fix(deps): bump the npm group across 1 directory with 32 updates

[dependabot]

Bumps the npm group with 32 updates in the / directory:

Package	From	To
@simplewebauthn/browser	13.3.0	14.0.0
@simplewebauthn/server	13.3.2	14.0.3
@xyflow/react	12.11.1	12.12.0
argon2	0.44.0	0.45.1
better-sqlite3	12.11.1	13.0.3
drizzle-orm	0.45.2	0.45.3
iron-session	8.0.4	9.0.1
js-yaml	5.4.1	5.4.2
lucide-react	1.22.0	1.48.0
nodemailer	10.0.6	10.0.12
otplib	13.4.1	13.5.0
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
zod	4.4.3	4.6.5
@playwright/test	1.61.1	1.63.0
@semantic-release/changelog	6.0.3	7.0.0
@semantic-release/git	10.0.1	11.0.1
@semantic-release/github	12.0.8	12.0.10
@semantic-release/npm	13.1.5	13.2.0
@tailwindcss/postcss	4.3.2	4.3.3
@types/better-sqlite3	7.6.13	9.6.0
@types/node	26.0.1	26.6.3
@types/nodemailer	8.0.1	8.0.2
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
drizzle-kit	0.31.10	0.31.11
eslint-config-next	16.2.9	16.3.6
semantic-release	25.0.5	25.0.9
tailwindcss	4.3.2	4.3.3
tsx	4.22.4	4.23.15
typescript	6.0.3	7.0.2
vitest	5.0.0	5.0.2

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @​simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @​agektmr)

• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

• [server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

• [server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

• [server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

• [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

• [server] Updated MDS blob signature verification to support more algorithms (#788)
• [server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @​simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)
• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)
• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)
• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)
• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)
• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

• 3e2dc0c Update version to v14.0.0
• 618c0e9 Merge v14.0.0 milestone to master (#792)
• See full diff in compare view

Updates @simplewebauthn/server from 13.3.2 to 14.0.3

Release notes

Sourced from @​simplewebauthn/server's releases.

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

v14.0.1

• [server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @​agektmr)

• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

• [server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

• [server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

• [server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

• [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

... (truncated)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

v14.0.1

Changes:

• [server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

... (truncated)

Commits

• 084e601 Update server version to v14.0.3
• cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
• 7e3c4c4 Kinda makes more sense to do the AKI check first
• 21f99a2 Update server version to v14.0.2
• f03758a Merge commit from fork
• 0bfdc3b Update server version to v14.0.1
• 4831ce2 Fix X.509 parsing to support PQC use in attestation statements (#800)
• 3e2dc0c Update version to v14.0.0
• 618c0e9 Merge v14.0.0 milestone to master (#792)
• 4b189bd Update server version to 13.3.3
• Additional commits viewable in compare view

Updates @xyflow/react from 12.11.1 to 12.12.0

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

@​xyflow/react@​12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

@​xyflow/react@​12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

@​xyflow/react@​12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

@​xyflow/react@​12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

... (truncated)

Changelog

Sourced from @​xyflow/react's changelog.

12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

... (truncated)

Commits

• 8716946 chore(packages): bump
• 9fd41fd chore(packages): bump
• 19f9c2a fix(react/store): reset defaultEdgeOptions
• 2acefb5 fix(react/store): reset functions #5991
• 8f0a5d6 chore(packages): bump
• 286816c chore(packages): bump
• 3319ef4 fix(react): keep minimap bounds at the viewport when all nodes are hidden
• b7186f3 fix(react): minimap still works after reactflow remounts #5971
• d8edc77 Merge pull request #5955 from Jian-Zhang08/fix/minimap-onnodeclick-conditiona...
• 59b1a60 Simplify node click handling in MiniMap component
• Additional commits viewable in compare view

Updates argon2 from 0.44.0 to 0.45.1

Release notes

Sourced from argon2's releases.

v0.45.1

Fixes an issue with v0.45.0 where TypeScript generated types for the hash function as returning Promise<any>

Full Changelog: ranisalt/node-argon2@v0.45.0...v0.45.1

v0.45.0

What's Changed

Drops support for Node 18 and 20 (probably still works, but isn't tested)

• Add comparison with node:crypto and clarify parameter usage in README.md by @​cbodin in ranisalt/node-argon2#491
• Fix compilation on solaris by @​matt-fidd in ranisalt/node-argon2#538

New Contributors

• @​cbodin made their first contribution in ranisalt/node-argon2#491
• @​matt-fidd made their first contribution in ranisalt/node-argon2#538

Full Changelog: ranisalt/node-argon2@v0.44.0...v0.45.0

Commits

• 786de71 fix: hash function generated types
• e2fe33f fix: update Node.js version to latest in publish job
• e27980f fix: revert sync to default in freebsd test
• 3d0a0b4 fix: change npm publish to npm stage publish in release workflow
• c61513f chore: update actions versions
• 2bc0733 fix: revert sync to default in freebsd build
• b012379 chore: update dependencies and devDependencies
• d2edf4e fix(tests): add unicode flag to regex assertions in option tests
• 0eb1db1 Apply npm fixes to package.json
• a09b94e Fix compilation on solaris (#538)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for argon2 since your current version.

Updates better-sqlite3 from 12.11.1 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

• use Ubuntu 22.04-arm by @​neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

• add gypfile option to package.json by @​neoxpert in WiseLibs/better-sqlite3#1505
• Update SQLite to version 3.53.4 by @​JoshuaWise in WiseLibs/better-sqlite3#1506
• validate the parameters of table properly by @​theosotr in WiseLibs/better-sqlite3#1504
• fix: this dependabot configuration does not set a co... in... by @​anupamme in WiseLibs/better-sqlite3#1508
• fixed process aborting from terminating worker threads (WiseLibs/better-sqlite3#1507)

New Contributors

• @​theosotr made their first contribution in WiseLibs/better-sqlite3#1504
• @​anupamme made their first contribution in WiseLibs/better-sqlite3#1508

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

• Refactored codebase to use node-addon-api by @​JoshuaWise in WiseLibs/better-sqlite3#1498
• Added a new db.explain() method, for running EXPLAIN queries without needing to supply bound parameters.
• Added a new preparedStatement.toString() method, for getting the expanded SQL of a prepared statement.
• Fix SqliteError cross-realm and Error.isError compatibility by @​dennismutuku2005 in WiseLibs/better-sqlite3#1473

New Contributors

• @​dennismutuku2005 made their first contribution in WiseLibs/better-sqlite3#1473

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

• Update SQLite to version 3.53.3 by @​JoshuaWise in WiseLibs/better-sqlite3#1492
• Utilize node:20-trixie for Electron v43 and onwards by @​neoxpert in WiseLibs/better-sqlite3#1495

... (truncated)

Commits

• dbc2ea1 13.0.3
• b872585 use Ubuntu 22.04-arm (#1510)
• 569e85a 13.0.2
• df1324b fix: this dependabot configuration does not set a co... in... (#1508)
• b9fbe5f fixed segfault from making calls while worker thread is terminating
• 71707c4 validate the parameters of table properly (#1504)
• 6478c99 Update SQLite to version 3.53.4 (#1506)
• 6d24034 add gypfile option to package.json (#1505)
• ab6232e fixed typo in docs
• 57d751c updated readme
• Additional commits viewable in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates iron-session from 8.0.4 to 9.0.1

Release notes

Sourced from iron-session's releases.

v9.0.1

No code changes. dist/index.js and dist/index.d.ts are byte-for-byte identical to 9.0.0; only the version number differs.

9.0.0 was published from a laptop because CI could not authenticate with npm, so its tarball carries no provenance attestation and cannot be verified against a commit. npm versions are immutable, so that is not fixable after the fact.

9.0.1 is the same code published from CI with provenance, built from a0bd646 by .github/workflows/release.yaml. You can check it yourself:

npm audit signatures

If you are on 9.0.0 and do not care about provenance, there is no reason to upgrade.

v9.0.0

pnpm add iron-session

Needs Node 22.13+ and is ESM-only (require() works on Node 22.13+). Stuck on older Node, or need CommonJS? Stay on iron-session@8.

How to upgrade

Most apps change two things. Both are things v8 got wrong quietly.

- session.lastSeen = new Date();   // v8 sealed this as a string
+ session.lastSeen = Date.now();

const userId = session.user.id;  // empty on a first visit


const userId = session.user?.id;

Nothing else is required:

• getIronSession(req, res, options) and getIronSession(await cookies(), options) both still work. Delete any as any you had on await cookies().
• v9 reads v8 cookies and v8 reads v9 cookies, so a deploy rolls back without signing everyone out.
• Users on pre-v8 cookies (iron-session 6 and older) sign in once more. That format picked its shape from a marker outside the signature, so an attacker could flip it.

Full guide: MIGRATION.md.

What's new

1. Sessions work in Next.js Proxy (middleware), via nextProxyCookies
2. Sessions can be bigger than 4KB, with chunk: true
3. getIronSession(await cookies(), options) typechecks
4. Four bugs that lost sessions or logouts without an error are fixed
5. onUnsealError tells you why a cookie was rejected
6. TypeScript catches reads of a session that may not exist
7. Tested in Chromium, Firefox and WebKit, plus Node 22/24/26, Bun and Deno

... (truncated)

Changelog

Sourced from iron-session's changelog.

9.0.1

No code changes. dist/index.js and dist/index.d.ts are byte-for-byte identical to 9.0.0; only the version number differs.

9.0.0 was published from a laptop because CI could not authenticate with npm, so its tarball carries no provenance attestation and cannot be verified against a commit. That is not fixable after the fact: npm versions are immutable. 9.0.1 is the same code published from CI with provenance, so you can check it was built from this repository at a known commit:

npm audit signatures

If you are on 9.0.0 and do not care about provenance, there is no reason to upgrade.

9.0.0

Install

pnpm add iron-session
pnpm add iron-session@8   # if you are still on Node 20 or need CommonJS

How to upgrade

Requires Node 22.13+, and the package is ESM-only (require() works on Node 22.13+). Two code changes cover most apps:

- session.lastSeen = new Date();   // v8 sealed it as a string
+ session.lastSeen = Date.now();

const userId = session.user.id;  // empty on a first visit


const userId = session.user?.id;

Nothing else is required. getIronSession(req, res, options) and getIronSession(await cookies(), options) both still work, and v9 reads v8 cookies while v8 reads v9 cookies, so a deploy rolls back without signing everyone out. Delete any as any you had on await cookies().

Full guide, including removed APIs: MIGRATION.md.

⚠ BREAKING CHANGES

... (truncated)

Commits

• a0bd646 chore: 9.0.1 (#955)
• c324c1e ci: publish via npm trusted publishing instead of NPM_TOKEN (#954)
• 301faa8 chore: concurrently 10, which drops the vulnerable shell-quote
• 88145a5 Release 9.0.0 (#953)
• 4640b36 fix: soften four v9 guards that broke working code (#952)
• a7c5c12 docs: call it Proxy (middleware), matching what Next 16 calls it
• b23c4b0 ci: release workflow that publishes with provenance
• 22ac051 chore: 9.0.0-beta.0
• 325ce32 test: Playwright suite on Chromium, Firefox and WebKit (#948)
• a5f2c52 Make IronSession<T> properties optional on read (#947)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for iron-session since your current version.

Updates js-yaml from 5.4.1 to 5.4.2

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

Commits

• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• See full diff in compare view

Updates lucide-react from 1.22.0 to 1.48.0

Release notes

Sourced from lucide-react's releases.

Version 1.48.0

What's Changed

• feat(icons): added briefcase-plus icon by @​tylerkade in lucide-icons/lucide#4757
• feat(icons): added square-sparkles icon by @​nananecy in lucide-icons/lucide#3610
• feat(icons): added line-dot-left-horizontal icon by @​nathan-de-pachtere in lucide-icons/lucide#3855
• fix(packages/svelte,solid): fix shared type import...

  Description has been truncated

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml