Skip to content

chore(deps): bump the production-minor group across 1 directory with 18 updates - #880

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-83a853194e
Open

chore(deps): bump the production-minor group across 1 directory with 18 updates#880
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-83a853194e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-minor group with 18 updates in the / directory:

Package From To
@cloudflare/workers-oauth-provider 0.8.3 0.10.3
lucide-react 1.28.0 1.37.0
next 16.2.12 16.3.3
pg 8.22.0 8.23.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
fast-xml-parser 5.10.1 5.11.1
zod 4.4.3 4.5.4
agents 0.20.1 0.22.0
@sigstore/protobuf-specs 0.5.1 0.5.2
@sigstore/verify 4.1.0 4.1.2
ws 8.21.1 8.21.3
@remotion/bundler 4.0.503 4.0.518
@remotion/cli 4.0.503 4.0.518
@remotion/google-fonts 4.0.503 4.0.518
@remotion/renderer 4.0.503 4.0.518
@remotion/tailwind-v4 4.0.503 4.0.518
remotion 4.0.503 4.0.518

Updates @cloudflare/workers-oauth-provider from 0.8.3 to 0.10.3

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.10.3

Patch Changes

  • #299 dc63ec8 Thanks @​mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

v0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

v0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

v0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

v0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

v0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch

... (truncated)

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.10.3

Patch Changes

  • #299 dc63ec8 Thanks @​mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable

... (truncated)

Commits
  • d83b2e7 Version Packages (#300)
  • dc63ec8 fix(cimd): scope default grant revocation to the authorizing redirect URI (#299)
  • f3b8b27 Version Packages (#296)
  • 3a41fd7 fix(cimd): centralize client metadata resolution (#295)
  • a316ce8 Version Packages (#286)
  • 9e3f44d chore: release resource compatibility as patch (#291)
  • a3e69f7 refactor(auth): simplify client auth storage (#290)
  • 7a6baf9 fix(resource): preserve omission and legacy grants (#288)
  • 30b1f4f fix(auth): preserve legacy client-secret transports (#287)
  • 737dfa2 fix(cimd): negotiate optional client capabilities (#285)
  • Additional commits viewable in compare view

Updates lucide-react from 1.28.0 to 1.37.0

Release notes

Sourced from lucide-react's releases.

Version 1.37.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.35.0...1.37.0

Version 1.36.0

What's Changed

... (truncated)

Commits
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • See full diff in compare view

Updates next from 16.2.12 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • 528c1cd [16.3.x] Stop generating error codes (#97780)
  • d0ac882 v16.3.2
  • 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
  • cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates fast-xml-parser from 5.10.1 to 5.11.1

Release notes

Sourced from fast-xml-parser's releases.

v5.11.1

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

... (truncated)

Commits

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

@dependabot
chore(deps): bump the production-minor group across 1 directory with …
94935cc 
…18 updates

Bumps the production-minor group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.8.3` | `0.10.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.37.0` |
| [next](https://github.com/vercel/next.js) | `16.2.12` | `16.3.3` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.10.1` | `5.11.1` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.20.1` | `0.22.0` |
| [@sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) | `0.5.1` | `0.5.2` |
| [@sigstore/verify](https://github.com/sigstore/sigstore-js) | `4.1.0` | `4.1.2` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [@remotion/bundler](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.518` |
| [@remotion/cli](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.518` |
| [@remotion/google-fonts](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.518` |
| [@remotion/renderer](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.518` |
| [@remotion/tailwind-v4](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.518` |
| [remotion](https://github.com/remotion-dev/remotion) | `4.0.503` | `4.0.518` |



Updates `@cloudflare/workers-oauth-provider` from 0.8.3 to 0.10.3
- [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases)
- [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md)
- [Commits](cloudflare/workers-oauth-provider@v0.8.3...v0.10.3)

Updates `lucide-react` from 1.28.0 to 1.37.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react)

Updates `next` from 16.2.12 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.3)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `fast-xml-parser` from 5.10.1 to 5.11.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.1)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `agents` from 0.20.1 to 0.22.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.22.0/packages/agents)

Updates `@sigstore/protobuf-specs` from 0.5.1 to 0.5.2
- [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md)
- [Commits](sigstore/protobuf-specs@v0.5.1...v0.5.2)

Updates `@sigstore/verify` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/verify@4.1.0...@sigstore/verify@4.1.2)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `@remotion/bundler` from 4.0.503 to 4.0.518
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.518)

Updates `@remotion/cli` from 4.0.503 to 4.0.518
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.518)

Updates `@remotion/google-fonts` from 4.0.503 to 4.0.518
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.518)

Updates `@remotion/renderer` from 4.0.503 to 4.0.518
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.518)

Updates `@remotion/tailwind-v4` from 4.0.503 to 4.0.518
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.518)

Updates `remotion` from 4.0.503 to 4.0.518
- [Release notes](https://github.com/remotion-dev/remotion/releases)
- [Commits](remotion-dev/remotion@v4.0.503...v4.0.518)

---
updated-dependencies:
- dependency-name: "@cloudflare/workers-oauth-provider"
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: lucide-react
  dependency-version: 1.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: fast-xml-parser
  dependency-version: 5.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: agents
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor
- dependency-name: "@sigstore/protobuf-specs"
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@sigstore/verify"
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/bundler"
  dependency-version: 4.0.518
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/cli"
  dependency-version: 4.0.518
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/google-fonts"
  dependency-version: 4.0.518
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/renderer"
  dependency-version: 4.0.518
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: "@remotion/tailwind-v4"
  dependency-version: 4.0.518
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
- dependency-name: remotion
  dependency-version: 4.0.518
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 2, 2026
@dependabot
dependabot Bot requested a review from choraria as a code owner September 2, 2026 03:04
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@choraria choraria Awaiting requested review from choraria choraria is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@choraria choraria

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@choraria