chore(deps)(deps): Bump the production-dependencies group with 19 updates (#9212)

* chore(deps)(deps): Bump the production-dependencies group with 19 updates

Bumps the production-dependencies group with 19 updates:

| Package | From | To |
| --- | --- | --- |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [@oclif/core](https://github.com/oclif/core) | `4.13.2` | `4.13.3` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.2` | `13.0.3` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.12` | `2.1.1` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.2` | `5.2.3` |
| [mingo](https://github.com/kofrasa/mingo) | `7.2.2` | `7.2.4` |
| [nanoid](https://github.com/ai/nanoid) | `6.0.0` | `6.0.1` |
| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | `2.2.0` | `2.3.0` |
| [jose](https://github.com/panva/jose) | `6.2.7` | `6.2.8` |
| [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.2` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.3` | `9.0.5` |
| [pinyin-pro](https://github.com/zh-lx/pinyin-pro/tree/HEAD/packages/pinyin-pro) | `3.28.2` | `3.29.1` |
| [@noble/ciphers](https://github.com/paulmillr/noble-ciphers) | `2.2.0` | `2.3.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.0` | `16.14.4` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.1` | `15.2.3` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.0` | `16.14.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.31.0` |
| [next](https://github.com/vercel/next.js) | `16.2.12` | `16.3.1` |


Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.12)

Updates `@oclif/core` from 4.13.2 to 4.13.3
- [Release notes](https://github.com/oclif/core/releases)
- [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md)
- [Commits](oclif/core@4.13.2...4.13.3)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `better-sqlite3` from 13.0.2 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v13.0.2...v13.0.3)

Updates `@hono/node-server` from 2.0.12 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.12...v2.1.1)

Updates `js-yaml` from 5.2.2 to 5.2.3
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.2...5.2.3)

Updates `mingo` from 7.2.2 to 7.2.4
- [Changelog](https://github.com/kofrasa/mingo/blob/main/CHANGELOG.md)
- [Commits](kofrasa/mingo@7.2.2...7.2.4)

Updates `nanoid` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@6.0.0...6.0.1)

Updates `@noble/hashes` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/noble-hashes/releases)
- [Commits](paulmillr/noble-hashes@2.2.0...2.3.0)

Updates `jose` from 6.2.7 to 6.2.8
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.7...v6.2.8)

Updates `hono` from 4.12.34 to 4.13.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.34...v4.13.2)

Updates `nodemailer` from 9.0.3 to 9.0.5
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.3...v9.0.5)

Updates `pinyin-pro` from 3.28.2 to 3.29.1
- [Release notes](https://github.com/zh-lx/pinyin-pro/releases)
- [Changelog](https://github.com/zh-lx/pinyin-pro/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zh-lx/pinyin-pro/commits/3.29.1/packages/pinyin-pro)

Updates `@noble/ciphers` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/noble-ciphers/releases)
- [Commits](paulmillr/noble-ciphers@2.2.0...2.3.0)

Updates `fumadocs-core` from 16.14.0 to 16.14.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.0...fumadocs@16.14.4)

Updates `fumadocs-mdx` from 15.2.1 to 15.2.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.1...fumadocs-mdx@15.2.3)

Updates `fumadocs-ui` from 16.14.0 to 16.14.4
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.0...fumadocs@16.14.4)

Updates `lucide-react` from 1.28.0 to 1.31.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react)

Updates `next` from 16.2.12 to 16.3.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.1)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@oclif/core"
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 5.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: mingo
  dependency-version: 7.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: nanoid
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@noble/hashes"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: nodemailer
  dependency-version: 9.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: pinyin-pro
  dependency-version: 3.29.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@noble/ciphers"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fumadocs-core
  dependency-version: 16.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
  dependency-version: 15.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-ui
  dependency-version: 16.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): add patch changeset for #9212 production-dependency bumps

Derived from the actual diff of #9212: 12 published packages whose
dependencies/optionalDependencies/peerDependencies ranges changed in the
weekly Dependabot production group. devDependencies-only changes
(@objectstack/hono, @objectstack/client, @objectstack/core,
@objectstack/plugin-sharing, @objectstack/spec) and private packages
(apps/docs, examples/app-todo, workspace root) are excluded per the
consumer-facing-only rule.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: os-project-manager <pm@objectstack.ai>

Author: dependabot[bot]

