Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 14 updates - #125

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-38712b4acc
Closed

chore(deps): bump the production-dependencies group across 1 directory with 14 updates#125
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-38712b4acc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 14 updates in the / directory:

Package From To
@hookform/resolvers 5.8.0 5.9.1
@langchain/core 1.2.7 1.2.9
@langchain/openai 1.5.7 1.5.10
@sentry/nextjs 10.70.0 10.71.0
@tavily/core 0.7.7 0.7.8
input-otp 1.4.2 1.5.0
langchain 1.5.8 1.5.10
lucide-react 1.31.0 1.35.0
mongoose 9.9.2 9.9.4
next 16.3.1 16.3.3
posthog-js 1.417.0 1.422.1
react-hook-form 7.85.0 7.86.0
react-resizable-panels 4.12.2 4.12.3
uuid 14.0.1 14.0.2

Updates @hookform/resolvers from 5.8.0 to 5.9.1

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

  • isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

Commits
  • f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
  • c8159ae feat: update joi to v18 (#873)
  • See full diff in compare view

Updates @langchain/core from 1.2.7 to 1.2.9

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.9

Patch Changes

@​langchain/core@​1.2.8

Patch Changes

  • #11369 d6ad973 Thanks @​hntrl! - fix(langchain): use unified endpoint for gateway

  • #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

    Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

    @langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

    modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

    Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

Commits
  • e493ed6 chore: version packages (#11393)
  • 8384848 fix(google-common): release endpoint routing fix as patch (#11413)
  • 8cfff4d feat(google): add gateway support for genai (#11405)
  • 7df258c chore(langchain): update langgraph deps (#11412)
  • 3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
  • fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
  • 0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
  • 5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
  • 5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
  • 43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
  • Additional commits viewable in compare view

Updates @langchain/openai from 1.5.7 to 1.5.10

Release notes

Sourced from @​langchain/openai's releases.

@​langchain/openai@​1.5.10

Patch Changes

@​langchain/openai@​1.5.9

Patch Changes

  • #11399 5c9fdf2 Thanks @​gethin-langchain! - update to v7 openai sdk

  • #11403 fe8eec1 Thanks @​thushanth-bengre-langchain! - Drop Gemini-native functionCall content blocks (already carried in tool_calls) when converting messages to Chat Completions API params, fixing requests that fail when a ChatGoogleGenerativeAI message is passed to ChatOpenAI (e.g. a cross-provider handoff in LangGraph).

  • #11399 5c9fdf2 Thanks @​gethin-langchain! - Map OpenAI's cache_write_tokens to cache_creation in usage_metadata.input_token_details, mirroring the existing cached_tokens -> cache_read mapping across the Chat Completions and Responses APIs. Previously, prompt cache-write token counts were silently dropped.

@​langchain/openai@​1.5.8

Patch Changes

  • #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(openai): mark OpenAI provider errors as retryable or not

    Builds on stampRetryable in @langchain/core so the retry middleware can tell a transient failure from a deterministic one. Timeouts and rate limits are marked retryable; aborts, context overflow, invalid tool results, bad credentials, and unknown models non-retryable. Anything else stays unmarked and retries as before.

    Also forwards a per-call maxRetries to the retry loop, so a surrounding retry loop such as modelRetryMiddleware can take over instead of the two multiplying against each other.

    Errors keep their original class, so instanceof against the openai SDK error types is unaffected.

Commits
  • d5264a1 chore: version packages (#11427)
  • c26c87e fix(openai): send content null (not []) for tool-call-only v1 assistant messa...
  • 041a755 fix(anthropic): preserve generic tool_search_tool_result blocks (#11421)
  • e493ed6 chore: version packages (#11393)
  • 8384848 fix(google-common): release endpoint routing fix as patch (#11413)
  • 8cfff4d feat(google): add gateway support for genai (#11405)
  • 7df258c chore(langchain): update langgraph deps (#11412)
  • 3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
  • fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
  • 0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
  • Additional commits viewable in compare view

Updates @sentry/nextjs from 10.70.0 to 10.71.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.71.0

Important Changes

  • feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

  • feat(v10/core): Deprecate scope.clear() method (#23231)
  • fix(v10/core): Bound child span tracking on long-lived spans (#23406)
  • fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
  • fix(v10/hono): Use captureException from scope, not from Client (#23280)
  • fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
  • fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundaries (#23421)
  • fix(v10/react): Match TanStack Router pageload against the router location (#23494)
  • test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.51 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.25 KB
@​sentry/browser (incl. Tracing, Profiling) 50.15 KB
@​sentry/browser (incl. Tracing, Replay) 83.83 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.71 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.45 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.79 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB
@​sentry/browser (incl. Logs) 28.38 KB
@​sentry/browser (incl. Metrics & Logs) 29.06 KB
@​sentry/react 28.86 KB
@​sentry/react (incl. Tracing) 47.72 KB
@​sentry/vue 32.4 KB
@​sentry/vue (incl. Tracing) 47.43 KB
@​sentry/svelte 27.12 KB
CDN Bundle 29.43 KB
CDN Bundle (incl. Tracing) 47.43 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.71.0

Important Changes

  • feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

  • feat(v10/core): Deprecate scope.clear() method (#23231)
  • fix(v10/core): Bound child span tracking on long-lived spans (#23406)
  • fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
  • fix(v10/hono): Use captureException from scope, not from Client (#23280)
  • fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
  • fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundaries (#23421)
  • fix(v10/react): Match TanStack Router pageload against the router location (#23494)
  • test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)
Commits
  • 9fcb063 release: 10.71.0
  • fbc14d8 meta(changelog): Update changelog for 10.71.0 (#23517)
  • 671f4b1 fix(v10/nuxt): Delete source maps after Nitro finishes building (#23508)
  • 0211227 fix(v10/react): Match TanStack Router pageload against the router location (#...
  • bbea828 feat(v10/core)!: Enable logs by default (#23311)
  • 7ded310 fix(v10/core): Bound child span tracking on long-lived spans (#23406)
  • 245d807 fix(v10/react-router): Carry multi-byte UTF-8 across SSR stream chunk boundar...
  • 1d439a3 fix(v10/core): Read Supabase PostgREST headers from Headers instances (#23241)
  • 8f03efe test(v10/nextjs): Add e2e app for a user-owned OpenTelemetry setup (#23278)
  • c884ae1 fix(v10/hono): Use captureException from scope, not from Client (#23280)
  • Additional commits viewable in compare view

Updates @tavily/core from 0.7.7 to 0.7.8

Commits

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

  • fix(input): reserve the password manager badge gutter only where it fits
  • fix(input): disable spellcheck by default
  • fix(input): feature-detect ResizeObserver before observing
  • fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
  • fix(input): clear pending synchronization timeouts on unmount
  • feat(input): add a nonce prop for Content-Security-Policy support
  • fix(input): guard the input reference used by the selectionchange listener
  • fix(input): opt the container out of browser translation
  • fix(input): report cosmetic CSS rule failures as warnings instead of errors
  • docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

  • revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
  • revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
  • docs: align the mobile and edge-case documentation with the stable candidate
  • test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

  • fix(input): reserve the password manager badge gutter only where it fits
    • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
  • fix(input): disable spellcheck by default
    • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
  • fix(input): feature-detect ResizeObserver before observing
    • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
  • fix(input): fall back to 16px font-size until --root-height resolves
    • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
  • fix(input): clear pending sync timeouts on unmount
    • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
  • feat(input): add nonce prop
    • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
  • fix(input): use the guarded input reference inside the selectionchange listener
    • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
  • fix(input): opt the container out of browser translation
    • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
  • fix(input): log CSS rule insertion failures as warnings, not errors
    • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
  • chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

  • fix(input): reserve the password manager badge gutter only where it fits
  • fix(input): disable spellcheck by default
  • fix(input): feature-detect ResizeObserver before observing
  • fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
  • fix(input): clear pending synchronization timeouts on unmount
  • feat(input): add a nonce prop for Content-Security-Policy support
  • fix(input): guard the input reference used by the selectionchange listener
  • fix(input): opt the container out of browser translation
  • fix(input): report cosmetic CSS rule failures as warnings instead of errors
  • docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

  • revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
  • revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
  • docs: align the mobile and edge-case documentation with the stable candidate
  • test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

  • fix(input): reserve the password manager badge gutter only where it fits
    • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
  • fix(input): disable spellcheck by default
    • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
  • fix(input): feature-detect ResizeObserver before observing
    • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
  • fix(input): fall back to 16px font-size until --root-height resolves
    • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
  • fix(input): clear pending sync timeouts on unmount
    • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
  • feat(input): add nonce prop
    • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
  • fix(input): use the guarded input reference inside the selectionchange listener
    • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
  • fix(input): opt the container out of browser translation
    • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.


Updates langchain from 1.5.8 to 1.5.10

Release notes

Sourced from langchain's releases.

langchain@1.5.10

Patch Changes

langchain@1.5.9

Patch Changes

  • #11369 d6ad973 Thanks @​hntrl! - fix(langchain): use unified endpoint for gateway

  • #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

    Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

    @langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

    modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

    Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

Commits
  • e493ed6 chore: version packages (#11393)
  • 8384848 fix(google-common): release endpoint routing fix as patch (#11413)
  • 8cfff4d feat(google): add gateway support for genai (#11405)
  • 7df258c chore(langchain): update langgraph deps (#11412)
  • 3ceef4b fix(anthropic): round-trip tool search server-tool result blocks (#11407)
  • fe8eec1 fix(openai): drop Gemini functionCall content blocks in Chat Completions mess...
  • 0e7c765 fix(google-genai): throw ContentBlockedError when Gemini candidate has no con...
  • 5c9fdf2 fix(openai): retain cache_write_tokens, update to v7 sdk (#11399)
  • 5ff9179 fix(google-genai): guard streaming chunks when candidate has no content (#10742)
  • 43e4396 fix(core): include tool_call blocks and skip empty text blocks in ChatVertexA...
  • Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.35.0

Release notes

Sourced from lucide-react's releases.

Version 1.35.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.34.0...1.35.0

Version 1.34.0

What's Changed

Full Changelog: lucide-icons/lucide@1.33.0...1.34.0

Version 1.33.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

... (truncated)

Commits

Updates mongoose from 9.9.2 to 9.9.4

Release notes

Sourced from mongoose's releases.

9.9.4 / 2026-08-25

  • fix(query): set strictQuery and strict on _mongooseOptions consistently #16451 #16447
  • fix(hydration): use the doc model for looking up a ref #16453 rawmind
  • fix(schema): drop the map values subpath when removing a map path #16457 rawmind
  • fix(schema): remove a map that lives under a nested path #16461 #16457 luantaraschi
  • fix(schema): do not repeat null in a toJSONSchema enum that already lists null #16456 luantaraschi
  • fix(schema): clone a document array element with its own constructor signature #16463 #16462 luantaraschi
  • fix(schema): keep the map value schematype a single object when cloning #16473 luantaraschi
  • fix(schema): clarify duplicate index warning to note index is not created #16476 vjymisal0
  • perf(model): index bulkSave write errors by document id #16474 yoominho91
  • docs: add Atlas Vector Search and Atlas Search documentation #16395
  • docs: fix dead MongoDB driver Collection link #16458 rajanpanth

9.9.3 / 2026-08-17

Changelog

Sourced from mongoose's changelog.

9.9.4 / 2026-08-25

  • fix(query): set strictQuery and strict on _mongooseOptions consistently #16451 #16447
  • fix(hydration): use the doc model for looking up a ref #16453 rawmind
  • fix(schema): drop the map values subpath when removing a map path #16457 rawmind
  • fix(schema): remove a map that lives under a nested path #16461 #16457 luantaraschi
  • fix(schema): do not repeat null in a toJSONSchema enum that already lists null #16456 luantaraschi
  • fix(schema): clone a document array element with its own constructor signature #16463 #16462 luantaraschi
  • fix(schema): keep the map value schematype a single object when cloning #16473 luantaraschi
  • fix(schema): clarify duplicate index warning to note index is not created #16476 vjymisal0
  • perf(model): index bulkSave write errors by document id #16474 yoominho91
  • docs: add Atlas Vector Search and Atlas Search documentation #16395
  • docs: fix dead MongoDB driver Collection link #16458 rajanpanth

8.24.4 / 2026-08-21

9.9.3 / 2026-08-17

8.24.3 / 2026-08-10

  • fix(query): apply sanitizeFilter on countDocuments and cursor()
Commits
  • a4b8a60 chore: release 9.9.4
  • 9ffac59 Merge pull request #16474 from yoominho91/perf/bulksave-error-index
  • e57f554 Merge pull request #16478 from vjymisal0/fix/duplicate-index-warning-message
  • aa68225 docs: fix markdown lint
  • e3b2db6 Merge pull request #16395 from RaschidJFR/docs/mongodb-sync-20260708-151113
  • e76ea0a Clarify embedded_movies collection usage
  • 72c9d59 Improve search example
  • 5e57227 perf(model): only index bulkSave errors for large batches
  • ec2d92d docs(schema): clarify duplicate index warning to note index is not created (g...
  • 5e98644 Merge pull request #16473 from luantaraschi/fix/clone-map-value-schematype
  • Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)Description has been truncated

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
d874a8d 
…y with 14 updates

Bumps the production-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.8.0` | `5.9.1` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.7` | `1.2.9` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.7` | `1.5.10` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.70.0` | `10.71.0` |
| [@tavily/core](https://github.com/tavily-ai/tavily-js) | `0.7.7` | `0.7.8` |
| [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp) | `1.4.2` | `1.5.0` |
| [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.8` | `1.5.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.35.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.9.2` | `9.9.4` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.417.0` | `1.422.1` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.86.0` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.2` | `4.12.3` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |



Updates `@hookform/resolvers` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.8.0...v5.9.1)

Updates `@langchain/core` from 1.2.7 to 1.2.9
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.7...@langchain/core@1.2.9)

Updates `@langchain/openai` from 1.5.7 to 1.5.10
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.7...@langchain/openai@1.5.10)

Updates `@sentry/nextjs` from 10.70.0 to 10.71.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.71.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.70.0...10.71.0)

Updates `@tavily/core` from 0.7.7 to 0.7.8
- [Commits](https://github.com/tavily-ai/tavily-js/commits)

Updates `input-otp` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/guilhermerodz/input-otp/releases)
- [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp)

Updates `langchain` from 1.5.8 to 1.5.10
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.8...langchain@1.5.10)

Updates `lucide-react` from 1.31.0 to 1.35.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.35.0/packages/lucide-react)

Updates `mongoose` from 9.9.2 to 9.9.4
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.9.2...9.9.4)

Updates `next` from 16.3.1 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.3)

Updates `posthog-js` from 1.417.0 to 1.422.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.417.0...posthog-js@1.422.1)

Updates `react-hook-form` from 7.85.0 to 7.86.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.85.0...v7.86.0)

Updates `react-resizable-panels` from 4.12.2 to 4.12.3
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.2...4.12.3)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

---
updated-dependencies:
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@langchain/core"
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@langchain/openai"
  dependency-version: 1.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tavily/core"
  dependency-version: 0.7.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: input-otp
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: langchain
  dependency-version: 1.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mongoose
  dependency-version: 9.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.422.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-hook-form
  dependency-version: 7.86.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-resizable-panels
  dependency-version: 4.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: vectorMindsAI. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 7, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-38712b4acc branch September 7, 2026 09:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants