build(deps): bump the minor-and-patch group across 1 directory with 22 updates

[dependabot]

Bumps the minor-and-patch group with 22 updates in the / directory:

Package	From	To
@graphql-codegen/cli	7.2.0	7.4.0
@j178/prek	0.4.13	0.5.1
knip	6.32.2	6.34.0
react-doctor	0.9.12	0.9.13
tsx	4.23.12	4.23.13
@cloudflare/sandbox	0.12.6	0.12.9
better-auth	1.6.28	1.7.2
cloudflare	7.0.0	7.1.0
graphql-yoga	5.21.3	5.22.0
hono	4.13.2	4.13.5
xstate	5.32.5	5.32.6
wrangler	4.123.0	4.128.0
@assistant-ui/react	0.15.14	0.15.17
@hugeicons/core-free-icons	4.2.3	4.3.0
@hugeicons/react	1.1.9	1.1.10
@tanstack/react-query	5.101.4	5.102.8
react-router-dom	7.18.2	7.18.3
streamdown	2.5.0	2.6.0
@types/react-dom	19.2.4	19.2.5
@vitejs/plugin-react	6.0.5	6.1.1
vite	8.2.1	8.2.2
@ag-ui/core	0.0.57	0.0.59

Updates @graphql-codegen/cli from 7.2.0 to 7.4.0

Changelog

Sourced from @​graphql-codegen/cli's changelog.

7.4.0

Minor Changes

• #10928 90229a5 Thanks @​eddeee888! - Add contentComparison?: 'cache-first' | 'disk' to control disk-vs-cache write comparison in watch mode.

  In watch mode the CLI caches the hash of the content it last wrote per file and compares new output against that cached hash to skip redundant writes. This assumes generated output is a pure function of the codegen inputs. An output whose content depends on the file's existing content (e.g. a preset that reads the file and rewrites part of it) breaks that assumption: if the file is changed on disk and codegen regenerates content identical to a previous run, the cached hash still matches and the write is skipped, so the on-disk change is never corrected.

  contentComparison: 'disk' opts an output into comparing the generated content against the file on disk instead of the in-memory record of what codegen last wrote, so the file is rewritten when it was changed externally. It can be set:

  • by a preset, on the GenerateOptions it returns from buildGeneratesSection, or
  • on the output config (generates[output].contentComparison) for any output, including plain plugin outputs without a preset.

  When both are present, the preset's value takes precedence. The default, 'cache-first', keeps the existing in-memory-cache behaviour for outputs that are a pure function of their inputs.

Patch Changes

• #10930 448431a Thanks @​eddeee888! - Fix overwrite being ignored for preset-based generates outputs.

  A generates entry that used a preset and set overwrite (e.g. overwrite: { removeStaleFiles: false }) had that setting silently ignored, so in watch mode its generated files could still be deleted as stale.

  The CLI resolved overwrite per generated file by looking the file's path up in config.generates. That fails for a preset: its generates entry is keyed by the preset's baseOutputDir, not by any generated file's path (and a preset can emit files outside that directory), and the lookup additionally required a plugins key that preset entries don't have. Both cases fell through to the global config.overwrite (default true).

• Updated dependencies [90229a5, 448431a]:

  • @​graphql-codegen/plugin-helpers@​7.3.0

7.3.1

... (truncated)

Commits

• 3216e72 chore(release): update monorepo packages versions (#10929)
• 448431a Fix overwrite being ignored for preset-based generates outputs (#10930)
• 90229a5 Add contentComparison to allow plugins and presets to configure whether to ...
• a2e1d5c chore(release): update monorepo packages versions (#10925)
• 0c8f5ba Implement rolling profiler output for watch mode (#10924)
• 6aa476a Upcoming Release Changes (#10923)
• 58cdb31 Add overwrite.updateExistingFiles and overwrite.removeStaleFiles (#10921)
• See full diff in compare view

Updates @j178/prek from 0.4.13 to 0.5.1

Release notes

Sourced from @​j178/prek's releases.

0.5.1

Release Notes

Released on 2026-09-01.

Enhancements

• Add --hide-status <passed|failed|skipped> for hook reports (#2644)
• Add prek init for repository setup (#2636)
• Apply hook env during environment creation (#2650)
• Disable error snippets in check-yaml diagnostics (#2664)
• Show hooks excluded by skip selectors (#2645)
• Support Pixi for Conda environments (#2667)
• Support cargo-binstall for Rust CLI dependencies (#2658)
• Warn about unused keys in user settings (#2665)

Bug fixes

• Reject unsupported YAML tags in check-yaml (#2656)

Documentation

• Clarify local hook documentation (#2640)
• Clarify pre-commit command compatibility (#2635)
• Document automatic PR fixes with autofix.ci (#2643)
• Document check-yaml unsafe support (#2632)
• Improve setup and workflow documentation (#2637)

Other changes

• Drop low-usage release targets (#2651)
• Generate a prek manifest JSON schema (#2648)

Contributors

• @​j178

Install prek 0.5.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.1/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.1/prek-installer.ps1 | iex"

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.1

Released on 2026-09-01.

Enhancements

• Add --hide-status <passed|failed|skipped> for hook reports (#2644)
• Add prek init for repository setup (#2636)
• Apply hook env during environment creation (#2650)
• Disable error snippets in check-yaml diagnostics (#2664)
• Show hooks excluded by skip selectors (#2645)
• Support Pixi for Conda environments (#2667)
• Support cargo-binstall for Rust CLI dependencies (#2658)
• Warn about unused keys in user settings (#2665)

Bug fixes

• Reject unsupported YAML tags in check-yaml (#2656)

Documentation

• Clarify local hook documentation (#2640)
• Clarify pre-commit command compatibility (#2635)
• Document automatic PR fixes with autofix.ci (#2643)
• Document check-yaml unsafe support (#2632)
• Improve setup and workflow documentation (#2637)

Other changes

• Drop low-usage release targets (#2651)
• Generate a prek manifest JSON schema (#2648)

Contributors

• @​j178

0.5.0

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

... (truncated)

Commits

• 10a896e Bump version to 0.5.1 (#2669)
• 8648709 Support Pixi for Conda environments (#2667)
• 9a793f4 Refactor container and Cargo installer types (#2668)
• 72f3e9a Warn about unused keys in user settings (#2665)
• 0b16695 Disable error snippets in check-yaml diagnostics (#2664)
• a6353bb Simplify integration test helper visibility (#2663)
• edfb174 Support cargo-binstall for Rust CLI dependencies (#2658)
• 0cefa90 Update ubuntu:26.04 Docker digest to 2260313 (#2660)
• b5bdccf Update Rust crate similar to v3.2.0 (#2662)
• 11404ef Update GitHub Actions (#2661)
• Additional commits viewable in compare view

Updates knip from 6.32.2 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
• Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
• Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
• Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
• Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
• Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
• Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)
• Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)
• Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)
• Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)
• fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @​DreamLongYT!
• fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @​addielaruee!
• Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @​DreierF!
• fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @​DreamLongYT!
• Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)
• Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)
• Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)
• Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)
• Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)
• Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)
• Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)
• Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Release 6.32.3

• Update sentry production snapshot (9f18cba93c91de8554636b13692d6e7a937b7697)
• Pin TypeScript ecosystem test (de5162952d223050f3135afb02d4e8de6d46f381)
• Update query snapshot (f6964dd577d8f7967f9be6778f5c3953632e3c96)
• fix(tsup): match config files with .cts and .mts extensions (#1938) (68d6f52f7913cfa1e36618e6b03f90734da34149) - thanks @​codeAnqiang-ma!
• fix(lefthook): match all config file names and extensions (#1940) (4015ae0330c78e97360a2c8f697d17f82c5c24ae) - thanks @​codeAnqiang-ma!

... (truncated)

Commits

• 4ffebb7 Release knip@6.34.0
• f0cf11d Assert counters in targeted regression tests
• 96ff2df Declare webpack directly instead of through @types/webpack
• c4e0f08 Update dependencies
• cc47061 Resolve Nuxt #shared imports from the shared directory (#1991)
• 462ae45 fix: compile files with workspace-scoped compilers (#1997)
• ab90e24 fix(cli): validate numeric options instead of passing NaN through (#1975)
• 964085d Set an explicit Bun test timeout
• 1c90b49 Make prop access consistent while at it
• f93ad09 Respect JSDoc tags on URL dependencies (resolve #1943)
• Additional commits viewable in compare view

Updates react-doctor from 0.9.12 to 0.9.13

Release notes

Sourced from react-doctor's releases.

react-doctor@0.9.13

Patch Changes

• 28a1a9f Thanks @​aidenybai! - Add bippy as a runtime dependency.

• #1695 ac87f7d Thanks @​skoshx! - Preserve plugin settings when React Doctor adopts an existing lint config.

• #1651 ffc2d14 Thanks @​aidenybai! - Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.

• #1689 1d3e4a6 Thanks @​skoshx! - Use pnpm's strict dependency layout and declare the runtime dependencies that the CLI imports directly.

• #1646 05ef989 Thanks @​aidenybai! - Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.

  Report standalone Three.js render loops that use requestAnimationFrame instead of the renderer-managed setAnimationLoop API.

  Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.

• #1714 013f737 Thanks @​aidenybai! - Clean leading npm messages from GitHub Action JSON reports before later steps read them.

• #1697 0557145 Thanks @​skoshx! - Stop multi-project scans from recommending GitHub Actions when the root workflow is already configured.

• #1730 adc3a91 Thanks @​skoshx! - Fix rn-no-raw-text false positives in components that return only direct <fbt> or <fbs> elements.

• #1723 e1d4c51 Thanks @​skoshx! - Prevent rn-no-raw-text reports for <fbt> content passed through verified React Native text wrappers.

• #1693 4e04921 Thanks @​skoshx! - Show an npm-native recovery command when an incomplete npx installation is missing Ajv meta-schema files.

• #1734 025d69d Thanks @​skoshx! - Fix js-set-map-lookups false positives for substring checks on values returned by the global String constructor.

• #1725 0f59a3b Thanks @​aidenybai! - Run test-noise rules in ambiguous product-named directories such as tools, demo, and migrations when they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.

• #1688 72a4f46 Thanks @​skoshx! - Make generated GitHub workflows explain how to pin the action to an immutable commit SHA.

• #1663 2b0f06e Thanks @​aidenybai! - Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.

• #1650 0b670aa Thanks @​aidenybai! - Run installed Claude Code and Cursor hooks once at the end of an agent turn, include untracked files in the changed-file scan, and migrate existing per-tool React Doctor hooks automatically.

• #1746 ca30808 Thanks @​aidenybai! - Accept source file paths as positional CLI arguments.

• #1624 8c2f03a Thanks @​aidenybai! - Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.

• #1653 1971506 Thanks @​aidenybai! - Add an interactive URL scan and /performance skill that record Chrome DevTools traces, flash live component render outlines, and return agent-readable React performance context.

• #1654 6416370 Thanks @​aidenybai! - Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcn from components.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-only data-[selected]: / data-[disabled]: Tailwind variants on command items are reported because cmdk renders both attributes as "true" or "false". TanStack Form submit handlers that call the form's handleSubmit without event.preventDefault() are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the root without the list part are reported for shadcn, Radix, and Base UI; the existing shadcn-tabs-trigger-requires-list rule is now enabled by default for shadcn projects through the capability gate and no longer risks false positives on extracted trigger subcomponents. React Aria Dialogs without a Heading or aria-label are reported as unnamed. TanStack Table data/columns options that provably get a new array identity every render (inline literals, render-scoped const arrays, fresh ?? [] fallbacks, inline .filter()/.map() transforms) are reported for rebuilding row and column models each render and looping auto-reset features, and elements measured by TanStack Virtual's measureElement without a data-index attribute are reported because the virtualizer drops the measurement.

• #1743 6f3dd03 Thanks @​aidenybai! - Normalize Oxlint file URLs before applying ignore patterns and writing report-relative diagnostic paths.

• Updated dependencies [ffc2d14, f7efb7d, 05ef989, a04b933, adc3a91, 2c4560f, e1d4c51, 905607f, 17eeeb5, afa1780, 025d69d, 0f59a3b, 5bc88ae, 4bf7aff, bd08406, 2b0f06e, 8c2f03a, 6416370, 28d4343]:

  • oxlint-plugin-react-doctor@0.9.13

Changelog

Sourced from react-doctor's changelog.

0.9.13

Patch Changes

• 28a1a9f Thanks @​aidenybai! - Add bippy as a runtime dependency.

• #1695 ac87f7d Thanks @​skoshx! - Preserve plugin settings when React Doctor adopts an existing lint config.

• #1651 ffc2d14 Thanks @​aidenybai! - Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.

• #1689 1d3e4a6 Thanks @​skoshx! - Use pnpm's strict dependency layout and declare the runtime dependencies that the CLI imports directly.

• #1646 05ef989 Thanks @​aidenybai! - Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.

  Report standalone Three.js render loops that use requestAnimationFrame instead of the renderer-managed setAnimationLoop API.

  Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.

• #1714 013f737 Thanks @​aidenybai! - Clean leading npm messages from GitHub Action JSON reports before later steps read them.

• #1697 0557145 Thanks @​skoshx! - Stop multi-project scans from recommending GitHub Actions when the root workflow is already configured.

• #1730 adc3a91 Thanks @​skoshx! - Fix rn-no-raw-text false positives in components that return only direct <fbt> or <fbs> elements.

• #1723 e1d4c51 Thanks @​skoshx! - Prevent rn-no-raw-text reports for <fbt> content passed through verified React Native text wrappers.

• #1693 4e04921 Thanks @​skoshx! - Show an npm-native recovery command when an incomplete npx installation is missing Ajv meta-schema files.

• #1734 025d69d Thanks @​skoshx! - Fix js-set-map-lookups false positives for substring checks on values returned by the global String constructor.

• #1725 0f59a3b Thanks @​aidenybai! - Run test-noise rules in ambiguous product-named directories such as tools, demo, and migrations when they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.

• #1688 72a4f46 Thanks @​skoshx! - Make generated GitHub workflows explain how to pin the action to an immutable commit SHA.

• #1663 2b0f06e Thanks @​aidenybai! - Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.

• #1650 0b670aa Thanks @​aidenybai! - Run installed Claude Code and Cursor hooks once at the end of an agent turn, include untracked files in the changed-file scan, and migrate existing per-tool React Doctor hooks automatically.

• #1746 ca30808 Thanks @​aidenybai! - Accept source file paths as positional CLI arguments.

• #1624 8c2f03a Thanks @​aidenybai! - Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.

• #1653 1971506 Thanks @​aidenybai! - Add an interactive URL scan and /performance skill that record Chrome DevTools traces, flash live component render outlines, and return agent-readable React performance context.

• #1654 6416370 Thanks @​aidenybai! - Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcn from components.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-only data-[selected]: / data-[disabled]: Tailwind variants on command items are reported because cmdk renders both attributes as "true" or "false". TanStack Form submit handlers that call the form's handleSubmit without event.preventDefault() are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the root without the list part are reported for shadcn, Radix, and Base UI; the existing shadcn-tabs-trigger-requires-list rule is now enabled by default for shadcn projects through the capability gate and no longer risks false positives on extracted trigger subcomponents. React Aria Dialogs without a Heading or aria-label are reported as unnamed. TanStack Table data/columns options that provably get a new array identity every render (inline literals, render-scoped const arrays, fresh ?? [] fallbacks, inline .filter()/.map() transforms) are reported for rebuilding row and column models each render and looping auto-reset features, and elements measured by TanStack Virtual's measureElement without a data-index attribute are reported because the virtualizer drops the measurement.

• #1743 6f3dd03 Thanks @​aidenybai! - Normalize Oxlint file URLs before applying ignore patterns and writing report-relative diagnostic paths.

• Updated dependencies [ffc2d14, f7efb7d, 05ef989, a04b933, adc3a91, 2c4560f, e1d4c51, 905607f, 17eeeb5, afa1780, 025d69d, 0f59a3b, 5bc88ae, 4bf7aff, bd08406, 2b0f06e, 8c2f03a, 6416370, 28d4343]:

  • oxlint-plugin-react-doctor@0.9.13

Commits

• fd23edc chore: version packages (#1649)
• ca30808 feat(cli): accept positional file paths (#1746)
• adc3a91 fix: handle direct fbt component returns (#1730)
• e1d4c51 fix: allow fbt content in verified text wrappers (#1723)
• ac87f7d fix(core): preserve settings from adopted lint configs (#1695)
• 72a4f46 fix(ci): prevent pull request cache writes (#1688)
• 71800cc test(cli): cover staged rule parity (#1719)
• 0557145 fix(cli): check root workflow before recommending CI (#1697)
• 013f737 fix(action): clean npm output from JSON reports (#1714)
• 4e04921 fix(cli): explain incomplete npx installs (#1693)
• Additional commits viewable in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Updates @cloudflare/sandbox from 0.12.6 to 0.12.9

Release notes

Sourced from @​cloudflare/sandbox's releases.

@​cloudflare/sandbox@​0.12.9

Patch Changes

• #877 664d8e3 Thanks @​scuffi! - Allow mounted R2 buckets to open object keys containing spaces, symbols, percent signs, and non-ASCII characters.

@​cloudflare/sandbox@​0.12.8

Patch Changes

• #879 8534aef Thanks @​scuffi! - Enforce source mount prefixes for server-side copies between R2 bindings.

@​cloudflare/sandbox@​0.12.7

Patch Changes

• 23a08e4 Thanks @​ghostwriternr! - Ensure stable releases advance npm's latest tag only after all release artifacts pass verification.

Commits

• 1339396 Version Packages (#885)
• 664d8e3 Fix R2 mount object key decoding (#877)
• 310b4ff Promote public refs to 0.12.8 (#882)
• ca0b013 Version Packages (#881)
• 8534aef Fix R2 copy source prefix scoping (#879)
• 6abf639 Retry stable release reinspection
• 6ac5165 Promote public refs to 0.12.7 (#871)
• 9bf17d1 Version Packages
• 3d261f0 Promote public refs to 0.12.6
• 23a08e4 Fix promotion branch creation
• Additional commits viewable in compare view

Updates better-auth from 1.6.28 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin ...

  Description has been truncated