chore(deps): bump the production-dependencies group with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
@proj-airi/font-departure-mono	0.11.0	0.11.3
next	16.2.10	16.2.11
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
simple-icons	16.25.0	16.27.0

Updates @proj-airi/font-departure-mono from 0.11.0 to 0.11.3

Release notes

Sourced from @​proj-airi/font-departure-mono's releases.

v0.11.3 Highlights

New Contributors

• @​LFour86 made their first contribution in moeru-ai/airi#2037
• @​panpan0000 made their first contribution in moeru-ai/airi#2017
• @​zyr-ai made their first contribution in moeru-ai/airi#2064
• @​ayobamiseun made their first contribution in moeru-ai/airi#2078
• @​binyangzhu000-sudo made their first contribution in moeru-ai/airi#2076
• @​lee101 made their first contribution in moeru-ai/airi#1980

Product Updates

Desktop Companion

• You can now use voice input directly in the desktop companion. AIRI listens through the configured microphone, buffers short transcript fragments, and avoids feeding its own speech back into chat while it is talking.
• You can now move the desktop window back to the center of the current display from the controls island or the desktop data settings. This helps recover AIRI when the window gets awkwardly positioned or ends up hard to reach.
• Microphone permission handling is more reliable in the Electron app, while still limiting permission grants to AIRI-owned local pages.
• Desktop sign-in is more robust. Invalid auth callbacks no longer consume the one-time login flow, and the standalone auth UI now accepts the newer AIRI backend origin.
• Settings entry icons are now preserved in production builds, so settings navigation should no longer lose icons after bundling.

Character Cards And Models

• Character cards can now be imported and exported as AIRI .zip packages.
• Exported packages include the character card plus supported display model resources, so sharing a character can carry more of the setup with it.
• Invalid or incomplete card packages now show clearer import errors.
• Live2D model loading now handles non-ASCII file names inside restored model folders and avoids double-encoding already encoded paths.

Account And Cloud Reliability

• AIRI now records AI generation, LLM usage, Stripe identity, and checkout-related analytics more consistently. This improves billing, support investigation, and product health tracking without changing the visible checkout flow.
• PostHog event naming and forwarding were normalized across app and server surfaces, making account and usage events easier to correlate.

To Developers

• @​proj-airi/pipelines-audio received stronger event typing, playback manager cleanup, ACT payload normalization, transcript buffering, and clearer error handling for speech and playback flows.
• Chat/LLM runtime paths now carry usage metadata more consistently, including server-side OpenAI-compatible request handling and downstream analytics headers.
• Auth callback handling now validates OIDC state inside the loopback server before resolving the login attempt.

To Contributors

• Grafana server dashboards and related build tests were refreshed.
• .env files are now ignored to reduce accidental credential leakage.
• Nix Xorg attributes were updated for current package structure.
• Claude Code dependencies, sponsor data, and generated translations were refreshed.
• The release bumps AIRI packages and apps to 0.11.1.

Upgrade Notes

• Character card import now expects AIRI .zip packages instead of raw .json card files.

... (truncated)

Commits

• dbf8124 release: v0.11.3
• b43b894 release: v0.11.2
• 089ca99 release: v0.11.1
• See full diff in compare view

Updates next from 16.2.10 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates simple-icons from 16.25.0 to 16.27.0

Release notes

Sourced from simple-icons's releases.

Release 16.27.0

1 new icon

• CodeBuddy (#14865) (@​LitoMore)

Release 16.26.0

2 new icons

• KIMI (#14861) (@​LitoMore)
• Z.ai (#14857) (@​tonylawx)

Commits

• 44a643f Replace README CDN theme image links
• f7cc400 Release 16.27.0
• a78ea66 Bump version to 16.27.0
• afd8c82 Add CodeBuddy icon (#14865)
• f739261 Release 16.26.0
• 0f9fa54 Bump version to 16.26.0
• 5bb49e2 Add Z.ai icon (#14857)
• 38574d7 Add KIMI icon (#14861)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
portfolio-app	Ready	Preview, Comment	Jul 22, 2026 3:06pm

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.