Skip to content

chore(deps): bump the bun-minor-and-patch group across 1 directory with 17 updates - #91

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/bun/dev/bun-minor-and-patch-00a83e2b68
Open

chore(deps): bump the bun-minor-and-patch group across 1 directory with 17 updates#91
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/bun/dev/bun-minor-and-patch-00a83e2b68

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown

Bumps the bun-minor-and-patch group with 16 updates in the / directory:

Package From To
atmn 1.1.17 1.1.23
oxfmt 0.62.0 0.66.0
oxlint 1.78.0 1.81.0
turbo 2.10.9 2.10.12
convex 1.43.0 1.45.0
werift 0.24.3 0.24.4
mint 4.2.788 4.2.873
hono 4.13.1 4.13.5
better-auth 1.6.26 1.7.2
@convex-dev/resend 0.2.7 0.2.8
convex-helpers 0.1.122 0.1.123
jose 6.2.8 6.2.10
resend 6.22.1 6.26.0
convex-test 0.0.55 0.0.56
vite 8.2.1 8.2.2
vitest 4.1.10 4.1.11

Updates atmn from 1.1.17 to 1.1.23

Commits
  • 7f04cd3 feat: atmn support for pooled plan items in CLI push/pull (#3213)
  • a8fbf2e Narrow exclusive credit-schema unions so bun ts passes.
  • 99f3762 fix atmn graduated credit schema support
  • 32d5a2f Merge branch 'useautumn:dev' into fix/atmn-push-archived-plans
  • 252459f fix(atmn): forward plan archived flag on push
  • 890f68e Pin @​types/bun to 1.3.14 to match the Bun runtime
  • 1504379 fix(atmn): type ApiPlan as ApiPlanExpandedV1, merge diverged ai submodule his...
  • e15df47 Merge pull request #2764 from useautumn/charlie/fix-atmn-semicolonless-config...
  • 4dc9270 test: 💍 verify config state after repush
  • b42b606 fix: 🐛 handle multiline comments after imports
  • Additional commits viewable in compare view

Updates oxfmt from 0.62.0 to 0.66.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[0.64.0] - 2026-08-18

🚀 Features

  • c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

  • fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)
Commits
  • 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
  • 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
  • 63bc313 chore(npm): update funding URL (#26066)
  • 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
  • 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
  • c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
  • fed6681 docs(oxfmt): skip expanding overrides options (#25572)
  • c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
  • 00f490d refactor(oxfmt,formatter): split sortImports validation and use type enum (...
  • See full diff in compare view

Updates oxlint from 1.78.0 to 1.81.0

Release notes

Sourced from oxlint's releases.

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

Oxlint v1.81.0

🚀 Features

  • 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

  • 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
  • baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
  • 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
  • fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
  • e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
  • d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
  • 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
  • 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
  • bd15905 linter/react/no-unstable-nested-components: Check nested component object property names (#26101) (camc314)
  • 3910e2b linter/eslint/no-unassigned-vars: Skip Svelte and Vue files (#26042) (Hamody We)
  • 047f7ca linter/plugins: Fix interaction between JS plugins and Vue rules (#26080) (overlookmotel)
  • 8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)
  • dc464ff linter/unicorn/prefer-math-min-max: Avoid unsafe autofix (#26060) (camc314)

📚 Documentation

  • 464ddd1 linter: Support a shared short description for jest/vitest rules (#26186) (connorshea)
  • 9db5ad3 linter: Add short description to vue/no-dupe-keys (#26183) (connorshea)
  • db66f58 linter: Correct export/import mismatch in bar and foo example (#25927) (billychannnnnn)
  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Oxfmt v0.66.0

🚀 Features

  • 1fb37b6 formatter/css: Format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194) (leaysgur)

🐛 Bug Fixes

  • 9f81002 formatter: Re-add suppressed statement terminators per options.semi (#26220) (leaysgur)
  • 769ffd5 formatter: Print suppressed typecast parens (#26218) (leaysgur)
  • 5ff57f8 formatter/sort-imports: Handle custom side effect groups (#26217) (leaysgur)
  • 2f4d759 formatter: Do not skip cast comment lookup (#26216) (leaysgur)
  • 1213e12 formatter: Preserve comment for statement terminators and binary casts (#26213) (leaysgur)
  • 57e8e22 formatter_css: Space a folded sign after a call in Less operations (#26134) (leaysgur)
  • e4298fb formatter/jsdoc: Follow CommonMark for interrupting lists and guard wrapping from creating them (#26098) (leaysgur)
  • a1e21c2 formatter: Apply head body policy everywhere (#26074) (leaysgur)
  • 676b7e1 formatter: Keep comments in their for-head slot, before an empty-statement body and do-while (#26073) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)
Commits
  • 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
  • d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
  • 63bc313 chore(npm): update funding URL (#26066)
  • 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
  • 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
  • 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
  • aa49d86 fix(linter): allow spread rule options in config types (#25675)
  • 8922381 refactor(linter): remove inactive react config rule (#25740)
  • 8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
  • 36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
  • Additional commits viewable in compare view

Updates turbo from 2.10.9 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates convex from 1.43.0 to 1.45.0

Changelog

Sourced from convex's changelog.

1.45.0

  • Local deployments now upgrade to a new backend version in place, instead of going through a snapshot export and import. Upgrades no longer depend on the size of your local data, and no longer prompt about transferring it.
  • The Convex MCP server (npx convex mcp) now supports the stateless MCP protocol (2026-07-28 MCP specification).
  • Added a new getServiceToken function that generates service tokens for first-party Convex services. This will be used by the upcoming Convex AI gateway.
  • Improved the error message when npx convex export fails because a snapshot export is already in progress.

1.44.0

  • schema.doc(tableName) returns the validator for whole documents of a table: the table's own validator with the _id and _creationTime system fields added (to each member, for tables defined with a union). schema.id(tableName) is v.id(tableName) restricted to the table names in the schema. docValidator(tableName, tableDefinition) from convex/server does the same as schema.doc when you only have a table definition.
  • The server-provided environment variables CONVEX_SITE_URL and CONVEX_CLOUD_URL are now available on env by default in _generated/server.d.ts, along with other environment variables specified in convex/convex.config.ts.
  • Fixed a bug where the context value provided by ConvexProviderWithAuth was not referentially stable.
  • Fixed a bug where npx convex login status would report misleading results when the user is logged in but does not have access to the current project.
Commits

Updates werift from 0.24.3 to 0.24.4

Release notes

Sourced from werift's releases.

v0.24.4

🐛 Bug Fixes

  • TURN CreatePermission / ChannelBind peer isolation (#667, #668): Fix TurnProtocol so a rejected peer no longer poisons later peers on the same TURN allocation.
    • Per-peer in-flight maps and success-only caches (permission by IP, channel by IP+port); allocation-global shared Promise poison removed.
    • Serial queues keep a resolved tail so one peer’s rejection is not re-thrown to the next.
    • Failed ChannelBind rolls back provisional mapping; failed channel numbers are not reused; channel refresh deadlines are per channel.
    • ICE connectivity checks can fail a high-priority rejected remote first and still nominate a later valid relay ↔ relay pair and exchange data.
  • PeerConnection close / Event cleanup (#665): On close(), complete public Events (including connectionStateChange / onNegotiationneeded) so subscribers and closures do not retain the peer; Event.allUnsubscribe is idempotent after complete() instead of throwing.

🧪 Testing & tooling

  • Memleak harness (packages/webrtc, #665): Opt-in heap-snapshot scenarios for major use cases (npm run memleak, Node 24+); not part of default CI.
  • pion TURN interop (packages/ice, #667): Opt-in Docker integration via npm run test:pion-turn / PION_TURN_HOST; unit isolation tests for permission/channel peer isolation.
  • Design note: docs/design/allocation-peer-isolation.md (before/after sequences).

📦 Packaging / versions

  • werift (packages/webrtc): 0.24.3 → 0.24.4
  • werift-ice (packages/ice): 0.2.2 → 0.2.3
  • Other lower-level packages unchanged (werift-common 0.0.3, werift-rtp 0.8.9, werift-sctp 0.0.11, werift-dtls 0.5.8, werift-ice-server 0.0.1).
Changelog

Sourced from werift's changelog.

v0.24.4

🐛 Bug Fixes

  • TURN CreatePermission / ChannelBind peer isolation (#667, #668): Fix TurnProtocol so a rejected peer no longer poisons later peers on the same TURN allocation.
    • Per-peer in-flight maps and success-only caches (permission by IP, channel by IP+port); allocation-global shared Promise poison removed.
    • Serial queues keep a resolved tail so one peer’s rejection is not re-thrown to the next.
    • Failed ChannelBind rolls back provisional mapping; failed channel numbers are not reused; channel refresh deadlines are per channel.
    • ICE connectivity checks can fail a high-priority rejected remote first and still nominate a later valid relay ↔ relay pair and exchange data.
  • PeerConnection close / Event cleanup (#665): On close(), complete public Events (including connectionStateChange / onNegotiationneeded) so subscribers and closures do not retain the peer; Event.allUnsubscribe is idempotent after complete() instead of throwing.

🧪 Testing & tooling

  • Memleak harness (packages/webrtc, #665): Opt-in heap-snapshot scenarios for major use cases (npm run memleak, Node 24+); not part of default CI.
  • pion TURN interop (packages/ice, #667): Opt-in Docker integration via npm run test:pion-turn / PION_TURN_HOST; unit isolation tests for permission/channel peer isolation.
  • Design note: docs/design/allocation-peer-isolation.md (before/after sequences).

📦 Packaging / versions

  • werift (packages/webrtc): 0.24.3 → 0.24.4
  • werift-ice (packages/ice): 0.2.2 → 0.2.3
  • Other lower-level packages unchanged (werift-common 0.0.3, werift-rtp 0.8.9, werift-sctp 0.0.11, werift-dtls 0.5.8, werift-ice-server 0.0.1).
Commits
  • b530e62 verup
  • fe5d462 fix(ice): isolate TURN CreatePermission/ChannelBind state per peer (#667) (#668)
  • e50c502 Add memleak harness for major WebRTC use cases (#665)
  • 06af61c chore(deps-dev): bump postcss in /examples/turn-loopback/chrome-e2e (#664)
  • fe33d22 chore(deps): bump postcss from 8.5.14 to 8.5.25 (#660)
  • c811d9b chore(deps-dev): bump postcss from 8.5.13 to 8.5.25 in /e2e (#661)
  • 193ba2d chore(deps): bump undici from 6.27.0 to 6.28.0 in /examples (#663)
  • See full diff in compare view

Updates mint from 4.2.788 to 4.2.873

Commits

Updates hono from 4.13.1 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits
  • 06880c4 4.13.5
  • 531e9c5 Merge commit from fork
  • 3a67f7f Merge commit from fork
  • 9c28d72 Merge commit from fork
  • 017000d 4.13.4
  • 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
  • 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
  • c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
  • 612b59c fix(request): drop stale content length for cloned FormData (#5282)
  • 73794bd fix(client): omit empty query delimiter (#5283)
  • Additional commits viewable in compare view

Updates better-auth from 1.6.26 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

  • #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

  • #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

  • #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

  • #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

  • #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

  • #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

  • #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

  • #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

  • #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

  • Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

    • @​better-auth/core@​1.7.2
    • @​better-auth/kysely-adapter@​1.7.2
    • @​better-auth/drizzle-adapter@​1.7.2
    • @​better-auth/memory-adapter@​1.7.2
    • @​better-auth/mongo-adapter@​1.7.2
    • @​better-auth/prisma-adapter@​1.7.2
    • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

  • #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

    getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

    auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

    A required field whose database column is still nullable logs a warning instead of blocking the migration.

    A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.1
    • @​better-auth/drizzle-adapter@​1.7.1

... (truncated)

Commits
  • ba12fcd chore: release v1.7.2 (#10870)
  • 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
  • c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
  • e1d4011 fix(logger): respect configured logger in auth request context (#10939)
  • 557e19b refactor(context): clarify auth endpoint context access (#10938)
  • b4ad5a1 refactor: centralize placeholder email generation (#10982)
  • fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
  • f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
  • ce8a3ab f...

    Description has been truncated

@dependabot
chore(deps): bump the bun-minor-and-patch group across 1 directory wi…
04aab1b 
…th 17 updates

Bumps the bun-minor-and-patch group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [atmn](https://github.com/useautumn/autumn/tree/HEAD/packages/atmn) | `1.1.17` | `1.1.23` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.62.0` | `0.66.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.81.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.9` | `2.10.12` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.43.0` | `1.45.0` |
| [werift](https://github.com/shinyoshiaki/werift-webrtc) | `0.24.3` | `0.24.4` |
| [mint](https://github.com/mintlify/mint/tree/HEAD/packages/mint) | `4.2.788` | `4.2.873` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.5` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.26` | `1.7.2` |
| [@convex-dev/resend](https://github.com/get-convex/resend) | `0.2.7` | `0.2.8` |
| [convex-helpers](https://github.com/get-convex/convex-helpers/tree/HEAD/packages/convex-helpers) | `0.1.122` | `0.1.123` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` |
| [resend](https://github.com/resend/resend-node) | `6.22.1` | `6.26.0` |
| [convex-test](https://github.com/get-convex/convex-test) | `0.0.55` | `0.0.56` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |



Updates `atmn` from 1.1.17 to 1.1.23
- [Commits](https://github.com/useautumn/autumn/commits/atmn-v1.1.23/packages/atmn)

Updates `oxfmt` from 0.62.0 to 0.66.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.66.0/npm/oxfmt)

Updates `oxlint` from 1.78.0 to 1.81.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.81.0/npm/oxlint)

Updates `turbo` from 2.10.9 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.9...v2.10.12)

Updates `convex` from 1.43.0 to 1.45.0
- [Release notes](https://github.com/get-convex/convex-backend/releases)
- [Changelog](https://github.com/get-convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `werift` from 0.24.3 to 0.24.4
- [Release notes](https://github.com/shinyoshiaki/werift-webrtc/releases)
- [Changelog](https://github.com/shinyoshiaki/werift-webrtc/blob/develop/changelog.md)
- [Commits](shinyoshiaki/werift-webrtc@v0.24.3...v0.24.4)

Updates `mint` from 4.2.788 to 4.2.873
- [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/mint)

Updates `hono` from 4.13.1 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.5)

Updates `better-auth` from 1.6.26 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)

Updates `@convex-dev/resend` from 0.2.7 to 0.2.8
- [Changelog](https://github.com/get-convex/resend/blob/main/CHANGELOG.md)
- [Commits](get-convex/resend@v0.2.7...v0.2.8)

Updates `convex-helpers` from 0.1.122 to 0.1.123
- [Changelog](https://github.com/get-convex/convex-helpers/blob/main/packages/convex-helpers/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-helpers/commits/npm/0.1.123/packages/convex-helpers)

Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)

Updates `resend` from 6.22.1 to 6.26.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.22.1...v6.26.0)

Updates `@types/bun` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `convex-test` from 0.0.55 to 0.0.56
- [Changelog](https://github.com/get-convex/convex-test/blob/main/CHANGELOG.md)
- [Commits](get-convex/convex-test@v0.0.55...v0.0.56)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: atmn
  dependency-version: 1.1.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: oxfmt
  dependency-version: 0.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: convex
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: werift
  dependency-version: 0.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: mint
  dependency-version: 4.2.873
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@convex-dev/resend"
  dependency-version: 0.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: convex-helpers
  dependency-version: 0.1.123
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: resend
  dependency-version: 6.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@types/bun"
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: convex-test
  dependency-version: 0.0.56
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@vercel

vercel Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
wrapper-web Error Error Sep 7, 2026 6:24am UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants