[dependabot]

Bumps the production group with 3 updates in the / directory: @tanstack/react-query, react-router and better-auth.

Updates @tanstack/react-query from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Commits

• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
• 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
• 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
• d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
• Additional commits viewable in compare view

Updates react-router from 8.5.0 to 8.5.1

Release notes

Sourced from react-router's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

Changelog

Sourced from react-router's changelog.

v8.5.1

Patch Changes

• Fix URIError: URI malformed when an ssr: false dev server receives a URL path with a malformed percent-encoding (#15649)
• Bound server route manifest processing for paths with expensive route expansion (#15703)
  • Fall back to initial route discovery during server rendering and RSC document/data requests
  • Account for the number and depth of candidate branches when using regex matching
• Encode commas within paths sent to the lazy route discovery manifest endpoint so routes with commas in their paths are discovered correctly (#15640)
• Fix fetcher revalidation errors bubbling to the root error boundary instead of the nearest boundary above the route that owns the fetcher (#15676)
• Avoid duplicate history entries when posting a <Form> to the current URL with an encoded action (#15679)
  • Replace the current history entry when the action contains characters that get percent-encoded, such as spaces or non-ASCII characters
• Fix an unhandled promise rejection when the browser skips a viewTransition navigation, for example in a hidden tab (#15582)
• Bubble rejected lazy.Component imports on loader-less routes to the nearest error boundary (#15658)
  • Render the error boundary instead of a blank page
• Preserve pending fetcher mutation revalidation when an older navigation or background reload completes to prevent stale loader data (#15686)
  • Keep newer fetcher loads cancellable and preserve them when earlier revalidations finish or abort, preventing older responses from overwriting fresh fetcher data
• Retry rejected lazy route imports instead of caching failures permanently (#15689)
• Revalidate loader data when a fetcher action redirect is not followed (#15557)
  • Revalidate when an action redirect is ignored because a newer navigation started or the fetcher unmounted while the action was running
  • Include shared parent loaders when another navigation completed while the action was running
  • Continue to respect shouldRevalidate
  • Return fetchers to idle when a revalidation completes a pending navigation started by another fetcher's redirect
• Avoid adding an incompatible document.startViewTransition() overload to the global Document type (#15680)
  • Allow transition results to be assigned to the DOM ViewTransition type
• Skip deleteData in destroySession when the session has no ID (#15639)
  • Avoid failures when destroying a session without a cookie on storage that rejects an empty key
• Surface the host's 404 response when a SPA fallback route has no prerendered data (#15646)
  • Request single-fetch .data files for hydrating routes with a server loader in an ssr: false app with a prerender config
  • Avoid the internal "No result found for routeId" error for non-prerendered parameterized paths served via the SPA fallback
• Improve turbo-stream decoding validation and object property handling (18e1fbd)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add an opt-in <Await unstable_promise={promise}> implementation based on React's use() API (#15678)
  • Use React.use instead of React Router's internal promise tracking
  • Accept promise-like values and retain errorElement, useAsyncValue, and useAsyncError support
  • Handle only promise rejections with errorElement when using unstable_promise, allowing child render errors to bubble to the nearest React error boundary
  • Track streamed promises during decoding so settled server content stays visible during hydration updates with either Await API or direct React.use()
• Fix URIError: URI malformed when an API-only (ssr: "unstable_api-only") server receives a URL path with a malformed percent-encoding (#15649)
• Fix duplicate headers when throwing a redirect from an RSC server function (#15667)

Commits

• a2783e6 Release v8.5.1 (#15656)
• 69465b0 docs: prepare 8.5.1 release notes
• 393d7c1 Bound server route manifest processing (#15703)
• 18e1fbd Improve turbo-stream decoding validation and object property handling
• cc0b62e Add Await unstable_promise and preserve streamed content during hydration (#1...
• a7db797 fix(react-router): retry rejected lazy route imports (#15689)
• 3ef3def fix(react-router): preserve pending mutation revalidation (#15686)
• 6cdc3fa fix(react-router): revalidate when an ignored fetcher action redirect is not ...
• b0a4477 chore: format
• 4f788db Fix 404 on hard load of non-prerendered param route served via SPA fallback (...
• Additional commits viewable in compare view

Updates better-auth from 1.7.13 to 1.7.14

Release notes

Sourced from better-auth's releases.

v1.7.14

better-auth

Bug Fixes

• Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

Changelog

Sourced from better-auth's changelog.

1.7.14

Patch Changes

• #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

• Updated dependencies [2947ab7]:

  • @​better-auth/core@​1.7.14
  • @​better-auth/drizzle-adapter@​1.7.14
  • @​better-auth/kysely-adapter@​1.7.14
  • @​better-auth/memory-adapter@​1.7.14
  • @​better-auth/mongo-adapter@​1.7.14
  • @​better-auth/prisma-adapter@​1.7.14
  • @​better-auth/telemetry@​1.7.14

Commits

• a936663 chore: release v1.7.14 (#12055)
• d2cb7f5 fix(two-factor): accept imported Base32 TOTP secrets (#12031)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Updates TanStack React Query to 5.105.0, React Router to 8.5.1, and Better Auth to 1.7.14 with matching lockfile changes.

Example: Install the application's locked production dependencies.

• Before: The dashboard uses React Query 5.104.5 and React Router 8.5.0; the API uses Better Auth 1.7.13.
• After: The dashboard uses React Query 5.105.0 and React Router 8.5.1; the API uses Better Auth 1.7.14.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused maintenance with passing CI and verified absence of an auth schema change; runtime confidence rests on the existing harness, and the release-note finding remains.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored refresh is outside the ordinary contributor proof gate; exact-head CI exercises existing Worker authentication tests, while upstream source changes affect features Krillswitch does not enable.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Application dependencies need compatible maintenance updates.
Reason: This follows the repository's established dependency maintenance pattern without adding configuration, public APIs, or application machinery.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This PR contains compatible dependency updates absent from current main; the required changelog entry is the only confirmed finding.

Priority: P3
Reviewed head: 5d4305a46d19e25d2693d7e715e0a34bbb4112f8

Before merge

• Add the required Unreleased dependency changelog entry (P3) - The root AGENTS.md requires an Unreleased entry for compatibility and release changes. This PR changes production dashboard and authentication dependencies but leaves CHANGELOG.md untouched, so the release notes omit this refresh. Add a short entry naming the three dependency updates.

Findings

• [P3] Add the required Unreleased dependency changelog entry — apps/api/package.json:22

Tests

• Missing end-to-end proof: No shipped dashboard navigation or existing-session upgrade run is supplied; ordinary contributor behavior proof is not required for this bot-authored PR.

Agent review details

How this fits together

The dashboard uses React Query for API data and React Router for navigation; the Worker uses Better Auth with D1 for dashboard sessions, independently of public flag evaluation.

flowchart LR
  Browser --> Dashboard
  Dashboard --> QueryAndRouter
  QueryAndRouter --> Worker
  Worker --> BetterAuth
  BetterAuth --> D1
  SDK --> PublicEvaluation
  PublicEvaluation --> D1

Loading

Technical review

Best possible solution:

Retain the focused dependency refresh and add an Unreleased changelog entry covering the three updates.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported runtime defect; source inspection confirms the requested version changes.

Is this the best way to solve the issue?

The manifest and lockfile updates are appropriately focused, and upstream Better Auth changes do not alter Krillswitch's enabled authentication features or stored schema.

Full review comments:

• [P3] Add the required Unreleased dependency changelog entry — apps/api/package.json:22
  The root AGENTS.md requires an Unreleased entry for compatibility and release changes. This PR changes production dashboard and authentication dependencies but leaves CHANGELOG.md untouched, so the release notes omit this refresh. Add a short entry naming the three dependency updates.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 666708d2ebd8.

Provenance checked

• Dashboard dependency versions keeps the original intent (7d6ec50: The prior refresh updated compatible dashboard dependencies while preserving runtime support and the dependency cooldown.)
• Better Auth runtime and lockfile keeps the original intent (666708d: The prior refresh maintained compatible runtime dependencies and aligned schema generation; this update changes no schema or configured provider behavior, although the generator pin remains one patch behind.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• git diff --check
• git diff -- CHANGELOG.md

What I checked:

• Verified introduced changes: The pinned base-to-head diff updates three dependency versions and their existing lockfile records; current main retains the previous versions. (apps/api/package.json:22, 5d4305a46d19)
• Applicable repository policy: The complete root policy requires an Unreleased entry for compatibility and release changes; no nested AGENTS.md, maintainer notes, or pr-simplify skill was present. The review request supersedes the instruction to run another reviewer. (AGENTS.md, 5d4305a46d19)
• Dependency update provenance: build(deps): refresh compatible application and tooling dependencies #176 established the previous compatible dependency refresh and explicitly kept the auth generator aligned. This PR leaves that generator at 1.7.13, but the reviewed upstream changes establish no schema incompatibility. Some historical git show reads failed because older objects are unavailable locally. (apps/api/package.json:17, 666708d2ebd8)
• Upstream authentication change boundary: The verified v1.7.13-to-v1.7.14 comparison changes production source only for imported Base32 TOTP secrets and Kakao login hints. Krillswitch imports this runtime but enables neither feature; its configured GitHub provider, session schema, and Drizzle adapter implementation are unchanged. (packages/better-auth/src/plugins/two-factor/totp/index.ts, a936663d3a3c)
• Exact-head checks and discussion: GitHub reports successful lint, typecheck, tests, build, CodeQL, and native keyring checks for the reviewed head. The discussion contains only review-status bot comments and no additional behavior evidence or maintainer decision. (.github/workflows/ci.yml, 5d4305a46d19)

Likely related people:

• Peter Steinberger: Raw commit 311476e adds apps/admin/package.json:14 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 311476e9ae21; files: apps/admin/package.json)

Labels

Label changes:

• add P3: Routine compatible dependency maintenance with successful exact-head CI and a low-impact release-note omission.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: Routine compatible dependency maintenance with successful exact-head CI and a low-impact release-note omission.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 30, 2026, 2:49 PM ET / 18:49 UTC.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.