chore(deps): bump the npm-deps group across 1 directory with 25 updates

[dependabot]

Bumps the npm-deps group with 25 updates in the /apps/web directory:

Package	From	To
@radix-ui/react-avatar	1.1.12	1.2.6
@radix-ui/react-dropdown-menu	2.1.17	2.1.24
@radix-ui/react-slot	1.2.5	1.3.3
@radix-ui/react-tooltip	1.2.9	1.2.16
@tanstack/react-query	5.101.0	5.101.4
@xyflow/react	12.11.0	12.11.2
framer-motion	12.40.0	12.42.2
lenis	1.3.23	1.3.25
lucide-react	1.18.0	1.27.0
next	15.5.19	16.2.12
next-auth	5.0.0-beta.31	5.0.0-beta.32
react	19.1.0	19.2.8
react-dom	19.1.0	19.2.8
recharts	3.8.1	3.10.1
three	0.184.0	0.185.1
@types/three	0.184.1	0.185.1
@eslint/eslintrc	3.3.5	3.3.6
@playwright/test	1.60.0	1.62.0
@tailwindcss/postcss	4.3.1	4.3.3
@types/node	20.19.43	26.1.1
eslint	9.39.4	10.8.0
eslint-config-next	15.5.19	16.2.12
prettier	3.8.4	3.9.6
tailwindcss	4.3.1	4.3.3
typescript	5.9.3	7.0.2

Updates @radix-ui/react-avatar from 1.1.12 to 1.2.6

Changelog

Sourced from @​radix-ui/react-avatar's changelog.

1.2.6

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-context@1.2.2, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-is-hydrated@0.1.3, @radix-ui/react-use-layout-effect@1.1.4

1.2.5

• Updated dependencies: @radix-ui/react-primitive@2.1.9

1.2.4

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-context@1.2.1, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-callback-ref@1.1.3, @radix-ui/react-use-is-hydrated@0.1.2, @radix-ui/react-use-layout-effect@1.1.3

1.2.3

• Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
• Fix dev-only checks with conditional exports to drop dev-warnings from production builds.
• Updated dependencies: @radix-ui/primitive@1.1.6, @radix-ui/react-context@1.2.0, @radix-ui/react-primitive@2.1.7, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-is-hydrated@0.1.1, @radix-ui/react-use-layout-effect@1.1.2

1.2.2

• Updated dependencies: @radix-ui/react-context@1.2.0

1.2.1

• Updated dependencies: @radix-ui/react-primitive@2.1.7

1.2.0

• Fixed several edge cases with Avatar's loading state
  • An avatar's fallback would not be displayed again if its image component unmounted. This is now fixed.
  • Rendering multiple Avatar.Image components per Avatar.Root was never supported and results in buggy, unpredictable behavior. We now warn about this in development.
  • Zero-sized images were treated as loading, meaning that onLoadingStatusChange is never called once loaded. A zero-sized image now triggers an error status on load.

Other updates

• Fixed console warnings to show in test environments.
• Updated dependencies: @radix-ui/react-primitive@2.1.6

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.17 to 2.1.24

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.24

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

2.1.23

• Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

2.1.22

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-menu@2.1.22, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5

2.1.21

• Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
• Updated dependencies: @radix-ui/react-menu@2.1.21, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7

2.1.20

• Fixed menu items, tab triggers, toolbar links, and select items intercepting Space/Enter keys that originate from focusable descendants.
• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-menu@2.1.20

2.1.19

• Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.

Other updates

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-menu@2.1.19

2.1.18

• Fixed a bug where menus and submenus remained open after a window loses focus.
• Updated dependencies: @radix-ui/react-menu@2.1.18, @radix-ui/react-primitive@2.1.6

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.2.5 to 1.3.3

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.2, 1.3.3

• Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.

const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>('Slot');

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.2.9 to 1.2.16

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.2.16

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-id@1.1.4, @radix-ui/react-popper@1.3.7, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-visually-hidden@1.2.11

1.2.15

• Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-popper@1.3.6, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

1.2.14

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-id@1.1.3, @radix-ui/react-popper@1.3.5, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3, @radix-ui/react-visually-hidden@1.2.9

1.2.13

• Fixed a bug where Tooltip.Content children were mounted to the DOM twice.
• Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
• Updated dependencies: @radix-ui/react-popper@1.3.4, @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-visually-hidden@1.2.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-layout-effect@1.1.2

1.2.12

• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.15, @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7, @radix-ui/react-popper@1.3.3

1.2.11

• Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-popper@1.3.2, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7

1.2.10

• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

Commits

• See full diff in compare view

Updates @tanstack/react-query from 5.101.0 to 5.101.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.101.4
  • @​tanstack/react-query@​5.101.4

@​tanstack/react-query-next-experimental@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.4

@​tanstack/react-query-persist-client@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.4
  • @​tanstack/react-query@​5.101.4

@​tanstack/react-query@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.4

@​tanstack/react-query-devtools@​5.101.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.101.3
  • @​tanstack/react-query@​5.101.3

@​tanstack/react-query-next-experimental@​5.101.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.3

@​tanstack/react-query-persist-client@​5.101.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.3
  • @​tanstack/react-query@​5.101.3

@​tanstack/react-query@​5.101.3

Patch Changes

• Updated dependencies [7e3c822]:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.4

5.101.3

Patch Changes

• Updated dependencies [7e3c822]:
  • @​tanstack/query-core@​5.101.3

5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

5.101.1

Patch Changes

• Updated dependencies [9eff92e]:
  • @​tanstack/query-core@​5.101.1

Commits

• 86bb8a6 ci: Version Packages (#11094)
• 181ea82 ci: Version Packages (#11089)
• 6d55b07 test({react,preact}-query): use the '.then()' convention consistently (#11085)
• 44f38df test({react,preact,solid}-query/useInfiniteQuery): inline the shared 'fetchIt...
• d1558c1 test({react,preact}-query/usePrefetchQuery): inline the 'generateQueryFn' fac...
• 99690d1 test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use helper...
• 10770f0 test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared 'Suspe...
• dbd5a86 test({react,preact}-query/usePrefetchQuery): inline the shared 'Suspended' co...
• b955f60 test({react,preact}-query/useSuspenseQuery): assert the 'loading' fallback is...
• b9c657e test({react,preact}-query/usePrefetchQuery): assert the 'Loading...' fallback...
• Additional commits viewable in compare view

Updates @xyflow/react from 12.11.0 to 12.11.2

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

@​xyflow/react@​12.11.1

Patch Changes

• #5815 87da45c - Fix FinalConnectionState type so it preserves the discriminated union.

• #5823 a6afc91 - Update attribution link

• #5824 6b1dac5 - Do not fire on pane click when connection ends on pane

• #5818 4ddc2d8 - Provide the shared handle config (connectOnClick, noPanClassName, rfId) through context instead of subscribing to the store in every Handle, so a store update no longer runs a selector once per handle

• #5817 8df250b - Reduce per-handle work on store updates by returning a shared connection state while no connection is in progress.

• #5822 a6249de - Return stable reference for edge position when connected node gets deleted

• Updated dependencies [ceb8604, 87da45c]:

  • @​xyflow/system@​0.0.78

Changelog

Sourced from @​xyflow/react's changelog.

12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

12.11.1

Patch Changes

• #5815 87da45c - Fix FinalConnectionState type so it preserves the discriminated union.

• #5823 a6afc91 - Update attribution link

• #5824 6b1dac5 - Do not fire on pane click when connection ends on pane

• #5818 4ddc2d8 - Provide the shared handle config (connectOnClick, noPanClassName, rfId) through context instead of subscribing to the store in every Handle, so a store update no longer runs a selector once per handle

• #5817 8df250b - Reduce per-handle work on store updates by returning a shared connection state while no connection is in progress.

• #5822 a6249de - Return stable reference for edge position when connected node gets deleted

• Updated dependencies [ceb8604, 87da45c]:

  • @​xyflow/system@​0.0.78

Commits

• 3ab66ef chore(packages): bump
• 01d58b6 Merge pull request #5846 from AlaricBaraou/perf/viewport-imperative-transform
• 742860c perf(react): skip minimap re-renders when its geometry is unchanged
• 17c64a1 perf(react): apply the viewport transform imperatively instead of re-renderin...
• 775bdd6 Merge pull request #5825 from AlaricBaraou/perf/xydrag-draggable-only
• 576a43d refactor(react): pass nodesDraggable to prevent wrong initial state
• eedbc81 chore(packages): bump
• c7bdce4 chore(pane): cleanup
• cd5ec45 chore(react/pane): cleanup
• f919daa fix(pane): do not fire pane click when connection ends on pane
• Additional commits viewable in compare view

Updates framer-motion from 12.40.0 to 12.42.2

Changelog

Sourced from framer-motion's changelog.

[12.42.2] 2026-07-01

Fixed

• animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

• animateView: Old layer fade out now cancelled when defining .new().

[12.42.0] 2026-06-24

Changed

• animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

• animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.
• animateView: Disabled automatic border-radius animation.

[12.41.0] 2026-06-23

Added

• animateView: Moves from Motion+ Early Access and alpha to main library.
• animateView: .add() resolves a CSS selector or Element to automatically generate, apply and remove view-transition-name.
• animateView: .new() and .old() configures values to animate on new and old layers.
• animateView: .layout() can set a custom transition on the size/position animation of the currently selected elements.
• animateView: Group layers now automatically crop with children set to cover, with border-radius animating from old radius to new. .crop(false) disables this behaviour.
• animateView: .class(name) tags currently selected elements with a view-transition-class as a custom CSS hook.

Fixed

• AnimatePresence: Prevent stuck exit animations when children interrupt.
• drag: Child e.stopPropagation() no longer break drag end.
• Fixing Next.js OOM on Windows when importing via motion package.
• animateLayout: Improve handling of parallel/interleaved calls.

Changed

• animateView: .enter() and .exit() now refer specifically to new and old layers where there are no matching old or new layers.
• animateView: Interrupted transition setups now return resolved animation rather than throwing.

Commits

• 40e8756 v12.42.2
• 718ccc7 Merge pull request #3768 from motiondivision/view-cropped-corner-radius
• 19195a4 Dedupe corner-radius longhands; merge crop box/radii measurements
• 5299aa6 Resolve cropped-clip radius timing once; fix transition-option leak
• 937cdf3 Animate cropped view-transition group corner radius
• fd2d6f6 v12.42.1
• 2223d87 Hold the old layer when only a non-opacity .new() is set
• 9c84145 v12.42.0
• 60d7c72 Add view-transition group nesting and aspect-aware cropping
• 6437276 Updating
• Additional commits viewable in compare view

Updates lenis from 1.3.23 to 1.3.25

Release notes

Sourced from lenis's releases.

v1.3.25

• fix anchors with special characters

v1.3.24

• fix text selection on iOS

Commits

• 82f782e v1.3.25
• 0761f56 fix(core): resolve anchor targets with CSS-special-char ids (#520) (#526)
• 4ae9a70 v1.3.24
• 12a7341 fix(core): don't scroll while dragging iOS text-selection handles (#524)
• b283107 Fix sponsor links in README.md
• ba2f962 Update sponsor links in README.md
• dea8a3f Clean up sponsor section in README.md
• d5f4766 docs: expand Features into term/detail pairs
• e25471a docs: add Features section to README
• 80e95ca Update README.md
• Additional commits viewable in compare view

Updates lucide-react from 1.18.0 to 1.27.0

Release notes

Sourced from lucide-react's releases.

Version 1.27.0

What's Changed

• feat(icons): removed brand names from tags & revised brand stopwords by @​karsa-mistmere in lucide-icons/lucide#4575
• fix(docs): Fix site build by @​ericfennis in lucide-icons/lucide#4582
• fix(icons): optimised square-scissors icons by @​karsa-mistmere in lucide-icons/lucide#4581
• fix(packages/angular): add more supported attributes for SVG nodes by @​karsa-mistmere in lucide-icons/lucide#4570
• feat(icons): added pending-cw icon by @​NielsLazaroms in lucide-icons/lucide#4439
• fix(icons): changed zap and zap-off icons by @​kapowaz in lucide-icons/lucide#4536
• feat(icons): add square-off icon by @​october-learns in lucide-icons/lucide#4496
• chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @​dependabot[bot] in lucide-icons/lucide#4572
• fix(icons): changed toolbox icon by @​karsa-mistmere in lucide-icons/lucide#4571
• feat(icons): add scan-square by @​samuelalake in lucide-icons/lucide#4550
• feat(icons): added user-shield icon by @​MArtytraM99 in lucide-icons/lucide#3099
• feat(icons): added mosque icon by @​iskepr in lucide-icons/lucide#4494
• fix(request-review): Remove pull_request_target by @​ericfennis in lucide-icons/lucide#4593
• fix(icons): changed feather icon by @​karsa-mistmere in lucide-icons/lucide#4584
• feat(ci): added custom prettier plugin for icon SVG files by @​karsa-mistmere in lucide-icons/lucide#4576
• ci(ci.yml): Remove concurrency in ci.yml by @​ericfennis in lucide-icons/lucide#4595
• fix(icons): changed barrel icon by @​karsa-mistmere in lucide-icons/lucide#4592
• feat(lab): Migrate lab to main repo. by @​ericfennis in lucide-icons/lucide#4521
• fix(icons): changed trophy icon by @​karsa-mistmere in lucide-icons/lucide#4591
• feat(analytics): add utm source and medium by @​jguddas in lucide-icons/lucide#4596
• feat(docs): Add lab requirement in pull_request_template.md by @​danielbayley in lucide-icons/lucide#3651
• feat(icons): replaces podcast icon with new mic-* icons by @​karsa-mistmere in lucide-icons/lucide#4583
• feat(icons): add layout-freeform by @​samuelalake in lucide-icons/lucide#4543

New Contributors

• @​NielsLazaroms made their first contribution in lucide-icons/lucide#4439
• @​kapowaz made their first contribution in lucide-icons/lucide#4536
• @​october-learns made their first contribution in lucide-icons/lucide#4496
• @​samuelalake made their first contribution in lucide-icons/lucide#4550
• @​iskepr made their first contribution in lucide-icons/lucide#4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

• fix(docs): fix home page package links & accessible labels by @​karsa-mistmere in lucide-icons/lucide#4540
• fix(icons): changed columns-3-cog icon by @​kamilasw in lucide-icons/lucide#4578
• fix(icons): extended metadata of ad icon by @​karsa-mistmere in lucide-icons/lucide#4579
• fix(icons): changed book-open icons by @​karsa-mistmere in lucide-icons/lucide#4565
• feat(icons): added shield-keyhole icon by @​karsa-mistmere in lucide-icons/lucide#4580

New Contributors

• @​kamilasw made their first contribution in lucide-icons/lucide#4578

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

Version 1.25.0

What's Changed

... (truncated)

Commits

• f229f83 chore(depedencies): Update dependencies (#4553)
• 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
• See full diff in compare view

Updates next from 15.5.19 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

• Backport/docs fixes 16.2 - July round by @​icyJoseph in vercel/next.js#96031
• [Backport] Fixes to support TypeScript 7 by @​lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

• 2234717 v16.2.12
• 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
• b56eb16 Backport/docs fixes 16.2 - July round (#96031)
• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• Additional commits viewable in compare view

Updates next-auth from 5.0.0-beta.31 to 5.0.0-beta.32

Release notes

Sourced from next-auth's releases.

next-auth@5.0.0-beta.32

Beta release for the v5 line.

Picks up the @​auth/core@​0.41.3 security fixes (malformed Bearer token handling in getToken, provider-bound OAuth check cookies, and NFKC email normalization).

Fixes auth checks failing open on provider configuration errors: a non-OK session response now yields no session instead of an error object, so checks like !!auth fail closed.

Commits

• e293b37 chore(release): next-auth@5.0.0-beta.32 [skip ci]
• b690d91 chore: add npm bugs metadata and fix repository field format (#13452)
• 5af7357 chore(release): bump package version(s) [skip ci]
• 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
• 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
• 1116034 Chore/nodemailer 8 peer deps (#13434)
• 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
• b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
• a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
• d008b9b Merge commit from fork
• Additional commits viewable in compare view

Updates react from 19.1.0 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

19.2.3 (December 11th, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (December 11th, 2025)

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon facebook/react#35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #35289, #35345)

19.2.1 (December 3rd, 2025)

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #35277)

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

19.2.3 (Dec 11, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (Dec 11, 2025)

React Server Components

• Move react-server-dom-webpack/...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repopilot	Error		Jul 26, 2026 6:19am