.changeset/dependabot-9212-production-dependencies-patch.md

@@ -0,0 +1,38 @@
+---
+"@objectstack/cli": patch
+"@objectstack/driver-memory": patch
+"@objectstack/driver-mongodb": patch
+"@objectstack/driver-sql": patch
+"@objectstack/driver-sqlite-wasm": patch
+"@objectstack/driver-turso": patch
+"@objectstack/metadata": patch
+"@objectstack/plugin-auth": patch
+"@objectstack/plugin-email": patch
+"@objectstack/plugin-hono-server": patch
+"@objectstack/plugin-pinyin-search": patch
+"@objectstack/service-settings": patch
+---
+
+chore(deps): production-dependency patch bumps from the weekly Dependabot group (#9212)
+
+Routine dependency-range refresh, no behavior change: `@oclif/core` 4.13.2→4.13.3,
+`esbuild` 0.28.1→0.28.2 and `better-sqlite3` ^13.0.2→^13.0.3 (optional) on
+`@objectstack/cli`; `mingo` 7.2.2→7.2.4 on `@objectstack/driver-memory`; `nanoid`
+6.0.0→6.0.1 on `@objectstack/driver-mongodb`, `@objectstack/driver-sql`,
+`@objectstack/driver-sqlite-wasm` and `@objectstack/driver-turso`, plus
+`better-sqlite3` ^13.0.2→^13.0.3 (optional on `@objectstack/driver-sql`, peer on
+`@objectstack/driver-turso`); `js-yaml` 5.2.2→5.2.3 on `@objectstack/metadata`;
+`@noble/hashes` 2.2.0→2.3.0 and `jose` 6.2.5→6.2.8 on `@objectstack/plugin-auth`;
+`nodemailer` 9.0.3→9.0.5 on `@objectstack/plugin-email`; `@hono/node-server`
+2.0.12→2.1.1 and `hono` 4.12.34→4.13.2 on `@objectstack/plugin-hono-server`;
+`pinyin-pro` 3.28.2→3.29.1 on `@objectstack/plugin-pinyin-search`; and
+`@noble/ciphers` 2.2.0→2.3.0 on `@objectstack/service-settings`.
+
+Every entry above changed a `dependencies`, `optionalDependencies` or
+`peerDependencies` range in the published manifest — the only kind of change
+that reaches a consumer's install. The same Dependabot group also bumped
+`devDependencies` on `@objectstack/hono`, `@objectstack/client`,
+`@objectstack/core`, `@objectstack/plugin-sharing` and `@objectstack/spec`
+(none consumer-facing), and touched the private `apps/docs`,
+`examples/app-todo` and workspace-root manifests (none published) — none of
+those get an entry here.

apps/docs/package.json

@@ -14,12 +14,12 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "fumadocs-core": "16.14.0",
-    "fumadocs-mdx": "15.2.1",
-    "fumadocs-ui": "16.14.0",
-    "lucide-react": "^1.28.0",
+    "fumadocs-core": "16.14.4",
+    "fumadocs-mdx": "15.2.3",
+    "fumadocs-ui": "16.14.4",
+    "lucide-react": "^1.31.0",
     "mermaid": "^11.16.0",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "next-themes": "^0.4.6",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",

examples/app-todo/package.json

@@ -35,7 +35,7 @@
     "@objectstack/core": "workspace:*",
     "@objectstack/service-automation": "workspace:*",
     "@objectstack/trigger-record-change": "workspace:*",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   }

package.json

@@ -125,7 +125,7 @@
     "semver": "^7.8.5",
     "svelte": "^5.56.8",
     "tsup": "^8.5.1",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "turbo": "^2.10.7",
     "typescript": "^6.0.3",
     "yaml": "^2.9.0"

packages/adapters/hono/package.json

@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@objectstack/runtime": "workspace:*",
-    "hono": "^4.12.34",
+    "hono": "^4.13.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },

packages/cli/package.json

@@ -91,14 +91,14 @@
     "@objectstack/trigger-schedule": "workspace:*",
     "@objectstack/types": "workspace:*",
     "@objectstack/verify": "workspace:*",
-    "@oclif/core": "^4.13.2",
+    "@oclif/core": "^4.13.3",
     "bundle-require": "^5.1.0",
     "chalk": "^6.0.0",
     "chokidar": "^5.0.0",
     "dotenv-flow": "^4.1.0",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "ts-morph": "^28.0.0",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
@@ -111,7 +111,7 @@
     }
   },
   "optionalDependencies": {
-    "better-sqlite3": "^13.0.2"
+    "better-sqlite3": "^13.0.3"
   },
   "devDependencies": {
     "@objectstack/driver-turso": "workspace:*",

packages/client/package.json

@@ -25,13 +25,13 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@hono/node-server": "^2.0.12",
+    "@hono/node-server": "^2.1.1",
     "@objectstack/driver-sqlite-wasm": "workspace:*",
     "@objectstack/hono": "workspace:*",
     "@objectstack/objectql": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
     "@objectstack/runtime": "workspace:*",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },

packages/core/package.json

@@ -26,7 +26,7 @@
   "devDependencies": {
     "@objectstack/metadata-core": "workspace:*",
     "@types/node": "^26.1.2",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },

packages/drivers/driver-memory/package.json

@@ -22,7 +22,7 @@
     "@objectstack/core": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
-    "mingo": "^7.2.2"
+    "mingo": "^7.2.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

packages/drivers/driver-mongodb/package.json

@@ -23,7 +23,7 @@
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
     "mongodb": "^7.5.0",
-    "nanoid": "^6.0.0"
+    "nanoid": "^6.0.1"
   },
   "devDependencies": {
     "@objectstack/objectql": "workspace:*",