Skip to content

chore(deps): bump the customer-app-deps group in /apps/customer-app with 14 updates - #203

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/customer-app/customer-app-deps-5dadd34bf5
Closed

chore(deps): bump the customer-app-deps group in /apps/customer-app with 14 updates#203
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/customer-app/customer-app-deps-5dadd34bf5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown

Bumps the customer-app-deps group in /apps/customer-app with 14 updates:

Package From To
@base-ui/react 1.5.0 1.7.0
@hookform/resolvers 5.4.0 5.9.1
better-auth 1.6.22 1.7.2
lucide-react 1.17.0 1.37.0
pg 8.21.0 8.23.0
@types/pg 8.20.0 8.23.1
react 19.2.4 19.2.8
@types/react 19.2.17 19.2.18
react-dom 19.2.4 19.2.8
@types/react-dom 19.2.3 19.2.5
react-hook-form 7.77.0 7.86.0
shadcn 4.10.0 4.19.0
sonner 2.0.7 2.0.8
zod 4.4.3 4.5.2

Updates @base-ui/react from 1.5.0 to 1.7.0

Release notes

Sourced from @​base-ui/react's releases.

v1.7.0

General changes

Accordion

Alert Dialog

  • Prevent <AlertDialog.Root> from reopening after remounting with a reused handle (#5109) by @​michaldudak

Autocomplete

Avatar

Button

Checkbox

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.7.0

Aug 4, 2026

General changes

Accordion

Alert Dialog

  • Prevent <AlertDialog.Root> from reopening after remounting with a reused handle (#5109) by @​michaldudak

Autocomplete

Avatar

Button

... (truncated)

Commits
  • 254f474 [release] v1.7.0 (#5404)
  • 9222cda [meter] Format clamped values (#5409)
  • becc19a [combobox][autocomplete][select] Fix listbox separator semantics (#5399)
  • 7cc0eef [drawer] Fix click-only outside dismissal after swipe (#5392)
  • 1a2ca3c [all components] Fix canceled exit unmount (#5401)
  • 166e8ac [popups] Fix quadratic dev-mode trigger registration check (#5400)
  • 071e892 [all components] Avoid unused popup handle attachments (#5394)
  • cbc87d1 [select] Stabilize scroll arrow cleanup test (#5402)
  • 3b5715c [all components] Fix popup handle lifecycle regressions (#5387)
  • 54cfcc1 [typescript] Preserve published internals types (#5386)
  • Additional commits viewable in compare view

Updates @hookform/resolvers from 5.4.0 to 5.9.1

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

  • isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

v5.8.0

5.8.0 (2026-08-13)

Features

v5.7.1

5.7.1 (2026-08-02)

Bug Fixes

  • ata-validator peer dependency version (#871) (827f20b)

v5.7.0

5.7.0 (2026-08-02)

Features

v5.6.0

5.6.0 (2026-08-01)

Features

  • improve all resovlers drops validation errors for special root field names (b011a5f)

v5.5.8

5.5.8 (2026-08-01)

... (truncated)

Commits
  • f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
  • c8159ae feat: update joi to v18 (#873)
  • a5100ab feat: support Vest 6
  • 28ec539 fix(vest)!: support Vest 6 (#874)
  • 827f20b fix: ata-validator peer dependency version (#871)
  • 4cfba18 feat: support vine v4 (#867)
  • 58d2e2d remove dead image
  • b011a5f feat: improve all resovlers drops validation errors for special root field names
  • 5483a03 improve all resolvers (#870)
  • 2f28787 fix: Zod resolver drops validation errors for special root field names (#869)
  • Additional commits viewable in compare view

Updates better-auth from 1.6.22 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

  • #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

  • #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

  • #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

  • #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

  • #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

  • #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

  • #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

  • #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

  • #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

  • Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

    • @​better-auth/core@​1.7.2
    • @​better-auth/kysely-adapter@​1.7.2
    • @​better-auth/drizzle-adapter@​1.7.2
    • @​better-auth/memory-adapter@​1.7.2
    • @​better-auth/mongo-adapter@​1.7.2
    • @​better-auth/prisma-adapter@​1.7.2
    • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

  • #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

    getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

    auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

    A required field whose database column is still nullable logs a warning instead of blocking the migration.

    A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.1
    • @​better-auth/drizzle-adapter@​1.7.1

... (truncated)

Commits
  • ba12fcd chore: release v1.7.2 (#10870)
  • 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
  • c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
  • e1d4011 fix(logger): respect configured logger in auth request context (#10939)
  • 557e19b refactor(context): clarify auth endpoint context access (#10938)
  • b4ad5a1 refactor: centralize placeholder email generation (#10982)
  • fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
  • f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
  • ce8a3ab fix(admin): ban without a duration should clear the previous expiration (#10823)
  • a021eaf fix(client): a client with more plugins fits a narrower client type again (#1...
  • Additional commits viewable in compare view

Updates lucide-react from 1.17.0 to 1.37.0

Release notes

Sourced from lucide-react's releases.

Version 1.37.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.35.0...1.37.0

Version 1.36.0

What's Changed

... (truncated)

Commits
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
  • f229f83 chore(depedencies): Update dependencies (#4553)
  • 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
  • See full diff in compare view

Updates pg from 8.21.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

pg@8.22.0

Commits

Updates @types/pg from 8.20.0 to 8.23.1

Commits

Updates react from 19.2.4 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates @types/react from 19.2.17 to 19.2.18

Commits

Updates react-dom from 19.2.4 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

Updates react-hook-form from 7.77.0 to 7.86.0

Release notes

Sourced from react-hook-form's releases.

Version 7.86.0

✨ Features

🐞 Fixes

  • Fix useWatch returning stale values when the watched name changes to null. (#13668)
  • Fix unregister keepDirty behavior. (#13669)
  • Fix setValues for fields registered under object or array values. (#13667)
  • Fix Controller notifications for field array item roots. (#13665)
  • Fix validation state checks. (#13661)
  • Fix setCustomValidity with criteriaMode: 'all'. (#13655)
  • Fix File, Blob, and FileList handling in flatten. (#13652)
  • Fix stale errors and touched state after updating a field array item. (#13650)
  • Fix stale field names leaking into persisted formState. (#13649)

🚀 Performance

  • Improve createFormControl performance. (#13648)
  • Improve cloneObject performance.
  • Avoid unnecessary value cloning in unregister. (#13662)
  • Improve performance in onChange-heavy workloads.

🧹 Chores & Refactoring

  • Remove unnecessary any usage. (

@dependabot
chore(deps): bump the customer-app-deps group
e899d1f 
Bumps the customer-app-deps group in /apps/customer-app with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.5.0` | `1.7.0` |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.4.0` | `5.9.1` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.22` | `1.7.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.17.0` | `1.37.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.21.0` | `8.23.0` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.23.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.77.0` | `7.86.0` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.10.0` | `4.19.0` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.2` |


Updates `@base-ui/react` from 1.5.0 to 1.7.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.7.0/packages/react)

Updates `@hookform/resolvers` from 5.4.0 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.4.0...v5.9.1)

Updates `better-auth` from 1.6.22 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)

Updates `lucide-react` from 1.17.0 to 1.37.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react)

Updates `pg` from 8.21.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@types/pg` from 8.20.0 to 8.23.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `react` from 19.2.4 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.4 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-hook-form` from 7.77.0 to 7.86.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.77.0...v7.86.0)

Updates `shadcn` from 4.10.0 to 4.19.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.19.0/packages/shadcn)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `zod` from 4.4.3 to 4.5.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.2)

---
updated-dependencies:
- dependency-name: "@base-ui/react"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: better-auth
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: lucide-react
  dependency-version: 1.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: "@types/pg"
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: customer-app-deps
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: customer-app-deps
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: customer-app-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: customer-app-deps
- dependency-name: react-hook-form
  dependency-version: 7.86.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: shadcn
  dependency-version: 4.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: customer-app-deps
- dependency-name: zod
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: customer-app-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: customer-app, dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@cursor

cursor Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Closing. #206 merged the dashboard/docs/go cleanup on current main. Customer-app bumps should come through the workspace-root js-workspace group (#205) rather than this per-directory PR.

@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/apps/customer-app/customer-app-deps-5dadd34bf5 branch September 1, 2026 18:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@santoshkumarradha santoshkumarradha Awaiting requested review from santoshkumarradha santoshkumarradha is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@santoshkumarradha