9

v16.2.8

v16.2.7

Core Changes

next-auth@4.24.15

next-auth@4.24.14

Bugfixes

v0.35.0

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

v8.1.5

v8.1.4

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

`better-auth`

`@better-auth/scim`

`@better-auth/stripe`

`auth`

`better-auth`