Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 25 updates - #628

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-b7f02ecfa5
Open

build(deps): bump the minor-and-patch group across 1 directory with 25 updates#628
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-b7f02ecfa5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 25 updates in the / directory:

Package From To
@graphql-codegen/cli 7.2.0 7.4.0
@j178/prek 0.4.13 0.5.2
knip 6.32.2 6.35.0
react-doctor 0.9.12 0.9.13
tsx 4.23.12 4.23.13
@cloudflare/sandbox 0.12.6 0.12.9
better-auth 1.6.28 1.7.3
cloudflare 7.0.0 7.1.0
graphql-yoga 5.21.3 5.22.0
hono 4.13.2 4.13.7
xstate 5.32.5 5.32.6
wrangler 4.123.0 4.130.0
@assistant-ui/react 0.15.14 0.15.18
@base-ui/react 1.7.0 1.8.0
@hugeicons/core-free-icons 4.2.3 4.3.2
@hugeicons/react 1.1.9 1.1.10
@lobehub/icons-static-svg 1.94.0 1.95.0
@tanstack/react-query 5.101.4 5.102.8
react-router-dom 7.18.2 7.18.3
streamdown 2.5.0 2.6.0
@types/react-dom 19.2.4 19.2.7
@vitejs/plugin-react 6.0.5 6.1.1
vite 8.2.1 8.2.2
@ag-ui/core 0.0.57 0.0.59
@playwright/test 1.62.1 1.63.0

Updates @graphql-codegen/cli from 7.2.0 to 7.4.0

Changelog

Sourced from @​graphql-codegen/cli's changelog.

7.4.0

Minor Changes

  • #10928 90229a5 Thanks @​eddeee888! - Add contentComparison?: 'cache-first' | 'disk' to control disk-vs-cache write comparison in watch mode.

    In watch mode the CLI caches the hash of the content it last wrote per file and compares new output against that cached hash to skip redundant writes. This assumes generated output is a pure function of the codegen inputs. An output whose content depends on the file's existing content (e.g. a preset that reads the file and rewrites part of it) breaks that assumption: if the file is changed on disk and codegen regenerates content identical to a previous run, the cached hash still matches and the write is skipped, so the on-disk change is never corrected.

    contentComparison: 'disk' opts an output into comparing the generated content against the file on disk instead of the in-memory record of what codegen last wrote, so the file is rewritten when it was changed externally. It can be set:

    • by a preset, on the GenerateOptions it returns from buildGeneratesSection, or
    • on the output config (generates[output].contentComparison) for any output, including plain plugin outputs without a preset.

    When both are present, the preset's value takes precedence. The default, 'cache-first', keeps the existing in-memory-cache behaviour for outputs that are a pure function of their inputs.

Patch Changes

  • #10930 448431a Thanks @​eddeee888! - Fix overwrite being ignored for preset-based generates outputs.

    A generates entry that used a preset and set overwrite (e.g. overwrite: { removeStaleFiles: false }) had that setting silently ignored, so in watch mode its generated files could still be deleted as stale.

    The CLI resolved overwrite per generated file by looking the file's path up in config.generates. That fails for a preset: its generates entry is keyed by the preset's baseOutputDir, not by any generated file's path (and a preset can emit files outside that directory), and the lookup additionally required a plugins key that preset entries don't have. Both cases fell through to the global config.overwrite (default true).

  • Updated dependencies [90229a5, 448431a]:

    • @​graphql-codegen/plugin-helpers@​7.3.0

7.3.1

... (truncated)

Commits
  • 3216e72 chore(release): update monorepo packages versions (#10929)
  • 448431a Fix overwrite being ignored for preset-based generates outputs (#10930)
  • 90229a5 Add contentComparison to allow plugins and presets to configure whether to ...
  • a2e1d5c chore(release): update monorepo packages versions (#10925)
  • 0c8f5ba Implement rolling profiler output for watch mode (#10924)
  • 6aa476a Upcoming Release Changes (#10923)
  • 58cdb31 Add overwrite.updateExistingFiles and overwrite.removeStaleFiles (#10921)
  • See full diff in compare view

Updates @j178/prek from 0.4.13 to 0.5.2

Release notes

Sourced from @​j178/prek's releases.

0.5.2

Release Notes

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

Install prek 0.5.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.2

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

</tr></table>

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.2

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

0.5.1

Released on 2026-09-01.

Enhancements

  • Add --hide-status <passed|failed|skipped> for hook reports (#2644)
  • Add prek init for repository setup (#2636)
  • Apply hook env during environment creation (#2650)
  • Disable error snippets in check-yaml diagnostics (#2664)
  • Show hooks excluded by skip selectors (#2645)
  • Support Pixi for Conda environments (#2667)
  • Support cargo-binstall for Rust CLI dependencies (#2658)
  • Warn about unused keys in user settings (#2665)

Bug fixes

  • Reject unsupported YAML tags in check-yaml (#2656)

Documentation

  • Clarify local hook documentation (#2640)
  • Clarify pre-commit command compatibility (#2635)
  • Document automatic PR fixes with autofix.ci (#2643)
  • Document check-yaml unsafe support (#2632)
  • Improve setup and workflow documentation (#2637)

Other changes

  • Drop low-usage release targets (#2651)
  • Generate a prek manifest JSON schema (#2648)

Contributors

0.5.0

... (truncated)

Commits

Updates knip from 6.32.2 to 6.35.0

Release notes

Sourced from knip's releases.

Release 6.35.0

  • fix: track pnpm workspace override catalogs (#1999) (c6497a18c6534ee914b27bb459d7778a7b93a914) - thanks @​gioboa!
  • fix: track spreads under string-literal keys (#2003) (9ce68ed42a3c22fa4f4711b06d6d80a0e7f2ba13) - thanks @​gioboa!
  • fix: don't flag a tag that suppresses member issues (#2004) (2e7d498cf1e53f0bbad5e16c335c5e1417432ffd) - thanks @​devYRPauli!
  • fix: resolve Nuxt Virtual Component Imports (#2006) (a21f972ed68aaa6d145dd883b4ce4d68c71e6afb) - thanks @​gioboa!
  • Update raw transfer problems doc with low RAM machines (#2014) (31789404cca5a8ba119b4ae97b959b7e2c595345) - thanks @​s-h-a-d-o-w!
  • fix: recognize pnpm stage as built-in (#2015) (aaab35a948b458e3031989c13c13d099fdd6f229) - thanks @​gioboa!
  • fix: support object-form Rstest test environments (#2010) (6c27aab20de5b6d31d71513b016548e74fc494ba) - thanks @​gioboa!
  • fix: honor explicit entry export analysis (#2012) (a092e4075a6a37107c0da05c8e59343d5a7c8fab) - thanks @​gioboa!
  • Document that pnpm.overrides is read from the root manifest only (f69a7f6d4fa2c68f76a9ba91fb876c5963a9e978)
  • Compile source on demand (resolve #1906) (3662c9545e8bb980a5503fdea48ecc6f7e2ad3b3)
  • Update dependency bun to v1.4.2 (#2019) (90b384da25203c07acb9303336622f794d77b575) - thanks @​renovate[bot]!
  • feat: support configuring preprocessors in knip.json (#1920) (16d03f75ae752cb419684868ff14d89b01e84e62) - thanks @​bytedoe!
  • Fix Windows paths in cache persistence and test fixtures (a4c7a93a81e04afde09d7977298b397cee9a68c2)
  • fix: add a fallback to seach for lock file at cwd if its missing at the root level (#2020) (f66c9f1631347f0256f2276748de89b0d8448017) - thanks @​JayaKrishnaNamburu!
  • fix: ignore raw Vite import globs (#2017) (75d56286b41ba3e3b4aad53b603736ec357fac75) - thanks @​gioboa!
  • Edit docs re. cycles issue type/reporter (resolve #2021) (f1e690b5a4d8f2b3d13388aa3a95216b9691becb)
  • Update dependencies (e2bd3fcc2274b52d35adf0eaec2c555d74873433)
  • Resolve Vite public script entries (resolve #2023) (1cc979b7e37a4dcde5e8e9e75a8d79cf663c606e)
  • Add mise plugin (resolve #2001) (db6d8919af4e870432cdda205e6271a166c84645)
  • Add editor severity setting for diagnostics (resolve #1955) (4afbbcf8b16454a1d1c201d50cf8e8bd28d2cb91)

Release 6.34.0

  • fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
  • 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
  • Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
  • Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
  • Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
  • Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
  • fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
  • fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
  • Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
  • Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
  • Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
  • Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

  • Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
  • Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
  • Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
  • Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
  • Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
  • Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
  • fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
  • Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
  • Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
  • Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
  • Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
  • Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
  • Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)

... (truncated)

Commits

Updates react-doctor from 0.9.12 to 0.9.13

Release notes

Sourced from react-doctor's releases.

react-doctor@0.9.13

Patch Changes

  • 28a1a9f Thanks @​aidenybai! - Add bippy as a runtime dependency.

  • #1695 ac87f7d Thanks @​skoshx! - Preserve plugin settings when React Doctor adopts an existing lint config.

  • #1651 ffc2d14 Thanks @​aidenybai! - Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.

  • #1689 1d3e4a6 Thanks @​skoshx! - Use pnpm's strict dependency layout and declare the runtime dependencies that the CLI imports directly.

  • #1646 05ef989 Thanks @​aidenybai! - Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.

    Report standalone Three.js render loops that use requestAnimationFrame instead of the renderer-managed setAnimationLoop API.

    Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.

  • #1714 013f737 Thanks @​aidenybai! - Clean leading npm messages from GitHub Action JSON reports before later steps read them.

  • #1697 0557145 Thanks @​skoshx! - Stop multi-project scans from recommending GitHub Actions when the root workflow is already configured.

  • #1730 adc3a91 Thanks @​skoshx! - Fix rn-no-raw-text false positives in components that return only direct <fbt> or <fbs> elements.

  • #1723 e1d4c51 Thanks @​skoshx! - Prevent rn-no-raw-text reports for <fbt> content passed through verified React Native text wrappers.

  • #1693 4e04921 Thanks @​skoshx! - Show an npm-native recovery command when an incomplete npx installation is missing Ajv meta-schema files.

  • #1734 025d69d Thanks @​skoshx! - Fix js-set-map-lookups false positives for substring checks on values returned by the global String constructor.

  • #1725 0f59a3b Thanks @​aidenybai! - Run test-noise rules in ambiguous product-named directories such as tools, demo, and migrations when they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.

  • #1688 72a4f46 Thanks @​skoshx! - Make generated GitHub workflows explain how to pin the action to an immutable commit SHA.

  • #1663 2b0f06e Thanks @​aidenybai! - Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.

  • #1650 0b670aa Thanks @​aidenybai! - Run installed Claude Code and Cursor hooks once at the end of an agent turn, include untracked files in the changed-file scan, and migrate existing per-tool React Doctor hooks automatically.

  • #1746 ca30808 Thanks @​aidenybai! - Accept source file paths as positional CLI arguments.

  • #1624 8c2f03a Thanks @​aidenybai! - Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.

  • #1653 1971506 Thanks @​aidenybai! - Add an interactive URL scan and /performance skill that record Chrome DevTools traces, flash live component render outlines, and return agent-readable React performance context.

  • #1654 6416370 Thanks @​aidenybai! - Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcn from components.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-only data-[selected]: / data-[disabled]: Tailwind variants on command items are reported because cmdk renders both attributes as "true" or "false". TanStack Form submit handlers that call the form's handleSubmit without event.preventDefault() are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the root without the list part are reported for shadcn, Radix, and Base UI; the existing shadcn-tabs-trigger-requires-list rule is now enabled by default for shadcn projects through the capability gate and no longer risks false positives on extracted trigger subcomponents. React Aria Dialogs without a Heading or aria-label are reported as unnamed. TanStack Table data/columns options that provably get a new array identity every render (inline literals, render-scoped const arrays, fresh ?? [] fallbacks, inline .filter()/.map() transforms) are reported for rebuilding row and column models each render and looping auto-reset features, and elements measured by TanStack Virtual's measureElement without a data-index attribute are reported because the virtualizer drops the measurement.

  • #1743 6f3dd03 Thanks @​aidenybai! - Normalize Oxlint file URLs before applying ignore patterns and writing report-relative diagnostic paths.

  • Updated dependencies [ffc2d14, f7efb7d, 05ef989, a04b933, adc3a91, 2c4560f, e1d4c51, 905607f, 17eeeb5, afa1780, 025d69d, 0f59a3b, 5bc88ae, 4bf7aff, bd08406, 2b0f06e, 8c2f03a, 6416370, 28d4343]:

    • oxlint-plugin-react-doctor@0.9.13
Changelog

Sourced from react-doctor's changelog.

0.9.13

Patch Changes

  • 28a1a9f Thanks @​aidenybai! - Add bippy as a runtime dependency.

  • #1695 ac87f7d Thanks @​skoshx! - Preserve plugin settings when React Doctor adopts an existing lint config.

  • #1651 ffc2d14 Thanks @​aidenybai! - Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.

  • #1689 1d3e4a6 Thanks @​skoshx! - Use pnpm's strict dependency layout and declare the runtime dependencies that the CLI imports directly.

  • #1646 05ef989 Thanks @​aidenybai! - Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.

    Report standalone Three.js render loops that use requestAnimationFrame instead of the renderer-managed setAnimationLoop API.

    Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.

  • #1714 013f737 Thanks @​aidenybai! - Clean leading npm messages from GitHub Action JSON reports before later steps read them.

  • #1697 0557145 Thanks @​skoshx! - Stop multi-project scans from recommending GitHub Actions when the root workflow is already configured.

  • #1730 adc3a91 Thanks @​skoshx! - Fix rn-no-raw-text false positives in components that return only direct <fbt> or <fbs> elements.

  • #1723 e1d4c51 Thanks @​skoshx! - Prevent rn-no-raw-text reports for <fbt> content passed through verified React Native text wrappers.

  • #1693 4e04921 Thanks @​skoshx! - Show an npm-native recovery command when an incomplete npx installation is missing Ajv meta-schema files.

  • #1734 025d69d Thanks @​skoshx! - Fix js-set-map-lookups false positives for substring checks on values returned by the global String constructor.

  • #1725 0f59a3b Thanks @​aidenybai! - Run test-noise rules in ambiguous product-named directories such as tools, demo, and migrations when they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.

  • #1688 72a4f46 Thanks @​skoshx! - Make generated GitHub workflows explain how to pin the action to an immutable commit SHA.

  • #1663 2b0f06e Thanks @​aidenybai! - Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.

  • #1650 0b670aa Thanks @​aidenybai! - Run installed Claude Code and Cursor hooks once at the end of an agent turn, include untracked files in the changed-file scan, and migrate existing per-tool React Doctor hooks automatically.

  • #1746 ca30808 Thanks @​aidenybai! - Accept source file paths as positional CLI arguments.

  • #1624 8c2f03a Thanks @​aidenybai! - Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.

  • #1653 1971506 Thanks @​aidenybai! - Add an interactive URL scan and /performance skill that record Chrome DevTools traces, flash live component render outlines, and return agent-readable React performance context.

  • #1654 6416370 Thanks @​aidenybai! - Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcn from components.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-only data-[selected]: / data-[disabled]: Tailwind variants on command items are reported because cmdk renders both attributes as "true" or "false". TanStack Form submit handlers that call the form's handleSubmit without event.preventDefault() are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the root without the list part are reported for shadcn, Radix, and Base UI; the existing shadcn-tabs-trigger-requires-list rule is now enabled by default for shadcn projects through the capability gate and no longer risks false positives on extracted trigger subcomponents. React Aria Dialogs without a Heading or aria-label are reported as unnamed. TanStack Table data/columns options that provably get a new array identity every render (inline literals, render-scoped const arrays, fresh ?? [] fallbacks, inline .filter()/.map() transforms) are reported for rebuilding row and column models each render and looping auto-reset features, and elements measured by TanStack Virtual's measureElement without a data-index attribute are reported because the virtualizer drops the measurement.

  • #1743 6f3dd03 Thanks @​aidenybai! - Normalize Oxlint file URLs before applying ignore patterns and writing report-relative diagnostic paths.

  • Updated dependencies [ffc2d14, f7efb7d, 05ef989, a04b933, adc3a91, 2c4560f, e1d4c51, 905607f, 17eeeb5, afa1780, 025d69d, 0f59a3b, 5bc88ae, 4bf7aff, bd08406, 2b0f06e, 8c2f03a, 6416370, 28d4343]:

    • oxlint-plugin-react-doctor@0.9.13
Commits

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

Commits

Updates @cloudflare/sandbox from 0.12.6 to 0.12.9

Release notes

Sourced from @​cloudflare/sandbox's releases.

@​cloudflare/sandbox@​0.12.9

Patch Changes

  • #877 664d8e3 Thanks @​scuffi! - Allow mounted R2 buckets to open object keys containing spaces, symbols, percent signs, and non-ASCII characters.

@​cloudflare/sandbox@​0.12.8

Patch Changes

  • #879 8534aef Thanks @​scuffi! - Enforce source mount prefixes for server-side copies between R2 bindings.

@​cloudflare/sandbox@​0.12.7

Patch Changes

  • 23a08e4 Thanks @​ghostwriternr! - Ensure stable releases advance npm's latest tag only after all release artifacts pass verification.
Commits

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 2…
78af8db 
…5 updates

Bumps the minor-and-patch group with 25 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@graphql-codegen/cli](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli) | `7.2.0` | `7.4.0` |
| [@j178/prek](https://github.com/j178/prek) | `0.4.13` | `0.5.2` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.32.2` | `6.35.0` |
| [react-doctor](https://github.com/millionco/react-doctor/tree/HEAD/packages/react-doctor) | `0.9.12` | `0.9.13` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |
| [@cloudflare/sandbox](https://github.com/cloudflare/sandbox-sdk) | `0.12.6` | `0.12.9` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.28` | `1.7.3` |
| [cloudflare](https://github.com/cloudflare/cloudflare-typescript) | `7.0.0` | `7.1.0` |
| [graphql-yoga](https://github.com/graphql-hive/graphql-yoga/tree/HEAD/packages/graphql-yoga) | `5.21.3` | `5.22.0` |
| [hono](https://github.com/honojs/hono) | `4.13.2` | `4.13.7` |
| [xstate](https://github.com/statelyai/xstate) | `5.32.5` | `5.32.6` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.123.0` | `4.130.0` |
| [@assistant-ui/react](https://github.com/assistant-ui/assistant-ui/tree/HEAD/packages/react) | `0.15.14` | `0.15.18` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.7.0` | `1.8.0` |
| @hugeicons/core-free-icons | `4.2.3` | `4.3.2` |
| [@hugeicons/react](https://github.com/hugeicons/hugeicons/tree/HEAD/packages/react) | `1.1.9` | `1.1.10` |
| [@lobehub/icons-static-svg](https://github.com/lobehub/lobe-icons) | `1.94.0` | `1.95.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.8` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.2` | `7.18.3` |
| [streamdown](https://github.com/vercel/streamdown/tree/HEAD/packages/streamdown) | `2.5.0` | `2.6.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.7` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |
| [@ag-ui/core](https://github.com/ag-ui-protocol/ag-ui) | `0.0.57` | `0.0.59` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |



Updates `@graphql-codegen/cli` from 7.2.0 to 7.4.0
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/graphql-codegen-cli/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/cli@7.4.0/packages/graphql-codegen-cli)

Updates `@j178/prek` from 0.4.13 to 0.5.2
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.13...v0.5.2)

Updates `knip` from 6.32.2 to 6.35.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.35.0/packages/knip)

Updates `react-doctor` from 0.9.12 to 0.9.13
- [Release notes](https://github.com/millionco/react-doctor/releases)
- [Changelog](https://github.com/millionco/react-doctor/blob/main/packages/react-doctor/CHANGELOG.md)
- [Commits](https://github.com/millionco/react-doctor/commits/react-doctor@0.9.13/packages/react-doctor)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

Updates `@cloudflare/sandbox` from 0.12.6 to 0.12.9
- [Release notes](https://github.com/cloudflare/sandbox-sdk/releases)
- [Changelog](https://github.com/cloudflare/sandbox-sdk/blob/main/docs/RELEASE.md)
- [Commits](https://github.com/cloudflare/sandbox-sdk/compare/@cloudflare/sandbox@0.12.6...@cloudflare/sandbox@0.12.9)

Updates `better-auth` from 1.6.28 to 1.7.3
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.3/packages/better-auth)

Updates `cloudflare` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/cloudflare/cloudflare-typescript/releases)
- [Changelog](https://github.com/cloudflare/cloudflare-typescript/blob/main/CHANGELOG.md)
- [Commits](cloudflare/cloudflare-typescript@v7.0.0...v7.1.0)

Updates `graphql-yoga` from 5.21.3 to 5.22.0
- [Release notes](https://github.com/graphql-hive/graphql-yoga/releases)
- [Changelog](https://github.com/graphql-hive/graphql-yoga/blob/main/packages/graphql-yoga/CHANGELOG.md)
- [Commits](https://github.com/graphql-hive/graphql-yoga/commits/graphql-yoga@5.22.0/packages/graphql-yoga)

Updates `hono` from 4.13.2 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.2...v4.13.7)

Updates `xstate` from 5.32.5 to 5.32.6
- [Release notes](https://github.com/statelyai/xstate/releases)
- [Commits](https://github.com/statelyai/xstate/compare/xstate@5.32.5...xstate@5.32.6)

Updates `wrangler` from 4.123.0 to 4.130.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.130.0/packages/wrangler)

Updates `@assistant-ui/react` from 0.15.14 to 0.15.18
- [Release notes](https://github.com/assistant-ui/assistant-ui/releases)
- [Changelog](https://github.com/assistant-ui/assistant-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/assistant-ui/assistant-ui/commits/@assistant-ui/react@0.15.18/packages/react)

Updates `@base-ui/react` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react)

Updates `@hugeicons/core-free-icons` from 4.2.3 to 4.3.2

Updates `@hugeicons/react` from 1.1.9 to 1.1.10
- [Changelog](https://github.com/hugeicons/hugeicons/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/hugeicons/hugeicons/commits/HEAD/packages/react)

Updates `@lobehub/icons-static-svg` from 1.94.0 to 1.95.0
- [Release notes](https://github.com/lobehub/lobe-icons/releases)
- [Changelog](https://github.com/lobehub/lobe-icons/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lobehub/lobe-icons/compare/@lobehub/icons-static-svg@1.94.0...@lobehub/icons-static-svg@1.95.0)

Updates `@tanstack/react-query` from 5.101.4 to 5.102.8
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query)

Updates `react-router-dom` from 7.18.2 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

Updates `streamdown` from 2.5.0 to 2.6.0
- [Release notes](https://github.com/vercel/streamdown/releases)
- [Changelog](https://github.com/vercel/streamdown/blob/main/packages/streamdown/CHANGELOG.md)
- [Commits](https://github.com/vercel/streamdown/commits/streamdown@2.6.0/packages/streamdown)

Updates `@types/react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `@ag-ui/core` from 0.0.57 to 0.0.59
- [Release notes](https://github.com/ag-ui-protocol/ag-ui/releases)
- [Commits](https://github.com/ag-ui-protocol/ag-ui/compare/@ag-ui/core@0.0.57...@ag-ui/core@0.0.59)

Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

---
updated-dependencies:
- dependency-name: "@graphql-codegen/cli"
  dependency-version: 7.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@j178/prek"
  dependency-version: 0.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: knip
  dependency-version: 6.35.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-doctor
  dependency-version: 0.9.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/sandbox"
  dependency-version: 0.12.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cloudflare
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: graphql-yoga
  dependency-version: 5.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: xstate
  dependency-version: 5.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.130.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@assistant-ui/react"
  dependency-version: 0.15.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@base-ui/react"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@hugeicons/core-free-icons"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@hugeicons/react"
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@lobehub/icons-static-svg"
  dependency-version: 1.95.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: streamdown
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@ag-ui/core"
  dependency-version: 0.0.59
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 12, 2026
@dependabot
dependabot Bot requested a review from Yevanchen as a code owner September 12, 2026 06:46
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 12, 2026
@dependabot
dependabot Bot requested a review from samzong as a code owner September 12, 2026 06:46
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Sep 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Yevanchen Yevanchen Awaiting requested review from Yevanchen Yevanchen is a code owner
@samzong samzong Awaiting requested review from samzong samzong is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants