chore(deps): bump the production group across 1 directory with 12 updates by dependabot[bot] · Pull Request #166 · marinom2/lightnode

dependabot · 2026-07-23T02:36:23Z

Bumps the production group with 12 updates in the / directory:

Package	From	To
@radix-ui/react-slot	`1.2.4`	`1.3.3`
@reown/appkit	`1.8.20`	`1.8.23`
@reown/appkit-adapter-wagmi	`1.8.20`	`1.8.23`
@stackblitz/sdk	`1.11.0`	`1.11.1`
@tanstack/react-query	`5.100.14`	`5.101.4`
framer-motion	`11.18.2`	`12.43.0`
lucide-react	`0.468.0`	`1.27.0`
next	`15.5.18`	`16.2.12`
react	`19.0.0`	`19.2.8`
react-dom	`19.0.0`	`19.2.8`
tailwind-merge	`2.6.1`	`3.6.0`
wagmi	`2.19.5`	`3.7.4`

Updates @radix-ui/react-slot from 1.2.4 to 1.3.3

Changelog

Sourced from @radix-ui/react-slot's changelog.

1.3.2, 1.3.3

Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.
const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>('Slot');
1.2.5

Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render

Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it

Added repository.directory to all package.json files

Improved error messages for invalid slot children

Updated dependencies: @radix-ui/react-compose-refs@1.1.3

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @radix-ui/react-slot since your current version.

Updates @reown/appkit from 1.8.20 to 1.8.23

Release notes

Sourced from @reown/appkit's releases.

@reown/appkit-siwe@1.8.23

Patch Changes

#5712 f2d2539 Thanks @enesozturk! - Recover Coinbase Wallet from the EIP-1193 4100 ("Must call 'eth_requestAccounts' before other methods") error that could dead-end signing after a session restore.

On an AppKit auto-restore, the Coinbase Wallet SDK provider keeps its accounts but drops its internal authorization — unlike wagmi's own reconnect, AppKit's restore reads eth_accounts without re-issuing eth_requestAccounts. Consumers that call .request() directly on the provider (rather than through wagmi's hooks) then failed the first signing RPC with 4100.

The provider registration seam (syncProvider) now wraps Coinbase eip155 providers — keyed on the connector id, which is stable across the wagmi, ethers, and ethers5 adapters (the provider "type" is remapped to 'EXTERNAL' on most paths, so it can't be used to detect Coinbase). A 4100 then triggers a one-shot recovery: a single eth_requestAccounts re-authorization, an active-chain re-assert before an eth_sendTransaction retry (so the transaction can't broadcast on the wrong network after the handshake resets the SDK's chain), then exactly one retry. Non-4100 errors, rejected re-auth prompts, and non-Coinbase providers are unaffected. The wrapper is cached per provider instance so consumers keep a stable reference.

#5665 e5ee43c Thanks @Khizr97! - Fix coinbasePreference option being ignored — 'all' and 'eoaOnly' now correctly use the coinbaseWallet connector (with QR code support) instead of always using baseAccount. 'smartWalletOnly' uses baseAccount. Regression introduced in PR #5269.

#5663 da65c78 Thanks @Khizr97! - fix(ethers,ethers5): resolve walletProvider after account switch in modal

useAppKitProvider returned a stale provider when switching accounts inside the modal. In the early-return path of connect(), connector.provider was never initialised, causing the base-client's accountChanged handler to skip syncProvider(). The provider is now resolved from ethersProviders before the event is emitted.

#5706 ccf0dcb Thanks @ignaciosantise! - fix: persist the universal-link base as the WalletConnect deeplink choice when experimental_preferUniversalLinks is enabled, so session-request re-opens (handled by universal-provider) use the wallet's universal link instead of falling back to its native custom scheme

Updated dependencies [f2d2539, e5ee43c, da65c78, ccf0dcb]:

@reown/appkit-utils@1.8.23

@reown/appkit-common@1.8.23

@reown/appkit-ui@1.8.23

@reown/appkit-wallet@1.8.23

@reown/appkit-controllers@1.8.23

@reown/appkit-scaffold-ui@1.8.23

Patch Changes

#5712 f2d2539 Thanks @enesozturk! - Recover Coinbase Wallet from the EIP-1193 4100 ("Must call 'eth_requestAccounts' before other methods") error that could dead-end signing after a session restore.

On an AppKit auto-restore, the Coinbase Wallet SDK provider keeps its accounts but drops its internal authorization — unlike wagmi's own reconnect, AppKit's restore reads eth_accounts without re-issuing eth_requestAccounts. Consumers that call .request() directly on the provider (rather than through wagmi's hooks) then failed the first signing RPC with 4100.

The provider registration seam (syncProvider) now wraps Coinbase eip155 providers — keyed on the connector id, which is stable across the wagmi, ethers, and ethers5 adapters (the provider "type" is remapped to 'EXTERNAL' on most paths, so it can't be used to detect Coinbase). A 4100 then triggers a one-shot recovery: a single eth_requestAccounts re-authorization, an active-chain re-assert before an eth_sendTransaction retry (so the transaction can't broadcast on the wrong network after the handshake resets the SDK's chain), then exactly one retry. Non-4100 errors, rejected re-auth prompts, and non-Coinbase providers are unaffected. The wrapper is cached per provider instance so consumers keep a stable reference.

#5665 e5ee43c Thanks @Khizr97! - Fix coinbasePreference option being ignored — 'all' and 'eoaOnly' now correctly use the coinbaseWallet connector (with QR code support) instead of always using baseAccount. 'smartWalletOnly' uses baseAccount. Regression introduced in PR #5269.

#5663 da65c78 Thanks @Khizr97! - fix(ethers,ethers5): resolve walletProvider after account switch in modal

useAppKitProvider returned a stale provider when switching accounts inside the modal. In the early-return path of connect(), connector.provider was never initialised, causing the base-client's accountChanged handler to skip syncProvider(). The provider is now resolved from ethersProviders before the event is emitted.

#5706 ccf0dcb Thanks @ignaciosantise! - fix: persist the universal-link base as the WalletConnect deeplink choice when experimental_preferUniversalLinks is enabled, so session-request re-opens (handled by universal-provider) use the wallet's universal link instead of falling back to its native custom scheme

Updated dependencies [f2d2539, e5ee43c, da65c78, ccf0dcb]:

... (truncated)

Commits

a211396 chore: version packages (#5714)
f2d2539 fix(controllers): recover Coinbase 4100 unauthorized signing at the provider ...
da65c78 fix(ethers,ethers5): resolve walletProvider after account switch in modal (#5...
e5ee43c fix(wagmi): respect coinbasePreference when selecting Coinbase connector (#5665)
ccf0dcb fix: honor experimental_preferUniversalLinks on session-request re-opens (#5706)
a9d9c6c feat(siwx): tron verifier (#5688)
a409474 Release (#5705)
fb09a6d feat(appkit): expose headless resetWalletConnectUri + resetConnectingWallet (...
6b9c313 feat(controllers): expose WalletConnect URI on public state for headless QR (...
a4b2d2f feat: expose headless wallet list imperatively on the AppKit client (#5695)
Additional commits viewable in compare view

Updates @reown/appkit-adapter-wagmi from 1.8.20 to 1.8.23

Release notes

Sourced from @reown/appkit-adapter-wagmi's releases.

@reown/appkit-adapter-wagmi@1.8.23

Patch Changes

#5712 f2d2539 Thanks @enesozturk! - Recover Coinbase Wallet from the EIP-1193 4100 ("Must call 'eth_requestAccounts' before other methods") error that could dead-end signing after a session restore.

On an AppKit auto-restore, the Coinbase Wallet SDK provider keeps its accounts but drops its internal authorization — unlike wagmi's own reconnect, AppKit's restore reads eth_accounts without re-issuing eth_requestAccounts. Consumers that call .request() directly on the provider (rather than through wagmi's hooks) then failed the first signing RPC with 4100.

The provider registration seam (syncProvider) now wraps Coinbase eip155 providers — keyed on the connector id, which is stable across the wagmi, ethers, and ethers5 adapters (the provider "type" is remapped to 'EXTERNAL' on most paths, so it can't be used to detect Coinbase). A 4100 then triggers a one-shot recovery: a single eth_requestAccounts re-authorization, an active-chain re-assert before an eth_sendTransaction retry (so the transaction can't broadcast on the wrong network after the handshake resets the SDK's chain), then exactly one retry. Non-4100 errors, rejected re-auth prompts, and non-Coinbase providers are unaffected. The wrapper is cached per provider instance so consumers keep a stable reference.

#5665 e5ee43c Thanks @Khizr97! - Fix coinbasePreference option being ignored — 'all' and 'eoaOnly' now correctly use the coinbaseWallet connector (with QR code support) instead of always using baseAccount. 'smartWalletOnly' uses baseAccount. Regression introduced in PR #5269.

#5663 da65c78 Thanks @Khizr97! - fix(ethers,ethers5): resolve walletProvider after account switch in modal

useAppKitProvider returned a stale provider when switching accounts inside the modal. In the early-return path of connect(), connector.provider was never initialised, causing the base-client's accountChanged handler to skip syncProvider(). The provider is now resolved from ethersProviders before the event is emitted.

#5706 ccf0dcb Thanks @ignaciosantise! - fix: persist the universal-link base as the WalletConnect deeplink choice when experimental_preferUniversalLinks is enabled, so session-request re-opens (handled by universal-provider) use the wallet's universal link instead of falling back to its native custom scheme

Updated dependencies [f2d2539, e5ee43c, da65c78, ccf0dcb]:

@reown/appkit-utils@1.8.23

@reown/appkit@1.8.23

@reown/appkit-common@1.8.23

@reown/appkit-polyfills@1.8.23

@reown/appkit-scaffold-ui@1.8.23

@reown/appkit-wallet@1.8.23

@reown/appkit-controllers@1.8.23

@reown/appkit-adapter-wagmi@1.8.22

Patch Changes

#5697 6b9c313 Thanks @enesozturk! - Add a headless read for the WalletConnect URI, so a host can render a QR without the useAppKitWallets React hook.

The AppKit instance now exposes getWalletConnectUri() — returning { wcUri, wcError, wcFetchingUri } — and subscribeWalletConnectUri(). Both read the connection layer directly (mirroring the existing getWalletList() / subscribeWalletList() pair), so a headless host gets the URI ungated through the instance without importing @reown/appkit-controllers (which can otherwise resolve to a different valtio singleton). This replaces the connection-level subscribeConnections, which is gated behind the multiWallet remote feature and so can't serve the URI for a single-wallet QR.

Breaking: the imperative pre-fetch trigger previously named getWalletConnectUri() is renamed to prefetchWalletConnectUri(), freeing getWalletConnectUri() for the new read.

#5701 fb09a6d Thanks @enesozturk! - Add headless reset methods for the WalletConnect URI + connecting-wallet state.

The AppKit instance now exposes resetWalletConnectUri() and resetConnectingWallet() — thin passthroughs to HeadlessWalletUtil.resetWcUri() / resetConnectingWallet(). A headless host that reads the URI via getWalletConnectUri() can now clear it (e.g. when a QR is dismissed or a connection is cancelled) through the instance, without importing @reown/appkit-controllers. This completes the headless WalletConnect-URI surface alongside getWalletConnectUri / subscribeWalletConnectUri / prefetchWalletConnectUri.

#5695 a4b2d2f Thanks @enesozturk! - Expose the headless wallet list imperatively on the AppKit client, so a non-React host can list / search / connect wallets without the useAppKitWallets React hook.

New AppKit instance methods: fetchWallets(options?), getWalletList(), subscribeWalletList(cb), getWalletConnectUri(options?), and connectWallet(wallet, namespace?, options?). The shared imperative logic lives in a new HeadlessWalletUtil (@reown/appkit-controllers), which both the client methods and the React hook can use — one tested code path for headless wallet listing, search, pagination, the WalletConnect URI, and programmatic connect (injected / API / mobile-deeplink).

#5694 1c17897 Thanks @enesozturk! - Fixed TRON tron_signTransaction payload shape to respect the wallet's tron_method_version session property. The connector now sends the spec-mandated legacy nested transaction.transaction shape by default, and the simplified flat shape only when the wallet advertises tron_method_version: "v1" in sessionProperties.

Updated dependencies [6b9c313, fb09a6d, a4b2d2f, 1c17897]:

... (truncated)

Commits

a211396 chore: version packages (#5714)
f2d2539 fix(controllers): recover Coinbase 4100 unauthorized signing at the provider ...
da65c78 fix(ethers,ethers5): resolve walletProvider after account switch in modal (#5...
e5ee43c fix(wagmi): respect coinbasePreference when selecting Coinbase connector (#5665)
ccf0dcb fix: honor experimental_preferUniversalLinks on session-request re-opens (#5706)
a9d9c6c feat(siwx): tron verifier (#5688)
a409474 Release (#5705)
fb09a6d feat(appkit): expose headless resetWalletConnectUri + resetConnectingWallet (...
6b9c313 feat(controllers): expose WalletConnect URI on public state for headless QR (...
a4b2d2f feat: expose headless wallet list imperatively on the AppKit client (#5695)
Additional commits viewable in compare view

Updates @stackblitz/sdk from 1.11.0 to 1.11.1

Changelog

Sourced from @stackblitz/sdk's changelog.

v1.11.1 (2026-07-01)

fix: allow cross-origin-isolation for the run endpoint (stackblitz/sdk#39)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by d3lm, a new releaser for @stackblitz/sdk since your current version.

Updates @tanstack/react-query from 5.100.14 to 5.101.4

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.101.4

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.101.4

@tanstack/react-query@5.101.4

@tanstack/react-query-next-experimental@5.101.4

Patch Changes

Updated dependencies []:

@tanstack/react-query@5.101.4

@tanstack/react-query-persist-client@5.101.4

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.101.4

@tanstack/react-query@5.101.4

@tanstack/react-query@5.101.4

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.4

@tanstack/react-query-devtools@5.101.3

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.101.3

@tanstack/react-query@5.101.3

@tanstack/react-query-next-experimental@5.101.3

Patch Changes

Updated dependencies []:

@tanstack/react-query@5.101.3

@tanstack/react-query-persist-client@5.101.3

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.101.3

@tanstack/react-query@5.101.3

@tanstack/react-query@5.101.3

Patch Changes

Updated dependencies [7e3c822]:

... (truncated)

Changelog

Sourced from @tanstack/react-query's changelog.

5.101.4

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.4

5.101.3

Patch Changes

Updated dependencies [7e3c822]:

@tanstack/query-core@5.101.3

5.101.2

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.2

5.101.1

Patch Changes

Updated dependencies [9eff92e]:

@tanstack/query-core@5.101.1

5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.0

Commits

86bb8a6 ci: Version Packages (#11094)
181ea82 ci: Version Packages (#11089)
6d55b07 test({react,preact}-query): use the '.then()' convention consistently (#11085)
44f38df test({react,preact,solid}-query/useInfiniteQuery): inline the shared 'fetchIt...
d1558c1 test({react,preact}-query/usePrefetchQuery): inline the 'generateQueryFn' fac...
99690d1 test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use helper...
10770f0 test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared 'Suspe...
dbd5a86 test({react,preact}-query/usePrefetchQuery): inline the shared 'Suspended' co...
b955f60 test({react,preact}-query/useSuspenseQuery): assert the 'loading' fallback is...
b9c657e test({react,preact}-query/usePrefetchQuery): assert the 'Loading...' fallback...
Additional commits viewable in compare view

Updates framer-motion from 11.18.2 to 12.43.0

Changelog

Sourced from framer-motion's changelog.

[12.43.0] 2026-07-27

Added

Hardware acceleration for backgroundColor in supported browsers.

Hardware acceleration for SVG elements.

Fixed

AnimatePresence: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.

motion: Throw error when passing a custom motion component an incorrect ref type.

[12.42.2] 2026-07-01

Fixed

animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

animateView: Old layer fade out now cancelled when defining .new().

[12.42.0] 2026-06-24

Changed

animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.

animateView: Disabled automatic border-radius animation.

[12.41.0] 2026-06-23

Added

animateView: Moves from Motion+ Early Access and alpha to main library.

animateView: .add() resolves a CSS selector or Element to automatically generate, apply and remove view-transition-name.

animateView: .new() and .old() configures values to animate on new and old layers.

animateView: .layout() can set a custom transition on the size/position animation of the currently selected elements.

animateView: Group layers now automatically crop with children set to cover, with border-radius animating from old radius to new. .crop(false) disables this behaviour.

animateView: .class(name) tags currently selected elements with a view-transition-class as a custom CSS hook.

Fixed

AnimatePresence: Prevent stuck exit animations when children interrupt.

drag: Child e.stopPropagation() no longer break drag end.

... (truncated)

Commits

a4ef40a v12.43.0
14f2d28 adding svg acceleration
1f5a27b Fixing merge
79f0353 Updating changelog
57f179b Updating changelog
695cb39 Merge pull request #3755 from motiondivision/fix-issue-2777
33a1820 Drop the production fallback for non-DOM refs
ebe35f2 Throw an actionable invariant for non-DOM custom component refs
a6ed094 Merge pull request #3754 from motiondivision/fix-3745-popchild-ref-warning
9f251f3 Merge pull request #3763 from motiondivision/advisor/003-color-waapi
Additional commits viewable in compare view

Updates lucide-react from 0.468.0 to 1.27.0

Release notes

Sourced from lucide-react's releases.

Version 1.27.0

What's Changed

feat(icons): removed brand names from tags & revised brand stopwords by @karsa-mistmere in lucide-icons/lucide#4575

fix(docs): Fix site build by @ericfennis in lucide-icons/lucide#4582

fix(icons): optimised square-scissors icons by @karsa-mistmere in lucide-icons/lucide#4581

fix(packages/angular): add more supported attributes for SVG nodes by @karsa-mistmere in lucide-icons/lucide#4570

feat(icons): added pending-cw icon by @NielsLazaroms in lucide-icons/lucide#4439

fix(icons): changed zap and zap-off icons by @kapowaz in lucide-icons/lucide#4536

feat(icons): add square-off icon by @october-learns in lucide-icons/lucide#4496

chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @dependabot[bot] in lucide-icons/lucide#4572

fix(icons): changed toolbox icon by @karsa-mistmere in lucide-icons/lucide#4571

feat(icons): add scan-square by @samuelalake in lucide-icons/lucide#4550

feat(icons): added user-shield icon by @MArtytraM99 in lucide-icons/lucide#3099

feat(icons): added mosque icon by @iskepr in lucide-icons/lucide#4494

fix(request-review): Remove pull_request_target by @ericfennis in lucide-icons/lucide#4593

fix(icons): changed feather icon by @karsa-mistmere in lucide-icons/lucide#4584

feat(ci): added custom prettier plugin for icon SVG files by @karsa-mistmere in lucide-icons/lucide#4576

ci(ci.yml): Remove concurrency in ci.yml by @ericfennis in lucide-icons/lucide#4595

fix(icons): changed barrel icon by @karsa-mistmere in lucide-icons/lucide#4592

feat(lab): Migrate lab to main repo. by @ericfennis in lucide-icons/lucide#4521

fix(icons): changed trophy icon by @karsa-mistmere in lucide-icons/lucide#4591

feat(analytics): add utm source and medium by @jguddas in lucide-icons/lucide#4596

feat(docs): Add lab requirement in pull_request_template.md by @danielbayley in lucide-icons/lucide#3651

feat(icons): replaces podcast icon with new mic-* icons by @karsa-mistmere in lucide-icons/lucide#4583

feat(icons): add layout-freeform by @samuelalake in lucide-icons/lucide#4543

New Contributors

@NielsLazaroms made their first contribution in lucide-icons/lucide#4439

@kapowaz made their first contribution in lucide-icons/lucide#4536

@october-learns made their first contribution in lucide-icons/lucide#4496

@samuelalake made their first contribution in lucide-icons/lucide#4550

@iskepr made their first contribution in lucide-icons/lucide#4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

fix(docs): fix home page package links & accessible labels by @karsa-mistmere in lucide-icons/lucide#4540

fix(icons): changed columns-3-cog icon by @kamilasw in lucide-icons/lucide#4578

fix(icons): extended metadata of ad icon by @karsa-mistmere in lucide-icons/lucide#4579

fix(icons): changed book-open icons by @karsa-mistmere in lucide-icons/lucide#4565

feat(icons): added shield-keyhole icon by @karsa-mistmere in lucide-icons/lucide#4580

New Contributors

@kamilasw made their first contribution in lucide-icons/lucide#4578

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

Version 1.25.0

What's Changed

... (truncated)

Commits

f229f83 chore(depedencies): Update dependencies (#4553)
5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
07c885e fix(docs): fix zephyr-cloud URL in readmes
50d8af5 docs(readme): Update readme files (#4320)
653e44b feat(packages): use .mjs for ESM bundles (#4285)
7623e23 feat(docs): add Zephyr Cloud to Hero Backers tier & rework updateSponsors scr...
dada0a8 fix(lucide-react): Fix dynamic imports (#4210)
a6e648a fix(lucide-react): correct client directives in RSC files (#4189)
1f010a3 fix(lucide-react): Fixes provider export and RSC render issues (#4175)
484f2c9 docs(version-1): Version 1 website (#4142)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.

Updates next from 15.5.18 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Updates react from 19.0.0 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @gnoff, @lubieowoce, @sebmarkbage, @unstubbable)

19.2.3 (December 11th, 2025)

React Server Components

Add extra loop protection to React Server Functions (@sebmarkbage #35351)

19.2.2 (December 11th, 2025)

React Server Components

Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@eps1lon facebook/react#35290)

Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289, #35345)

19.2.1 (December 3rd, 2025)

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

Type hardening and performance improvements (@eps1lon, @unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

Add more cycle protections (@eps1lon, @unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (@gnoff, @lubieowoce, @sebmarkbage, @unstubbable #35632)

19.2.3 (Dec 11, 2025)

React Server Components

Add extra loop protection to React Server Functions (@s... Description has been truncated

vercel · 2026-07-23T02:36:26Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lightnode	Error		Jul 29, 2026 8:12am

marinom2 · 2026-07-29T07:57:34Z

Not a rubber-stamp merge — this is five major upgrades at once, and two of them need real migration work:

package	change	risk
`next`	15.5 → 16.2	major; also forces the eslint-config-next 16 / eslint 10 pair in #167
`wagmi`	2.19 → 3.7	major; breaking API, and 13 files here import wagmi
`framer-motion`	11 → 12	major
`lucide-react`	0.468 → 1.27	major
`tailwind-merge`	2 → 3	major

The Next bump is also coupled to #167 — they have to land together or lint breaks (see that PR for the detail, and #169 for the grouping fix that prevents the split recurring).

Suggested path: land #169 first, then do this as a deliberate migration on its own branch — Next 15→16 codemod, then the wagmi 2→3 wallet-connection migration verified against a real connect/sign flow, not just a green build. The wallet path is the one place where a passing typecheck proves the least.

Leaving open.

…ates Bumps the production group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.2.4` | `1.3.3` | | [@reown/appkit](https://github.com/reown-com/appkit) | `1.8.20` | `1.8.23` | | [@reown/appkit-adapter-wagmi](https://github.com/reown-com/appkit) | `1.8.20` | `1.8.23` | | [@stackblitz/sdk](https://github.com/stackblitz/sdk) | `1.11.0` | `1.11.1` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.100.14` | `5.101.4` | | [framer-motion](https://github.com/motiondivision/motion) | `11.18.2` | `12.43.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.468.0` | `1.27.0` | | [next](https://github.com/vercel/next.js) | `15.5.18` | `16.2.12` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.0.0` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.0.0` | `19.2.8` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `2.6.1` | `3.6.0` | | [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `2.19.5` | `3.7.4` | Updates `@radix-ui/react-slot` from 1.2.4 to 1.3.3 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `@reown/appkit` from 1.8.20 to 1.8.23 - [Release notes](https://github.com/reown-com/appkit/releases) - [Commits](https://github.com/reown-com/appkit/compare/@reown/appkit@1.8.20...@reown/appkit@1.8.23) Updates `@reown/appkit-adapter-wagmi` from 1.8.20 to 1.8.23 - [Release notes](https://github.com/reown-com/appkit/releases) - [Commits](https://github.com/reown-com/appkit/compare/@reown/appkit-adapter-wagmi@1.8.20...@reown/appkit-adapter-wagmi@1.8.23) Updates `@stackblitz/sdk` from 1.11.0 to 1.11.1 - [Changelog](https://github.com/stackblitz/sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/stackblitz/sdk/commits) Updates `@tanstack/react-query` from 5.100.14 to 5.101.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query) Updates `framer-motion` from 11.18.2 to 12.43.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v11.18.2...v12.43.0) Updates `lucide-react` from 0.468.0 to 1.27.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react) Updates `next` from 15.5.18 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.18...v16.2.12) Updates `react` from 19.0.0 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.0.0 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `tailwind-merge` from 2.6.1 to 3.6.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](dcastil/tailwind-merge@v2.6.1...v3.6.0) Updates `wagmi` from 2.19.5 to 3.7.4 - [Release notes](https://github.com/wevm/wagmi/releases) - [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/wevm/wagmi/commits/wagmi@3.7.4/packages/react) --- updated-dependencies: - dependency-name: "@radix-ui/react-slot" dependency-version: 1.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@reown/appkit" dependency-version: 1.8.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@reown/appkit-adapter-wagmi" dependency-version: 1.8.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@stackblitz/sdk" dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@tanstack/react-query" dependency-version: 5.101.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: framer-motion dependency-version: 12.42.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: lucide-react dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: tailwind-merge dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: wagmi dependency-version: 3.7.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

marinom2 · 2026-07-29T08:48:55Z

Closing, for two reasons.

It blocks the fix. This PR was opened before #170 landed the dependabot grouping, and it holds the next 15 → 16 bump. Dependabot won't propose the same upgrade twice, so while this sits open it prevents next from joining the nextjs-toolchain group — which is exactly why #172 came through as the broken half-upgrade again. Closing both lets the next run produce one coherent PR.

It isn't a merge, it's a migration. Five majors at once: next 15→16, wagmi 2→3 (breaking, and 13 files import it), framer-motion 11→12, lucide-react 0.468→1.27, tailwind-merge 2→3. The wagmi bump alone rewrites the wallet connection path, which is the one area where a green typecheck proves least — it needs a real connect-and-sign check, not just CI.

Worth doing deliberately on its own branch, with the Next codemod and a manual wallet pass. Not by merging a bot PR.

dependabot · 2026-07-29T08:48:58Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026

vercel Bot had a problem deploying to Preview July 23, 2026 02:36 Failure

dependabot Bot changed the title ~~chore(deps): bump the production group with 12 updates~~ chore(deps): bump the production group across 1 directory with 12 updates Jul 29, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-39dc3f59a7 branch from 48cce4c to a18fb0a Compare July 29, 2026 07:26

vercel Bot had a problem deploying to Preview July 29, 2026 07:26 Failure

marinom2 mentioned this pull request Jul 29, 2026

chore(deps-dev): bump the development group across 1 directory with 7 updates #167

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-39dc3f59a7 branch from a18fb0a to 1f85a7b Compare July 29, 2026 08:11

vercel Bot had a problem deploying to Preview July 29, 2026 08:12 Failure

marinom2 mentioned this pull request Jul 29, 2026

chore(deps-dev): bump the nextjs-toolchain group with 2 updates #172

Closed

marinom2 closed this Jul 29, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-39dc3f59a7 branch July 29, 2026 08:49

Navigation Menu

chore(deps): bump the production group across 1 directory with 12 updates - #166

chore(deps): bump the production group across 1 directory with 12 updates#166
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-39dc3f59a7

dependabot Bot commented on behalf of github Jul 23, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

marinom2 commented Jul 29, 2026

Uh oh!

marinom2 commented Jul 29, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.3.2, 1.3.3

1.3.1

1.3.0

Added generic type arguments for SlotProps and createSlot

1.2.5

@​reown/appkit-siwe@​1.8.23

Patch Changes

@​reown/appkit-scaffold-ui@​1.8.23

Patch Changes

@​reown/appkit-adapter-wagmi@​1.8.23

Patch Changes

@​reown/appkit-adapter-wagmi@​1.8.22

Patch Changes

v1.11.1 (2026-07-01)

@​tanstack/react-query-devtools@​5.101.4

Patch Changes

@​tanstack/react-query-next-experimental@​5.101.4

Patch Changes

@​tanstack/react-query-persist-client@​5.101.4

Patch Changes

@​tanstack/react-query@​5.101.4

Patch Changes

@​tanstack/react-query-devtools@​5.101.3

Patch Changes

@​tanstack/react-query-next-experimental@​5.101.3

Patch Changes

@​tanstack/react-query-persist-client@​5.101.3

Patch Changes

@​tanstack/react-query@​5.101.3

Patch Changes

5.101.4

Patch Changes

5.101.3

Patch Changes

5.101.2

Patch Changes

5.101.1

Patch Changes

5.101.0

Patch Changes

[12.43.0] 2026-07-27

Added

Fixed

[12.42.2] 2026-07-01

Fixed

[12.42.1] 2026-06-30

Fixed

[12.42.0] 2026-06-24

Changed

Fixed

[12.41.0] 2026-06-23

Added

Fixed

Version 1.27.0

What's Changed

New Contributors

Version 1.26.0

What's Changed

New Contributors

Version 1.25.0

What's Changed

v16.2.12

What's Changed

v16.2.11

v16.2.10

v16.2.9

v16.2.8

v16.2.7

Core Changes

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

dependabot Bot commented on behalf of github Jul 23, 2026 •

edited

Loading

Added generic type arguments for `SlotProps` and `createSlot`

`@reown/appkit-siwe@1`.8.23

`@reown/appkit-scaffold-ui@1`.8.23

`@reown/appkit-adapter-wagmi@1`.8.23

`@reown/appkit-adapter-wagmi@1`.8.22

`@tanstack/react-query-devtools@5`.101.4

`@tanstack/react-query-next-experimental@5`.101.4

`@tanstack/react-query-persist-client@5`.101.4

`@tanstack/react-query@5`.101.4

`@tanstack/react-query-devtools@5`.101.3

`@tanstack/react-query-next-experimental@5`.101.3

`@tanstack/react-query-persist-client@5`.101.3

`@tanstack/react-query@5`.101.3

vercel Bot commented Jul 23, 2026 •

edited

Loading