chore(deps): bump the bun-minor-patch group with 8 updates

[dependabot]

Bumps the bun-minor-patch group with 8 updates:

Package	From	To
posthog-js	1.422.1	1.422.5
resend	6.24.0	6.25.0
@biomejs/biome	2.5.10	2.5.11
chromatic	18.6.1	18.7.2
cspell	10.1.1	10.2.0
knip	6.32.3	6.34.0
next	16.2.12	16.3.4
wrangler	4.127.0	4.127.1

Updates posthog-js from 1.422.1 to 1.422.5

Release notes

Sourced from posthog-js's releases.

posthog-js@1.422.5

1.422.5

Patch Changes

• Updated dependencies [a895e7e]:
  • @​posthog/browser-common@​0.7.0

posthog-js@1.422.4

1.422.4

Patch Changes

• #4626 3c650a1 Thanks @​nandinitiw! - Re-translate popover surveys when the display language changes while the survey is on screen, either from a browser languagechange event or from identify() updating the language person property. In-progress answers are preserved. $survey_questions[].question and $survey_language on survey sent / survey dismissed now report the text and language the user saw when they answered, not the language active when the event fired. Feedback-button (widget) surveys are unchanged. (2026-08-28)
• Updated dependencies [3c650a1]:
  • @​posthog/core@​1.49.2

posthog-js@1.422.3

1.422.3

Patch Changes

• #4669 d0279e5 Thanks @​posthog! - Autocapture no longer throws a RangeError into the host page when it sorts element attributes. It now sorts attribute keys with a plain lexical comparator instead of localeCompare, which can throw on browsers with faulty ICU data. (2026-08-28)
• Updated dependencies [d0279e5]:
  • @​posthog/browser-common@​0.6.2

posthog-js@1.422.2

1.422.2

Patch Changes

• #4665 d5ef459 Thanks @​fasyy612! - Session replay can now bound DOM mutation bytes with an opt-in budget. Set __mutationBytesBucketSize (e.g. 1MB) to enable: mutations beyond the sustained budget (__mutationBytesRefillRate, default 25KB/s) are dropped and the recording resyncs with a full snapshot, keeping recordings from apps with very high DOM churn playable. Off by default. (2026-08-28)
• Updated dependencies [d5ef459]:
  • @​posthog/types@​1.407.1

Commits

• 2239803 chore: update versions and lockfile [version bump]
• a895e7e feat(browser-next): add private experimental browser core (#4378)
• 862ac0b chore: update versions and lockfile [version bump]
• 3c650a1 fix(surveys): re-translate displayed surveys when user language changes (#4626)
• 22ed264 chore: update versions and lockfile [version bump]
• d0279e5 fix(autocapture): sort attribute keys without localeCompare to avoid RangeErr...
• c2855bd chore: update versions and lockfile [version bump]
• d5ef459 fix(replay): bound mutation bytes with a budget and resync via full snapshot ...
• See full diff in compare view

Updates resend from 6.24.0 to 6.25.0

Release notes

Sourced from resend's releases.

v6.25.0

What's Changed

• feat: allow CNAME type on domain SPF records by @​vieiralucas in resend/resend-node#1085

Full Changelog: resend/resend-node@v6.24.0...v6.25.0

Commits

• a73eb3b feat: allow CNAME type on domain SPF records (#1085)
• See full diff in compare view

Updates @biomejs/biome from 2.5.10 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• See full diff in compare view

Updates chromatic from 18.6.1 to 18.7.2

Release notes

Sourced from chromatic's releases.

v18.7.2

🐛 Bug Fix

• Add Sentry tags to TurboSnap v2 events #1469 (@​codykaup)
• [TurboSnap v2] Filter data URLs #1470 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

v18.7.1

🐛 Bug Fix

• fix: chromaui/action to resolve correct E2E package when multiple are installed #1465 (@​AriPerkkio)

Authors: 1

• Ari Perkkiö (@​AriPerkkio)

v18.7.0

🚀 Enhancement

• TurboSnap v2 release (runs alongside v1) #1463 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

v18.6.2

🐛 Bug Fix

• Return capture counts on bypassed builds #1467 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

Changelog

Sourced from chromatic's changelog.

v18.7.2 (Mon Aug 31 2026)

🐛 Bug Fix

• Add Sentry tags to TurboSnap v2 events #1469 (@​codykaup)
• [TurboSnap v2] Filter data URLs #1470 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

v18.7.1 (Fri Aug 28 2026)

🐛 Bug Fix

• fix: chromaui/action to resolve correct E2E package when multiple are installed #1465 (@​AriPerkkio)

Authors: 1

• Ari Perkkiö (@​AriPerkkio)

---

v18.7.0 (Fri Aug 28 2026)

🚀 Enhancement

• TurboSnap v2 release (runs alongside v1) #1463 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

v18.6.2 (Fri Aug 28 2026)

🐛 Bug Fix

• Return capture counts on bypassed builds #1467 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

Commits

• a4e4375 Bump version to: 18.7.2 [skip ci]
• 1a0dcb9 Update CHANGELOG.md [skip ci]
• e0a4650 Merge pull request #1469 from chromaui/worktree-sentry-turbosnap-v2-tag
• 4386b19 Merge pull request #1470 from chromaui/cody/cap-5018-ignore-data-url-paths
• 7f93f56 Filter data URLs
• 7efd466 Add Sentry tags to TurboSnap v2 events
• ec1c832 Bump version to: 18.7.1 [skip ci]
• 5a75fc8 Update CHANGELOG.md [skip ci]
• fc6ff5c Merge pull request #1465 from chromaui/ari/SB-1674
• a39b04d Bump version to: 18.7.0 [skip ci]
• Additional commits viewable in compare view

Updates cspell from 10.1.1 to 10.2.0

Release notes

Sourced from cspell's releases.

v10.2.0

Features

feat: Support languages without word breaks (Part 2) (#9133)

This pull request introduces support for locale-sensitive word segmentation, enabling better spell checking for languages such as Japanese, Chinese, Thai, Lao, Khmer, and Myanmar. The main changes add a new configuration option, useIntlWordSegmentation, to the schema and internal types, implement the corresponding text transformation logic, and update the document validation pipeline to use this feature. Additional test fixtures and tests are included to ensure correct behavior.

Support for locale-sensitive word segmentation:

• Added a new boolean configuration option, useIntlWordSegmentation, to the JSON schema (cspell.schema.json) and internal TypeScript types (BaseSetting), allowing users to enable locale-aware text segmentation for supported languages. [1] [2] [3] [4]
• Implemented the IntlSegmentTextTransformer and a factory function, createIntlSegmentTextTransformer, to perform locale-sensitive segmentation using the specified language.
• Introduced a new utility, chainTransformers, and an IdentityTextTransformer to allow chaining multiple text transformers in the validation pipeline.
• Updated the document validation logic (docValidator.ts and related files) to use the new transformer when useIntlWordSegmentation is enabled, ensuring correct segmentation for complex scripts. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]

Testing and fixtures:

• Added new test fixtures and a test document containing Thai text, as well as a corresponding dictionary file and configuration to verify correct segmentation and spell checking. [1] [2] [3]
• Extended the document validator tests to cover the new segmentation feature.

These changes collectively improve support for non-space-delimited languages and provide a more robust spell-checking experience for a wider range of languages.

---

feat: Support languages without word breaks (Part 1) (#9131)

This pull request introduces a new IntlSegmentTextTransformer for locale-aware text segmentation, refactors text transformation infrastructure for better composability, and improves locale normalization to BCP 47 standards. It also adds comprehensive tests for these new features and refactors existing transformers for consistency.

Locale normalization improvements

• Improved the normalizeLocaleIntl function in LanguageSettings.ts to support BCP 47 language tag normalization, including script and region subtags, and added tests for these cases. [1] [2]

New locale-aware text transformer

• Added the IntlSegmentTextTransformer class for locale-aware word segmentation using Intl.Segmenter, along with tests covering multiple locales (including Thai). [1] [2]

Transformer infrastructure and API improvements

• Introduced a generic TextTransformer interface and the Edit type in Transformer.ts to standardize text transformation operations.
• Added utility functions applyEditsToMappedText and applyEditsToText in TextMapEdit.ts for applying edits and maintaining source maps, used by all transformers.

Refactoring and consistency

• Refactored SubstitutionTransformer to implement the new TextTransformer interface and use the new edit application utilities, simplifying and unifying its implementation. [1] [2] [3]

These changes collectively improve the flexibility, correctness, and internationalization support of the text transformation pipeline.

---

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.2.0 (2026-08-31)

Features

feat: Support languages without word breaks (Part 2) (#9133)

This pull request introduces support for locale-sensitive word segmentation, enabling better spell checking for languages such as Japanese, Chinese, Thai, Lao, Khmer, and Myanmar. The main changes add a new configuration option, useIntlWordSegmentation, to the schema and internal types, implement the corresponding text transformation logic, and update the document validation pipeline to use this feature. Additional test fixtures and tests are included to ensure correct behavior.

Support for locale-sensitive word segmentation:

• Added a new boolean configuration option, useIntlWordSegmentation, to the JSON schema (cspell.schema.json) and internal TypeScript types (BaseSetting), allowing users to enable locale-aware text segmentation for supported languages. [1] [2] [3] [4]
• Implemented the IntlSegmentTextTransformer and a factory function, createIntlSegmentTextTransformer, to perform locale-sensitive segmentation using the specified language.
• Introduced a new utility, chainTransformers, and an IdentityTextTransformer to allow chaining multiple text transformers in the validation pipeline.
• Updated the document validation logic (docValidator.ts and related files) to use the new transformer when useIntlWordSegmentation is enabled, ensuring correct segmentation for complex scripts. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]

Testing and fixtures:

• Added new test fixtures and a test document containing Thai text, as well as a corresponding dictionary file and configuration to verify correct segmentation and spell checking. [1] [2] [3]
• Extended the document validator tests to cover the new segmentation feature.

These changes collectively improve support for non-space-delimited languages and provide a more robust spell-checking experience for a wider range of languages.

---

feat: Support languages without word breaks (Part 1) (#9131)

This pull request introduces a new IntlSegmentTextTransformer for locale-aware text segmentation, refactors text transformation infrastructure for better composability, and improves locale normalization to BCP 47 standards. It also adds comprehensive tests for these new features and refactors existing transformers for consistency.

Locale normalization improvements

• Improved the normalizeLocaleIntl function in LanguageSettings.ts to support BCP 47 language tag normalization, including script and region subtags, and added tests for these cases. [1] [2]

New locale-aware text transformer

• Added the IntlSegmentTextTransformer class for locale-aware word segmentation using Intl.Segmenter, along with tests covering multiple locales (including Thai). [1] [2]

Transformer infrastructure and API improvements

• Introduced a generic TextTransformer interface and the Edit type in Transformer.ts to standardize text transformation operations.
• Added utility functions applyEditsToMappedText and applyEditsToText in TextMapEdit.ts for applying edits and maintaining source maps, used by all transformers.

Refactoring and consistency

... (truncated)

Commits

• 2d310af v10.2.0
• 90f3b74 chore: Prepare Release v10.2.0 (auto-deploy) (#9125)
• 308c7ea v10.2.0-alpha.7
• b03d9ce chore: Prepare Release v10.2.0-alpha.7 (auto-deploy) (#9123)
• b3ec56e chore: Prepare Release v10.2.0-alpha.6 (auto-deploy) (#9116)
• e4f1c80 v10.2.0-alpha.5
• 444c3b3 chore: Prepare Release v10.2.0-alpha.5 (auto-deploy) (#9114)
• 12112f5 v10.2.0-alpha.4
• 79dee1b chore: Prepare Release v10.2.0-alpha.4 (auto-deploy) (#9109)
• 8cef1df v10.2.0-alpha.3
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cspell since your current version.

Updates knip from 6.32.3 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
• Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
• Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
• Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
• Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
• Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
• Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)
• Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)
• Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)
• Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)
• fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @​DreamLongYT!
• fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @​addielaruee!
• Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @​DreierF!
• fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @​DreamLongYT!
• Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)
• Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)
• Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)
• Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)
• Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)
• Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)
• Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)
• Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Commits

• 4ffebb7 Release knip@6.34.0
• f0cf11d Assert counters in targeted regression tests
• 96ff2df Declare webpack directly instead of through @types/webpack
• c4e0f08 Update dependencies
• cc47061 Resolve Nuxt #shared imports from the shared directory (#1991)
• 462ae45 fix: compile files with workspace-scoped compilers (#1997)
• ab90e24 fix(cli): validate numeric options instead of passing NaN through (#1975)
• 964085d Set an explicit Bun test timeout
• 1c90b49 Make prop access consistent while at it
• f93ad09 Respect JSDoc tags on URL dependencies (resolve #1943)
• Additional commits viewable in compare view

Updates next from 16.2.12 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311

... (truncated)

Commits

• 299180d v16.3.4
• 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
• 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
• d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
• 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• Additional commits viewable in compare view

...

Description has been truncated

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	resq-design	75c0095	Commit Preview URL Branch Preview URL	Sep 04 2026, 10:27 AM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	posthog-js@​1.422.1 ⏵ 1.422.5	+1		+1
	chromatic@​18.6.1 ⏵ 18.7.2	+1		+1
	wrangler@​4.127.0 ⏵ 4.127.1
	knip@​6.32.3 ⏵ 6.34.0	+1		+1	+1
	cspell@​10.1.1 ⏵ 10.2.0	+1			+3
	resend@​6.24.0 ⏵ 6.25.0				+1
	@​biomejs/​biome@​2.5.10 ⏵ 2.5.11	+1		+1	+1

View full report

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.