Skip to content

chore(deps): Update non-major dependencies#55

Merged
Leon-JavaScript merged 2 commits into
masterfrom
renovate/non-major
Jun 18, 2026
Merged

chore(deps): Update non-major dependencies#55
Leon-JavaScript merged 2 commits into
masterfrom
renovate/non-major

Conversation

@renovate

@renovate renovate Bot commented Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@base-ui/react (source) ^1.5.0 → ^1.6.0 age confidence
@better-auth/api-key (source) ^1.6.18 → ^1.6.19 age confidence
@better-auth/prisma-adapter (source) ^1.6.18 → ^1.6.19 age confidence
@scalar/nextjs-api-reference (source) ^0.11.3 → ^0.11.4 age confidence
better-auth (source) ^1.6.18 → ^1.6.19 age confidence
lucide-react (source) ^1.18.0 → ^1.21.0 age confidence
radix-ui (source) ^1.5.0 → ^1.6.0 age confidence

Release Notes

mui/base-ui (@​base-ui/react)

v1.6.0

Compare Source

Jun 18, 2026

General changes
Accordion
Alert Dialog
Autocomplete
Avatar
Checkbox
Checkbox Group
Collapsible
Combobox
Dialog
Drawer
Field
Fieldset
Form
Menu
Menubar
Meter
Navigation Menu
Number Field
OTP Field
  • 🚨 Breaking change: Unmark preview

    the namespace export is renamed OTPFieldPreview → OTPField and should be imported as: { OTPField } from '@​base-ui/react/otp-field' (#​5029) by @​atomiks
  • Avoid password manager bubbles after first input (#​4868) by @​atomiks
Popover
Preview Card
Radio Group
Scroll Area
Select
Slider
Switch
Tabs
Toast
Toggle
Toggle Group
Toolbar
Tooltip

All contributors of this release in alphabetical order: @​aarongarciah, @​atomiks, @​chuganzy, @​flaviendelangle, @​lyzno1, @​mattrothenberg, @​michaldudak, @​mj12albert, @​sernstberger, @​spokodev

better-auth/better-auth (@​better-auth/api-key)

v1.6.19

Compare Source

Patch Changes
better-auth/better-auth (@​better-auth/prisma-adapter)

v1.6.19

Compare Source

Patch Changes
scalar/scalar (@​scalar/nextjs-api-reference)

v0.11.4

better-auth/better-auth (better-auth)

v1.6.19

Compare Source

Patch Changes

  • #​10088 de4aa52 Thanks @​bytaesu! - Session and account cache cookies near the browser's per-cookie size limit (for example with a long cookiePrefix or many cached fields) are now split into chunks instead of being silently dropped by the browser. A cache too large to fit even when chunked is skipped with a warning rather than failing the request, so reads fall back to the database.

  • #​9995 b4b0266 Thanks @​ElGauchooooo! - The device authorization plugin now accepts an optional user_id when issuing a device code via /device/code, pre-binding the code to that user. Only the bound user can approve or deny the code, so a publicly visible user code can no longer be claimed by someone else.

  • #​10086 5bd5e1c Thanks @​gustavovalverde! - Refresh-token rotation and token revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance now work on Prisma. Concurrent or repeat requests in these flows could previously return an error on Prisma instead of the expected result.

    On MongoDB servers older than 5.0, these flows and other guarded value updates (rate-limit window resets, API-key refills) no longer fail with an empty-update error.

    @better-auth/core: incrementOne now reports a clear error when called with no increment and no set.

  • #​9319 581f827 Thanks @​ping-maxwell! - fix(last-login-method): include domain when clearing cross-subdomain cookies

  • #​10067 8407885 Thanks @​bytaesu! - The oauth-popup plugin now ignores internal OAuth state fields passed through its additionalData parameter, so additionalData only ever carries your own custom values.

  • #​9555 c1a8a64 Thanks @​ChrisMGeo! - Fix invalid OpenAPI output for Better Auth callback, session, and passkey routes so client generators can consume the schema.

  • #​10071 635f190 Thanks @​gustavovalverde! - Auth clients exported from wrapper packages can now be emitted in TypeScript declaration builds without extra type annotations.

  • #​10070 a787e0b Thanks @​gustavovalverde! - Single-use verification flows no longer hang on database adapters that use a one-connection pool. This fixes magic-link verification and similar token checks in connection-limited serverless database setups.

  • #​9348 c2f718f Thanks @​ping-maxwell! - fix: cookie cache fallback lookup

  • #​8863 7d18175 Thanks @​ping-maxwell! - sendVerificationEmail was invoked via runInBackgroundOrAwait, which could defer work when advanced.backgroundTasks.handler is configured (so the handler could return 200 before the email callback finished) and, in the default path, caught and logged errors without rethrowing. User callbacks that throw APIError (e.g. 429 from a rate limiter) were therefore not reliably reflected in the HTTP response (better-auth/better-auth#8757).

    Now we await sendVerificationEmailFn so failures surface to the client with the correct status. The unauthenticated /send-verification-email path enforces a constant-time floor (500 ms) so that the response duration does not reveal whether the email belongs to a real unverified user.

  • Updated dependencies [0895993, 5bd5e1c, a787e0b]:

lucide-icons/lucide (lucide-react)

v1.21.0: Version 1.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.20.0...1.21.0

v1.20.0: Version 1.20.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.19.0...1.20.0

v1.19.0: Version 1.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.18.0...1.19.0

radix-ui/primitives (radix-ui)

v1.6.0

const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>('Slot');
Avatar
  • Fixed several edge cases with Avatar's loading state
    • An avatar's fallback would not be displayed again if its image component unmounted. This is now fixed.
    • Rendering multiple Avatar.Image components per Avatar.Root was never supported and results in buggy, unpredictable behavior. We now warn about this in development.
    • Zero-sized images were treated as loading, meaning that onLoadingStatusChange is never called once loaded. A zero-sized image now triggers an error status on load.
Password Toggle Field
  • Renamed misspelled onVisiblityChange prop to onVisibilityChange.
  • Fixed prop type definitions to include asChild for all component parts.
Scroll Area
  • Stabilized the viewport style tag unless the nonce changes.
Slot
  • SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.
Toggle Group
  • Updated single-select and multi-select toggle groups to use the radiogroup and toolbar roles, respectively.
Select
  • Allowed a Select.Item with an empty string value to act as a "clear" option. Selecting it resets the selection back to the placeholder, restoring the native <select> behavior for optional selects. Previously using an empty string value would throw an error.
  • Fixed a bug where typeahead search resulted in focusing an element that no longer exists.
Other updates
  • Fixed a regression in that caused submenu misalignment when using custom portals.
  • Removed dev-only warnings for dialogs when title and/or description is not rendered.
  • Fixed a bug where menus and submenus remained open after a window loses focus.
  • Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
  • Fixed Duplicate index signature errors that surfaced when consuming multiple packages together.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Jun 16, 2026
@renovate renovate Bot requested a review from a team as a code owner June 16, 2026 03:36
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Jun 16, 2026
@renovate renovate Bot force-pushed the renovate/non-major branch from 27efabd to 9e9b72b Compare June 16, 2026 08:19
@Leon-JavaScript Leon-JavaScript added this to the v2.0.0-beta.3 milestone Jun 16, 2026
@renovate renovate Bot force-pushed the renovate/non-major branch 2 times, most recently from 7e146bd to 9385ba8 Compare June 17, 2026 18:43
@renovate renovate Bot force-pushed the renovate/non-major branch from 9385ba8 to 4e19f34 Compare June 18, 2026 13:17
@Leon-JavaScript Leon-JavaScript merged commit 14cfd33 into master Jun 18, 2026
2 checks passed
@Leon-JavaScript Leon-JavaScript deleted the renovate/non-major branch June 18, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Leon-JavaScript Leon-JavaScript Leon-JavaScript approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

v2.0.0-beta.3

Development

Successfully merging this pull request may close these issues.

1 participant

@Leon-JavaScript