Bump the npm-dependencies group across 1 directory with 51 updates

[dependabot]

Bumps the npm-dependencies group with 51 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	3.1131.0	3.1146.0
@radix-ui/react-avatar	1.2.6	1.2.7
@radix-ui/react-checkbox	1.3.11	1.3.12
@radix-ui/react-collapsible	1.1.20	1.1.21
@radix-ui/react-dialog	1.1.23	1.2.0
@radix-ui/react-dropdown-menu	2.1.24	2.1.25
@radix-ui/react-label	2.1.15	2.1.16
@radix-ui/react-popover	1.1.23	1.2.0
@radix-ui/react-progress	1.1.16	1.1.17
@radix-ui/react-radio-group	1.4.7	1.4.8
@radix-ui/react-scroll-area	1.2.18	1.3.0
@radix-ui/react-select	2.3.7	2.3.8
@radix-ui/react-separator	1.1.15	1.1.16
@radix-ui/react-slot	1.3.3	1.4.0
@radix-ui/react-switch	1.3.7	1.3.8
@radix-ui/react-tabs	1.1.21	1.1.22
@radix-ui/react-toast	1.2.23	1.2.24
@radix-ui/react-tooltip	1.2.16	1.3.0
@simplewebauthn/server	14.0.1	14.0.3
@tanstack/react-query	5.102.8	5.104.1
drizzle-orm	0.45.2	0.45.3
js-yaml	5.4.1	5.4.3
lru-cache	11.5.2	11.5.3
lucide-react	1.45.0	1.52.0
next	16.3.6	16.3.8
next-intl	4.14.4	4.14.9
nodemailer	10.0.9	10.0.15
pg	8.23.0	8.23.1
posthog-node	5.52.1	5.55.0
react-day-picker	10.0.1	10.0.2
react-hook-form	7.88.0	7.89.0
stripe	22.6.2	23.0.0
tailwind-merge	3.6.0	3.7.0
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2
yargs	18.1.0	18.2.0
zod	4.6.2	4.6.5
@dotenvx/dotenvx	2.24.1	2.33.0
@react-email/ui	6.9.5	6.11.0
@tanstack/react-query-devtools	5.102.8	5.104.1
@types/node	26.5.1	26.6.4
@types/nodemailer	8.0.1	8.0.2
@types/ws	8.18.1	8.18.2
drizzle-kit	0.31.10	0.31.11
eslint	10.10.0	10.12.0
eslint-config-next	16.3.5	16.3.8
postcss	8.5.28	8.5.29
prettier	3.9.6	3.9.9
react-email	6.9.5	6.11.0
tsc-alias	1.9.5	1.9.7
tsx	4.23.13	4.23.15
typescript-eslint	8.70.0	8.71.1

Updates @aws-sdk/client-s3 from 3.1131.0 to 3.1146.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1146.0

3.1146.0(2026-10-02)

Documentation Changes

• client-lambda-web: Documentation update for AWS Lambda Web Functions, clarifies that the LambdaWeb APIs are experimental and not yet available to external customers. (de11d1e1)

New Features

• client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Static filter configuration allows users to configure endpoints with layouts and sources without using query parameters. The number of sources per multiview channel has been increased to 50. (8a1ac09c)
• client-invoicing: API and doc updates related to adding MarketplacePunchOutEnabled and MarketplacePunchOutPreference fields to ProcurementPortalPreferences related APIs (948be4b5)
• client-glue: Added refresh token grant type to Glue Connection supported OAuth 2.0 grant types (6101fef0)
• client-cognito-identity-provider: Amazon Cognito User Pools now supports the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on issued access and Id tokens. Amazon Cognito User Pools also now supports step-up authentication via our existing authentication APIs. (196e191f)
• client-pinpoint-sms-voice-v2: AWS End User Messaging SMS CarrierLookup API now supports phone number cleansing on customer opt-in. when selected, the response includes the additional field "OriginalPhoneNumber". It can also return additional PhoneNumberType enums, VOIP and PREPAID. (42d43613)
• client-securityagent: Adds trigger filters that control which pull request events, target branches, and labels start an automatic code review. (3d73df94)

---

For list of updated packages, view updated-packages.md in assets-3.1146.0.zip

v3.1145.0

3.1145.0(2026-10-01)

Chores

• update lock-threads workflow (#8327) (5daff5f2)

Documentation Changes

• client-ec2: This release launches the AMI tag sharing feature, which lets AMI owners share tags alongside their AMIs, eliminating the need to build and maintain custom tag replication workflows. (82608f8c)

New Features

• clients: update client endpoints as of 2026-10-01 (5244c2a9)
• client-bedrock-agent: Adds an optional textReadyAt field to ListIngestionJobs and GetIngestionJob for Managed Knowledge Bases data source sync jobs. The field denotes the timestamp at which all the documents in the scope of a sync job had their text content indexed and are available for retrieval. (a810c753)
• client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (ed0d0540)
• client-quicksight: This release adds HierarchyFilter support for Amazon QuickSight analysis and dashboard and 2 legged OAuth for databricks datasources. (a1730e33)
• client-endusermessaging: AWS End User Messaging now supports Brand profiles and Notify code configurations. Brand profiles capture your sender details once to reuse across phone number registrations. Notify code configurations let you define your OTP policy and delivery settings to send passcodes in minutes. (3e5402c6)
• client-transfer: AWS Transfer Family Workflows adds support for the structuredLogDestinations option, enabling customers to specify a custom Amazon CloudWatch Logs log group for managed workflow execution logs. (db1f8330)
• client-health: Adds DescribeServiceLifecycle operation returning lifecycle information for AWS services, including end-of-support dates, version recommendations, and lifecycle events. (db93c016)
• client-cloudfront: Added always-amz-auth as a supported signing behavior for Origin Access Control (OAC), enabling CloudFront to authenticate requests to Lambda-Web origins. (e24eb7cf)
• client-sagemaker: Release support for c8a.16xlarge and m8a.16xlarge instance types for SageMaker HyperPod (cfa700a6)
• client-securityhub: Adds GetRemediationsV2 and ListExposuresByRemediationV2 APIs. This feature allows customers to see their highest priority remediations for their Exposure findings. Remediations target key changes customers can make to resources to drive finding resolution. (fe355577)

Bug Fixes

• lib-transfer-manager: respect file read stream's byte range on upload (#8324) (449c2814)
• ci: run format-check when a draft PR is marked ready for review (#8326) (d99dd58e)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1144.0 (2026-09-30)

Features

• client-s3: Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others. (82bbbdc)

3.1143.0 (2026-09-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1142.0 (2026-09-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1141.0 (2026-09-25)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits

• 054298b Publish v3.1146.0
• 0199117 Publish v3.1145.0
• ce26281 Publish v3.1144.0
• 82bbbdc feat(client-s3): Amazon S3 adds a new optional S3 Inventory field, Intelligen...
• 81afad0 Publish v3.1143.0
• c935fdd Publish v3.1142.0
• 5bc8d9a Publish v3.1141.0
• 6050a38 Publish v3.1140.0
• 03d54a8 Publish v3.1139.0
• c68e50e Publish v3.1138.0
• Additional commits viewable in compare view

Updates @radix-ui/react-avatar from 1.2.6 to 1.2.7

Changelog

Sourced from @​radix-ui/react-avatar's changelog.

1.2.7

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-checkbox from 1.3.11 to 1.3.12

Changelog

Sourced from @​radix-ui/react-checkbox's changelog.

1.3.12

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-collapsible from 1.1.20 to 1.1.21

Changelog

Sourced from @​radix-ui/react-collapsible's changelog.

1.1.21

• Updated dependencies: @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.23 to 1.2.0

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.1.25

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.15 to 2.1.16

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-popover from 1.1.23 to 1.2.0

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.2.0

• Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-progress from 1.1.16 to 1.1.17

Changelog

Sourced from @​radix-ui/react-progress's changelog.

1.1.17

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-radio-group from 1.4.7 to 1.4.8

Changelog

Sourced from @​radix-ui/react-radio-group's changelog.

1.4.8

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-scroll-area from 1.2.18 to 1.3.0

Changelog

Sourced from @​radix-ui/react-scroll-area's changelog.

1.3.0

• Added a ScrollArea.Content part so consumers can own the wrapper element implicitly rendered by ScrollArea.Viewport. Pass disableImplicitContentElement to the viewport and render ScrollArea.Content as its child.

  <ScrollArea.Root>
    <ScrollArea.Viewport disableImplicitContentElement>
      <ScrollArea.Content>{children}</ScrollArea.Content>
    </ScrollArea.Viewport>
    <ScrollArea.Scrollbar>
      <ScrollArea.Thumb />
    </ScrollArea.Scrollbar>
  </ScrollArea.Root>

  In the next major release, the viewport will no longer render this element implicitly. We recommend migrating to this API now for a smoother upgrade.

• Fixed a bug where asChild on ScrollArea.Viewport merged props onto the implicit content element instead of the consumer's element.

• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-select from 2.3.7 to 2.3.8

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.3.8

• Fixed a bug where internal event handlers were still called on disabled Select.Item elements. Consumer-provided event handlers still run, but Radix's own selection logic no longer fires for disabled items.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-separator from 1.1.15 to 1.1.16

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.3.3 to 1.4.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.4.0

• Added support for multiple aria-describedby attributes.
• Fixed compatibility issues with React Server Components.

Commits

• See full diff in compare view

Updates @radix-ui/react-switch from 1.3.7 to 1.3.8

Changelog

Sourced from @​radix-ui/react-switch's changelog.

1.3.8

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-tabs from 1.1.21 to 1.1.22

Changelog

Sourced from @​radix-ui/react-tabs's changelog.

1.1.22

• Fixed a bug where a focused element inside Tabs.Content did not fire a blur event before the tab switched. Tabs.Trigger now moves focus before the tab's state change.
• Updated dependencies: @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-toast from 1.2.23 to 1.2.24

Changelog

Sourced from @​radix-ui/react-toast's changelog.

1.2.24

• Fixed a bug where a paused Toast would not auto-close after its duration changed while the timer was paused.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.2.16 to 1.3.0

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.3.0

• Added support for multiple aria-describedby attributes.
• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @simplewebauthn/server from 14.0.1 to 14.0.3

Release notes

Sourced from @​simplewebauthn/server's releases.

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

Commits

• 084e601 Update server version to v14.0.3
• cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
• 7e3c4c4 Kinda makes more sense to do the AKI check first
• 21f99a2 Update server version to v14.0.2
• f03758a Merge commit from fork
• See full diff in compare view

Updates @tanstack/react-query from 5.102.8 to 5.104.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.1

Patch Changes

• Updated dependencies [ec060b6]:
  • @​tanstack/query-devtools@​5.104.1
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-next-experimental@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-persist-client@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.104.1
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

@​tanstack/react-query-devtools@​5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/query-devtools@​5.104.0
  • @​tanstack/react-query@​5.104.0

@​tanstack/react-query-next-experimental@​5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/react-query@​5.104.0

@​tanstack/react-query-persist-client@​5.104.0

Minor Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

• #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
• Updated dependencies []:
  • @​tanstack/query-core@​5.103.3

5.103.2

Patch Changes

• Updated dependencies [8a28904]:
  • @​tanstack/query-core@​5.103.2

5.103.1

Patch Changes

• Updated dependencies [8330b2f, 3212966]:
  • @​tanstack/query-core@​5.103.1

5.103.0

Patch Changes

• Updated dependencies [e57f816, fdae2ce, a1119e5, cbf77bf]:
  • @​tanstack/query-core@​5.103.0

Commits

• 29859ae ci: Version Packages (#11806)
• 339e09f chore(*): manage 'react' eslint plugins with pnpm 'catalog' (#11781)
• 0a57279 test({react,preact,solid,angular}-query/mutationOptions): fix 'mutationOpt1' ...
• c51bb62 chore(*): declare '@​eslint-react/eslint-plugin' in the react packages and exa...
• a914613 chore(*): declare 'eslint-plugin-react-hooks' in the react packages that use ...
• d99c84b chore(*): update '@​eslint-react/eslint-plugin' to v5 and apply its 'recommend...
• fd96529 chore(*): update 'eslint-plugin-react-hooks' to v7 and use its stable 'recomm...
• e878990 chore(*): manage 'react' packages with pnpm 'catalog' (#11712)
• 2e1ad64 chore(*): declare 'npm-run-all2' once in the root 'package.json' like other s...
• c1de23a chore(*): manage 'typescript' with pnpm 'catalog' and declare it in each pack...
• Additional commits viewable in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates js-yaml from 5.4.1 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

Commits

• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• See full diff in compare view

Updates lru-cache from 11.5.2 to 11.5.3

Commits

• 7e71a1f 11.5.3
• 98b553f add react-native export condition with no diagnostics_channel
• See full diff in compare view

Updates lucide-react from 1.45.0 to 1.52.0

Release notes

Sourced from lucide-react's releases.

Version 1.52.0

What's Changed

• fix(icons): changed wifi-cog icon by @​karsa-mistmere in lucide-icons/lucide#4952

Full Changelog: lucide-icons/lucide@1.51.0...1.52.0

Version 1.51.0

What's Changed

• fix(site): persist icon customizer by @​karsa-mistmere in lucide-icons/lucide#4944
• chore(deps): Upgrade to vite 8 by @​ericfennis in lucide-icons/lucide#4950
• feat(icons): added rugby-ball icon by @​dev-mralph in lucide-icons/lucide#3496
• chore(deps): bump the react-deps group across 1 directory with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4951
• fix(react-native): stop forwarding arbitrary rest props to child shape elements by @​cipherprofessor in lucide-icons/lucide#4903
• test(lucide-solid): add Vite and SolidStart integration fixtures by @​ericfennis in lucide-icons/lucide#4884
• feat(icons): add door-closed-cog icon by @​ajaxjiang96 in lucide-icons/lucide#4905
• feat(icons): add text-align-justify-* icons by @​HectorZaGa in lucide-icons/lucide#4942
• chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the github-actions group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#4939
• chore(deps): Upgrade to vitest 5 by @​ericfennis in lucide-icons/lucide#4953
• feat(icons): added wind-arrow-up icon by @​jamesgpearce in lucide-icons/lucide#4501
• fix(github/actions): move to daily release flow by @​karsa-mistmere in lucide-icons/lucide#4911
• feat(@​lucide/solid): Support for Solid 2.0 RC by @​davedbase in lucide-icons/lucide#4751
• chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @​dependabot[bot] in lucide-icons/lucide#4954
• chore(deps): bump nuxt from 4.4.8 to 4.5.1 by @​dependabot[bot] in lucide-icons/lucide#4949
• feat(icons): added armenian-dram icon by @​Elawphant in lucide-icons/lucide#4456
• feat(icons): add kazakh-tenge icon by @​hkayrad in lucide-icons/lucide#4925

New Contributors

• @​dev-mralph made their first contribution in lucide-icons/lucide#3496
• @​cipherprofessor made their first contribution in lucide-icons/lucide#4903
• @​HectorZaGa made their first contribution in lucide-icons/lucide#4942
• @​jamesgpearce made their first contribution in lucide-icons/lucide#4501
• @​davedbase made their first contribution in lucide-icons/lucide#4751
• @​Elawphant made their first contribution in lucide-icons/lucide#4456
• @​hkayrad made their first contribution in lucide-icons/lucide#4925

Full Changelog: lucide-icons/lucide@1.50.0...1.51.0

Version 1.50.0

What's Changed

• fix(shared): escape attribute values in buildLucideSvg by @​Saadanjum0 in lucide-icons/lucide#4940
• fix(github/actions): use canonical metadata instructions for PR suggestions by @​karsa-mistmere in lucide-icons/lucide#4910
• fix(icons): replaced nut & nut-off with compliant designs by @​karsa-mistmere in lucide-icons/lucide#4840
• chore(deps-dev): bump @​angular/router from 22.1.7 to 22.2.0 by @​dependabot[bot] in lucide-icons/lucide#4945
• chore(deps): bump next from 16.3.4 to 16.3.6 by @​dependabot[bot] in lucide-icons/lucide#4946
• chore(deps-dev): bump the svelte-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#4918
• test(integrations): add Vue integration fixtures for Vite, Nuxt and Vike by @​ericfennis in lucide-icons/lucide#4882
• feat(svelte): export context subpath by @​vugarbbakhishov-hub in lucide-icons/lucide#4927
• fix(lucide-preact): add Preact v11 compatibility by @​JoviDeCroock in lucide-icons/lucide#4924
• feat(icons): added layout-grid-circles icon by @​karsa-mistmere in lucide-icons/lucide#4567

... (truncated)

Commits

• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
• See full diff in compare view

Updates next from 16.3.6 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

Commits

• b0fad0d v16.3.8
• 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
• e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
• 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
• 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
• bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
• 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
• e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
• 4c20699 v16.3.7
• 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
• See full diff in compare view

Updates next-intl from 4.14.4 to 4.14.9

Release notes

Sourced from next-intl's releases.

v4.14.9

4.14.9 (2026-10-02)

Bug Fixes

• Improvements for useExtracted (#2431) (