chore: bump the production-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: @seamless-auth/react, @seamless-auth/types, lucide-react and react-router-dom.

Updates @seamless-auth/react from 0.7.0 to 0.8.0

Release notes

Sourced from @​seamless-auth/react's releases.

v0.8.0

Minor Changes

• 28623e2: Offer a way past passkey registration when another login method is enabled.

  Registration used to end on a screen with one control on it. A user who did not want a passkey, or whose device could not make one, had no way forward: the unsupported branch rendered a message and nothing else, on a screen with no exit. The session already exists by then, since the OTP step that leads here establishes it, so leaving without a passkey was always a legitimate way to finish.

  useLoginMethods reads the instance configuration from the auth server, and the skip only appears when a method other than passkey is enabled. With passkey as the only method a skip would leave a user unable to sign back into the account they just created, so the control is not rendered at all. Unknown counts as unsafe: a failed or in-flight read shows no skip rather than guessing.

  The unsupported-device branch now says which case it is, and offers the same way forward when one exists.

  Login no longer starts from a hardcoded ['passkey', 'magic_link', 'phone_otp']. It uses the methods the instance reports, falling back to the narrower ['passkey', 'magic_link'] that matches the auth server's own defaults. The login response stays authoritative when it carries methods of its own.

  Requires an auth server serving GET /system-config/public, and an adapter that proxies it.

Changelog

Sourced from @​seamless-auth/react's changelog.

0.8.0

Minor Changes

• 28623e2: Offer a way past passkey registration when another login method is enabled.

  Registration used to end on a screen with one control on it. A user who did not want a passkey, or whose device could not make one, had no way forward: the unsupported branch rendered a message and nothing else, on a screen with no exit. The session already exists by then, since the OTP step that leads here establishes it, so leaving without a passkey was always a legitimate way to finish.

  useLoginMethods reads the instance configuration from the auth server, and the skip only appears when a method other than passkey is enabled. With passkey as the only method a skip would leave a user unable to sign back into the account they just created, so the control is not rendered at all. Unknown counts as unsafe: a failed or in-flight read shows no skip rather than guessing.

  The unsupported-device branch now says which case it is, and offers the same way forward when one exists.

  Login no longer starts from a hardcoded ['passkey', 'magic_link', 'phone_otp']. It uses the methods the instance reports, falling back to the narrower ['passkey', 'magic_link'] that matches the auth server's own defaults. The login response stays authoritative when it carries methods of its own.

  Requires an auth server serving GET /system-config/public, and an adapter that proxies it.

Commits

• 79e4ade Version Packages
• c206f29 chore(deps): move onto @​seamless-auth/types 0.5.0
• 28623e2 feat(passkey): let a user finish registration without a passkey
• See full diff in compare view

Updates @seamless-auth/types from 0.4.0 to 0.6.0

Release notes

Sourced from @​seamless-auth/types's releases.

v0.6.0

Minor Changes

• 9eb38cc: RegistrationSuccessSchema.ttl is a number, matching every other ttl in the contract.

  It was z.string(), which described what the auth API sent rather than what the value is. That made it the only ttl in the auth schemas a consumer could not treat like the others, and it had a real consequence: the Fastify adapter passes the value straight to a cookie library that requires an integer, so registration failed there with TypeError: option maxAge is invalid: 300. The Express adapter multiplies it into milliseconds, which coerces the string, so the same response worked.

  This is a breaking contract change, taken as a minor because the package is pre-1.0. It breaks anyone reading RegistrationSuccessResponse['ttl'] as a string, or parsing a registration body that still carries one. The auth API is fixed in the same round to send a number, and @seamless-auth/core parses the value defensively regardless of what arrives.

v0.5.0

Minor Changes

• e39584e: Add PublicSystemConfigResponseSchema, the slice of the system configuration a signed-out client may read.

  It carries loginMethods and nothing else. The sign-in screens in the SDKs currently fall back to a hardcoded list of methods when they have no session, which can advertise a method an instance has turned off. A contract for the configured methods lets a client ask instead of guess, and lets it decide whether declining a passkey during registration would leave the user with no way back in.

  Additive. No existing schema, type, or export changes.

v0.4.1

Patch Changes

• 9ae3092: No contract changes. Schemas, types, and exports are untouched.

  Packaging: the non-test sources under src now ship in the tarball. The published dist has always included declaration maps and source maps, but the sources they pointed at were not in the package, so the maps were dangling. Go to Definition now lands on the actual schema instead of a .d.ts.

  Documentation: the README now carries npm, CI, Node, and license badges, a requirements section that spells out the module resolution the subpath exports need, a conventions section covering the schema and type alias pairing, and sections on versioning, supply chain, and security. SECURITY.md states which versions are supported and what is in scope for this repository.

Changelog

Sourced from @​seamless-auth/types's changelog.

0.6.0

Minor Changes

• 9eb38cc: RegistrationSuccessSchema.ttl is a number, matching every other ttl in the contract.

  It was z.string(), which described what the auth API sent rather than what the value is. That made it the only ttl in the auth schemas a consumer could not treat like the others, and it had a real consequence: the Fastify adapter passes the value straight to a cookie library that requires an integer, so registration failed there with TypeError: option maxAge is invalid: 300. The Express adapter multiplies it into milliseconds, which coerces the string, so the same response worked.

  This is a breaking contract change, taken as a minor because the package is pre-1.0. It breaks anyone reading RegistrationSuccessResponse['ttl'] as a string, or parsing a registration body that still carries one. The auth API is fixed in the same round to send a number, and @seamless-auth/core parses the value defensively regardless of what arrives.

0.5.0

Minor Changes

• e39584e: Add PublicSystemConfigResponseSchema, the slice of the system configuration a signed-out client may read.

  It carries loginMethods and nothing else. The sign-in screens in the SDKs currently fall back to a hardcoded list of methods when they have no session, which can advertise a method an instance has turned off. A contract for the configured methods lets a client ask instead of guess, and lets it decide whether declining a passkey during registration would leave the user with no way back in.

  Additive. No existing schema, type, or export changes.

0.4.1

Patch Changes

• 9ae3092: No contract changes. Schemas, types, and exports are untouched.

  Packaging: the non-test sources under src now ship in the tarball. The published dist has always included declaration maps and source maps, but the sources they pointed at were not in the package, so the maps were dangling. Go to Definition now lands on the actual schema instead of a .d.ts.

  Documentation: the README now carries npm, CI, Node, and license badges, a requirements section that spells out the module resolution the subpath exports need, a conventions section covering the schema and type alias pairing, and sections on versioning, supply chain, and security. SECURITY.md states which versions are supported and what is in scope for this repository.

Commits

• cd29efc Merge pull request #28 from fells-code/changeset-release/main
• 409c6d2 Version Packages
• dbee1a4 Merge pull request #27 from fells-code/fix/registration-ttl-is-a-number
• 9eb38cc fix(auth): type the registration ttl as a number
• e964687 Merge pull request #26 from fells-code/chore/pin-prettier
• e49b4d3 chore(deps): pin prettier to an exact version
• 5490a9a Merge pull request #25 from fells-code/changeset-release/main
• 9788cef Version Packages
• da1c8ca Merge pull request #23 from fells-code/feat/public-system-config-schema
• 7ca3f4c Merge pull request #24 from fells-code/fix/exclude-issue-templates-from-prettier
• Additional commits viewable in compare view

Updates lucide-react from 1.27.0 to 1.29.0

Release notes

Sourced from lucide-react's releases.

Version 1.29.0

What's Changed

• fix(@​lucide/lab): Fix lab build by @​ericfennis in lucide-icons/lucide#4618
• feat(copilot): remove incorrect spaces clause from copilot instructions by @​karsa-mistmere in lucide-icons/lucide#4623
• feat(docs): remove Super and Noodle from showcase by @​karsa-mistmere in lucide-icons/lucide#4626
• chore(deps-dev): bump @​angular/platform-server from 21.2.18 to 21.2.19 by @​dependabot[bot] in lucide-icons/lucide#4629
• ci(security): improve security with adding permissions by @​ericfennis in lucide-icons/lucide#4619
• feat(dependabot): added dependabot config, grouping PRs for each package by @​karsa-mistmere in lucide-icons/lucide#4633
• fix(ci): limit certain github workflows to main repository by @​karsa-mistmere in lucide-icons/lucide#4628
• fix(dependabot): Revert dependabot groups by @​ericfennis in lucide-icons/lucide#4665
• chore(dependabot): Group by dependency group by @​ericfennis in lucide-icons/lucide#4666
• chore(deps-dev): bump the svelte-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4671
• chore(deps): bump the vue-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4670
• chore(deps): bump the github-actions group with 13 updates by @​dependabot[bot] in lucide-icons/lucide#4668
• feat(icons): added layer reordering icons by @​karsa-mistmere in lucide-icons/lucide#4617

Full Changelog: lucide-icons/lucide@1.28.0...1.29.0

Version 1.28.0

What's Changed

• feat(icons): improve calendar icons centre of gravity by @​karsa-mistmere in lucide-icons/lucide#4614

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

Commits

• See full diff in compare view

Updates react-router-dom from 7.18.1 to 7.18.2

Changelog

Sourced from react-router-dom's changelog.

v7.18.2

Patch Changes

• Updated dependencies:
  • react-router@7.18.2

Commits

• 69a653e Release v7.18.2 (#15354)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions