chore(deps)(deps): Bump the runtime-deps group across 1 directory with 11 updates by dependabot[bot] · Pull Request #222 · prisma/composer

dependabot · 2026-08-11T19:23:31Z

Bumps the runtime-deps group with 11 updates in the / directory:

Package	From	To
tsdown	`0.22.12`	`0.22.14`
@aws-sdk/client-s3	`3.1087.0`	`3.1101.0`
tar	`7.5.21`	`7.5.22`
@prisma/management-api-sdk	`1.50.0`	`1.53.0`
jose	`6.2.4`	`6.2.8`
better-auth	`1.6.24`	`1.6.26`
nodemailer	`9.0.3`	`9.0.4`
hono	`4.12.31`	`4.12.34`
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`
next	`16.2.10`	`16.2.12`

Updates tsdown from 0.22.12 to 0.22.14

Release notes

Sourced from tsdown's releases.

v0.22.14

   🚀 Features

Add CLI build concurrency option - by @sxzz and Jeroen Zwartepoorte (8a14c)

    View changes on GitHub

v0.22.13

   🚀 Features

deps: Support neverBundle: true to externalize all dependencies - by @sxzz (d30a7)

   🐞 Bug Fixes

Prevent tinyexec from modifying PATH - by @sxzz (d84c5)

    View changes on GitHub

Commits

ff3bdbd chore: release v0.22.14
8a14c35 feat: add CLI build concurrency option
0525465 docs: add note about cjsDefault only applying to explicit entry modules
a3a3551 refactor: fix lint
3dec506 refactor: use native Promise.withResolvers
e0266c1 docs: add tsdown users image
a733505 refactor: upgrade verkit, simplify version parse
e5fe2ca style: format
3e1fc63 chore: release v0.22.13
a6c8734 chore: upgrade deps
Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1087.0 to 3.1101.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1101.0

3.1101.0(2026-07-31)

New Features

client-resiliencehubv2: Adding support for new testing capability in AWS Resilience Hub. (105876ce)

client-cloudwatch-logs: Amazon CloudWatch Logs now lets you create and update lookup tables directly from CloudWatch Logs query results by passing a queryId, and configure a lookup table as a scheduled query destination so it refreshes automatically with the latest query results on each run. (6f5f75a0)

client-network-firewall: Doc Updates for Container Attributes (82107b32)

client-billing: Adds GetEnterpriseSupportChargeSummary, GetEnterpriseSupportContractDetails, and ListEnterpriseSupportLinkedAccountCharges. These APIs provide first-time programmatic access to billing data for Enterprise Support usage previously only available upon request through AWS Concierge or Support. (643d01c5)

client-quicksight: Adding TopicV2 management APIs, adding possibility to use Topics in Analysis (087bb505)

client-connectcampaignsv2: Launching feature for abandonment rate pacing control for outbound campaigns. (fbb8c225)

client-amp: Amazon Managed Service for Prometheus adds support for an Amazon OpenSearch Service exporter for managed collectors. (d9c634a8)

client-elementalinference: AWS Elemental Inference now supports graphic composition on cropped video outputs, enabling branded graphics and other visual elements to be overlaid as part of the inference workflow. (b9116f87)

client-rds: Adds StorageOperationStatus and StorageOperationPercentProgress to DescribeDBInstances, letting you monitor RDS storage initialization and optimization progress. (842d1779)

client-datazone: Adding support for enhanced Git experience in Sagemaker Unified Studio. (e5fcea3c)

client-transcribe-streaming: This release adds a new optional TranscriptFormat parameter to the Amazon Transcribe streaming API, letting customers select spoken or written form for numeric and formatted output. (5808fd5c)

client-bedrock-runtime: Added support for mid-conversation tool changes in the Amazon Bedrock Converse and ConverseStream APIs (8f29d856)

client-cloudformation: Adding enum for sensitive property to DriftIgnoredReason (ce2fa95d)

client-marketplace-catalog: This release enhances the ListEntities API to support TargetAgreementId, TargetAgreementIntent, and CreatedBySource filters for the Offer entity type. (550b6cf0)

client-outposts: Adds the "EKS" value to the AWSServiceName enum and marks the Address field as sensitive. (65dd1932)

For list of updated packages, view updated-packages.md in assets-3.1101.0.zip

v3.1100.0

3.1100.0(2026-07-31)

Chores

add packages-internal to root tsconfig inclusion (#8240) (a0f3fb58)

New Features

clients: update client endpoints as of 2026-07-31 (30d44c7e)

client-bcm-pricing-calculator: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (edce242c)

client-bcm-recommended-actions: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (7bed97ab)

Bug Fixes

core/protocols: v2 JSON codec updates and JsonBytesStringAdapter (#8238) (a1001f4b)

Tests

lib-transfer-manager: speed up tests (#8237) (b898c5dd)

... (truncated)

Changelog

Sourced from @aws-sdk/client-s3's changelog.

3.1101.0 (2026-07-31)

Note: Version bump only for package @aws-sdk/client-s3

3.1100.0 (2026-07-31)

Note: Version bump only for package @aws-sdk/client-s3

3.1099.0 (2026-07-30)

Note: Version bump only for package @aws-sdk/client-s3

3.1098.0 (2026-07-29)

Note: Version bump only for package @aws-sdk/client-s3

3.1097.0 (2026-07-28)

Note: Version bump only for package @aws-sdk/client-s3

3.1096.0 (2026-07-27)

Note: Version bump only for package @aws-sdk/client-s3

3.1095.0 (2026-07-24)

... (truncated)

Commits

272a6eb Publish v3.1101.0
6969cf9 Publish v3.1100.0
5b15ca7 Publish v3.1099.0
ee76673 Publish v3.1098.0
e40ebac chore(codegen): sync for CBOR v2 codec (#8233)
b24cb22 Publish v3.1097.0
1b94f0b Publish v3.1096.0
753d651 Publish v3.1095.0
bb564e5 chore(codegen): sync for CBOR large map deser, event-streams exceptions, endp...
c379112 Publish v3.1094.0
Additional commits viewable in compare view

Updates tar from 7.5.21 to 7.5.22

Commits

2a22bfc 7.5.22
df1cd8d Allow transform to be falsey
See full diff in compare view

Updates @prisma/management-api-sdk from 1.50.0 to 1.53.0

Commits

See full diff in compare view

Updates jose from 6.2.4 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

enforce a single recipient when decrypting dir and ECDH-ES (505c383)

reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

index the JWS and JWE registries without a wrapper (925f3bb)

name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

require own JOSE properties for presence checks (90ab09c)

Refactor

reduce bundle size (767d7f1)

v6.2.6

Fixes

types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

compare claim values for falsy validation options (eb86956)

forward key management parameters for a single JWE recipient (2d4f801)

handle a zero-length JWE additional authenticated data (16ca398)

reject a generateKeyPair crv option the algorithm does not imply (76364e9)

reject an unencoded payload in the JWS Compact Serialization (01d053f)

reject characters outside the Base64URL alphabet (0ebb971), references #879

reject duplicate "crit" values when producing (31d60e1)

reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)

reject truncated ASN.1 key data (7a16c66)

surface non-ASCII token segments as JOSE errors (194fe11)

types: correct JWK and CryptoKey types (62a196d)

types: correct key resolver and JWT header types (e95f8c4)

validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

correct subpaths and API documentation (2daec38)

document consumer-supplied type parameters (9e9f66c)

stop claiming the JWK "use" parameter is used during import (47a07b2)

update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

enforce a single recipient when decrypting dir and ECDH-ES (505c383)

reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

index the JWS and JWE registries without a wrapper (925f3bb)

name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

require own JOSE properties for presence checks (90ab09c)

Refactor

reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

compare claim values for falsy validation options (eb86956)

forward key management parameters for a single JWE recipient (2d4f801)

handle a zero-length JWE additional authenticated data (16ca398)

reject a generateKeyPair crv option the algorithm does not imply (76364e9)

reject an unencoded payload in the JWS Compact Serialization (01d053f)

reject characters outside the Base64URL alphabet (0ebb971), references #879

reject duplicate "crit" values when producing (31d60e1)

reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)

reject truncated ASN.1 key data (7a16c66)

surface non-ASCII token segments as JOSE errors (194fe11)

types: correct JWK and CryptoKey types (62a196d)

types: correct key resolver and JWT header types (e95f8c4)

validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

correct subpaths and API documentation (2daec38)

document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits

8b768eb chore(release): 6.2.8
1500459 refactor: name the "alg" source in unsupported algorithm failures
714f870 fix: reject a non-string "alg" in EmbeddedJWK
925f3bb refactor: index the JWS and JWE registries without a wrapper
505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
514831d chore(deps): bump the actions group with 3 updates
45965db chore: cleanup after release
60b941f chore(release): 6.2.7
90ab09c fix: require own JOSE properties for presence checks
767d7f1 refactor: reduce bundle size
Additional commits viewable in compare view

Updates better-auth from 1.6.24 to 1.6.26

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)

Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)

Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)

Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)

Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)

Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)

Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)

Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)

Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)

Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)

Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

v1.6.25

better-auth

Bug Fixes

Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)

Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

#10619 9ede805 Thanks @jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

#10608 5a811f1 Thanks @bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

#10605 d8327f1 Thanks @XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

#10513 e2c73fb Thanks @mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

#10635 af50c45 Thanks @krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

#10633 701cd43 Thanks @gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

#10599 e7b0eba Thanks @bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

#10552 2b4a14f Thanks @bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

#10467 7552a3b Thanks @jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

#10580 ea38fca Thanks @Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

#10520 a03e4c1 Thanks @bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

Updated dependencies [a30e274]:

@better-auth/core@1.6.26

@better-auth/drizzle-adapter@1.6.26

@better-auth/kysely-adapter@1.6.26

@better-auth/memory-adapter@1.6.26

@better-auth/mongo-adapter@1.6.26

@better-auth/prisma-adapter@1.6.26

@better-auth/telemetry@1.6.26

1.6.25

Patch Changes

#10479 5124c34 Thanks @krish-vachhani! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.

#10444 7439359 Thanks @birkskyum! - Expose the real $fetch instance and $store atoms from the Solid client instead of resolving them as dynamic API routes.

Updated dependencies [0ffd1fb]:

@better-auth/core@1.6.25

@better-auth/drizzle-adapter@1.6.25

@better-auth/kysely-adapter@1.6.25

@better-auth/memory-adapter@1.6.25

@better-auth/mongo-adapter@1.6.25

@better-auth/prisma-adapter@1.6.25

... (truncated)

Commits

a16b30e chore: release v1.6.26 (#10521)
9ede805 fix(rate-limit): await database cleanup by default (#10619)
af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
Additional commits viewable in compare view

Updates nodemailer from 9.0.3 to 9.0.4

Release notes

Sourced from nodemailer's releases.

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)

mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)

mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)

mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)

mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

Changelog

Sourced from nodemailer's changelog.

9.0.4 (2026-08-04)

Bug Fixes

mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)

mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)

mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)

mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)

mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

Commits

2a0e8c3 chore(master): release 9.0.4 (#1841)
78f4aa2 fix(mime-funcs): percent encode unpaired surrogates in header parameter values
182d39a refactor(mime-node): quote the Content-Type name parameter with JSON.stringify
9797f7f fix(mime-funcs): do not let an unpaired surrogate consume the next character
adcfc4f fix(mime-node): escape backslash and quote in the Content-Type name parameter...
5bd3a65 fix(mime-funcs): keep any surrogate pair intact when chunking base64 mime wor...
eaf12a0 chore(services): add TurboSMTP (#1839)
b27d300 test(mime-node): assert the Content-Type name= output for line break filenames
5bc9cab fix(mime): encode HT/CR/LF in header parameter values instead of quoting them...
acc2b43 chore(deps): update dev dependencies
Additional commits viewable in compare view

Updates hono from 4.12.31 to 4.12.34

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164

chore: bump @hono/node-server in honojs/hono#5167

fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166

chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

734755a 4.12.34
9839ff3 chore: update bun.lock (#5182)
0c45036 Merge commit from fork
720b566 Merge commit from fork
f70e2c3 Merge commit from fork
93fc250 Merge commit from fork
51db313 4.12.33
aed1463 chore: remove undici in favor of global fetch (#5168)
224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
df653ce chore: bump @hono/node-server (#5167)
Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates next from 16.2.10 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

dependabot · 2026-08-11T19:23:32Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

pkg-pr-new · 2026-08-11T19:25:45Z

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@222

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@222

commit: 062ca8e

…h 11 updates Bumps the runtime-deps group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tsdown](https://github.com/rolldown/tsdown) | `0.22.12` | `0.22.14` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1087.0` | `3.1101.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.21` | `7.5.22` | | [@prisma/management-api-sdk](https://github.com/prisma/pdp-control-plane/tree/HEAD/packages/management-api-sdk) | `1.50.0` | `1.53.0` | | [jose](https://github.com/panva/jose) | `6.2.4` | `6.2.8` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.24` | `1.6.26` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.3` | `9.0.4` | | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.12.34` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [next](https://github.com/vercel/next.js) | `16.2.10` | `16.2.12` | Updates `tsdown` from 0.22.12 to 0.22.14 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.22.12...v0.22.14) Updates `@aws-sdk/client-s3` from 3.1087.0 to 3.1101.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1101.0/clients/client-s3) Updates `tar` from 7.5.21 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.21...v7.5.22) Updates `@prisma/management-api-sdk` from 1.50.0 to 1.53.0 - [Commits](https://github.com/prisma/pdp-control-plane/commits/HEAD/packages/management-api-sdk) Updates `jose` from 6.2.4 to 6.2.8 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.4...v6.2.8) Updates `better-auth` from 1.6.24 to 1.6.26 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.26/packages/better-auth) Updates `nodemailer` from 9.0.3 to 9.0.4 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v9.0.3...v9.0.4) Updates `hono` from 4.12.31 to 4.12.34 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.12.34) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `next` from 16.2.10 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.10...v16.2.12) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1101.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime-deps - dependency-name: "@prisma/management-api-sdk" dependency-version: 1.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime-deps - dependency-name: better-auth dependency-version: 1.6.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: hono dependency-version: 4.12.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: jose dependency-version: 6.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: nodemailer dependency-version: 9.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: tar dependency-version: 7.5.22 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: tsdown dependency-version: 0.22.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot changed the title ~~chore(deps)(deps): Bump the runtime-deps group with 11 updates~~ chore(deps)(deps): Bump the runtime-deps group across 1 directory with 11 updates Aug 12, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/main/runtime-deps-e5477bda39 branch 2 times, most recently from 4baee3b to f05ee5d Compare August 12, 2026 09:00

dependabot Bot force-pushed the dependabot/npm_and_yarn/main/runtime-deps-e5477bda39 branch from f05ee5d to 062ca8e Compare August 12, 2026 09:56

Navigation Menu

Uh oh!

chore(deps)(deps): Bump the runtime-deps group across 1 directory with 11 updates - #222

chore(deps)(deps): Bump the runtime-deps group across 1 directory with 11 updates#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/runtime-deps-e5477bda39

dependabot Bot commented on behalf of github Aug 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 11, 2026

Uh oh!

pkg-pr-new Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.22.14

🚀 Features

View changes on GitHub

v0.22.13

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v3.1101.0

3.1101.0(2026-07-31)

New Features

v3.1100.0

3.1100.0(2026-07-31)

Chores

New Features

Bug Fixes

Tests

3.1101.0 (2026-07-31)

3.1100.0 (2026-07-31)

3.1099.0 (2026-07-30)

3.1098.0 (2026-07-29)

3.1097.0 (2026-07-28)

3.1096.0 (2026-07-27)

3.1095.0 (2026-07-24)

v6.2.8

Fixes

Refactor

v6.2.7

Fixes

Refactor

v6.2.6

Fixes

v6.2.5

Fixes

Documentation

Refactor

6.2.8 (2026-08-03)

Fixes

Refactor

6.2.7 (2026-08-01)

Fixes

Refactor

6.2.6 (2026-07-31)

Fixes

6.2.5 (2026-07-29)

Fixes

Documentation

v1.6.26

better-auth

Bug Fixes

@better-auth/core

Features

@better-auth/redis-storage

Bug Fixes

Contributors

v1.6.25

better-auth

Bug Fixes

1.6.26

Patch Changes

1.6.25

Patch Changes

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

9.0.4 (2026-08-04)

Bug Fixes

v4.12.34

Security fixes

memo() retains SSR output across requests, leading to cross-user data disclosure

ReDoS in CORS middleware via Access-Control-Request-Headers

Algorithmic complexity DoS in Language Middleware

Proxy Helper does not remove response headers listed in the Connection header

v4.12.33

What's Changed

v4.12.32

What's Changed

dependabot Bot commented on behalf of github Aug 11, 2026 •

edited

Loading

`better-auth`

`@better-auth/core`

`@better-auth/redis-storage`

`better-auth`

`memo()` retains SSR output across requests, leading to cross-user data disclosure

ReDoS in CORS middleware via `Access-Control-Request-Headers`

Proxy Helper does not remove response headers listed in the `Connection` header

pkg-pr-new Bot commented Aug 11, 2026 •

edited

Loading