Repository navigation
Conversation
Bumps the minor-and-patch group with 10 updates: | Package | From | To | | --- | --- | --- | | [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.7.6` | `0.9.1` | | [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` | | [@xterm/addon-attach](https://github.com/xtermjs/xterm.js) | `0.10.0` | `0.12.0` | | [@xterm/addon-clipboard](https://github.com/xtermjs/xterm.js) | `0.1.0` | `0.2.0` | | [@xterm/addon-fit](https://github.com/xtermjs/xterm.js) | `0.10.0` | `0.11.0` | | [drizzle-zod](https://github.com/drizzle-team/drizzle-orm) | `0.5.1` | `0.8.3` | | [next-themes](https://github.com/pacocoursey/next-themes) | `0.2.1` | `0.4.6` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.0.13` | `10.0.14` | | [simple-icons](https://github.com/simple-icons/simple-icons) | `16.33.0` | `16.34.0` | | [@better-auth/utils](https://github.com/better-auth/utils) | `0.4.2` | `0.4.3` | Updates `@hono/zod-validator` from 0.7.6 to 0.9.1 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.9.1/packages/zod-validator) Updates `hono` from 4.13.12 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.12...v4.13.13) Updates `@xterm/addon-attach` from 0.10.0 to 0.12.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](xtermjs/xterm.js@0.10...0.12) Updates `@xterm/addon-clipboard` from 0.1.0 to 0.2.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](https://github.com/xtermjs/xterm.js/commits) Updates `@xterm/addon-fit` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](xtermjs/xterm.js@0.10...0.11) Updates `drizzle-zod` from 0.5.1 to 0.8.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](https://github.com/drizzle-team/drizzle-orm/commits) Updates `next-themes` from 0.2.1 to 0.4.6 - [Release notes](https://github.com/pacocoursey/next-themes/releases) - [Commits](https://github.com/pacocoursey/next-themes/commits/v0.4.6) Updates `nodemailer` from 10.0.13 to 10.0.14 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.0.13...v10.0.14) Updates `simple-icons` from 16.33.0 to 16.34.0 - [Release notes](https://github.com/simple-icons/simple-icons/releases) - [Commits](simple-icons/simple-icons@16.33.0...16.34.0) Updates `@better-auth/utils` from 0.4.2 to 0.4.3 - [Release notes](https://github.com/better-auth/utils/releases) - [Commits](better-auth/utils@v0.4.2...v0.4.3) --- updated-dependencies: - dependency-name: "@hono/zod-validator" dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.13.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@xterm/addon-attach" dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@xterm/addon-clipboard" dependency-version: 0.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@xterm/addon-fit" dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: drizzle-zod dependency-version: 0.8.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: next-themes dependency-version: 0.4.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: nodemailer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: simple-icons dependency-version: 16.34.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@better-auth/utils" dependency-version: 0.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…hanges Что: - @better-auth/utils 0.5.0 одной копией через overrides в корне. better-auth 1.7.7 жестко закрепляет 0.4.2, а better-call 1.4.0 требует ^0.5.0; при прямой зависимости 0.4.3 bun ставил несколько копий, и сборка сервера падала на типах плагинов (auth.ts: api-key, SSO, SCIM). 0.5.0 по коду совпадает с 0.4.3 (отличия только в комментариях и типах); 0.4.3 против 0.4.2 исправляет только encode в binary, HMAC в кодировках hex/base64 и hex.decode в верхнем регистре, а better-auth вызывает HMAC только в base64urlnopad. Dependabot больше не трогает @better-auth/utils отдельно. - hono 4.13.13: override в корне держал 4.13.12, поэтому обновление hono из этого PR фактически не применялось. - @xterm/xterm 6.0.0: новые аддоны (fit 0.11, attach 0.12, clipboard 0.2) выпущены под xterm 6. xterm 6 убрал замену Alt+стрелка -> Ctrl+стрелка; общий обработчик клавиш attachTerminalKeyHandlers (вместо fixMacOsAltKeys) возвращает прежние последовательности. В globals.css .xterm-viewport снова прозрачный: xterm 6 красит фоном темы новый контейнер прокрутки, а этот элемент оставался черным (#000 из xterm.css), и в светлой теме текст терминала был не виден. - drizzle-zod 0.8.3: уточнение поля zod-схемой больше не делает его автоматически .optional()/.nullable(). Во всех createInsertSchema это дописано явно по колонкам: nullable -> .nullable().optional(), NOT NULL с default -> .optional() (кодмод по рантайм-схемам), ssh-key вручную. Зачем: - Dependabot PR падал на сборке сервера; после ее исправления typecheck показал, что drizzle-zod 0.8 делает обязательными scheduleType, serviceType и другие поля API и запрещает null там, где он был разрешен. Риски: - Целочисленные колонки (replicas, port сервера, gitlabProjectId, version в rollback) drizzle-zod 0.8 проверяет как int32: дробные и огромные значения теперь получают 400 BAD_REQUEST вместо прежней ошибки базы (проверено на Postgres 16: база такие значения и раньше не принимала). - JSON-колонки whitelabelingConfig/fullContext проверяются мягче на вложенных значениях; эти схемы не используются для проверки входа (только как TypeScript-тип). - @better-auth/utils 0.5.0 выше версии, закрепленной в better-auth 1.7.7; обновлять их вместе. - nodemailer остается на 10.0.14: 10.0.15 вышел 2026-10-05, это моложе 3-дневного карантина minimumReleaseAge. Проверки: - Все 322 zod-схемы из db/schema сравнены через z.toJSONSchema (input/output) и разбор пустого объекта на drizzle-zod 0.5.1 и 0.8.3: совпадают, кроме двух пунктов из рисков. - Дифференциальный тест @better-auth/utils 0.4.2 и 0.4.3 (~3000 сравнений: base32/64, hex, hash, HMAC sign/verify во всех кодировках, OTP с векторами RFC 4226, пароли, ECDSA/RSA): отличия только в исправленных функциях. - bun install --frozen-lockfile; bun run server:build; bun run typecheck: exit 0; bun run build: exit 0; bun audit: 0 уязвимостей; biome check по измененным файлам: 0 ошибок. - Полный vitest с Docker Swarm (OrbStack, как в CI): 252 файла, 2214 passed, 1 skipped. Новый тест __test__/lib/terminal-keyboard.test.ts: 10 passed. - Production-образ (Dockerfile, linux/amd64) с временным Postgres 16: миграции, health 200, регистрация и вход, 2FA (TOTP посчитан независимо: верный код 200, неверный 401). tRPC: schedule.create без scheduleType, mounts.create без serviceType, application/compose.update с null в watchPaths/triggerType/description и т.д., sshKey create/update с description null, mongo.create с дефолтами mongo:15/false, redis.create + deploy: все 200; replicas 1.5: 400. - Терминал в браузере (контейнер сервиса Dokploy): bash работает, Alt+Left/Right отправляют \e[1;5D/\e[1;5C и прыгают по словам, Alt+Up/Down \e[1;5A/\e[1;5B, прокрутка 300 строк и колесо, resize -> stty 16x75; светлая и темная тема после правки CSS. Тема next-themes 0.4.6: переключение и сохранение после перезагрузки. - apps/api и apps/schedules (hono 4.13.13, @hono/zod-validator 0.9.1): health 200, неверный ключ 403, неверное тело 400. - Ограничения: терминал веб-сервера (SSH к хосту) не проверялся вживую, только общий код xterm; образ собран под amd64 через эмуляцию (под arm64 не собирается tree-sitter 0.21.1, это было и до PR). What: - @better-auth/utils 0.5.0 as a single copy through the root overrides. better-auth 1.7.7 pins 0.4.2 exactly and better-call 1.4.0 needs ^0.5.0; with a direct 0.4.3 dependency bun installed several copies and the server build failed on the plugin types (auth.ts: api-key, SSO, SCIM). 0.5.0 is code-identical to 0.4.3 (only comments and types differ); 0.4.3 over 0.4.2 only fixes binary encode, HMAC in the hex/base64 encodings and upper-case hex.decode, and better-auth only calls HMAC with base64urlnopad. Dependabot no longer bumps @better-auth/utils on its own. - hono 4.13.13: the root override kept 4.13.12, so this PR's hono bump did not apply. - @xterm/xterm 6.0.0: the new addons (fit 0.11, attach 0.12, clipboard 0.2) ship for xterm 6. xterm 6 dropped its Alt+Arrow -> Ctrl+Arrow rewrite; the shared key handler attachTerminalKeyHandlers (replacing fixMacOsAltKeys) sends the previous sequences. globals.css makes .xterm-viewport transparent again: xterm 6 paints the theme background on its new scroll container and left this element black (#000 from xterm.css), which hid the terminal text in the light theme. - drizzle-zod 0.8.3: refining a field with a zod schema no longer makes it .optional()/.nullable() implicitly. Every createInsertSchema now spells it out per column: nullable -> .nullable().optional(), NOT NULL with a default -> .optional() (codemod driven by the runtime schemas), ssh-key by hand. Why: - The Dependabot PR failed the server build; once that was fixed, typecheck showed that drizzle-zod 0.8 makes scheduleType, serviceType and other API fields required and rejects null where it used to be allowed. Risks: - Integer columns (replicas, server port, gitlabProjectId, rollback version) are validated as int32 by drizzle-zod 0.8: fractional or huge values now get 400 BAD_REQUEST instead of the former database error (checked on Postgres 16: the database rejected those values before as well). - The JSON columns whitelabelingConfig/fullContext are validated more loosely for nested values; those schemas are not used to validate input (only as a TypeScript type). - @better-auth/utils 0.5.0 is above the version better-auth 1.7.7 pins; upgrade them together. - nodemailer stays at 10.0.14: 10.0.15 was released 2026-10-05, inside the 3-day minimumReleaseAge quarantine. Checks: - All 322 zod schemas from db/schema compared through z.toJSONSchema (input/output) and an empty-object parse on drizzle-zod 0.5.1 vs 0.8.3: identical except the two risk items. - Differential test of @better-auth/utils 0.4.2 vs 0.4.3 (~3000 comparisons: base32/64, hex, hash, HMAC sign/verify in every encoding, OTP with RFC 4226 vectors, passwords, ECDSA/RSA): differences only in the fixed functions. - bun install --frozen-lockfile; bun run server:build; bun run typecheck: exit 0; bun run build: exit 0; bun audit: 0 vulnerabilities; biome check on the changed files: 0 errors. - Full vitest with Docker Swarm (OrbStack, as in CI): 252 files, 2214 passed, 1 skipped. New test __test__/lib/terminal-keyboard.test.ts: 10 passed. - Production image (Dockerfile, linux/amd64) on a temporary Postgres 16: migrations, health 200, sign-up and sign-in, 2FA (TOTP computed independently: right code 200, wrong code 401). tRPC: schedule.create without scheduleType, mounts.create without serviceType, application/compose.update with null watchPaths/triggerType/description etc., sshKey create/update with a null description, mongo.create with the mongo:15/false defaults, redis.create + deploy: all 200; replicas 1.5: 400. - Terminal in the browser (a Dokploy service container): bash works, Alt+Left/Right send \e[1;5D/\e[1;5C and jump words, Alt+Up/Down \e[1;5A/\e[1;5B, 300-line scrollback and wheel, resize -> stty 16x75; light and dark theme after the CSS fix. next-themes 0.4.6: switching and persistence after reload. - apps/api and apps/schedules (hono 4.13.13, @hono/zod-validator 0.9.1): health 200, wrong key 403, invalid body 400. - Limitations: the web-server terminal (SSH to the host) was not exercised live, only the shared xterm code; the image was built for amd64 under emulation (tree-sitter 0.21.1 does not build on arm64, which predates this PR). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
agentHits
deleted the
dependabot/bun/AgentHits-Dev/minor-and-patch-4b02c90581
branch
October 7, 2026 09:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the minor-and-patch group with 10 updates:
0.7.60.9.14.13.124.13.130.10.00.12.00.1.00.2.00.10.00.11.00.5.10.8.30.2.10.4.610.0.1310.0.1416.33.016.34.00.4.20.4.3Updates
@hono/zod-validatorfrom 0.7.6 to 0.9.1Release notes
Sourced from @hono/zod-validator's releases.
Changelog
Sourced from @hono/zod-validator's changelog.
Commits
8de0f1eVersion Packages (#2114)51b7f97perf(zod-validator): Caching the key mapping table of the header scheme (#2112)40f956echore(dev-deps): partial upgrade to TypeScript 7 (#2048)70623e3Version Packages (#2037)7bc11dffix(zod-validator): UseInferInputfromhono/validatorinstead of a local...5e32c00chore: migrate to pnpm (#2006)c5ba38bchore(deps-dev): bump tsdown from 0.22.2 to 0.22.3 (#1996)f89ea30chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 (#1866)bf845adchore: unblock TypeScript v6 (#1937)2cbc5f0chore(deps-dev): bump tsdown to 0.22.2 (#1908)Updates
honofrom 4.13.12 to 4.13.13Release notes
Sourced from hono's releases.
Commits
08a023c4.13.13ae595defeat(mount): introduce Mount Middleware and deprecateapp.mount(#5221)f23b146fix(jsx): allow JSXNode function component results (#5476)6d73a74docs(request): fix jsdoc comments for some getters (#5445)deff529test(client): simulate network error for undefined route in parseResponse tes...Updates
@xterm/addon-attachfrom 0.10.0 to 0.12.0Commits
561fc59Added screenshot for docsce1d788Bumped bower version to 0.1101e48b7Revamped the attach addona1717fdUpdate docs indexc9f5f23Started documenting methods21dde3cUpdated version, in docs73bf6d1Started documenting eventsUpdates
@xterm/addon-clipboardfrom 0.1.0 to 0.2.0Commits
Updates
@xterm/addon-fitfrom 0.10.0 to 0.11.0Commits
ce1d788Bumped bower version to 0.1101e48b7Revamped the attach addona1717fdUpdate docs indexc9f5f23Started documenting methods21dde3cUpdated version, in docs73bf6d1Started documenting eventsUpdates
drizzle-zodfrom 0.5.1 to 0.8.3Commits
Updates
next-themesfrom 0.2.1 to 0.4.6Release notes
Sourced from next-themes's releases.
... (truncated)
Commits
Updates
nodemailerfrom 10.0.13 to 10.0.14Release notes
Sourced from nodemailer's releases.
Changelog
Sourced from nodemailer's changelog.
Commits
aefd1dachore(master): release 10.0.14 (#1880)520c4efchore(deps): update dependenciesa680254fix(addressparser): keep the group recursion depth out of the options object3570d26fix(addressparser): keep a quoted display name that holds no "@" out of the a...b8ccad7fix(mime-funcs): read and write header parameters per rfc2045 and rfc2231c6f7a55fix(dkim): trim a header field name in linear timeeddce83docs: give each overload signature its own JSDoc block (#1883)7310403docs: document the parameters the JSDoc blocks left out (#1882)256177cdocs: bind JSDoc@paramtags to the parameters they describe (#1874)1e90efbchore(services): add MailSenpai (#1881)Updates
simple-iconsfrom 16.33.0 to 16.34.0Release notes
Sourced from simple-icons's releases.
Commits
dde88abReplace README CDN theme image linksac1bf3dRelease 16.34.09f1c112Bump version to 16.34.01089fb7Add Django third-party package (#15040)0f37a8aAdd SumUp icon (#15028)f161ef7Fix dual module exported types (#14991)Updates
@better-auth/utilsfrom 0.4.2 to 0.4.3Release notes
Sourced from @better-auth/utils's releases.
Commits
eb877e0chore: release v0.4.3d857a89fix: handle HMAC signature encodings correctly (#30)a8f249dbuild: migrate from unbuild to tsdown (#29)f67b8cefix(binary): bind TextEncoder when encoding (#28)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions