[dependabot]

Bumps the production-minor-patch group with 44 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.131.0	0.135.0
@aws-sdk/client-s3	3.1146.0	3.1152.0
@aws-sdk/s3-request-presigner	3.1146.0	3.1152.0
@better-auth/core	1.7.7	1.7.10
@hookform/resolvers	5.9.1	5.9.2
@napi-rs/canvas	1.0.10	1.0.11
@prisma/adapter-pg	7.10.0	7.10.1
@prisma/client	7.10.0	7.10.1
@radix-ui/react-accordion	1.2.20	1.3.1
@radix-ui/react-alert-dialog	1.1.23	1.2.1
@radix-ui/react-avatar	1.2.6	1.3.1
@radix-ui/react-dialog	1.1.23	1.3.1
@radix-ui/react-dropdown-menu	2.1.24	2.2.1
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-popover	1.1.23	1.3.1
@radix-ui/react-select	2.3.7	2.4.1
@radix-ui/react-separator	1.1.15	1.2.0
@radix-ui/react-slider	1.4.7	1.6.1
@radix-ui/react-slot	1.3.3	1.5.0
@radix-ui/react-switch	1.3.7	1.4.1
@radix-ui/react-tabs	1.1.21	1.2.1
@radix-ui/react-tooltip	1.2.16	1.4.1
@react-email/render	2.1.0	2.1.1
@sentry/nextjs	11.4.0	11.8.0
@vercel/blob	2.8.0	2.8.2
better-auth	1.7.7	1.7.10
cron-parser	5.10.1	5.10.2
dompurify	3.4.16	3.4.17
gpt-tokenizer	4.0.0	4.1.0
libphonenumber-js	1.13.14	1.13.15
lucide-react	1.52.0	1.59.0
mermaid	12.1.0	12.2.0
next	16.3.8	16.4.2
openai	7.28.0	7.38.0
prisma	7.10.0	7.10.1
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-easy-crop	6.2.3	6.2.4
react-email	6.11.0	6.11.3
react-hook-form	7.89.0	7.90.0
react-window	2.3.3	2.3.4
resend	6.32.0	6.34.1
safe-regex2	5.1.1	5.1.2
zod	4.6.5	4.6.7

Updates @anthropic-ai/sdk from 0.131.0 to 0.135.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

sdk-v0.134.0

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start
• streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.135.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

0.134.0 (2026-10-14)

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start

... (truncated)

Commits

• 04a4c28 release: 0.135.0
• 69dbe62 Merge pull request #935 from anthropics/synced/published
• b61a531 feat(helpers): retry a rate-limited fast fallback at standard speed (#943)
• 38d0ab4 feat(api): add between_tools to thinking types in model capabilities
• 366b53b chore(docs): describe headers on Managed Agents and telemetry endpoints
• ca50812 docs(api): note that some models need a beta header to use speed
• 03f6012 fix(helpers): honor speed overrides from fallback entries when streaming (#942)
• 88bf034 docs(changelog): shorten the OpenTelemetry tracing note (#941)
• 7c807a0 fix(client): close streams dropped without being read to the end
• 64758f6 feat(api): add the speed parameter and usage.speed to Messages
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1146.0 to 3.1152.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes

• client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)

New Features

• clients: update client endpoints as of 2026-10-14 (91a8a07c)
• client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
• client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
• client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
• client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
• client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
• client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
• client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
• client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
• client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
• client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
• lib-transfer-manager: publish as a preview package (#8355) (41080929)

---

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores

• lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
• scripts: add preview/ folder to build tooling (#8350) (a922905a)

Documentation Changes

• client-lambda-web: Documentation update to include common use cases. (643507a0)

New Features

• clients: update client endpoints as of 2026-10-13 (d3994582)
• client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
• client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
• client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
• client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
• client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
• client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
• client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
• client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/client-s3

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/client-s3

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/client-s3

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

• 3ce8aa7 Publish v3.1152.0
• d6adfcb Publish v3.1151.0
• 4c9a334 Publish v3.1150.0
• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• 1bc0425 Publish v3.1148.0
• 663046d Publish v3.1147.0
• See full diff in compare view

Updates @aws-sdk/s3-request-presigner from 3.1146.0 to 3.1152.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes

• client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)

New Features

• clients: update client endpoints as of 2026-10-14 (91a8a07c)
• client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
• client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
• client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
• client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
• client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
• client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
• client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
• client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
• client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
• client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
• lib-transfer-manager: publish as a preview package (#8355) (41080929)

---

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores

• lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
• scripts: add preview/ folder to build tooling (#8350) (a922905a)

Documentation Changes

• client-lambda-web: Documentation update to include common use cases. (643507a0)

New Features

• clients: update client endpoints as of 2026-10-13 (d3994582)
• client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
• client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
• client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
• client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
• client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
• client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
• client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
• client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

Commits

• 3ce8aa7 Publish v3.1152.0
• d6adfcb Publish v3.1151.0
• 4c9a334 Publish v3.1150.0
• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• 1bc0425 Publish v3.1148.0
• 663046d Publish v3.1147.0
• See full diff in compare view

Updates @better-auth/core from 1.7.7 to 1.7.10

Release notes

Sourced from @​better-auth/core's releases.

v1.7.10

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
• Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
• Improved errors for unknown OAuth client_id values to say client not found. (#11799)
• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.7.10

Patch Changes

• #11612 fedd055 Thanks @​vhinayindia! - If your resource server verifies access tokens with verifyAccessTokenRequest or verifyBearerToken and a jwksUrl, including through the MCP plugin, a key set that cannot be reached at all, for example a refused connection, now throws an error. Before, the token was rejected as invalid with 401 "no token payload", which hid the outage. A key set that answers with an HTTP error already threw.

  With remoteVerify configured, such a failure no longer falls back to remote introspection.

  The OAuth provider's /oauth2/introspect, /oauth2/userinfo and /oauth2/revoke behave the same way with the JWT plugin's jwks.remoteUrl: they return 500 instead of reporting the token as invalid.

• #11805 bbd0a19 Thanks @​gustavovalverde! - Servers that verify JWTs against a key set now refetch that key set at most once every 30 seconds per server process when a token names a key ID (kid) the cached set does not contain. This covers the OAuth provider plugin's introspection, revocation, UserInfo, and logout endpoints, and resource servers that call verifyAccessTokenRequest or verifyBearerToken with jwksUrl. Previously every such token caused a new fetch: a remote request with jwksUrl or jwks.remoteUrl, or otherwise a read of the jwks table. Anyone could send tokens with made-up kid values to force one fetch per request, and the UserInfo endpoint needs no client credentials.

  Concurrent verifications now share one fetch, and a key set fetch that takes longer than 5 seconds fails with a JWKSTimeout error instead of waiting indefinitely.

  A token signed with a newly published key still verifies without waiting for the 5-minute cache to expire. It can be rejected for up to 30 seconds if the key set was already refetched for another unknown kid in that time. No configuration change is needed.

1.7.9

1.7.8

Patch Changes

• #11512 4175b34 Thanks @​bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

• #11592 435645e Thanks @​drewsephski! - Fix Atlassian user info errors being logged as coming from Figma.

• #11625 369176e Thanks @​gustavovalverde! - Fixed single-use checks for apps that set advanced.database.generateId: "uuid". Default id generation is unaffected, and no migration is needed.

  • On SQLite and MySQL, SAML sign-in, DPoP-bound requests checked against the database replay store, private_key_jwt client authentication, and magic link or email OTP sign-ins that adopt an unverified account failed with a NOT NULL error on the id column. They now work. SIWE sign-in ignored the email field and used the wallet-derived address; it now uses the supplied email when no other account has it.
  • On Postgres and MongoDB, a reused SAML assertion, DPoP proof, or client assertion was accepted. Each one is now accepted only once.

  With generateId: "serial", behavior is unchanged: these checks need string ids, and Better Auth now logs a warning the first time one of these flows runs.

• #11749 e78f15a Thanks @​gustavovalverde! - ID token verification now allows 30 seconds of clock difference between your server and the identity provider when checking exp, nbf, and iat. Previously, a provider whose clock ran even slightly ahead (for example, an nbf set a fraction of a second in the future) made sign-in fail. This affected generic OAuth providers configured with discoveryUrl since 1.7.0, ID token sign-in with the built-in social providers, and Google One Tap. Tokens up to 30 seconds past exp are now also accepted. No configuration change is needed. A custom verifyIdToken replaces this check and must set its own tolerance, and the SSO plugin's OIDC sign-in is unchanged.

• #11663 60525e0 Thanks @​kaiizer777! - Fixed Microsoft Entra ID sign-in with an ID token (signIn.social with idToken, and linking an account with an ID token) rejecting every token. Microsoft publishes its signing keys without an alg field, which made verification fail. Those keys are now treated as RS256, and Microsoft ID tokens signed with any other algorithm are rejected. The redirect sign-in flow was not affected.

• #11515 916ef5c Thanks @​BilalAtique! - If you pass client to mongodbAdapter on a replica set, concurrent requests that write the same documents no longer fail with a 500. Before, MongoDB aborted all but one of them with a write conflict, so a SCIM directory that provisions several users at once returned 500 for most of them. The adapter now retries such a transaction, as MongoDB requires, for up to 120 seconds or until your MongoClient's timeoutMS. Under contention a request can take longer instead of failing.

  A retry runs the work again. databaseHooks before hooks can run more than once for one request, and after hooks still run once, after the commit. Work that the request does outside the database before it commits can also repeat on a retried request. For example, an email sign-up can send its verification email twice. Requests that succeed on the first attempt are unaffected, and so are other adapters.

• #11718 1d95ebf Thanks @​bytaesu! - Fix missing device sessions and failed automatic session switching after cache eviction when storeSessionInDatabase is enabled and preserveSessionInDatabase is disabled. Automatic switching now follows the order of held sessions, and large lists or sessions whose users no longer exist no longer cause valid sessions to disappear.

• #10956 6214610 Thanks @​disbell! - Native OAuth clients and Client ID Metadata Documents can now use custom-scheme redirect URIs with a host and a path, such as Cursor's cursor://anysphere.cursor-mcp/oauth/callback. Previously, only the authority-free reverse-domain form, such as com.example.app:/callback, was accepted, and these registrations failed with invalid_redirect_uri.

  Cursor also omits application_type when it registers, so the web default still rejects it. To accept Cursor, set the new clientRegistrationDefaultApplicationType option to "infer". A dynamic registration that omits application_type then becomes native when any of its redirect URIs uses a custom scheme, and every redirect URI must pass the native rules. Setting "native" treats every registration that omits the field as native. The default remains "web", and an application_type the client sends is never overridden.

  Pairwise clients (subject_type: "pairwise") cannot use these host-bearing custom-scheme redirect URIs. Web clients are unaffected: they still accept only https redirect URIs on non-loopback hosts.

• #11626 67743ed Thanks @​gustavovalverde! - Password resets and password changes no longer keep the new password when revoking the user's sessions fails. With revokeSessionsOnPasswordReset or revokeOtherSessions, database sessions are revoked and the password is saved in one transaction when transactions are enabled for the adapter, so a failure leaves the old password and sessions in place. Sessions in secondary storage are still removed after commit, on a best-effort basis. This covers /reset-password, the email OTP and phone number reset endpoints, and /change-password. onPasswordReset now runs after sessions are revoked, so a throwing callback no longer leaves them active, and a callback that lists the user's sessions no longer sees the revoked ones.

... (truncated)

Commits

• b734a41 chore: release v1.7.10 (#11795)
• bb5edcf fix(core): use a newer cached key set before joining a pending JWKS fetch (#1...
• fedd055 fix(oauth2): report an unreachable JWKS as an error, not an invalid token (#1...
• bbd0a19 fix(core): limit JWKS refetches for unknown key IDs (#11805)
• d2a5f83 chore: release v1.7.9 (#11761)
• c03ced5 chore: bump @biomejs/biome (#11760)
• 5f4cc5c chore: release v1.7.8 (#11513)
• e78f15a fix(core): allow 30s of clock skew when verifying ID tokens (#11749)
• 60525e0 fix(core): verify microsoft entra id tokens when jwks keys omit alg (#11663)
• 916ef5c fix(mongo-adapter): retry a transaction aborted with a transient error (#11515)
• Additional commits viewable in compare view

Updates @hookform/resolvers from 5.9.1 to 5.9.2

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

• ajv: preserve escaped field names in validation errors (#879) (71e6052)

Commits

• 71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
• 8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
• See full diff in compare view

Updates @napi-rs/canvas from 1.0.10 to 1.0.11

Release notes

Sourced from @​napi-rs/canvas's releases.

v1.0.11

What's Changed

• chore(deps): update rust to v1.99.0 by @​renovate[bot] in Brooooooklyn/canvas#1349
• feat: emit CycloneDX SBOMs for platform packages by @​Brooooooklyn in Brooooooklyn/canvas#1351
• ci: attest binaries only on releases and in a single step by @​Brooooooklyn in Brooooooklyn/canvas#1354
• fix: start a new subpath for each Path2D.addPath call by @​binarychase in Brooooooklyn/canvas#1353

New Contributors

• @​binarychase made their first contribution in Brooooooklyn/canvas#1353

Full Changelog: Brooooooklyn/canvas@v1.0.10...v1.0.11

Changelog

Sourced from @​napi-rs/canvas's changelog.

1.0.11 (2026-10-10)

Bug Fixes

• start a new subpath for each Path2D.addPath call (#1353) (363cbd6)

Features

• emit CycloneDX SBOMs for platform packages (#1351) (22d9b29)

Commits

• adce718 1.0.11
• 363cbd6 fix: start a new subpath for each Path2D.addPath call (#1353)
• bad0717 ci: attest binaries only on releases and in a single step (#1354)
• 22d9b29 feat: emit CycloneDX SBOMs for platform packages (#1351)
• dfab6dc chore(deps): update rust to v1.99.0 (#1349)
• See full diff in compare view

Updates @prisma/adapter-pg from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had committed, the new one failed with P2028;
• if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 }
await prisma.$transaction(async (tx) => {
await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS)
})
// Before 7.10.1, this call could fail with P2028 or join another transaction.
await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)

Prisma Client no longer modifies the options object. (prisma/orm#30368, thanks @​lazerg)

Prisma Migrate: refuse a shadow database that is the main database

Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (prisma/prisma-engines#5851)

MariaDB adapter: updated to mariadb 3.5.4

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (prisma/orm#30668)

Dependency updates

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (prisma/orm#30314, prisma/orm#30189, prisma/orm#30668)

Commits

• 312e543 chore: update npm provenance repository (#30146)
• See full diff in compare view

Updates @prisma/client from 7.10.0 to 7.10.1

Release notes

Sourced from @​prisma/client's releases.

7.10.1

Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.

Fixes

Prisma Client: nested $transaction no longer changes the options object you pass in

If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:

• if the old transaction had c...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.