build(deps): Bump the npm-production group across 1 directory with 6 updates by dependabot[bot] · Pull Request #28 · SafetyMP/Autonomous-EHS-Management

dependabot · 2026-06-14T10:23:59Z

Bumps the npm-production group with 6 updates in the / directory:

Package	From	To
@tanstack/react-query	`5.100.14`	`5.101.0`
better-auth	`1.6.12`	`1.6.18`
next	`16.2.6`	`16.2.9`
pg-boss	`12.18.2`	`12.19.1`
react	`19.2.6`	`19.2.7`
react-dom	`19.2.6`	`19.2.7`

Updates @tanstack/react-query from 5.100.14 to 5.101.0

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.101.0

Patch Changes

Updated dependencies [3042860, e631dc3]:

@tanstack/query-devtools@5.101.0

@tanstack/react-query@5.101.0

@tanstack/react-query-next-experimental@5.101.0

Patch Changes

#10857 7cf5923 - fix(react-query-next-experimental): replace deprecated 'isServer' with 'environmentManager.isServer()'

Updated dependencies []:

@tanstack/react-query@5.101.0

@tanstack/react-query-persist-client@5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.101.0

@tanstack/react-query@5.101.0

@tanstack/react-query@5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.0

Changelog

Sourced from @tanstack/react-query's changelog.

5.101.0

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.101.0

Commits

f3d8d2a ci: Version Packages (#10774)
532bb29 fix(tests): disable local coverage instrumentation (#10776)
See full diff in compare view

Updates better-auth from 1.6.12 to 1.6.18

Release notes

Sourced from better-auth's releases.

v1.6.18

better-auth

Bug Fixes

Fixed getCookieCache to return null for expired sessions instead of treating stale signed cookies as live sessions.

Fixed the delete-account confirmation link to prevent duplicate account deletions from concurrent callback requests.

Fixed one-time tokens from being redeemable multiple times under concurrent requests.

Fixed password reset tokens from changing a password more than once under concurrent requests.

Fixed Reddit sign-in to assign a non-routable placeholder address (<id>@reddit.invalid) to users with no email, preventing accidental matches with real mailboxes.

Fixed Sign-In with Ethereum nonces from being accepted multiple times under concurrent sign-in requests.

Added internalAdapter.reserveVerificationValue to atomically record single-use markers, ensuring only one concurrent caller succeeds for replay-protected operations.

Added the incrementOne adapter method and SecondaryStorage.increment for atomic counter updates, enabling strict rate-limit and usage-counter enforcement under concurrent load.

Fixed expired two-factor challenges from completing login and prevented duplicate session creation from concurrent verifications.

Fixed captcha verification to time out after 10 seconds, preventing slow or unreachable captcha providers from hanging requests indefinitely.

Fixed /delete-user/callback to reject account deletion when the session has been revoked server-side (cookie-only session deployments are unaffected).

Fixed rate limiting to prevent concurrent requests from slipping past configured limits, with a new optional consume method for custom storage backends to opt into strict enforcement.

Fixed team deletion to preserve pending invitations by removing only the deleted team's reference rather than invalidating the invitations entirely.

Fixed expected authentication validation failures to log as warnings instead of errors.

Fixed MCP bearer token validation to reject expired access tokens and require the offline_access scope for refresh token usage.

Fixed plugin API inference in composite monorepo setups where the core package resolved through multiple paths (#9583)

Fixed OpenAPI generation to accurately serialize Zod request schemas, including optional, nullable, intersected, and record-shaped types (#9315)

Fixed a memory leak where the JWKS cache could grow on every access token verification.

Fixed Google One Tap to require a configured client ID (set via the oneTap plugin or socialProviders.google) and reject tokens issued for other applications.

Fixed device-authorization token polling to prevent the same approved device code from being redeemed multiple times under concurrent polls.

Fixed account cookie preservation when switching users in the same browser session.

Fixed email OTP sign-in to prevent concurrent requests from signing in multiple times or exceeding the attempt limit.

Fixed phone-number OTP sign-in to prevent concurrent requests from signing in multiple times or exceeding the attempt limit.

Fixed two-factor OTP sign-in to prevent concurrent requests from signing in multiple times or exceeding the attempt limit.

Fixed the Have I Been Pwned plugin to check breached passwords on additional endpoints, including email-OTP and phone-number reset-password routes and admin password-setting routes.

Fixed the multi-session set-active and revoke endpoints to only act on sessions the caller holds a signed cookie for, preventing unauthorized session manipulation.

Fixed the OIDC /oauth2/endsession endpoint to reject cross-site logout requests that carry only a session cookie without a valid id_token_hint.

Fixed WeChat sign-in to work without an email address by assigning a stable placeholder email, with mapProfileToUser available to supply a real one.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

Fixed SAML assertion replay protection to hold under concurrent requests, preventing a duplicate submission from being accepted more than once.

Fixed organization admins and owners to verify domain ownership for SSO providers their organization owns, not just the member who originally registered the provider.

Fixed trustEmailVerified to treat only a boolean true or the string "true" as a verified email, rejecting the string "false" as unverified.

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.18

Patch Changes

#9315 9ef7240 Thanks @GautamBytes! - fix OpenAPI requestBody generation for intersected and default-wrapped body schemas

#9583 b21a5f7 Thanks @GautamBytes! - Fix plugin-provided client methods and additional session fields not being inferred in composite monorepos.

Updated dependencies [b21a5f7]:

@better-auth/core@1.6.18

@better-auth/drizzle-adapter@1.6.18

@better-auth/kysely-adapter@1.6.18

@better-auth/memory-adapter@1.6.18

@better-auth/mongo-adapter@1.6.18

@better-auth/prisma-adapter@1.6.18

@better-auth/telemetry@1.6.18

1.6.17

Patch Changes

#9993 baeaa00 Thanks @gustavovalverde! - When a team had a single open slot, accepting an invitation into it was wrongly rejected as over the member limit and left a dangling membership record. Two invitations accepted into a nearly-full team at the same time could also push it past its limit. Both are fixed.

#9482 3e99e6c Thanks @bytaesu! - admin.setUserPassword now creates a credential account when the target user does not have one, matching the behavior of resetPassword. Previously the call returned status: true without doing anything for users without an existing credential account (e.g., social-only or magic-link signups), so admins migrating users from another auth system or assigning an initial password to a social-only user can now do so directly without poking the account table.

96c78c3 Thanks @GautamBytes! - Downgrade expected auth validation failures from error logs to warnings.

#9993 baeaa00 Thanks @gustavovalverde! - Captcha provider verification requests now time out after 10 seconds and fail closed, so a slow or unreachable captcha provider can no longer tie up a request indefinitely.

#9993 baeaa00 Thanks @gustavovalverde! - A delete-account confirmation link can no longer delete the account more than once when its callback is opened concurrently.

#9991 0c3856f Thanks @gustavovalverde! - Completing account deletion through /delete-user/callback now fails when the session has been revoked server-side, instead of proceeding within the cookie-cache window. Deployments that keep sessions only in the cookie are unaffected.

#9993 baeaa00 Thanks @gustavovalverde! - Polling for a device-authorization token can no longer redeem the same approved device code more than once when several polls arrive together.

#9993 baeaa00 Thanks @gustavovalverde! - Submitting the same email OTP from several requests at once can no longer sign in more than once or gain extra tries beyond the attempt limit.

#10002 ed7b6c9 Thanks @gustavovalverde! - Adding a member to a team that is already at its maximumMembersPerTeam limit is now rejected on every path. addMember with a teamId and add-team-member previously skipped the limit that invitation acceptance enforced, so they could push a team over its cap. A rejected addMember no longer creates the organization member.

#9677 e0a768c Thanks @GautamBytes! - Refactor role.authorize control flow while preserving existing authorization behavior.

#9987 7343284 Thanks @bytaesu! - Generic OAuth sign-in works again for providers whose userinfo response has no sub or id field when mapProfileToUser derives the account id. An empty id field now falls back to sub.

#9991 0c3856f Thanks @gustavovalverde! - getCookieCache now returns null for an expired session instead of the stale session data. Middleware that calls it to gate access no longer treats an expired signed cookie as a live session.

#9993 baeaa00 Thanks @gustavovalverde! - The Have I Been Pwned plugin now checks submitted passwords against the breach database on more password-setting endpoints by default, including the email-OTP and phone-number reset-password routes and the admin create-user and set-user-password routes. A breached password can no longer be set through those routes when the plugin is enabled with its default paths.

#9987 7343284 Thanks @bytaesu! - Preserve the fresh account cookie issued while switching users in the same browser instead of expiring it from stale request cookie state.

#9991 0c3856f Thanks @gustavovalverde! - Expired MCP access tokens are no longer accepted. A protected MCP resource now rejects a bearer token once it has expired, both on the server and through the remote client. A refresh token is accepted only when the original authorization included the offline_access scope.

... (truncated)

Commits

04debbf chore: release v1.6.18 (#10026)
9ef7240 fix(open-api): serialize zod request schemas accurately (#9315)
b21a5f7 fix(client): preserve plugin inference in composite monorepos (#9583)
0d8b238 chore: release v1.6.17 (#9984)
eff3c99 test(next-js): verify nextCookies forwards all set-cookie headers (#10013)
e0a768c refactor(access): flatten access plugin role authorization logic (#9677)
3310ebc fix(open-api): mark model ids as required (#9704)
59e0ccb fix(client): updateSession should infer session additional fields (#9777)
96c78c3 fix(logger): downgrade validation logs level to warn
5c289b5 fix(account): resolve stateless account cookies across instances (#9979)
Additional commits viewable in compare view

Updates next from 16.2.6 to 16.2.9

Release notes

Sourced from next's releases.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

[backport] Fix "type: module" in project dir when using standalone or adapters (#94050)

[backport] Propagate adapter preferred regions (#94200)

[16.2.x] Don't drop FormData entries (#94240)

[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!

Commits

f37fad9 v16.2.9
d9aaaed [cd] Allow tagging semver-lower releases as @latest if @latest po… (#94627)
6f16804 v16.2.8
0dbc1d5 [16.2.x][cd] Ensure release can be triggered on old branches (#94598)
90e3c81 [16.2.x] Align Actions dependencies with Canary (#94339)
83f402c [16.2.x][cd] Stop fetching all tags when searching parent tag (#94334)
411c455 v16.2.7
c63224f [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolut...
63115c7 [16.2.x] Don't drop FormData entries (#94240)
aef22fd [backport] Propagate adapter preferred regions (#94200)
Additional commits viewable in compare view

Updates pg-boss from 12.18.2 to 12.19.1

Release notes

Sourced from pg-boss's releases.

12.19.1

What's Changed

fix: reset startup state after start errors by @cyphercodes in timgit/pg-boss#809

New Contributors

@cyphercodes made their first contribution in timgit/pg-boss#809

Full Changelog: timgit/pg-boss@12.19.0...12.19.1

12.19.0

What's Changed

Add support for job dependencies using flow() by @klesgidis in timgit/pg-boss#777

Full Changelog: timgit/pg-boss@12.18.3...12.19.0

12.18.3

What's Changed

Export missing public input/option types by @blue2cat in timgit/pg-boss#795

Fixes the issue where results come back as an array of objects, instead of a single object by @DavidTanner in timgit/pg-boss#799

Change WIP to reliably emit even during slow jobs by @bcomnes in timgit/pg-boss#765

Move docs to Vitepress by @blue2cat in timgit/pg-boss#770

New Contributors

@DavidTanner made their first contribution in timgit/pg-boss#799

Full Changelog: timgit/pg-boss@12.18.2...12.18.3

Commits

f9e31a1 versioning for patch
fabab4c Merge pull request #809 from cyphercodes/fix/start-retry-after-error
a3275ff Merge pull request #808 from timgit/flows
ecd0379 revert whitespace and inline exports in plans
3f236e6 correctness and guards
08b7ada fix: reset startup state after start errors
e19cca3 rename test file
6782f31 flow docs
26ebd0b versioning and api updates pre-merge
9188fbc Merge pull request #777 from klesgidis/master
Additional commits viewable in compare view

Updates react from 19.2.6 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

Commits

6117d7c Version 19.2.7 (#36591)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates react-dom from 19.2.6 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

Commits

6117d7c Version 19.2.7 (#36591)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates Bumps the npm-production group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.100.14` | `5.101.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.12` | `1.6.18` | | [next](https://github.com/vercel/next.js) | `16.2.6` | `16.2.9` | | [pg-boss](https://github.com/timgit/pg-boss) | `12.18.2` | `12.19.1` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` | Updates `@tanstack/react-query` from 5.100.14 to 5.101.0 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query) Updates `better-auth` from 1.6.12 to 1.6.18 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.18/packages/better-auth) Updates `next` from 16.2.6 to 16.2.9 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.2.6...v16.2.9) Updates `pg-boss` from 12.18.2 to 12.19.1 - [Release notes](https://github.com/timgit/pg-boss/releases) - [Commits](timgit/pg-boss@12.18.2...12.19.1) Updates `react` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react) Updates `react-dom` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) --- updated-dependencies: - dependency-name: "@tanstack/react-query" dependency-version: 5.101.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: better-auth dependency-version: 1.6.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: next dependency-version: 16.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: pg-boss dependency-version: 12.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: react dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-14T10:23:59Z

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-06-14T10:24:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
autonomous-ehs-management	Ready	Preview, Comment	Jun 14, 2026 10:26am

dependabot · 2026-06-21T10:23:47Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

vercel Bot deployed to Preview June 14, 2026 10:26 View deployment

dependabot Bot closed this Jun 21, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-production-b86c16fd0f branch June 21, 2026 10:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the npm-production group across 1 directory with 6 updates#28

build(deps): Bump the npm-production group across 1 directory with 6 updates#28
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-b86c16fd0f

dependabot Bot commented on behalf of github Jun 14, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 14, 2026

Uh oh!

vercel Bot commented Jun 14, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​tanstack/react-query-devtools@​5.101.0

Patch Changes

@​tanstack/react-query-next-experimental@​5.101.0

Patch Changes

@​tanstack/react-query-persist-client@​5.101.0

Patch Changes

@​tanstack/react-query@​5.101.0

Patch Changes

5.101.0

Patch Changes

v1.6.18

better-auth

Bug Fixes

@better-auth/sso

Bug Fixes

@better-auth/memory-adapter

Bug Fixes

1.6.18

Patch Changes

1.6.17

Patch Changes

v16.2.9

v16.2.8

v16.2.7

Core Changes

Credits

12.19.1

What's Changed

New Contributors

12.19.0

What's Changed

12.18.3

What's Changed

New Contributors

19.2.7 (June 1st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

Uh oh!

dependabot Bot commented on behalf of github Jun 14, 2026

Labels

Uh oh!

vercel Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Jun 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 14, 2026 •

edited

Loading

`@tanstack/react-query-devtools@5`.101.0

`@tanstack/react-query-next-experimental@5`.101.0

`@tanstack/react-query-persist-client@5`.101.0

`@tanstack/react-query@5`.101.0

`better-auth`

`@better-auth/sso`

`@better-auth/memory-adapter`

vercel Bot commented Jun 14, 2026 •

edited

Loading