Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates#83

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-106f35eacd
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates#83
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-106f35eacd

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 27, 2026

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
better-auth 1.3.34 1.4.5
next 16.0.3 16.1.5
body-parser 2.2.0 2.2.2
preact 10.27.2 10.28.2
tar 6.2.1 removed
undici 5.29.0 6.23.0

Updates better-auth from 1.3.34 to 1.4.5

Release notes

Sourced from better-auth's releases.

v1.4.5-beta.2

   🐞 Bug Fixes

    View changes on GitHub

v1.4.4

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v1.4.4-beta.3

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
  • 2000fd6 chore: release v1.4.5
  • fcab5a8 fix: add helper types to exports (#6479)
  • c666670 chore: release v1.4.5-beta.1
  • fd72560 fix(db-adapter): string[] and number[] fieldTypes incorrectly parsed for plug...
  • 189dedd chore: release v1.4.4-beta.3
  • 6269a33 chore: release v1.4.4-beta.2
  • 52c15d4 chore: fix validation errors in unit tests (#6466)
  • a25fb65 fix: preserve user ID in cookie cache during stateless sessions (#6452)
  • 5cbe0a5 chore: enforce imports to use node: protocol (#6461)
  • fbe51c8 chore: add spell checker (#6319)
  • Additional commits viewable in compare view

Updates next from 16.0.3 to 16.1.5

Release notes

Sourced from next's releases.

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @​mischnic for helping!

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

v16.1.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Turbopack: Update to swc_core v50.2.3 (#87841) (#88296)
    • Fixes a crash when processing mdx files with multibyte characters. (#87713)
  • Turbopack: mimalloc upgrade and enabling it on musl (#88503) (#87815) (#88426)
    • Fixes a significant performance issue on musl-based Linux distributions (e.g. Alpine in Docker) related to musl's allocator.
    • Other platforms have always used mimalloc, but we previously did not use mimalloc on musl because of compilation issues that have since been resolved.

Credits

Huge thanks to @​mischnic for helping!

v16.1.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

... (truncated)

Commits
  • acba4a6 v16.1.5
  • e1d1fc6 Add maximum size limit for postponed body parsing (#88175)
  • 500ec83 fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
  • 1caaca3 feat(next/image)!: add images.maximumResponseBody config (#88183)
  • 522ed84 Sync DoS mitigations for React Flight
  • 8cad197 [backport][cna] Ensure created app is not considered the workspace root in pn...
  • 2718661 Backport/docs fixes (#89031)
  • 5333625 Backport/docs fixes 16.1.5 (#88916)
  • 60de6c2 v16.1.4
  • 5f75d22 backport: Only filter next config if experimental flag is enabled (#88733) (#...
  • Additional commits viewable in compare view

Updates body-parser from 2.2.0 to 2.2.2

Release notes

Sourced from body-parser's releases.

v2.2.2

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.1...v2.2.2

v2.2.1

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3
Commits

Updates preact from 10.27.2 to 10.28.2

Release notes

Sourced from preact's releases.

10.28.2

Fixes

  • Enforce strict equality for VNode object constructors

10.28.1

Fixes

10.28.0

Types

Fixes

Performance

10.27.3

Fixes

  • Enforce strict equality for VNode object constructors
Commits

Updates qs from 6.14.0 to 6.14.1

Changelog

Sourced from qs's changelog.

6.14.1

  • [Fix] ensure arrayLength applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions
  • [Tests] stringify: increase coverage
  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
Commits
  • 3fa11a5 v6.14.1
  • a626704 [Dev Deps] update npmignore
  • 3086902 [Fix] ensure arrayLength applies to [] notation as well
  • fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
  • 0b06aac [Dev Deps] update @ljharb/eslint-config
  • 64951f6 [Refactor] parse: extract key segment splitting helper
  • e1bd259 [Dev Deps] update @ljharb/eslint-config
  • f4b3d39 [eslint] add eslint 9 optional peer dep
  • 6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
  • 973dc3c [actions] add workflow permissions
  • Additional commits viewable in compare view

Removes tar

Updates undici from 5.29.0 to 6.23.0

Release notes

Sourced from undici's releases.

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

What's Changed

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

v6.21.3

What's Changed

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

v6.21.2

What's Changed

New Contributors

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

v6.21.1

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

... (truncated)

Commits
  • fbc31e2 Bumped v6.23.0
  • 3477c94 chore: release flow using provenance
  • d3aafea fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
  • f9c9185 Bumped v6.22.0
  • f670f2a feat: make UndiciErrors reliable to instanceof (#4472) (#4480)
  • 422e397 feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#41...
  • 4a06ffe feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180)...
  • 4cb3974 fix: fix EnvHttpProxyAgent for the Node.js bundle (#4064) (#4432)
  • 44c23e5 fix: fix wrong stream canceled up after cloning (v6) (#4414)
  • da0e823 Bumped v6.21.4
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 7 up…
ebfc074 
…dates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.3.34` | `1.4.5` |
| [next](https://github.com/vercel/next.js) | `16.0.3` | `16.1.5` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.2.2` |
| [preact](https://github.com/preactjs/preact) | `10.27.2` | `10.28.2` |
| [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `removed` |
| [undici](https://github.com/nodejs/undici) | `5.29.0` | `6.23.0` |



Updates `better-auth` from 1.3.34 to 1.4.5
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.4.5/packages/better-auth)

Updates `next` from 16.0.3 to 16.1.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.0.3...v16.1.5)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `preact` from 10.27.2 to 10.28.2
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@10.27.2...10.28.2)

Updates `qs` from 6.14.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.14.1)

Removes `tar`

Updates `undici` from 5.29.0 to 6.23.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.29.0...v6.23.0)

---
updated-dependencies:
- dependency-name: better-auth
  dependency-version: 1.4.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.1.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: preact
  dependency-version: 10.28.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.23.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies javascript Pull requests that update javascript code labels Jan 27, 2026
@dependabot dependabot bot requested a review from syed-reza98 as a code owner January 27, 2026 20:27
@dependabot dependabot bot added dependencies javascript Pull requests that update javascript code labels Jan 27, 2026
@github-actions
Copy link

github-actions bot commented Jan 27, 2026

👋 Thanks for opening your first pull request in StormCom!

A maintainer will review your PR soon. Please make sure:

  • Your PR follows our
    Contributing Guidelines
  • All CI checks pass
  • You've added appropriate tests
  • Documentation has been updated (if needed)

We appreciate your contribution to making StormCom better! 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@syed-reza98 syed-reza98 Awaiting requested review from syed-reza98 syed-reza98 is a code owner

Assignees

No one assigned

Labels

dependencies javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants