Skip to content

build(deps): Bump the production-deps group across 1 directory with 14 updates - #249

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/platform/production-deps-6dd704f32c
Open

build(deps): Bump the production-deps group across 1 directory with 14 updates#249
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/platform/production-deps-6dd704f32c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-deps group with 14 updates in the /platform directory:

Package From To
@next/mdx 16.3.2 16.3.5
@opentelemetry/instrumentation-http 0.221.0 0.222.0
@opentelemetry/sdk-node 0.221.0 0.222.0
@supabase/ssr 0.12.4 0.12.7
@supabase/supabase-js 2.112.3 2.116.0
lucide-react 1.33.0 1.45.0
next 16.3.2 16.3.5
next-safe-action 8.6.1 8.7.3
nodemailer 9.0.5 9.1.1
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
react-hook-form 7.85.0 7.87.0
resend 6.21.0 6.28.0
zod 4.4.3 4.6.2

Updates @next/mdx from 16.3.2 to 16.3.5

Release notes

Sourced from @​next/mdx's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Commits

Updates @opentelemetry/instrumentation-http from 0.221.0 to 0.222.0

Release notes

Sourced from @​opentelemetry/instrumentation-http's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

  • fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
  • fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
  • fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
  • fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

    • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

      Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
  • fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

🏠 Internal

  • refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna
Commits
  • 0b72a81 chore: prepare next release (#7044)
  • a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
  • f41805e chore: prepare next release (#7042)
  • b85eb28 chore(instrumentation-http): fix lint errors (#7039)
  • 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
  • 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
  • e086dec Merge commit from fork
  • 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
  • d0ce753 chore: add @​maryliag to maintainers (#7024)
  • 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
  • Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.221.0 to 0.222.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

  • fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
  • fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
  • fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
  • fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

    • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

      Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
  • fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

🏠 Internal

  • refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna
Commits
  • 0b72a81 chore: prepare next release (#7044)
  • a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
  • f41805e chore: prepare next release (#7042)
  • b85eb28 chore(instrumentation-http): fix lint errors (#7039)
  • 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
  • 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
  • e086dec Merge commit from fork
  • 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
  • d0ce753 chore: add @​maryliag to maintainers (#7024)
  • 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
  • Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.4 to 0.12.7

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.7

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

v0.12.7-rc.162

What's Changed

Full Changelog: supabase/ssr@v0.12.6...v0.12.7-rc.162

v0.12.6

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

v0.12.6-rc.158

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.5...v0.12.6-rc.158

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142
Commits
  • 9b28f49 chore(main): release 0.12.7 (#295)
  • 9d6e2a5 fix: apply non-browser defaults when cookies only sets encode (#294)
  • 4ed9f65 chore: add workflow for autoclosing stale issues (#292)
  • 71c33a7 chore(main): release 0.12.6 (#291)
  • c7c7e68 docs: fix typos in tsdoc and design doc (#288)
  • af750e2 fix: avoid duplicate cache headers per server client (#283)
  • 905c7c3 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#290)
  • 9e2564d chore: update @​supabase/supabase-js to v2.114.0 (#289)
  • c5310fd chore(main): release 0.12.5 (#286)
  • c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.116.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add bucket lifecycle configuration (#2659)
  • storage: topk 10k support (#2667)
  • storage: add versionId support to create URL methods (#2678)

🩹 Fixes

  • auth: silence commit-guard-discarded refresh in initial session (#2668)
  • storage: drop legacy prefix from lifecycles (#2674)
  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

  • fadymak
  • Ferhat Elmas
  • Katerina Skroumpelou @​mandarini
  • Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add versionId support to create URL methods (#2678)

❤️ Thank You

  • fadymak
  • Katerina Skroumpelou
  • Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

  • storage: topk 10k support (#2667)

🩹 Fixes

  • storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

🩹 Fixes

  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

Updates lucide-react from 1.33.0 to 1.45.0

Release notes

Sourced from lucide-react's releases.

Version 1.45.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.44.0...1.45.0

Version 1.44.0

What's Changed

New Contributors

... (truncated)

Commits

Updates next from 16.3.2 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • Additional commits viewable in compare view

Updates next-safe-action from 8.6.1 to 8.7.3

Release notes

Sourced from next-safe-action's releases.

next-safe-action@8.7.3

Patch Changes

  • #485 03661cb Thanks @​TheEdoRan! - Fix onNavigation and onSettled firing twice for a single redirect in useAction, useOptimisticAction and useStateAction. The redirect is delivered on the first commit that carries it, before the status reaches hasNavigated, and the later hasNavigated commit re-fired the same navigation. Each navigation now fires the callbacks exactly once.

next-safe-action@8.7.2

Patch Changes

  • #483 95a982e Thanks @​TheEdoRan! - fix(hooks): stop useAction and useOptimisticAction from leaking an unhandled promise rejection when the action call itself rejects (offline client, stale bundle after a deploy). The error still reaches the caller through status, onError with thrownError, and the executeAsync rejection. Closes #482.

next-safe-action@8.7.1

Patch Changes

  • #478 e5f6522 Thanks @​TheEdoRan! - Fix reset() letting the queued dispatches of useStateAction and useOptimisticStateAction write to the server after the user had discarded them.

    Both hooks queue dispatches through useActionState, and reset() marked every dispatch made before it as discarded: its result, its errors and its callbacks were all ignored when it settled. The dispatches themselves still ran, though, including the ones that were only queued and had never contacted the server. So a reset() in the middle of a draining queue performed exactly the writes the user had just thrown away, and a revalidatePath() inside any of them pushed a fresh currentState that landed after the reset, pulling the confirmed state into a value that was never on screen. With useOptimisticStateAction this reads as the list snapping to an order the user never chose, some seconds after resetting.

    A dispatch that a reset() marked stale before it took its turn in the queue now never calls the action at all: nothing had been sent for it, so the write is skipped, its executeAsync promise resolves with {}, and none of its callbacks fire. The dispatch that was already awaiting the server still completes, because React cannot recall it.

    Also fixed in useOptimisticStateAction: a currentState that committed while the queue was still draining applied the already-settled optimistic payloads a second time. React holds every payload for as long as the queue has work, and the hook relies on that to keep overlapping changes on screen, which is safe only while the confirmed base does not move. An urgent prop update moves it, and the settled payloads then folded on top of a base that already carried them (three queued appends over an acknowledged base rendered ["x", "x", "y", "z"] instead of ["x", "y", "z"]). Each payload now records its dispatch, and a prop that arrives mid-queue stops the payloads of dispatches that have already settled, while the pending ones keep folding. Next's own revalidation path is unaffected: it commits on the same suspended lane the queue waits on, so it never lands mid-queue.

    And a third fix in the same area: a currentState that committed while an action was still running discarded that action's own data, so the next queued dispatch built on its predecessor's predecessor and one write was silently overwritten (three queued appends over an acknowledging payload handed the third dispatch { data: ["x"] } instead of { data: ["x", "y"] }). Precedence between currentState and an action's data is now answered by arrival order for the value you render, as before, and by write order for the base the next queued dispatch sends to the server. A payload that commits while an action is running was rendered before that action wrote, so it is the older value there, whether it acknowledges the previous dispatch or carries an unrelated write. A payload that arrives once nothing is in flight still wins.

next-safe-action@8.7.0

Minor Changes

  • #473 5e37200 Thanks @​TheEdoRan! - Add useOptimisticStateAction, the optimistic hook for stateful actions.

    useOptimisticAction is last-write-wins: when two executions overlap, the newer response is kept and the older discarded. That is correct for replace semantics, but wrong when changes must accumulate, for example reordering an item and then reordering it again before the first save lands.

    useOptimisticStateAction is built on React's useActionState, so dispatches are queued: each waits for the previous to settle and receives its result as prevResult.

    const { optimisticState, execute } = useOptimisticStateAction(saveLayout, {
  currentState: groups,
  updateFn: layoutReducer,
});

    Confirmed state is the more recent of the action's successful data and the currentState option, which covers both shapes of the pattern: an action that returns the full next state owns the confirmed value, an action that returns nothing leaves currentState authoritative, and a revalidated currentState beats a stale client-side fold.

    Details worth knowing:

    • Confirmed domain state is tracked separately from the SafeActionResult envelope, so a validation or server error rolls back to the last confirmed value instead of blanking the UI.
    • prevResult handed to the server always carries a data branch: after a failed dispatch the hook substitutes the last confirmed state, so one rejected write cannot leave the rest of the queue without a base.
    • Callbacks are delivered per dispatch rather than from a render effect, because React withholds useActionState's commit until the whole queue drains and result/status cannot report intermediate results. They fire just before commit rather than after.
    • currentState is compared by identity, so pass a stable reference. A derived value (items.filter(...)) is a new identity on every render and breaks the same way an inline literal does.
    • When the action returns data, that data must be assignable to State. This is enforced at the type level, so an action returning some other shape is a compile error. Actions that return nothing are exempt, which is what the pending-changes-list shape relies on.
    • A currentState that commits while a dispatch is in flight supersedes that dispatch's return value, so a revalidated Server Component payload stays authoritative for everything queued behind it.
    • After reset(), the next change folds over the restored baseline instead of briefly re-showing the state that was just discarded.

... (truncated)

Commits
  • 38d566c Version Packages (#486)
  • 03661cb fix(hooks): fire onNavigation and onSettled once per redirect (#485)
  • 00764f6 Version Packages (#484)
  • 95a982e fix(hooks): stop useAction and useOptimisticAction from leaking an unhandled ...
  • 5be98ba docs(guides): surface useOptimisticStateAction from the hooks pages
  • bb0cb80 Version Packages (#480)
  • 5086911 fix(adapter-better-auth): stop tsdown from rewriting next/navigation import...
  • a7737ff Version Packages (#479)
  • e5f6522 fix(hooks): three ordering defects in the queued optimistic path (#478)
  • 2665926 Version Packages (#475)
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.5 to 9.1.1

Release notes

Sourced from nodemailer's releases.

v9.1.1

9.1.1 (2026-09-01)

Bug Fixes

  • mailer: apply the message access policy in resolveContent (dc48ed3)
  • mailer: keep message data from reopening the access sandbox (ab7ef34)
  • mime-node: inherit the access policy from the tree a node hangs in (262d550)

v9.1.0

9.1.0 (2026-08-31)

Features

  • mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

  • addressparser: handle address lists in linear time (9116da9)
  • addressparser: terminate the domain at an RFC 5322 comment (902b63e)
  • mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
  • mime-node: dedupe envelope recipients in linear time (7cc38af)
  • mime-node: flatten parsed addresses without concat.apply (83b8c48)
  • mime-node: keep the recipient dedupe linear across address headers (34da642)
  • mime-node: keep URL delimiters away from the domain mapper (b212ac4)

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)
Changelog

Sourced from nodemailer's changelog.

9.1.1 (2026-09-01)

Bug Fixes

  • mailer: apply the message access policy in resolveContent (

@dependabot
build(deps): Bump the production-deps group across 1 directory with 1…
e00b3f4 
…4 updates

Bumps the production-deps group with 14 updates in the /platform directory:

| Package | From | To |
| --- | --- | --- |
| [@next/mdx](https://github.com/vercel/next.js/tree/HEAD/packages/next-mdx) | `16.3.2` | `16.3.5` |
| [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) | `0.221.0` | `0.222.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.221.0` | `0.222.0` |
| [@supabase/ssr](https://github.com/supabase/ssr) | `0.12.4` | `0.12.7` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.116.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.45.0` |
| [next](https://github.com/vercel/next.js) | `16.3.2` | `16.3.5` |
| [next-safe-action](https://github.com/next-safe-action/next-safe-action) | `8.6.1` | `8.7.3` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `9.1.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.87.0` |
| [resend](https://github.com/resend/resend-node) | `6.21.0` | `6.28.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.2` |



Updates `@next/mdx` from 16.3.2 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.5/packages/next-mdx)

Updates `@opentelemetry/instrumentation-http` from 0.221.0 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.221.0...experimental/v0.222.0)

Updates `@opentelemetry/sdk-node` from 0.221.0 to 0.222.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.221.0...experimental/v0.222.0)

Updates `@supabase/ssr` from 0.12.4 to 0.12.7
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.12.4...v0.12.7)

Updates `@supabase/supabase-js` from 2.112.3 to 2.116.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/supabase-js)

Updates `lucide-react` from 1.33.0 to 1.45.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.45.0/packages/lucide-react)

Updates `next` from 16.3.2 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.2...v16.3.5)

Updates `next-safe-action` from 8.6.1 to 8.7.3
- [Release notes](https://github.com/next-safe-action/next-safe-action/releases)
- [Commits](https://github.com/next-safe-action/next-safe-action/compare/next-safe-action@8.6.1...next-safe-action@8.7.3)

Updates `nodemailer` from 9.0.5 to 9.1.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.5...v9.1.1)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `react-hook-form` from 7.85.0 to 7.87.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.85.0...v7.87.0)

Updates `resend` from 6.21.0 to 6.28.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.21.0...v6.28.0)

Updates `zod` from 4.4.3 to 4.6.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.2)

---
updated-dependencies:
- dependency-name: "@next/mdx"
  dependency-version: 16.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@opentelemetry/instrumentation-http"
  dependency-version: 0.222.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.222.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: "@supabase/ssr"
  dependency-version: 0.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.116.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: lucide-react
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: next
  dependency-version: 16.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-deps
- dependency-name: next-safe-action
  dependency-version: 8.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: nodemailer
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: react-hook-form
  dependency-version: 7.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: resend
  dependency-version: 6.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
- dependency-name: zod
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: platform. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 14, 2026
@vercel

vercel Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clickbus-iris Ready Ready Preview Sep 14, 2026 8:18pm UTC

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants