Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 26 updates - #203

Merged
catomean merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-bae564081b
Sep 23, 2026
Merged

chore(deps): bump the minor-and-patch group across 1 directory with 26 updates#203
catomean merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-bae564081b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 26 updates in the / directory:

Package From To
@bitbaum/ai-kit 1.4.0 1.10.0
@bitbaum/mail-kit 0.1.0 0.1.1
@headlessui/react 2.2.9 2.2.10
@supabase/ssr 0.8.0 0.12.7
@supabase/supabase-js 2.93.3 2.116.0
bip-kit 0.2.7 0.3.0
date-fns 4.1.0 4.4.0
next 16.3.3 16.3.5
postcss 8.5.23 8.5.28
react 19.2.8 19.3.0
@types/react 19.2.17 19.3.0
react-dom 19.2.8 19.3.0
@types/react-dom 19.2.3 19.3.0
react-hook-form 7.71.1 7.88.0
react-icons 5.5.0 5.7.0
sonner 2.0.7 2.0.8
zod 4.5.4 4.6.5
@playwright/test 1.58.1 1.63.0
@types/node 26.4.0 26.6.2
@types/react 19.2.17 19.3.0
@types/react-dom 19.2.3 19.3.0
@typescript-eslint/eslint-plugin 8.65.0 8.70.0
@typescript-eslint/parser 8.65.0 8.70.0
eslint 10.9.1 10.11.0
eslint-config-next 16.2.12 16.3.5
lint-staged 17.3.0 17.5.1
node-mocks-http 1.17.2 1.18.1
prettier 3.8.1 3.9.8

Updates @bitbaum/ai-kit from 1.4.0 to 1.10.0

Commits
  • a0f04ea chore(release): 1.10.0 — transcribe() (#65)
  • 9598005 feat(transcribe): speech to text over the same chain as everything else (#64)
  • e449c97 docs(providers): a register of what each vendor actually costs (#63)
  • 5119b59 feat(stream): the chain can stream, so apps stop going around it (#62)
  • 982b26f feat(chain): a third vendor that is actually free — Gemini (#61)
  • 2b91951 chore: rename FleetCrown to Loki (#60)
  • 107c605 fix(grounding): a citation is its ID, not its bracket shape (#59)
  • d37b905 feat(chain): two more Groq links, because the meter is per model (#58)
  • 97d9657 docs(chain): Groq rations per MODEL, so a same-vendor link can be a real fall...
  • b7f7410 feat(meter): read the limit that only the refusal admits to (#56)
  • Additional commits viewable in compare view

Updates @bitbaum/mail-kit from 0.1.0 to 0.1.1

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​bitbaum/mail-kit since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @headlessui/react from 2.2.9 to 2.2.10

Release notes

Sourced from @​headlessui/react's releases.

@​headlessui/react@​v2.2.10

Fixed

  • Don’t render <Portal> while hydrating (#3825)
  • Fix passing props on Fragment error due to Symbol(react.lazy) (#3873)
Changelog

Sourced from @​headlessui/react's changelog.

[2.2.10] - 2026-04-07

Fixed

  • Don’t render <Portal> while hydrating (#3825)
  • Fix passing props on Fragment error due to Symbol(react.lazy) (#3873)
Commits

Updates @supabase/ssr from 0.8.0 to 0.12.7

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.7

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

v0.12.7-rc.162

What's Changed

Full Changelog: supabase/ssr@v0.12.6...v0.12.7-rc.162

v0.12.6

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

v0.12.6-rc.158

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.5...v0.12.6-rc.158

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

0.12.4 (2026-07-28)

Bug Fixes

  • flush PKCE verifier slot removals on the server (#275) (6df6f03)

0.12.3 (2026-07-14)

Bug Fixes

  • cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

0.12.2 (2026-07-14)

Bug Fixes

  • align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

0.12.1 (2026-07-13)

Bug Fixes

  • cookies: deduplicate server cookie writes (#246) (035eabe)

0.12.0 (2026-06-09)

... (truncated)

Commits
  • 9b28f49 chore(main): release 0.12.7 (#295)
  • 9d6e2a5 fix: apply non-browser defaults when cookies only sets encode (#294)
  • 4ed9f65 chore: add workflow for autoclosing stale issues (#292)
  • 71c33a7 chore(main): release 0.12.6 (#291)
  • c7c7e68 docs: fix typos in tsdoc and design doc (#288)
  • af750e2 fix: avoid duplicate cache headers per server client (#283)
  • 905c7c3 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#290)
  • 9e2564d chore: update @​supabase/supabase-js to v2.114.0 (#289)
  • c5310fd chore(main): release 0.12.5 (#286)
  • c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.93.3 to 2.116.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add bucket lifecycle configuration (#2659)
  • storage: topk 10k support (#2667)
  • storage: add versionId support to create URL methods (#2678)

🩹 Fixes

  • auth: silence commit-guard-discarded refresh in initial session (#2668)
  • storage: drop legacy prefix from lifecycles (#2674)
  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

  • fadymak
  • Ferhat Elmas
  • Katerina Skroumpelou @​mandarini
  • Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add versionId support to create URL methods (#2678)

❤️ Thank You

  • fadymak
  • Katerina Skroumpelou
  • Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

  • storage: topk 10k support (#2667)

🩹 Fixes

  • storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

🩹 Fixes

  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.3 (2026-08-11)

🩹 Fixes

  • supabase: improve trace propagation sampling and diagnostics (#2604)
  • supabase: add trace context headers to canonical CORS allow-list (#2603)

❤️ Thank You

2.112.2 (2026-08-06)

... (truncated)

Commits
  • 5aedaab feat(auth): add MFA recovery codes API (#2676)
  • e4f675a fix(supabase): warn when schema is passed outside db options (#2663)
  • dbe7679 chore(release): version 2.115.0 changelogs (#2664)
  • 3eb6193 docs(supabase): clarify db.schema needs the second generic (#2662)
  • 92fb8ba feat(postgrest): add getOpenApiSpec() (#2651)
  • aef432b chore(release): version 2.114.0 changelogs (#2653)
  • 67b07b0 chore(release): version 2.113.0 changelogs (#2650)
  • 062ae5e chore(release): version 2.112.4 changelogs (#2628)
  • c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
  • bbc167c chore(release): version 2.112.3 changelogs (#2608)
  • Additional commits viewable in compare view

Updates bip-kit from 0.2.7 to 0.3.0

Commits
  • f124307 feat: render canonical public development records (v0.3.0) (#35)
  • 551fd4c fix(react): announce the active TOC entry with aria-current (v0.2.8) (#34)
  • a4680e7 chore: rename FleetCrown to Loki (#33)
  • f525f1f chore(deps-dev): Bump the minor-and-patch group with 7 updates (#32)
  • 1d0ba78 ci(publish): make publishing idempotent so a second run is green, not E403 (#31)
  • See full diff in compare view

Updates date-fns from 4.1.0 to 4.4.0

Release notes

Sourced from date-fns's releases.

v4.4.0

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

  • DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

  • Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

v4.2.1

Fixed

  • Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

  • Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.
Commits
  • cd53d25 Promote to v4.4.0
  • d948ec1 Preserve but deprecate CDN versions for v4, set up v5 with polyfills
  • ee65753 Add root mise :format task
  • 9f5bdf5 Add positional argument to test/smoke.sh script
  • 651ead6 Split CDN bundles into separate @​date-fns/cdn package
  • 224c1a2 Deprecate type tests as attw hangs on date-fns package
  • 7bb2842 Switch PACKAGE_OUTPUT_PATH to --dist flag in the package build script
  • b6ad5ac Add flags to control package build script
  • 424a783 Fix docs release after moving to monorepo setup
  • f95bcf1 (docs): Add missing tsx dependency
  • Additional commits viewable in compare view

Updates next from 16.3.3 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • Additional commits viewable in compare view

Updates postcss from 8.5.23 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).
Changelog

Sourced from postcss's changelog.

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).
Commits

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 2…
ed9c530 
…6 updates

Bumps the minor-and-patch group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@bitbaum/ai-kit](https://github.com/bitbaum/ai-kit) | `1.4.0` | `1.10.0` |
| [@bitbaum/mail-kit](https://github.com/bitbaum/mail-kit) | `0.1.0` | `0.1.1` |
| [@headlessui/react](https://github.com/tailwindlabs/headlessui/tree/HEAD/packages/@headlessui-react) | `2.2.9` | `2.2.10` |
| [@supabase/ssr](https://github.com/supabase/ssr) | `0.8.0` | `0.12.7` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.93.3` | `2.116.0` |
| [bip-kit](https://github.com/bitbaum/bip-kit) | `0.2.7` | `0.3.0` |
| [date-fns](https://github.com/date-fns/date-fns) | `4.1.0` | `4.4.0` |
| [next](https://github.com/vercel/next.js) | `16.3.3` | `16.3.5` |
| [postcss](https://github.com/postcss/postcss) | `8.5.23` | `8.5.28` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.3.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.71.1` | `7.88.0` |
| [react-icons](https://github.com/react-icons/react-icons) | `5.5.0` | `5.7.0` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.58.1` | `1.63.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.6.2` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.3.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.65.0` | `8.70.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.65.0` | `8.70.0` |
| [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.11.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.12` | `16.3.5` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.3.0` | `17.5.1` |
| [node-mocks-http](https://github.com/eugef/node-mocks-http) | `1.17.2` | `1.18.1` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.8` |



Updates `@bitbaum/ai-kit` from 1.4.0 to 1.10.0
- [Commits](bitbaum/ai-kit@v1.4.0...v1.10.0)

Updates `@bitbaum/mail-kit` from 0.1.0 to 0.1.1
- [Commits](bitbaum/mail-kit@v0.1.0...v0.1.1)

Updates `@headlessui/react` from 2.2.9 to 2.2.10
- [Release notes](https://github.com/tailwindlabs/headlessui/releases)
- [Changelog](https://github.com/tailwindlabs/headlessui/blob/main/packages/@headlessui-react/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/headlessui/commits/@headlessui/react@v2.2.10/packages/@headlessui-react)

Updates `@supabase/ssr` from 0.8.0 to 0.12.7
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.8.0...v0.12.7)

Updates `@supabase/supabase-js` from 2.93.3 to 2.116.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/supabase-js)

Updates `bip-kit` from 0.2.7 to 0.3.0
- [Commits](bitbaum/bip-kit@v0.2.7...v0.3.0)

Updates `date-fns` from 4.1.0 to 4.4.0
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Commits](date-fns/date-fns@v4.1.0...v4.4.0)

Updates `next` from 16.3.3 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.3...v16.3.5)

Updates `postcss` from 8.5.23 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.23...8.5.28)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.17 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-hook-form` from 7.71.1 to 7.88.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.71.1...v7.88.0)

Updates `react-icons` from 5.5.0 to 5.7.0
- [Release notes](https://github.com/react-icons/react-icons/releases)
- [Commits](react-icons/react-icons@v5.5.0...v5.7.0)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `zod` from 4.5.4 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.4...v4.6.5)

Updates `@playwright/test` from 1.58.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.58.1...v1.63.0)

Updates `@types/node` from 26.4.0 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.17 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@typescript-eslint/eslint-plugin` from 8.65.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.65.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/parser)

Updates `eslint` from 10.9.1 to 10.11.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.9.1...v10.11.0)

Updates `eslint-config-next` from 16.2.12 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.5/packages/eslint-config-next)

Updates `lint-staged` from 17.3.0 to 17.5.1
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.3.0...v17.5.1)

Updates `node-mocks-http` from 1.17.2 to 1.18.1
- [Release notes](https://github.com/eugef/node-mocks-http/releases)
- [Changelog](https://github.com/eugef/node-mocks-http/blob/master/HISTORY.md)
- [Commits](eugef/node-mocks-http@v1.17.2...v1.18.1)

Updates `prettier` from 3.8.1 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.1...3.9.8)

---
updated-dependencies:
- dependency-name: "@bitbaum/ai-kit"
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@bitbaum/mail-kit"
  dependency-version: 0.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@headlessui/react"
  dependency-version: 2.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@supabase/ssr"
  dependency-version: 0.12.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.116.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: bip-kit
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: date-fns
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-hook-form
  dependency-version: 7.88.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-icons
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lint-staged
  dependency-version: 17.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: node-mocks-http
  dependency-version: 1.18.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.8
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
@catomean
catomean merged commit ec08e85 into main Sep 23, 2026
1 check failed
@catomean
catomean deleted the dependabot/npm_and_yarn/minor-and-patch-bae564081b branch September 23, 2026 20:38
@catomean catomean mentioned this pull request Sep 25, 2026
Merged
catomean added a commit that referenced this pull request Sep 25, 2026
@catomean @claude
fix(ai): context extraction only on the user's own key; vendors by id…
ce98b0c 
… (main green again) (#205)

* fix(ai): pick chain vendors by id, and make main green again

main has been red since #203 bumped @bitbaum/ai-kit to 1.10, which put
Gemini second in freeChain('BOTSMANN'). vendorChain() indexed [1] for
OpenRouter, so a BYOK OpenRouter user's key would have been sent down the
Gemini link. Look vendors up by id instead (code and both tests).

Also clears the rest of the red verify from the same bump: prettier 3.x
reformat of six files and the new next lint rule on relative
window.location.href assignments (sign-out keeps its full reload).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Cato <41178744+catomean@users.noreply.github.com>

* fix(ai): context extraction runs only on the user's own key

Every professional-chat turn fired a second, unasked model call
(extractAndSaveContext, fire-and-forget after the answer) on the shared
free-tier Groq key. Standing rule (2026-09-25): free-tier keys are spent
only when a person deliberately asks. Extraction now requires the user's
own key and uses their provider; without one it returns before any call.

Adds tests/__tests__/no-free-background-ai.test.ts: walks the import graph
from the timer route (/api/rebuild, appcron-botsmann-rebuild), /api/warmup
and /api/health and fails if any reaches a model client. Proven by
mutation: importing lib/nlp into /api/rebuild fails it, and dropping the
own-key guard fails the three new extractor cases.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Cato <41178744+catomean@users.noreply.github.com>

---------

Signed-off-by: Cato <41178744+catomean@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@catomean