Skip to content

build(deps): Bump the production-deps group across 1 directory with 12 updates - #233

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/platform/production-deps-7bf1bfa9ea
Open

build(deps): Bump the production-deps group across 1 directory with 12 updates#233
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/platform/production-deps-7bf1bfa9ea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-deps group with 12 updates in the /platform directory:

Package From To
@next/mdx 16.3.2 16.3.4
@opentelemetry/instrumentation-http 0.221.0 0.222.0
@opentelemetry/sdk-node 0.221.0 0.222.0
@supabase/ssr 0.12.4 0.12.6
@supabase/supabase-js 2.112.3 2.115.0
lucide-react 1.33.0 1.41.0
next 16.3.2 16.3.4
next-safe-action 8.6.1 8.7.1
nodemailer 9.0.5 9.1.1
react-hook-form 7.85.0 7.87.0
resend 6.21.0 6.26.0
zod 4.4.3 4.5.4

Updates @next/mdx from 16.3.2 to 16.3.4

Release notes

Sourced from @​next/mdx's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Commits

Updates @opentelemetry/instrumentation-http from 0.221.0 to 0.222.0

Release notes

Sourced from @​opentelemetry/instrumentation-http's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

  • fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
  • fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
  • fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
  • fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

    • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

      Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
  • fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

🏠 Internal

  • refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna
Commits
  • 0b72a81 chore: prepare next release (#7044)
  • a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
  • f41805e chore: prepare next release (#7042)
  • b85eb28 chore(instrumentation-http): fix lint errors (#7039)
  • 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
  • 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
  • e086dec Merge commit from fork
  • 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
  • d0ce753 chore: add @​maryliag to maintainers (#7024)
  • 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
  • Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.221.0 to 0.222.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

  • fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
  • fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
  • fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
  • fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

    • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

      Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
  • fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

🏠 Internal

  • refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna
Commits
  • 0b72a81 chore: prepare next release (#7044)
  • a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
  • f41805e chore: prepare next release (#7042)
  • b85eb28 chore(instrumentation-http): fix lint errors (#7039)
  • 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
  • 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
  • e086dec Merge commit from fork
  • 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
  • d0ce753 chore: add @​maryliag to maintainers (#7024)
  • 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
  • Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.4 to 0.12.6

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.6

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

v0.12.6-rc.158

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.5...v0.12.6-rc.158

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.4...v0.12.5-rc.154

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142
Commits
  • 71c33a7 chore(main): release 0.12.6 (#291)
  • c7c7e68 docs: fix typos in tsdoc and design doc (#288)
  • af750e2 fix: avoid duplicate cache headers per server client (#283)
  • 905c7c3 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#290)
  • 9e2564d chore: update @​supabase/supabase-js to v2.114.0 (#289)
  • c5310fd chore(main): release 0.12.5 (#286)
  • c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
  • b4797e3 chore: update @​supabase/supabase-js to v2.112.4 (#285)
  • 6f5bc21 chore: update @​supabase/supabase-js to v2.112.3 (#282)
  • 35187b2 build(deps): bump postcss from 8.5.15 to 8.5.25 in the npm_and_yarn group acr...
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.115.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.115.0

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

v2.115.0-canary.0

2.115.0-canary.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

v2.114.0

2.114.0 (2026-09-02)

🚀 Features

  • storage: object versioning updates (#2644)

🩹 Fixes

  • auth: unenroll the unverified factor after a failed registration (#2641)
  • deps: override browserslist to patch high-severity advisories (#2652)

❤️ Thank You

v2.114.0-canary.0

2.114.0-canary.0 (2026-09-02)

🚀 Features

  • storage: object versioning updates (#2644)

🩹 Fixes

  • auth: unenroll the unverified factor after a failed registration (#2641)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

Updates lucide-react from 1.33.0 to 1.41.0

Release notes

Sourced from lucide-react's releases.

Version 1.41.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.40.0...1.41.0

Version 1.40.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.39.0...1.40.0

Version 1.39.0

What's Changed

Full Changelog: lucide-icons/lucide@1.38.0...1.39.0

... (truncated)

Commits

Updates next from 16.3.2 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • Additional commits viewable in compare view

Updates next-safe-action from 8.6.1 to 8.7.1

Release notes

Sourced from next-safe-action's releases.

[email protected]

Patch Changes

  • #478 e5f6522 Thanks @​TheEdoRan! - Fix reset() letting the queued dispatches of useStateAction and useOptimisticStateAction write to the server after the user had discarded them.

    Both hooks queue dispatches through useActionState, and reset() marked every dispatch made before it as discarded: its result, its errors and its callbacks were all ignored when it settled. The dispatches themselves still ran, though, including the ones that were only queued and had never contacted the server. So a reset() in the middle of a draining queue performed exactly the writes the user had just thrown away, and a revalidatePath() inside any of them pushed a fresh currentState that landed after the reset, pulling the confirmed state into a value that was never on screen. With useOptimisticStateAction this reads as the list snapping to an order the user never chose, some seconds after resetting.

    A dispatch that a reset() marked stale before it took its turn in the queue now never calls the action at all: nothing had been sent for it, so the write is skipped, its executeAsync promise resolves with {}, and none of its callbacks fire. The dispatch that was already awaiting the server still completes, because React cannot recall it.

    Also fixed in useOptimisticStateAction: a currentState that committed while the queue was still draining applied the already-settled optimistic payloads a second time. React holds every payload for as long as the queue has work, and the hook relies on that to keep overlapping changes on screen, which is safe only while the confirmed base does not move. An urgent prop update moves it, and the settled payloads then folded on top of a base that already carried them (three queued appends over an acknowledged base rendered ["x", "x", "y", "z"] instead of ["x", "y", "z"]). Each payload now records its dispatch, and a prop that arrives mid-queue stops the payloads of dispatches that have already settled, while the pending ones keep folding. Next's own revalidation path is unaffected: it commits on the same suspended lane the queue waits on, so it never lands mid-queue.

    And a third fix in the same area: a currentState that committed while an action was still running discarded that action's own data, so the next queued dispatch built on its predecessor's predecessor and one write was silently overwritten (three queued appends over an acknowledging payload handed the third dispatch { data: ["x"] } instead of { data: ["x", "y"] }). Precedence between currentState and an action's data is now answered by arrival order for the value you render, as before, and by write order for the base the next queued dispatch sends to the server. A payload that commits while an action is running was rendered before that action wrote, so it is the older value there, whether it acknowledges the previous dispatch or carries an unrelated write. A payload that arrives once nothing is in flight still wins.

[email protected]

Minor Changes

  • #473 5e37200 Thanks @​TheEdoRan! - Add useOptimisticStateAction, the optimistic hook for stateful actions.

    useOptimisticAction is last-write-wins: when two executions overlap, the newer response is kept and the older discarded. That is correct for replace semantics, but wrong when changes must accumulate, for example reordering an item and then reordering it again before the first save lands.

    useOptimisticStateAction is built on React's useActionState, so dispatches are queued: each waits for the previous to settle and receives its result as prevResult.

    const { optimisticState, execute } = useOptimisticStateAction(saveLayout, {
  currentState: groups,
  updateFn: layoutReducer,
});

    Confirmed state is the more recent of the action's successful data and the currentState option, which covers both shapes of the pattern: an action that returns the full next state owns the confirmed value, an action that returns nothing leaves currentState authoritative, and a revalidated currentState beats a stale client-side fold.

    Details worth knowing:

    • Confirmed domain state is tracked separately from the SafeActionResult envelope, so a validation or server error rolls back to the last confirmed value instead of blanking the UI.
    • prevResult handed to the server always carries a data branch: after a failed dispatch the hook substitutes the last confirmed state, so one rejected write cannot leave the rest of the queue without a base.
    • Callbacks are delivered per dispatch rather than from a render effect, because React withholds useActionState's commit until the whole queue drains and result/status cannot report intermediate results. They fire just before commit rather than after.
    • currentState is compared by identity, so pass a stable reference. A derived value (items.filter(...)) is a new identity on every render and breaks the same way an inline literal does.
    • When the action returns data, that data must be assignable to State. This is enforced at the type level, so an action returning some other shape is a compile error. Actions that return nothing are exempt, which is what the pending-changes-list shape relies on.
    • A currentState that commits while a dispatch is in flight supersedes that dispatch's return value, so a revalidated Server Component payload stays authoritative for everything queued behind it.
    • After reset(), the next change folds over the restored baseline instead of briefly re-showing the state that was just discarded.
    • Internal state is written after commit, never during render, so a render React starts and throws away (a Suspense retry, StrictMode's double invoke) cannot leak uncommitted state into the next dispatch.

    useStateAction is unchanged in behaviour; both hooks now share one internal implementation. That shared path also picks up three fixes:

    • A synchronous throw from a user callback no longer escapes before the dispatch is enqueued, which used to leave executeAsync pending forever.
    • A raw thrown error now settles the promises of dispatches queued behind it. React clears its whole action queue when an Action rejects, so those promises previously never resolved or rejected.
    • A throw from a dispatch that a reset already made stale no longer cancels fresh queued work.
Commits

Updates nodemailer from 9.0.5 to 9.1.1

Release notes

Sourced from nodemailer's releases.

v9.1.1

9.1.1 (2026-09-01)

Bug Fixes

  • mailer: apply the message access policy in resolveContent (dc48ed3)
  • mailer: keep message data from reopening the access sandbox (ab7ef34)
  • mime-node: inherit the access policy from the tree a node hangs in (262d550)

v9.1.0

9.1.0 (2026-08-31)

Features

  • mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

  • addressparser: handle address lists in linear time (9116da9)
  • addressparser: terminate the domain at an RFC 5322 comment (902b63e)
  • mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
  • mime-node: dedupe envelope recipients in linear time (7cc38af)
  • mime-node: flatten parsed addresses without concat.apply (83b8c48)
  • mime-node: keep the recipient dedupe linear across address headers (34da642)
  • mime-node: keep URL delimiters away from the domain mapper (b212ac4)

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)
Changelog

Sourced from nodemailer's changelog.

9.1.1 (2026-09-01)

Bug Fixes

  • mailer: apply the message access policy in resolveContent (dc48ed3)
  • mailer: keep message data from reopening the access sandbox (ab7ef34)
  • mime-node: inherit the access policy from the tree a node hangs in (262d550)

9.1.0 (2026-08-31)

Features

  • mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

  • addressparser: handle address lists in linear time (9116da9)
  • addressparser: terminate the domain at an RFC 5322 comment (902b63e)
  • mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
  • mime-node: dedupe envelope recipients in linear time (7cc38af)
  • mime-node: flatten parsed addresses without concat.apply (83b8c48)
  • mime-node: keep the recipient dedupe linear across address headers (34da642)
  • mime-node: keep URL delimiters away from the domain mapper (b212ac4)

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)
Commits
  • ad4513f chore(master): release 9.1.1 (#1850)
  • c3e261f docs: replace dead Node.js c-ares dependencies link (#1845)
  • c158a38 docs: mark 9.x as the supported security line (#1846)
  • 262d550 fix(mime-node): inherit the access policy from the tree a node hangs in
  • ab7ef34 fix(mailer): keep message data from reopening the access sandbox
  • dc48ed3 fix(mailer): apply the message access policy in resolveContent
  • efd6e29 chore(master): release 9.1.0 (#1849)
  • 1f9533b chore(deps): update dev dependencies
  • b212ac4 fix(mime-node): keep URL delimiters away from the domain mapper
  • 6aa7e3f refactor: fold review findings into the address parsing changes
  • Additional commits viewable in compare view

Updates react-hook-form from 7.85.0 to 7.87.0

Release notes

Sourced from react-hook-form's releases.

Version 7.87.0

✨ Features

  • Add shouldTouch option to trigger() ([#13671](react-hook-form/react-hook-form#13671))

    setValue already supported shouldTouch; trigger() now does too. This allows you to mark field(s) as touched after manual or programmatic validation, such as validate-on-mount or multi-step form navigation, without needing a setValue workaround:

    // Mark a single field as touched after validating it
await trigger('firstName', { shouldTouch: true });
// Mark every mounted field as touched after validating the whole form
await trigger(undefined, { shouldTouch: true });

  • Add OpaqueTypes registry for opaque leaf types ([#13676](react-hook-form/react-hook-form#13676))

    Recursive type helpers (Path, DeepPartial, DeepRequired, FieldErrorsImpl, etc.) previously stopped only at Primitive | BrowserNativeObject. As a result, rich third-party value types such as Dayjs and Decimal could be recursively traversed member-by-member, potentially causing TypeScript to report "Excessive complexity" diagnostics on large form types.

    You can now register a type as an opaque leaf via declaration merging:

    import type { Dayjs } from 'dayjs';
declare module 'react-hook-form' {
interface OpaqueTypes {
dayjs: Dayjs;
}
}

    While the registry is empty, types remain identical to the existing behavior. This is purely opt-in.

🐞 Fixes

@dependabot
build(deps): Bump the production-deps group across 1 directory with 1…
f08af74 
…2 updates

Bumps the production-deps group with 12 updates in the /platform directory:

| Package | From | To |
| --- | --- | --- |
| [@next/mdx](https://github.com/vercel/next.js/tree/HEAD/packages/next-mdx) | `16.3.2` | `16.3.4` |
| [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) | `0.221.0` | `0.222.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.221.0` | `0.222.0` |
| [@supabase/ssr](https://github.com/supabase/ssr) | `0.12.4` | `0.12.6` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.115.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.41.0` |
| [next](https://github.com/vercel/next.js) | `16.3.2` | `16.3.4` |
| [next-safe-action](https://github.com/next-safe-action/next-safe-action) | `8.6.1` | `8.7.1` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.1.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.87.0` |
| [resend](https://github.com/resend/resend-node) | `6.21.0` | `6.26.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |



Updates `@next/mdx` from 16.3.2 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.4/packages/next-mdx)

Updates `@opentelemetry/instrumentation-http` from 0.221.0 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.221.0...experimental/v0.222.0)

Updates `@opentelemetry/sdk-node` from 0.221.0 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.221.0...experimental/v0.222.0)

Updates `@supabase/ssr` from 0.12.4 to 0.12.6
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.12.4...v0.12.6)

Updates `@supabase/supabase-js` from 2.112.3 to 2.115.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.115.0/packages/core/supabase-js)

Updates `lucide-react` from 1.33.0 to 1.41.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react)

Updates `next` from 16.3.2 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.2...v16.3.4)

Updates `next-safe-action` from 8.6.1 to 8.7.1
- [Release notes](https://github.com/next-safe-action/next-safe-action/releases)
- [Commits](https://github.com/next-safe-action/next-safe-action/compare/[email protected]@8.7.1)

Updates `nodemailer` from 9.0.5 to 9.1.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.1.1)

Updates `react-hook-form` from 7.85.0 to 7.87.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.85.0...v7.87.0)

Updates `resend` from 6.21.0 to 6.26.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.21.0...v6.26.0)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

---
updated-dependencies:
- dependency-name: "@next/mdx"
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@opentelemetry/instrumentation-http"
  dependency-version: 0.222.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.222.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@supabase/ssr"
  dependency-version: 0.12.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.115.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: lucide-react
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: next-safe-action
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: nodemailer
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: react-hook-form
  dependency-version: 7.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: resend
  dependency-version: 6.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: platform. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@vercel

vercel Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clickbus-iris Ready Ready Preview Sep 7, 2026 8:17pm UTC

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants