Skip to content

chore(deps): bump the production-minor group with 14 updates - #873

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-87117e9c7c
Open

chore(deps): bump the production-minor group with 14 updates#873
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-87117e9c7c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor group with 14 updates:

Package From To
@cloudflare/workers-oauth-provider 0.8.3 0.10.2
lucide-react 1.28.0 1.30.0
next 16.2.12 16.3.0
pg 8.22.0 8.23.0
react 19.2.7 19.2.8
postal-mime 2.7.5 2.7.6
@sigstore/verify 4.1.0 4.1.2
ws 8.21.1 8.21.3
@remotion/bundler 4.0.503 4.0.507
@remotion/cli 4.0.503 4.0.507
@remotion/google-fonts 4.0.503 4.0.507
@remotion/renderer 4.0.503 4.0.507
@remotion/tailwind-v4 4.0.503 4.0.507
remotion 4.0.503 4.0.507

Updates @cloudflare/workers-oauth-provider from 0.8.3 to 0.10.2

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

v0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

v0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

v0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

v0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch CimdFetchError to restore the old behavior.

  • #259 71ec864 Thanks @​mattzcarey! - Enable RFC 9207 authorization response issuer identification. Authorization server metadata advertises support, parsed requests carry the expected issuer for application-owned terminal error responses, and successful code and implicit redirects include iss.

  • #255 5cc336c Thanks @​mattzcarey! - Validate protected resource metadata at construction time. Reject empty or invalid authorization server issuer lists, invalid resource and scope values, and bearer presentation methods the provider does not implement instead of publishing unusable or misleading RFC 9728 metadata.

... (truncated)

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch

... (truncated)

Commits

Updates lucide-react from 1.28.0 to 1.30.0

Release notes

Sourced from lucide-react's releases.

Version 1.30.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.29.0...1.30.0

Version 1.29.0

What's Changed

Full Changelog: lucide-icons/lucide@1.28.0...1.29.0

Commits

Updates next from 16.2.12 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates postal-mime from 2.7.5 to 2.7.6

Release notes

Sourced from postal-mime's releases.

v2.7.6

2.7.6 (2026-08-07)

Bug Fixes

  • bound inline message/rfc822 recursion and validate limit options (94e2a3c)

Performance Improvements

  • release MIME node content decoder after finalize (4d52365)
Changelog

Sourced from postal-mime's changelog.

2.7.6 (2026-08-07)

Bug Fixes

  • bound inline message/rfc822 recursion and validate limit options (94e2a3c)

Performance Improvements

  • release MIME node content decoder after finalize (4d52365)
Commits
  • 8ad4849 chore(master): release 2.7.6 (#93)
  • bacd050 chore: migrate to ESLint 10 flat config
  • 94e2a3c fix: bound inline message/rfc822 recursion and validate limit options
  • 4d52365 perf: release MIME node content decoder after finalize
  • 092c564 chore: bump devDependencies and fix tooling config
  • See full diff in compare view

Updates @sigstore/verify from 4.1.0 to 4.1.2

Release notes

Sourced from @​sigstore/verify's releases.

@​sigstore/verify@​4.1.2

Patch Changes

  • e66d99f: harden pre-signature checkpoint parsing

@​sigstore/verify@​4.1.1

Patch Changes

  • adbe253: Deduplicate transparency-log entries before counting them toward tlogThreshold, so repeated copies of a single entry no longer over-count. This matches the existing duplicate checks for timestamps and SCTs in the same verifier.
Commits

Updates ws from 8.21.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).
Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • See full diff in compare view

Updates @remotion/bundler from 4.0.503 to 4.0.507

Release notes

Sourced from @​remotion/bundler's releases.

v4.0.507

What's Changed

Docs

... (truncated)

Commits
  • 6b956da v4.0.507
  • cb0402c @remotion/canvas-capture-extension: Improve high-resolution recording (#10249)
  • 64aba6c @remotion/renderer: If a license key is set in Studio, pass it to renderMed...
  • a491b48 Docs: Update website navigation and footer (#10246)
  • 3d708ba Skills: Add Cursor Agent Plugin (#10245)
  • 6fd56b3 @remotion/studio: Lazily measure selected outlines (#10241)
  • 70c2e83 @remotion/studio-server: Reuse AST across sequence prop subscriptions (#10243)
  • 0ecb4fe @remotion/media: Scope caches to individual renders (#10240)
  • 9cd70a4 Skills: Clarify that Img is interactive (#10244)
  • d8d2ffc @remotion/studio: Collapse timeline tracks by default (#10242)
  • Additional commits viewable in compare view

Updates @remotion/cli from 4.0.503 to 4.0.507

Release notes

Sourced from @​remotion/cli's releases.

v4.0.507

What's Changed

@dependabot
chore(deps): bump the production-minor group with 14 updates
afc1404 
Bumps the production-minor group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.8.3` | `0.10.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.30.0` |
| [next](https://github.com/vercel/next.js) | `16.2.12` | `16.3.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [postal-mime](https://github.com/postalsys/postal-mime) | `2.7.5` | `2.7.6` |
| [@sigstore/verify](https://github.com/sigstore/sigstore-js) | `4.1.0` | `4.1.2` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [@remotion/bundler](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.507` |
| [@remotion/cli](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.507` |
| [@remotion/google-fonts](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.507` |
| [@remotion/renderer](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.507` |
| [@remotion/tailwind-v4](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.507` |
| [remotion](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.507` |


Updates `@cloudflare/workers-oauth-provider` from 0.8.3 to 0.10.2
- [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases)
- [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md)
- [Commits](cloudflare/workers-oauth-provider@v0.8.3...v0.10.2)

Updates `lucide-react` from 1.28.0 to 1.30.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.30.0/packages/lucide-react)

Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.0)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `postal-mime` from 2.7.5 to 2.7.6
- [Release notes](https://github.com/postalsys/postal-mime/releases)
- [Changelog](https://github.com/postalsys/postal-mime/blob/master/CHANGELOG.md)
- [Commits](postalsys/postal-mime@v2.7.5...v2.7.6)

Updates `@sigstore/verify` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/verify@4.1.0...@sigstore/verify@4.1.2)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `@remotion/bundler` from 4.0.503 to 4.0.507
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.507)

Updates `@remotion/cli` from 4.0.503 to 4.0.507
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.507)

Updates `@remotion/google-fonts` from 4.0.503 to 4.0.507
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.507)

Updates `@remotion/renderer` from 4.0.503 to 4.0.507
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.507)

Updates `@remotion/tailwind-v4` from 4.0.503 to 4.0.507
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.507)

Updates `remotion` from 4.0.503 to 4.0.507
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.507)

---
updated-dependencies:
- dependency-name: "@cloudflare/workers-oauth-provider"
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: lucide-react
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: postal-mime
  dependency-version: 2.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@sigstore/verify"
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/bundler"
  dependency-version: 4.0.507
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/cli"
  dependency-version: 4.0.507
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/google-fonts"
  dependency-version: 4.0.507
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/renderer"
  dependency-version: 4.0.507
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/tailwind-v4"
  dependency-version: 4.0.507
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: remotion
  dependency-version: 4.0.507
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 12, 2026
@dependabot
dependabot Bot requested a review from choraria as a code owner August 12, 2026 03:09
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@choraria choraria Awaiting requested review from choraria choraria is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@choraria choraria

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@choraria