Skip to content

chore(deps)(deps): Bump the runtime-deps group with 10 updates - #216

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/runtime-deps-3d06a0f368
Closed

chore(deps)(deps): Bump the runtime-deps group with 10 updates#216
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/runtime-deps-3d06a0f368

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the runtime-deps group with 10 updates:

Package From To
tsdown 0.22.12 0.22.14
@aws-sdk/client-s3 3.1087.0 3.1100.0
tar 7.5.21 7.5.22
@prisma/management-api-sdk 1.50.0 1.53.0
jose 6.2.4 6.2.8
better-auth 1.6.24 1.6.25
hono 4.12.31 4.12.34
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
next 16.2.10 16.2.12

Updates tsdown from 0.22.12 to 0.22.14

Release notes

Sourced from tsdown's releases.

v0.22.14

   🚀 Features

  • Add CLI build concurrency option  -  by @​sxzz and Jeroen Zwartepoorte (8a14c)
    View changes on GitHub

v0.22.13

   🚀 Features

  • deps: Support neverBundle: true to externalize all dependencies  -  by @​sxzz (d30a7)

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • ff3bdbd chore: release v0.22.14
  • 8a14c35 feat: add CLI build concurrency option
  • 0525465 docs: add note about cjsDefault only applying to explicit entry modules
  • a3a3551 refactor: fix lint
  • 3dec506 refactor: use native Promise.withResolvers
  • e0266c1 docs: add tsdown users image
  • a733505 refactor: upgrade verkit, simplify version parse
  • e5fe2ca style: format
  • 3e1fc63 chore: release v0.22.13
  • a6c8734 chore: upgrade deps
  • Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1087.0 to 3.1100.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1100.0

3.1100.0(2026-07-31)

Chores
  • add packages-internal to root tsconfig inclusion (#8240) (a0f3fb58)
New Features
  • clients: update client endpoints as of 2026-07-31 (30d44c7e)
  • client-bcm-pricing-calculator: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (edce242c)
  • client-bcm-recommended-actions: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (7bed97ab)
Bug Fixes
  • core/protocols: v2 JSON codec updates and JsonBytesStringAdapter (#8238) (a1001f4b)
Tests

For list of updated packages, view updated-packages.md in assets-3.1100.0.zip

v3.1099.0

3.1099.0(2026-07-30)

Chores
New Features
  • clients: update client endpoints as of 2026-07-30 (e93ec43a)
  • client-pricing-plan-manager: Adds support for Public PricingPlanManager SDK (f5af47b6)
  • client-securityagent: Adds support for providing a branch override when configured integrated repositories (0f5a2dd0)
  • client-iam: Improved IAM Policy Simulator accuracy. Simulator now evaluates SCP conditions and resource scoping, returns explicitDeny for explicit SCP denials, and reports accurate cross-account decisions. (d8cd86e4)
  • client-network-firewall: Adds UPDATING field to Container Association Status (65a8fd3f)
  • client-kafka: Amazon MSK Express brokers now support streaming tables for Apache Iceberg, continuously materializing Apache Kafka topics as Iceberg tables in Amazon S3 Tables. Express brokers also now support data delivery to Amazon S3 general purpose buckets. (16236255)
  • client-lambda: Add Python3.15 (python3.15) and NodeJs 26 (nodejs26.x) support to AWS Lambda (e9cf5069)
  • client-sagemaker: Adds support for g7 family instance types for SageMaker Studio JupyterLab and CodeEditor apps for IAD (us-east-1), PDX (us-west-2), CMH (us-east-2). (5e4ec9ce)
  • client-bedrock-agentcore-control: Adds support for configuring models through the OpenResponses API for custom evaluators. CreateEvaluator and UpdateEvaluator now accept an OpenResponses model configuration for LLM-as-a-Judge evaluations. (9cfbf372)

For list of updated packages, view updated-packages.md in assets-3.1099.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1100.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/client-s3

3.1099.0 (2026-07-30)

Note: Version bump only for package @​aws-sdk/client-s3

3.1098.0 (2026-07-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1097.0 (2026-07-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1096.0 (2026-07-27)

Note: Version bump only for package @​aws-sdk/client-s3

3.1095.0 (2026-07-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1094.0 (2026-07-23)

... (truncated)

Commits

Updates tar from 7.5.21 to 7.5.22

Commits

Updates @prisma/management-api-sdk from 1.50.0 to 1.53.0

Commits

Updates jose from 6.2.4 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

v6.2.6

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

6.2.6 (2026-07-31)

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits
  • 8b768eb chore(release): 6.2.8
  • 1500459 refactor: name the "alg" source in unsupported algorithm failures
  • 714f870 fix: reject a non-string "alg" in EmbeddedJWK
  • 925f3bb refactor: index the JWS and JWE registries without a wrapper
  • 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
  • 514831d chore(deps): bump the actions group with 3 updates
  • 45965db chore: cleanup after release
  • 60b941f chore(release): 6.2.7
  • 90ab09c fix: require own JOSE properties for presence checks
  • 767d7f1 refactor: reduce bundle size
  • Additional commits viewable in compare view

Updates better-auth from 1.6.24 to 1.6.25

Release notes

Sourced from better-auth's releases.

v1.6.25

better-auth

Bug Fixes

  • Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)
  • Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)
  • Fixed $fetch and $store not being exposed on the Solid client (#10444)
  • Fixed internal adapter queries being routed to the wrong table when a built-in table's modelName was set to another table's schema key (e.g. user.modelName = "account").

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​birkskyum, @​jsj, @​krish-vachhani

Full changelog: v1.6.24...v1.6.25

Changelog

Sourced from better-auth's changelog.

1.6.25

Patch Changes

  • #10479 5124c34 Thanks @​krish-vachhani! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.

  • #10444 7439359 Thanks @​birkskyum! - Expose the real $fetch instance and $store atoms from the Solid client instead of resolving them as dynamic API routes.

  • Updated dependencies [0ffd1fb]:

    • @​better-auth/core@​1.6.25
    • @​better-auth/drizzle-adapter@​1.6.25
    • @​better-auth/kysely-adapter@​1.6.25
    • @​better-auth/memory-adapter@​1.6.25
    • @​better-auth/mongo-adapter@​1.6.25
    • @​better-auth/prisma-adapter@​1.6.25
    • @​better-auth/telemetry@​1.6.25
Commits

Updates hono from 4.12.31 to 4.12.34

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates next from 16.2.10 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

Commits
  • 2234717 v16.2.12
  • 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
  • b56eb16 Backport/docs fixes 16.2 - July round (#96031)
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): Bump the runtime-deps group with 10 updates
40e1e60 
Bumps the runtime-deps group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [tsdown](https://github.com/rolldown/tsdown) | `0.22.12` | `0.22.14` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1087.0` | `3.1100.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.21` | `7.5.22` |
| [@prisma/management-api-sdk](https://github.com/prisma/pdp-control-plane/tree/HEAD/packages/management-api-sdk) | `1.50.0` | `1.53.0` |
| [jose](https://github.com/panva/jose) | `6.2.4` | `6.2.8` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.24` | `1.6.25` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.12.34` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [next](https://github.com/vercel/next.js) | `16.2.10` | `16.2.12` |


Updates `tsdown` from 0.22.12 to 0.22.14
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.22.12...v0.22.14)

Updates `@aws-sdk/client-s3` from 3.1087.0 to 3.1100.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1100.0/clients/client-s3)

Updates `tar` from 7.5.21 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.21...v7.5.22)

Updates `@prisma/management-api-sdk` from 1.50.0 to 1.53.0
- [Commits](https://github.com/prisma/pdp-control-plane/commits/HEAD/packages/management-api-sdk)

Updates `jose` from 6.2.4 to 6.2.8
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.4...v6.2.8)

Updates `better-auth` from 1.6.24 to 1.6.25
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.6.25/packages/better-auth)

Updates `hono` from 4.12.31 to 4.12.34
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.12.34)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `next` from 16.2.10 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.10...v16.2.12)

---
updated-dependencies:
- dependency-name: tsdown
  dependency-version: 0.22.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1100.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: "@prisma/management-api-sdk"
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: jose
  dependency-version: 6.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: better-auth
  dependency-version: 1.6.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: hono
  dependency-version: 4.12.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@pkg-pr-new

pkg-pr-new Bot commented Aug 10, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@216

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@216

commit: 40e1e60

@wmadden wmadden closed this Aug 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/main/runtime-deps-3d06a0f368 branch August 10, 2026 12:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wmadden