Skip to content

chore(deps): bump the dashboard-deps group across 1 directory with 13 updates - #127

Merged
AbirAbbas merged 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/dashboard/dashboard-deps-a00d2c17b6
Jun 29, 2026
Merged

AbirAbbas merged 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/dashboard/dashboard-deps-a00d2c17b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 23, 2026 •

Copy link
Copy Markdown

Bumps the dashboard-deps group with 13 updates in the /apps/dashboard directory:

Package From To
@base-ui/react 1.5.0 1.6.0
better-auth 1.6.14 1.6.22
kysely 0.28.17 0.29.2
lucide-react 1.17.0 1.22.0
next 16.2.7 16.2.9
pg 8.21.0 8.22.0
react 19.2.4 19.2.7
react-dom 19.2.4 19.2.7
react-hook-form 7.77.0 7.80.0
recharts 3.8.0 3.9.0
shadcn 4.10.0 4.12.0
eslint-config-next 16.2.7 16.2.9
playwright 1.60.0 1.61.1

Updates @base-ui/react from 1.5.0 to 1.6.0

Release notes

Sourced from @​base-ui/react's releases.

v1.6.0

General changes

Accordion

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Collapsible

Combobox

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.6.0

Jun 18, 2026

General changes

Accordion

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Collapsible

Combobox

... (truncated)

Commits
  • b34551d [code-infra] Fix package publishing (#5074)
  • 615b0e8 [release] v1.6.0 (#5064)
  • 8b7ca5d [test] Restore slider listener spies (#5072)
  • 2502524 [combobox][autocomplete] Document open requirement for the inline prop (#...
  • 4c33d74 [slider] Fix touchend listener accumulation leak (#5070)
  • d169cd5 [combobox] Fix autofill and selected state edge cases (#4972)
  • 2d8b8f6 [avatar] Fix image status edge cases (#4835)
  • ee3c13a [select] Skip disabled items in typeahead and fix multiple-mode serialization...
  • b167c85 [drawer] Commit swipe on primary-button release (#5057)
  • e972d74 [combobox] Avoid re-rendering every item on each keystroke (#4964)
  • Additional commits viewable in compare view

Updates better-auth from 1.6.14 to 1.6.22

Release notes

Sourced from better-auth's releases.

v1.6.22

better-auth

Bug Fixes

  • Fixed unproven credentials not being revoked during magic link and email OTP sign-in (#10239)
  • Fixed server-side OAuth requests to refuse redirect responses instead of following them (#10241)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

  • Fixed SCIM write-path operations to be properly scoped and to correctly honor the active attribute (#10242)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

  • Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

  • Added account-level verification lockout for two-factor authentication (#10240)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.6.21...v1.6.22

v1.6.21

better-auth

Bug Fixes

  • Fixed rate limits to be enforced before plugin request handlers run (#10191)
  • Fixed admin permission changes and bans to take effect immediately, even when session cookie cache is enabled (#10187)
  • Fixed deviceAuthorization() throwing a ZodError when called without a schema option under Zod v4 (#9939)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.22

Patch Changes

  • #10239 c06a56d Thanks @​gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

    If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

  • #10240 3a035e9 Thanks @​gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

    Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

    Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

  • Updated dependencies [8bd43d9]:

    • @​better-auth/core@​1.6.22
    • @​better-auth/drizzle-adapter@​1.6.22
    • @​better-auth/kysely-adapter@​1.6.22
    • @​better-auth/memory-adapter@​1.6.22
    • @​better-auth/mongo-adapter@​1.6.22
    • @​better-auth/prisma-adapter@​1.6.22
    • @​better-auth/telemetry@​1.6.22

1.6.21

Patch Changes

  • #10212 e0762a1 Thanks @​bytaesu! - In root-mounted deployments, requests whose path does not start with the configured basePath now return 404 instead of resolving to an endpoint.

  • #10187 882cf9e Thanks @​ping-maxwell! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.

  • #9939 f52e1ab Thanks @​benpsnyder! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option

  • #10196 b5bec19 Thanks @​Paola3stefania! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked input: false. Input-allowed additional fields still persist from mapProfileToUser, and schema defaults still apply when OAuth creates a user. Apps that used mapProfileToUser to fill input: false fields should set those fields in server-side provisioning code instead.

  • #10197 816d7f9 Thanks @​Paola3stefania! - Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim.

    Google One Tap now applies the configured Google hosted-domain restriction before creating a session.

  • #10192 239bcc8 Thanks @​bytaesu! - Validate PayPal user info against the verified ID token subject during social sign-in.

  • #10228 1bc370a Thanks @​gustavovalverde! - The SIWE plugin no longer binds a provided email that already belongs to another account. With anonymous set to false, /siwe/verify previously created the new account using that email even when it was already in use; it now keeps the wallet-derived address in that case, so one email cannot be attached to two accounts.

  • #10198 570267c Thanks @​rachit367! - Honor disableMigration on plugin schema tables. Tables flagged with disableMigration: true are now skipped by better-auth generate (Drizzle and Prisma output) and by the runtime migrator, instead of being emitted and created anyway. The flag was previously dropped while assembling the table list, so it had no effect.

  • #10182 461ca6f Thanks @​bytaesu! - Only store display username fallbacks as usernames when they pass username validation during email sign-up.

  • #10183 88409b0 Thanks @​bytaesu! - Require OAuth proxy profile callbacks to match an issued OAuth state before creating sessions.

  • #10203 5953157 Thanks @​bytaesu! - Rate limiting no longer trusts multi-hop X-Forwarded-For chains, preventing a client behind an appending proxy from spoofing the leftmost hop to bypass the per-IP rate limit. Single-value IP headers continue to work. To key the real client behind a proxy chain, set advanced.ipAddress.trustedProxies to your reverse-proxy IPs or CIDR ranges (the chain is walked right to left, skipping trusted hops), or point advanced.ipAddress.ipAddressHeaders at a single trusted client-IP header.

... (truncated)

Commits
  • a90d061 chore: release v1.6.22 (#10245)
  • 3a035e9 fix(two-factor): add account-level verification lockout (#10240)
  • c06a56d fix: revoke unproven credentials on magic-link/email-OTP sign-in (#10239)
  • 414169d chore: release v1.6.21 (#10184)
  • f52e1ab fix(device-authorization): make schema option optional under Zod v4 (#9939)
  • 882cf9e fix(admin): use authoritative session reads for authorization (#10187)
  • b5bec19 fix(oauth): apply user input rules to provider profiles (#10196)
  • 471f81c refactor: centralize request IP resolver in core (#10216)
  • 816d7f9 fix(one-tap): apply configured Google hosted domain (hd) on the callback (#10...
  • 1bc370a fix(siwe): reject sign-in when the provided email already belongs to another ...
  • Additional commits viewable in compare view

Updates kysely from 0.28.17 to 0.29.2

Release notes

Sourced from kysely's releases.

0.29.2

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: kysely-org/kysely@v0.29.1...v0.29.2

0.29.1

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: kysely-org/kysely@v0.29.0...v0.29.1

... (truncated)

Commits

Updates lucide-react from 1.17.0 to 1.22.0

Release notes

Sourced from lucide-react's releases.

Version 1.22.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.21.0...1.22.0

Version 1.21.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.20.0...1.21.0

Version 1.20.0

What's Changed

... (truncated)

Commits
  • 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
  • See full diff in compare view

Updates next from 16.2.7 to 16.2.9

Release notes

Sourced from next's releases.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

Commits

Updates pg from 8.21.0 to 8.22.0

Changelog

Sourced from pg's changelog.

pg@8.22.0

Commits

Updates react from 19.2.4 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.4 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates react-hook-form from 7.77.0 to 7.80.0

Release notes

Sourced from react-hook-form's releases.

Version 7.80.0

🧄 feat: disable useFieldArray fields (#13535)

const { fields } = useFieldArray({ disabled: true });
fields[0].disabled; // contains disabled props

🛺 perf: make rhf more performant (#13524) 🐞 fix(deepEqual): empty array and empty plain object should not be equal (#13533)

thanks to @​JSap0914

Version 7.79.0

🚷 feat: use field array disabled (#13520)

useFieldArray({ disabled, name: 'test' })

🐞 fix controller onChange promise (#13518) 🐞 fix: track visited pairs in deepEqual to avoid false positives with shared object references (#13515) 🐞 fix #12651 issue: field validation with shouldUseNativeValidation does not behave native like for radio groups (#13512) 🐞 fix #12754 createFormControl breaks with fast refresh in dev mode (#13511) 🐞 close #12709 #12750 StrictMode would remove field value & get mounted again (#13508) 🐞 fix #13505 issue: In v8 with React compiler, a change in formState errors does not cause child components to re-render (#13510)

thanks to @​DucMinhNe & @​louzhedong

Version 7.78.0

🦷 update type dirtyFields typing for field arrays with undefined entries (#13492) 🐞 fix: recover Controller fields after reset without rerender (RN issue #13455) (#13497) 🐞 fix useFormState().isDirty race with async resolver in onChange mode (#13495) 🐞 fix: use reactive values prop over defaultValues when shouldUnregister is true (#13485) 🐞 fix deepEqual for empty non-plain objects (#13493)

thanks to @​cyphercodes

Changelog

Sourced from react-hook-form's changelog.

[7.80.0] - 2026-06-20

Added

  • disabled prop support for individual fields within useFieldArray

Fixed

  • deepEqual incorrectly treating empty array [] and empty plain object {} as equal

Performance

  • Improve onChange, setValid, dirty checking, setValue, and setValues performance

[7.79.0] - 2026-06-13

Added

  • disabled option to useFieldArray

Fixed

  • Controller onChange promise return type
  • deepEqual false positives with shared object references
  • shouldUseNativeValidation behavior for radio groups
  • createFormControl stability with fast refresh in dev mode
  • StrictMode value preservation during remount
  • formState.errors reactivity with React compiler

[7.78.0] - 2026-06-08

Fixed

  • Recover Controller fields after reset without rerender (RN issue #13455)
  • useFormState().isDirty race with async resolver in onChange mode
  • Use reactive values prop over defaultValues when shouldUnregister is true
  • deepEqual for empty non-plain objects

Types

  • Update dirtyFields typing for field arrays with undefined entries
Commits

Updates recharts from 3.8.0 to 3.9.0

Release notes

Sourced from recharts's releases.

v3.9.0

What's Changed

Animations

3.9 comes with new animations! There are several bug fixes and what's best, all animations are now fully customizable.

See the animations guide on https://recharts.github.io/en-US/guide/animations/

@dependabot @github

dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dashboard, dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@AbirAbbas

Copy link
Copy Markdown
Contributor

@dependabot rebase

… updates

Bumps the dashboard-deps group with 13 updates in the /apps/dashboard directory:

| Package | From | To |
| --- | --- | --- |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.5.0` | `1.6.0` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.14` | `1.6.22` |
| [kysely](https://github.com/kysely-org/kysely) | `0.28.17` | `0.29.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.17.0` | `1.22.0` |
| [next](https://github.com/vercel/next.js) | `16.2.7` | `16.2.9` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.21.0` | `8.22.0` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.7` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.77.0` | `7.80.0` |
| [recharts](https://github.com/recharts/recharts) | `3.8.0` | `3.9.0` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.10.0` | `4.12.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.7` | `16.2.9` |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.1` |



Updates `@base-ui/react` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.6.0/packages/react)

Updates `better-auth` from 1.6.14 to 1.6.22
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.6.22/packages/better-auth)

Updates `kysely` from 0.28.17 to 0.29.2
- [Release notes](https://github.com/kysely-org/kysely/releases)
- [Commits](kysely-org/kysely@v0.28.17...v0.29.2)

Updates `lucide-react` from 1.17.0 to 1.22.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.22.0/packages/lucide-react)

Updates `next` from 16.2.7 to 16.2.9
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.7...v16.2.9)

Updates `pg` from 8.21.0 to 8.22.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg)

Updates `react` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `react-hook-form` from 7.77.0 to 7.80.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.77.0...v7.80.0)

Updates `recharts` from 3.8.0 to 3.9.0
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.8.0...v3.9.0)

Updates `shadcn` from 4.10.0 to 4.12.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.12.0/packages/shadcn)

Updates `eslint-config-next` from 16.2.7 to 16.2.9
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.9/packages/eslint-config-next)

Updates `playwright` from 1.60.0 to 1.61.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.1)

---
updated-dependencies:
- dependency-name: "@base-ui/react"
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: better-auth
  dependency-version: 1.6.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dashboard-deps
- dependency-name: eslint-config-next
  dependency-version: 16.2.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dashboard-deps
- dependency-name: kysely
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: lucide-react
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: next
  dependency-version: 16.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dashboard-deps
- dependency-name: pg
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: playwright
  dependency-version: 1.61.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dashboard-deps
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dashboard-deps
- dependency-name: react-hook-form
  dependency-version: 7.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: recharts
  dependency-version: 3.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
- dependency-name: shadcn
  dependency-version: 4.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dashboard-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/apps/dashboard/dashboard-deps-a00d2c17b6 branch from 4e92829 to 4974d53 Compare June 29, 2026 16:30
@AbirAbbas
AbirAbbas merged commit b924e02 into main Jun 29, 2026
3 of 9 checks passed
@AbirAbbas
AbirAbbas deleted the dependabot/npm_and_yarn/apps/dashboard/dashboard-deps-a00d2c17b6 branch June 29, 2026 16:38
AbirAbbas added a commit that referenced this pull request Jun 29, 2026
… fix) (#133)

Bumps the dashboard Dockerfile base image to node:26-alpine (#105). Node 25+
removed `corepack` from the core distribution, so the existing
`RUN corepack enable && corepack prepare pnpm@9.15.0` fails on node 26
(`/bin/sh: corepack: not found`, exit 127). Replace it with an explicit
`RUN npm install -g pnpm@9.15.0` in both the deps and build stages.

Validated (legacy docker build on node:26-alpine):
- node:26-alpine pulls; `npm install -g pnpm@9.15.0` succeeds (corepack fix)
- `pnpm install --frozen-lockfile --filter=dashboard...` resolves/installs clean under node 26
- `next build` of this dashboard is green on host node (see #127/#131/#110)

Supersedes #105 (which bumped the base image only and would fail on corepack).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant