build(deps): Bump the npm-production group across 1 directory with 4 updates

[dependabot]

Bumps the npm-production group with 4 updates in the / directory: @upstash/redis, better-auth, next and pg-boss.

Updates @upstash/redis from 1.38.0 to 1.38.2

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.2

Patch Changes

• c0f5ad7: Deduplicate telemetry header values so repeated mergeTelemetry calls no longer append the same sdk, platform or runtime tag multiple times

@​upstash/redis@​1.38.1

Patch Changes

• bd7a19f: Add a quick tip about creating a database via https://upstash.com/start-redis to the warnings shown when the Redis url or token is missing. On Cloudflare, the warning shown when both the url and the token are missing now names both wrangler secret put commands instead of only one.

Commits

• fc3089b chore: version packages (#1441)
• c0f5ad7 fix: deduplicate telemetry header values in mergeTelemetry (#1440)
• e45fb78 chore: version packages (#1439)
• bd7a19f DX-2866: add start-redis tip to missing url/token warnings (#1438)
• 8cf6209 fix: stabilize flaky evalshaRo test by waiting for script replication
• 3024bb2 DX-2750: add ai sdk telemetry to redis search example (#1437)
• bf3f48a chore: add resource section to README (#1435)
• 27f7253 docs: add quick tip for fast Redis database setup
• e93fef5 fix: add allowBuilds for pnpm 11 compatibility (#1434)
• See full diff in compare view

Updates better-auth from 1.6.25 to 1.6.26

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
• Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
• Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
• Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
• Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​Emmaccen, @​gustavovalverde, @​jashkarangiya, @​jeroenvandermerwe, @​jlucaso1, @​krish-vachhani, @​mrosberghaus, @​XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

• #10619 9ede805 Thanks @​jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

• #10608 5a811f1 Thanks @​bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

• #10605 d8327f1 Thanks @​XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

• #10513 e2c73fb Thanks @​mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

• #10635 af50c45 Thanks @​krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

• #10633 701cd43 Thanks @​gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

• #10599 e7b0eba Thanks @​bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

• #10552 2b4a14f Thanks @​bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

• #10467 7552a3b Thanks @​jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

• #10580 ea38fca Thanks @​Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

• #10520 a03e4c1 Thanks @​bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

• Updated dependencies [a30e274]:

  • @​better-auth/core@​1.6.26
  • @​better-auth/drizzle-adapter@​1.6.26
  • @​better-auth/kysely-adapter@​1.6.26
  • @​better-auth/memory-adapter@​1.6.26
  • @​better-auth/mongo-adapter@​1.6.26
  • @​better-auth/prisma-adapter@​1.6.26
  • @​better-auth/telemetry@​1.6.26

Commits

• a16b30e chore: release v1.6.26 (#10521)
• 9ede805 fix(rate-limit): await database cleanup by default (#10619)
• af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
• 222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
• d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
• e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
• 5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
• e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
• ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
• 7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
• Additional commits viewable in compare view

Updates next from 16.2.12 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

• Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
• Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
• Normalize encoded dynamic placeholders in app routes: #91603
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
• Update tokio from 1.43.0 to 1.47.3: #90945
• [turbopack] Simplify snapshotting logic: #91178
• Turbopack: enable server HMR for app route handlers: #91466
• turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
• [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
• Skip loadBindings() Lightning CSS check during next start: #91538
• turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
• Turbopack: Add importModule() support to webpack loaders: #89630
• turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
• turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
• feat(node-streams): add config flag, define-env, and env precedence test: #90427
• Rename /_next/webpack-hmr to /_next/hmr: #91415
• Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
• Handle encoded params further: #91627
• [turbopack] Respect {eval:true} in worker_threads constructors: #91666
• Fix missing route in otel spans without base-server: #91665
• [turbopack] Optimize compaction cpu usage: #91468
• Fix layout segment optimization: move app-page imports to server-utility transition: #91701
• Fix server actions in standalone mode with cacheComponents: #91711
• turbo-persistence: remove Unmergeable mmap advice: #91713
• turbopack: move "compact database" tracing span to backend layer: #91693
• Turbopack: lazy require metadata and handle TLA: #91705
• Fix adapter outputs for dynamic metadata routes: #91680
• Turbopack: fix webpack loader runner layer: #91727
• [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
• Add module count field to module graph tracing spans: #91697
• turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
• Turbopack: pull in updated vercel/nft tests: #91651
• [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
• [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
• [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
• Avoid deprecated TS node10 moduleResolution defaults: #91847
• [turbopack] Rebuild the docker build scripts: #91799
• Fix TS6 baseUrl deprecation for extended tsconfig: #91855
• Add next internal post-build CLI command for Turbopack database compaction: #91336
• Turbopack: Define Effect as a trait instead of a closure: #89080
• Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
• turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
• Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
• Use charCodeAt for normalizePathTrailingSlash: #91380
• Turbopack: Only patch lockfile when bindings fails to load: #91379
• [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
• [devtools] Make instant navs panel draggable: #91914
• [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

• d73f562 v16.3.0
• 2e0d4cb Edits to turbopackFileSystemCache (#96531)
• 86df9c7 docs: cover direct visits and client navigations in the instant() e2e example...
• 47a52c0 [turbopack / next.js] Add an end-to-end test for new root detection (#96544)
• 8e878d4 Remove implicit Partial Prefetching opt-in from instant (#96539)
• e37ddd1 Fix deploy test TypeScript exclusions (#96545)
• 8a4920c docs: clarify first-party Skills workflows (#96495)
• 4344b83 Flag newly disabled deploy tests (#96505)
• 459617a fix: double fragment on navigation (#93132)
• cbf0cef Enable TypeScript CLI by default (#96497)
• Additional commits viewable in compare view

Updates pg-boss from 12.26.3 to 12.27.0

Release notes

Sourced from pg-boss's releases.

12.27.0

What's Changed

This release lets schema be any name PostgreSQL accepts as a quoted identifier, fixes a set of catalog lookups that were silently wrong for schema names PostgreSQL folds to lower case, and adds a startup guard against the config mistake the new spelling makes possible.

Highlights

Quoted schema names

schema may now be passed pre-quoted to reach names that aren't legal bare identifiers — dashes, reserved words, mixed case you want preserved (#700):

new PgBoss({ schema: '"My-Schema"' })

The value is used verbatim in identifier positions, so the quotes are preserved as written. Quoting is the caller's, not pg-boss's: MySchema and "MySchema" are different schemas, since PostgreSQL folds the unquoted form to myschema. Existing configurations are unaffected — a bare name emits exactly the SQL it does today.

Inside a quoted name, double quotes, single quotes, percent signs, periods, dollar signs, backslashes and control characters are rejected. Each one would either escape the identifier or corrupt the format() / dollar-quoted bodies the schema is interpolated into.

Thanks to @​MoazEmad1 for the original PR (#859).

Catalog lookups now use the resolved schema name

PostgreSQL stores the folded name, so every nspname = '<schema>' comparison pg-boss makes had to fold too. It didn't. With a mixed-case bare name such as schema: 'MySchema' (accepted by every prior version, stored by PostgreSQL as myschema), each of these was silently broken:

• Queue stats partition maintenance — the "does today's partition exist" check never matched, so maintenance re-issued CREATE TABLE … PARTITION OF on a partition that already existed and failed with relation already exists. Retention pruning found no partitions to drop, so old ones accumulated forever.
• detectSchemaDrift() / pg-boss doctor — reported an entirely empty schema, i.e. every table, index, function, column, constraint and enum value as missing.
• BAM background index builds — the liveness probe and the invalid-index heal probe both resolved to nothing, so a stalled build was reclaimed on timeout only and an invalid leftover index was never healed.

All of these now resolve the configured value to the name in pg_namespace before comparing.

The notify channel and advisory lock key are deliberately not folded. They're hashes of a string, never compared against the catalog, so they only need to agree between instances — and folding them would change the channel and lock key of every existing bare name, leaving old and new instances unable to coordinate during a rolling upgrade. Only redundant quoting is collapsed ('"pgboss"' and 'pgboss' land on one channel). Derived values stay byte-identical to prior releases.

Guardrails for the two spellings

MySchema and "MySchema" differ by two characters in config, name two different schemas, and look identical in logs. Mis-spelling the quoting was not an error on its own: pg-boss found no installation, created an empty second schema, and every existing job appeared to have vanished. start() now refuses to install into a schema when another one differing from it only by case already holds a pg-boss installation, and names the spelling that reaches the existing data:

pg-boss is not installed in schema MySchema, but is installed in "MySchema", which differs only
in case. PostgreSQL folds unquoted names to lower case and stores quoted names verbatim, so these
are different schemas. To use the existing installation, set schema: '"MySchema"'. To install a
new schema beside it anyway, set allowSchemaCaseVariant: true.

Only pg-boss installations count, so an unrelated schema that happens to share a folded name never blocks an install. The check runs once, on the install path only. Set the new allowSchemaCaseVariant option to true if two installations whose names differ by case are genuinely intended.

Relatedly, the error for a name that isn't a legal bare identifier now hands back the config that works, instead of only naming the rule that was broken:

Schema name "my-schema" can only contain alphanumeric characters or underscores when unquoted.
Pass it quoted to use it verbatim: schema: '"my-schema"'
</tr></table> 

... (truncated)

Commits

• aa1ce16 fix flaky test
• 617ec33 added tests
• d034e75 new config option to allow schema case variants on startup
• feb0d76 deps and versioning
• 69e33eb updates for schema quoting PR
• 0148543 Merge pull request #859 from MoazEmad1/schema-identifier-quoting
• 0ce5d27 docs domain update
• faaa887 update vitepress
• 6022c02 allow caller-quoted schema names
• f869cc9 deps and versioning for dashboard
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
autonomous-ehs-management	Error		Aug 10, 2026 12:36am