build(deps): bump the npm-minor-and-patch group across 1 directory with 21 updates by dependabot[bot] · Pull Request #68 · datj9/enclave

dependabot · 2026-10-01T07:04:21Z

Bumps the npm-minor-and-patch group with 21 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	`0.115.0`	`0.131.0`
@aws-sdk/client-s3	`3.1104.0`	`3.1146.0`
@aws-sdk/s3-request-presigner	`3.1104.0`	`3.1146.0`
@base-ui/react	`1.7.0`	`1.8.0`
@node-rs/argon2	`2.0.2`	`2.2.1`
drizzle-orm	`0.45.2`	`0.45.3`
jose	`6.2.8`	`6.2.12`
next	`16.3.0`	`16.3.8`
openai	`7.4.0`	`7.28.0`
openid-client	`6.8.4`	`6.8.8`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.4`	`19.3.0`
zod	`4.4.3`	`4.6.5`
@playwright/test	`1.62.1`	`1.63.0`
@types/node	`26.1.2`	`26.6.4`
@types/react	`19.2.18`	`19.3.0`
@types/react-dom	`19.2.4`	`19.3.0`
drizzle-kit	`0.31.10`	`0.31.11`
eslint-config-next	`16.3.0`	`16.3.8`
prettier	`3.9.6`	`3.9.9`
tsx	`4.23.8`	`4.23.15`

Updates @anthropic-ai/sdk from 0.115.0 to 0.131.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk: v0.131.0

0.131.0 (2026-09-30)

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

api: add list spend limits endpoint (cfb78c8)

Chores

client: deprecate sonnet 4.5 (d72cfaf)

sdk: v0.130.0

0.130.0 (2026-09-30)

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)

api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)

api: add per-user usage and cost reports to the Admin API analytics (0a74a28)

api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)

api: add repository error types to Managed Agents session errors (6735615)

api: allow removing a plugin's org-wide installation setting (c7d120f)

api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)

api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

api: make memory store description, metadata, archived_at required (ed68900)

api: type admin plugin preference and marketplace fields as enums (942ae01)

pagination: auto-paging continues past an empty page while next_page is set (2d75266)

tool-runner: only send API fields for runnable tools (#404) (a62c2a2)

tools: stop the session tool runner after any idle that ends the turn (#878) (cab32f8)

Chores

api: update MCP Tunnels types and descriptions (394d60c)

docs: remove placeholder enum descriptions (04f0812)

tests: fixture update (#381) (9cfe4d4)

sdk: v0.129.0

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

0.131.0 (2026-09-30)

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

api: add list spend limits endpoint (cfb78c8)

Chores

client: deprecate sonnet 4.5 (d72cfaf)

0.130.0 (2026-09-30)

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)

api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)

api: add per-user usage and cost reports to the Admin API analytics (0a74a28)

api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)

api: add repository error types to Managed Agents session errors (6735615)

api: allow removing a plugin's org-wide installation setting (c7d120f)

api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)

api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

api: make memory store description, metadata, archived_at required (ed68900)

api: type admin plugin preference and marketplace fields as enums (942ae01)

pagination: auto-paging continues past an empty page while next_page is set (2d75266)

tool-runner: only send API fields for runnable tools (#404) (a62c2a2)

tools: stop the session tool runner after any idle that ends the turn (#878) (cab32f8)

Chores

api: update MCP Tunnels types and descriptions (394d60c)

docs: remove placeholder enum descriptions (04f0812)

tests: fixture update (#381) (9cfe4d4)

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

... (truncated)

Commits

d49bdab Merge pull request #1230 from anthropics/release-please--branches--main--chan...
4759f20 chore: release main
9ded9f3 codegen metadata
d72cfaf chore(client): deprecate sonnet 4.5
cfb78c8 feat(api): add list spend limits endpoint
e8f4c28 Merge branch 'main' into next
e6ca605 Merge pull request #1229 from anthropics/release-please--branches--main--chan...
2dd6192 chore: release main
cab32f8 fix(tools): stop the session tool runner after any idle that ends the turn (#...
0a74a28 feat(api): add per-user usage and cost reports to the Admin API analytics
Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1104.0 to 3.1146.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1146.0

3.1146.0(2026-10-02)

Documentation Changes

client-lambda-web: Documentation update for AWS Lambda Web Functions, clarifies that the LambdaWeb APIs are experimental and not yet available to external customers. (de11d1e1)

New Features

client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Static filter configuration allows users to configure endpoints with layouts and sources without using query parameters. The number of sources per multiview channel has been increased to 50. (8a1ac09c)

client-invoicing: API and doc updates related to adding MarketplacePunchOutEnabled and MarketplacePunchOutPreference fields to ProcurementPortalPreferences related APIs (948be4b5)

client-glue: Added refresh token grant type to Glue Connection supported OAuth 2.0 grant types (6101fef0)

client-cognito-identity-provider: Amazon Cognito User Pools now supports the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on issued access and Id tokens. Amazon Cognito User Pools also now supports step-up authentication via our existing authentication APIs. (196e191f)

client-pinpoint-sms-voice-v2: AWS End User Messaging SMS CarrierLookup API now supports phone number cleansing on customer opt-in. when selected, the response includes the additional field "OriginalPhoneNumber". It can also return additional PhoneNumberType enums, VOIP and PREPAID. (42d43613)

client-securityagent: Adds trigger filters that control which pull request events, target branches, and labels start an automatic code review. (3d73df94)

For list of updated packages, view updated-packages.md in assets-3.1146.0.zip

v3.1145.0

3.1145.0(2026-10-01)

Chores

update lock-threads workflow (#8327) (5daff5f2)

Documentation Changes

client-ec2: This release launches the AMI tag sharing feature, which lets AMI owners share tags alongside their AMIs, eliminating the need to build and maintain custom tag replication workflows. (82608f8c)

New Features

clients: update client endpoints as of 2026-10-01 (5244c2a9)

client-bedrock-agent: Adds an optional textReadyAt field to ListIngestionJobs and GetIngestionJob for Managed Knowledge Bases data source sync jobs. The field denotes the timestamp at which all the documents in the scope of a sync job had their text content indexed and are available for retrieval. (a810c753)

client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (ed0d0540)

client-quicksight: This release adds HierarchyFilter support for Amazon QuickSight analysis and dashboard and 2 legged OAuth for databricks datasources. (a1730e33)

client-endusermessaging: AWS End User Messaging now supports Brand profiles and Notify code configurations. Brand profiles capture your sender details once to reuse across phone number registrations. Notify code configurations let you define your OTP policy and delivery settings to send passcodes in minutes. (3e5402c6)

client-transfer: AWS Transfer Family Workflows adds support for the structuredLogDestinations option, enabling customers to specify a custom Amazon CloudWatch Logs log group for managed workflow execution logs. (db1f8330)

client-health: Adds DescribeServiceLifecycle operation returning lifecycle information for AWS services, including end-of-support dates, version recommendations, and lifecycle events. (db93c016)

client-cloudfront: Added always-amz-auth as a supported signing behavior for Origin Access Control (OAC), enabling CloudFront to authenticate requests to Lambda-Web origins. (e24eb7cf)

client-sagemaker: Release support for c8a.16xlarge and m8a.16xlarge instance types for SageMaker HyperPod (cfa700a6)

client-securityhub: Adds GetRemediationsV2 and ListExposuresByRemediationV2 APIs. This feature allows customers to see their highest priority remediations for their Exposure findings. Remediations target key changes customers can make to resources to drive finding resolution. (fe355577)

Bug Fixes

lib-transfer-manager: respect file read stream's byte range on upload (#8324) (449c2814)

ci: run format-check when a draft PR is marked ready for review (#8326) (d99dd58e)

... (truncated)

Changelog

Sourced from @aws-sdk/client-s3's changelog.

3.1146.0 (2026-10-02)

Note: Version bump only for package @aws-sdk/client-s3

3.1145.0 (2026-10-01)

Note: Version bump only for package @aws-sdk/client-s3

3.1144.0 (2026-09-30)

Features

client-s3: Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others. (82bbbdc)

3.1143.0 (2026-09-29)

Note: Version bump only for package @aws-sdk/client-s3

3.1142.0 (2026-09-28)

Note: Version bump only for package @aws-sdk/client-s3

3.1141.0 (2026-09-25)

Note: Version bump only for package @aws-sdk/client-s3

... (truncated)

Commits

054298b Publish v3.1146.0
0199117 Publish v3.1145.0
ce26281 Publish v3.1144.0
82bbbdc feat(client-s3): Amazon S3 adds a new optional S3 Inventory field, Intelligen...
81afad0 Publish v3.1143.0
c935fdd Publish v3.1142.0
5bc8d9a Publish v3.1141.0
6050a38 Publish v3.1140.0
03d54a8 Publish v3.1139.0
c68e50e Publish v3.1138.0
Additional commits viewable in compare view

Updates @aws-sdk/s3-request-presigner from 3.1104.0 to 3.1146.0

Release notes

Sourced from @aws-sdk/s3-request-presigner's releases.

v3.1146.0

3.1146.0(2026-10-02)

Documentation Changes

client-lambda-web: Documentation update for AWS Lambda Web Functions, clarifies that the LambdaWeb APIs are experimental and not yet available to external customers. (de11d1e1)

New Features

client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Static filter configuration allows users to configure endpoints with layouts and sources without using query parameters. The number of sources per multiview channel has been increased to 50. (8a1ac09c)

client-invoicing: API and doc updates related to adding MarketplacePunchOutEnabled and MarketplacePunchOutPreference fields to ProcurementPortalPreferences related APIs (948be4b5)

client-glue: Added refresh token grant type to Glue Connection supported OAuth 2.0 grant types (6101fef0)

client-cognito-identity-provider: Amazon Cognito User Pools now supports the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on issued access and Id tokens. Amazon Cognito User Pools also now supports step-up authentication via our existing authentication APIs. (196e191f)

client-pinpoint-sms-voice-v2: AWS End User Messaging SMS CarrierLookup API now supports phone number cleansing on customer opt-in. when selected, the response includes the additional field "OriginalPhoneNumber". It can also return additional PhoneNumberType enums, VOIP and PREPAID. (42d43613)

client-securityagent: Adds trigger filters that control which pull request events, target branches, and labels start an automatic code review. (3d73df94)

For list of updated packages, view updated-packages.md in assets-3.1146.0.zip

v3.1145.0

3.1145.0(2026-10-01)

Chores

update lock-threads workflow (#8327) (5daff5f2)

Documentation Changes

client-ec2: This release launches the AMI tag sharing feature, which lets AMI owners share tags alongside their AMIs, eliminating the need to build and maintain custom tag replication workflows. (82608f8c)

New Features

clients: update client endpoints as of 2026-10-01 (5244c2a9)

client-bedrock-agent: Adds an optional textReadyAt field to ListIngestionJobs and GetIngestionJob for Managed Knowledge Bases data source sync jobs. The field denotes the timestamp at which all the documents in the scope of a sync job had their text content indexed and are available for retrieval. (a810c753)

client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (ed0d0540)

client-quicksight: This release adds HierarchyFilter support for Amazon QuickSight analysis and dashboard and 2 legged OAuth for databricks datasources. (a1730e33)

client-endusermessaging: AWS End User Messaging now supports Brand profiles and Notify code configurations. Brand profiles capture your sender details once to reuse across phone number registrations. Notify code configurations let you define your OTP policy and delivery settings to send passcodes in minutes. (3e5402c6)

client-transfer: AWS Transfer Family Workflows adds support for the structuredLogDestinations option, enabling customers to specify a custom Amazon CloudWatch Logs log group for managed workflow execution logs. (db1f8330)

client-health: Adds DescribeServiceLifecycle operation returning lifecycle information for AWS services, including end-of-support dates, version recommendations, and lifecycle events. (db93c016)

client-cloudfront: Added always-amz-auth as a supported signing behavior for Origin Access Control (OAC), enabling CloudFront to authenticate requests to Lambda-Web origins. (e24eb7cf)

client-sagemaker: Release support for c8a.16xlarge and m8a.16xlarge instance types for SageMaker HyperPod (cfa700a6)

client-securityhub: Adds GetRemediationsV2 and ListExposuresByRemediationV2 APIs. This feature allows customers to see their highest priority remediations for their Exposure findings. Remediations target key changes customers can make to resources to drive finding resolution. (fe355577)

Bug Fixes

lib-transfer-manager: respect file read stream's byte range on upload (#8324) (449c2814)

ci: run format-check when a draft PR is marked ready for review (#8326) (d99dd58e)

... (truncated)

Changelog

Sourced from @aws-sdk/s3-request-presigner's changelog.

3.1146.0 (2026-10-02)

Note: Version bump only for package @aws-sdk/s3-request-presigner

3.1145.0 (2026-10-01)

Note: Version bump only for package @aws-sdk/s3-request-presigner

3.1144.0 (2026-09-30)

Note: Version bump only for package @aws-sdk/s3-request-presigner

3.1143.0 (2026-09-29)

Note: Version bump only for package @aws-sdk/s3-request-presigner

3.1142.0 (2026-09-28)

Note: Version bump only for package @aws-sdk/s3-request-presigner

3.1141.0 (2026-09-25)

Note: Version bump only for package @aws-sdk/s3-request-presigner

3.1140.0 (2026-09-24)

... (truncated)

Commits

054298b Publish v3.1146.0
0199117 Publish v3.1145.0
ce26281 Publish v3.1144.0
81afad0 Publish v3.1143.0
c935fdd Publish v3.1142.0
5bc8d9a Publish v3.1141.0
6050a38 Publish v3.1140.0
03d54a8 Publish v3.1139.0
c68e50e Publish v3.1138.0
9a10476 chore(codegen): sync for MetricsRecorder support and core error/retry fixes (...
Additional commits viewable in compare view

Updates @base-ui/react from 1.7.0 to 1.8.0

Release notes

Sourced from @base-ui/react's releases.

v1.8.0

General changes

Fix label association when a control unregisters (#5456) by @atomiks

Reduce animation completion work (#5535) by @atomiks

Fix prop and ref merging for lazy render elements (#5562) by @atomiks

Fix roving focus when items are added or removed (#5447) by @atomiks

Fix hover and focus interaction issues (#5037) by @atomiks

Improve trigger mount performance (#5426) by @atomiks

Fix disabled anchor tracking on scroll (#5478) by @atomiks

Fix transform origin for start/end alignment (#5015) by @atomiks

Remove duplicate options key from arrow middleware (#5606) by @atomiks

Register passive touch listeners (#5572) by @wanxiankai

Alert Dialog

Ignore outside clicks from presses that began before open (#5378) by @michaldudak

Autocomplete

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

Move aria-orientation to the role owners (#5551) by @gonzoblasco

Hide group labels and scrollbars from the accessibility tree (#5598) by @azeng4499

Avatar

Add keepMounted prop to <Avatar.Image> (#5536) by @atomiks

Checkbox

Fix stale and duplicated control IDs (#5457) by @atomiks

Fix controlled blur validation and stale filled state (#5563) by @atomiks

Checkbox Group

Fix stale and duplicated control IDs (#5457) by @atomiks

Combobox

Fix applying data-readonly to <Combobox.Trigger> (#5418) by @sai6855

Add createItems collection API (#5326) by @atomiks

Fix cancellation when preserving the filter after selection (#5362) by @atomiks

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

Move aria-orientation to the role owners (#5551) by @gonzoblasco

Fix record item label lookup reading from Object.prototype (#5518) by @XionWCFM

Anchor multiple selection to the first selected item with a linear lookup (#5573, #5613) by @atomiks and @michaldudak

Hide group labels and scrollbars from the accessibility tree (#5598) by @azeng4499

... (truncated)

Changelog

Sourced from @base-ui/react's changelog.

v1.8.0

Sep 4, 2026

General changes

Fix label association when a control unregisters (#5456) by @atomiks

Reduce animation completion work (#5535) by @atomiks

Fix prop and ref merging for lazy render elements (#5562) by @atomiks

Fix roving focus when items are added or removed (#5447) by @atomiks

Fix hover and focus interaction issues (#5037) by @atomiks

Improve trigger mount performance (#5426) by @atomiks

Fix disabled anchor tracking on scroll (#5478) by @atomiks

Fix transform origin for start/end alignment (#5015) by @atomiks

Remove duplicate options key from arrow middleware (#5606) by @atomiks

Register passive touch listeners (#5572) by @wanxiankai

Alert Dialog

Ignore outside clicks from presses that began before open (#5378) by @michaldudak

Autocomplete

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

Move aria-orientation to the role owners (#5551) by @gonzoblasco

Hide group labels and scrollbars from the accessibility tree (#5598) by @azeng4499

Avatar

Add keepMounted prop to <Avatar.Image> (#5536) by @atomiks

Checkbox

Fix stale and duplicated control IDs (#5457) by @atomiks

Fix controlled blur validation and stale filled state (#5563) by @atomiks

Checkbox Group

Fix stale and duplicated control IDs (#5457) by @atomiks

Combobox

Fix applying data-readonly to <Combobox.Trigger> (#5418) by @sai6855

Add createItems collection API (#5326) by @atomiks

Fix cancellation when preserving the filter after selection (#5362) by @atomiks

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

... (truncated)

Commits

47b4052 [release] v1.8.0 (#5609)
dd13809 [toast] Accept an updater function in the update method instead of on data (#...
670e95c [docs] Update docs infra to restore generated types (#5616)
e8526f7 [utils] Restore frozen EMPTY_ARRAY (#5620)
b7f6683 [number field] Preserve consumer selection when focusing the input (#5619)
b8c5d78 [context menu] Correct generated API metadata (#5523)
261d699 [combobox][autocomplete] Document that items must not contain nullish entries...
0a6ff44 [toast] Replace custom data wholesale and accept a function to derive it (#5611)
2e1bddd [combobox][select] Make the multiple selection anchor lookup linear (#5613)
ad83c8a [code-infra] Run TypeScript 7 alongside the TS6 JS API (#5603)
Additional commits viewable in compare view

Updates @node-rs/argon2 from 2.0.2 to 2.2.1

Commits

56c64a1 chore(release): publish
f8d6b3e fix: record and lock Rust release dependencies (#1206)
b8b4fae fix: remove forced SSE4.2 from x64 builds (#1205)
7769109 fix: disable mimalloc arch optimizations on Linux ARM64 (#1204)
bb467e8 chore(deps): lock file maintenance (#1202)
e692dfa chore(deps): update dependency oxfmt to ^0.67.0 (#1203)
784f4c3 chore(deps): update rust to v1.98.1 (#1201)
1f53bf3 chore(deps): update dependency oxfmt to ^0.66.0 (#1198)
cb6b2b2 chore(deps): lock file maintenance (#1197)
fa136ac chore(release): publish
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @node-rs/argon2 since your current version.

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (

…th 21 updates Bumps the npm-minor-and-patch group with 21 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.115.0` | `0.131.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1104.0` | `3.1146.0` | | [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1104.0` | `3.1146.0` | | [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.7.0` | `1.8.0` | | [@node-rs/argon2](https://github.com/napi-rs/node-rs) | `2.0.2` | `2.2.1` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` | | [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.12` | | [next](https://github.com/vercel/next.js) | `16.3.0` | `16.3.8` | | [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.28.0` | | [openid-client](https://github.com/panva/openid-client) | `6.8.4` | `6.8.8` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.6.4` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` | | [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.31.10` | `0.31.11` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.0` | `16.3.8` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.8` | `4.23.15` | Updates `@anthropic-ai/sdk` from 0.115.0 to 0.131.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.115.0...sdk-v0.131.0) Updates `@aws-sdk/client-s3` from 3.1104.0 to 3.1146.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1146.0/clients/client-s3) Updates `@aws-sdk/s3-request-presigner` from 3.1104.0 to 3.1146.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1146.0/packages/s3-request-presigner) Updates `@base-ui/react` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/mui/base-ui/releases) - [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react) Updates `@node-rs/argon2` from 2.0.2 to 2.2.1 - [Release notes](https://github.com/napi-rs/node-rs/releases) - [Commits](https://github.com/napi-rs/node-rs/compare/@node-rs/argon2@2.0.2...@node-rs/argon2@2.2.1) Updates `drizzle-orm` from 0.45.2 to 0.45.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3) Updates `jose` from 6.2.8 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.8...v6.2.12) Updates `next` from 16.3.0 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.0...v16.3.8) Updates `openai` from 7.4.0 to 7.28.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.4.0...v7.28.0) Updates `openid-client` from 6.8.4 to 6.8.8 - [Release notes](https://github.com/panva/openid-client/releases) - [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md) - [Commits](panva/openid-client@v6.8.4...v6.8.8) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `zod` from 4.4.3 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.5) Updates `@playwright/test` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) Updates `@types/node` from 26.1.2 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `drizzle-kit` from 0.31.10 to 0.31.11 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.10...drizzle-kit@0.31.11) Updates `eslint-config-next` from 16.3.0 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next) Updates `prettier` from 3.9.6 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.9) Updates `tsx` from 4.23.8 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.8...v4.23.15) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.128.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1141.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@aws-sdk/s3-request-presigner" dependency-version: 3.1141.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@base-ui/react" dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@node-rs/argon2" dependency-version: 2.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@playwright/test" dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: drizzle-kit dependency-version: 0.31.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: drizzle-orm dependency-version: 0.45.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: next dependency-version: 16.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: openai dependency-version: 7.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: openid-client dependency-version: 6.8.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

dependabot Bot mentioned this pull request Oct 1, 2026

build(deps): bump the npm-minor-and-patch group with 21 updates #65

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-7d62b32672 branch from 8313e8d to f0e5c09 Compare October 8, 2026 07:01

Navigation Menu

Repository navigation

build(deps): bump the npm-minor-and-patch group across 1 directory with 21 updates - #68

build(deps): bump the npm-minor-and-patch group across 1 directory with 21 updates#68
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-7d62b32672

dependabot Bot commented on behalf of github Oct 1, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

sdk: v0.131.0

0.131.0 (2026-09-30)

Features

Chores

sdk: v0.130.0

0.130.0 (2026-09-30)

Features

Bug Fixes

Chores

sdk: v0.129.0

0.129.0 (2026-09-28)

0.131.0 (2026-09-30)

Features

Chores

0.130.0 (2026-09-30)

Features

Bug Fixes

Chores

0.129.0 (2026-09-28)

Features

v3.1146.0

3.1146.0(2026-10-02)

Documentation Changes

New Features

v3.1145.0

3.1145.0(2026-10-01)

Chores

Documentation Changes

New Features

Bug Fixes

3.1146.0 (2026-10-02)

3.1145.0 (2026-10-01)

3.1144.0 (2026-09-30)

Features

3.1143.0 (2026-09-29)

3.1142.0 (2026-09-28)

3.1141.0 (2026-09-25)

v3.1146.0

3.1146.0(2026-10-02)

Documentation Changes

New Features

v3.1145.0

3.1145.0(2026-10-01)

Chores

Documentation Changes

New Features

Bug Fixes

3.1146.0 (2026-10-02)

3.1145.0 (2026-10-01)

3.1144.0 (2026-09-30)

3.1143.0 (2026-09-29)

3.1142.0 (2026-09-28)

3.1141.0 (2026-09-25)

3.1140.0 (2026-09-24)

v1.8.0

General changes

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Combobox

v1.8.0

General changes

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Combobox

0.45.3

New Netlify DB Driver

v6.2.12

Documentation

Refactor

Performance

v6.2.11

dependabot Bot commented on behalf of github Oct 1, 2026 •

edited

Loading