Skip to content

chore(deps)(deps): bump the production-dependencies group across 1 directory with 11 updates#1437

Merged
hotlong merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-743dad7eaf
Jun 1, 2026
Merged

chore(deps)(deps): bump the production-dependencies group across 1 directory with 11 updates#1437
hotlong merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-743dad7eaf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
tsx 4.22.3 4.22.4
@ai-sdk/gateway 3.0.120 3.0.121
js-yaml 4.1.1 4.2.0
ai 6.0.191 6.0.193
@better-auth/core 1.6.11 1.6.13
@better-auth/oauth-provider 1.6.11 1.6.13
better-auth 1.6.11 1.6.13
lucide-react 1.16.0 1.17.0
fumadocs-core 16.9.1 16.9.3
fumadocs-mdx 15.0.8 15.0.10
fumadocs-ui 16.9.1 16.9.3

Updates tsx from 4.22.3 to 4.22.4

Release notes

Sourced from tsx's releases.

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

  • resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

This release is also available on:

Commits

Updates @ai-sdk/gateway from 3.0.120 to 3.0.121

Release notes

Sourced from @​ai-sdk/gateway's releases.

@​ai-sdk/gateway@​3.0.121

Patch Changes

  • 4084fcd: feat(provider/anthropic): add support for claude-opus-4-8
Changelog

Sourced from @​ai-sdk/gateway's changelog.

3.0.121

Patch Changes

  • 4084fcd: feat(provider/anthropic): add support for claude-opus-4-8
Commits

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates ai from 6.0.191 to 6.0.193

Release notes

Sourced from ai's releases.

ai@6.0.193

Patch Changes

  • af580ea: fix(ai): do not re-validate tool input for output-error parts in validateUIMessages

ai@6.0.192

Patch Changes

  • Updated dependencies [4084fcd]
    • @​ai-sdk/gateway@​3.0.121
Changelog

Sourced from ai's changelog.

6.0.193

Patch Changes

  • af580ea: fix(ai): do not re-validate tool input for output-error parts in validateUIMessages

6.0.192

Patch Changes

  • Updated dependencies [4084fcd]
    • @​ai-sdk/gateway@​3.0.121
Commits

Updates @better-auth/core from 1.6.11 to 1.6.13

Release notes

Sourced from @​better-auth/core's releases.

v1.6.13

better-auth

Features

  • Added support for server-side accountInfo calls with an optional userId parameter, allowing trusted callers to read provider profiles without constructing session headers (#9813)

Bug Fixes

  • Clarified that viewBackupCodes is a server-only function not accessible via HTTP in its API documentation (#9822)
  • Fixed Google One Tap authenticating the wrong user when the presented Google account is already linked to a different local user, by resolving identity through the shared OAuth path
  • Fixed storeStateStrategy defaulting to "cookie" instead of "database" when only secondaryStorage is configured, preventing oversized-cookie errors on platforms like AWS Lambda (#9591)
  • Fixed updateUserInfoOnLink not being applied when linking accounts through the standard OAuth redirect flow (#8758)
  • Fixed oidc-provider and mcp plugins accepting invalid redirect_uri schemes such as javascript: and data: (#9838)
  • Fixed organization logo not accepting null, preventing users from clearing an existing logo on create and update (#9842)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SAML Single Logout leaving the user signed in due to session deletion matching on row ID instead of session token
  • Fixed ambiguous internalAdapter helper methods that could silently match the wrong account or wipe all sessions for a user (#9818)
  • Fixed a high-severity XML injection vulnerability in signed SAML assertions by updating samlify to 2.13.1 (GHSA-34r5-q4jw-r36m) (#9821)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

  • Fixed verifyApiKey rejecting keys created under a non-default configId when the request omitted configId (#9794)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed a silent failure in consumeOne when an adapter's deleteMany returned a non-numeric value, now surfacing a clear error (#9831)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed sign-in being lost on Expo when a provider issues large tokens, by splitting oversized account cookies across multiple storage keys (#9815)

... (truncated)

Changelog

Sourced from @​better-auth/core's changelog.

1.6.13

Patch Changes

  • #9818 43c08a2 Thanks @​gustavovalverde! - Fix two buggy internalAdapter helpers.

    Remove findAccount(accountId). It looked accounts up by account ID alone, which is unique neither across providers nor across users, so it returned a non-deterministic match. All callers now use a user-scoped or provider-scoped lookup.

    Replace the ambiguous deleteSessions(string | string[]) with two explicit methods. deleteUserSessions(userId) revokes every session for a user, and deleteSessions(tokens) revokes sessions by token. The old single-string overload silently treated its argument as a user ID, so a caller that meant to delete one session token could instead wipe all of a user's sessions or quietly match nothing.

  • #9831 5c3e248 Thanks @​bytaesu! - Surface a clear error when an adapter's deleteMany returns a non-numeric value in the consumeOne fallback, instead of silently failing the consume.

1.6.12

Patch Changes

  • #8870 a3b0c63 Thanks @​jsj! - fix(apple): accept hashed nonces for native iOS Sign In

  • #9799 c5b9f93 Thanks @​gustavovalverde! - Refresh access tokens from genericOAuth providers that omit expires_in.

    When a provider's token response leaves out expires_in, Better Auth recorded no expiry, so getAccessToken couldn't tell the token had lapsed and never refreshed it; callers kept receiving a stale token. Set accessTokenExpiresIn (seconds) on a genericOAuth config entry to declare the token's lifetime; the expiry is then synthesized at sign-in and on refresh, and the existing refresh path works. The option is opt-in: providers that return expires_in or issue non-expiring tokens are unaffected.

  • #9727 83fa369 Thanks @​bytaesu! - Add toCamelCase, toSnakeCase, toPascalCase, and toKebabCase to @better-auth/core/utils/string.

  • #9683 04303a9 Thanks @​yb175! - Widen Kysely peer dependency ranges to support both 0.28.x and 0.29.x.

  • #9655 7bf5449 Thanks @​cyphercodes! - verifyAccessToken now returns unauthorized API errors for invalid token-shape verification failures, including missing JWT key IDs, while preserving raw JOSE errors for JWKS infrastructure failures.

Commits
  • a6f38c7 chore: release v1.6.13 (#9804)
  • be32012 fix(oauth): validate redirect_uri schemes in oidc-provider and mcp (#9838)
  • 5c3e248 fix(core): throw on non-numeric deleteMany in consumeOne fallback (#9831)
  • 43c08a2 fix(account): scope OAuth account identity and fix buggy internalAdapter help...
  • 23d7cbf fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow (#8758)
  • 5f282bd fix(account): default storeStateStrategy to "database" when using `secondar...
  • c0c574e chore: release v1.6.12 (#9590)
  • c5b9f93 fix(generic-oauth): add accessTokenExpiresIn for providers that omit `expir...
  • a3b0c63 fix: accept hashed nonces for native iOS sign-in with Apple (#8870)
  • 7bf5449 fix(oauth2): map jose token verification errors (#9655)
  • Additional commits viewable in compare view

Updates @better-auth/oauth-provider from 1.6.11 to 1.6.13

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.6.13

better-auth

Features

  • Added support for server-side accountInfo calls with an optional userId parameter, allowing trusted callers to read provider profiles without constructing session headers (#9813)

Bug Fixes

  • Clarified that viewBackupCodes is a server-only function not accessible via HTTP in its API documentation (#9822)
  • Fixed Google One Tap authenticating the wrong user when the presented Google account is already linked to a different local user, by resolving identity through the shared OAuth path
  • Fixed storeStateStrategy defaulting to "cookie" instead of "database" when only secondaryStorage is configured, preventing oversized-cookie errors on platforms like AWS Lambda (#9591)
  • Fixed updateUserInfoOnLink not being applied when linking accounts through the standard OAuth redirect flow (#8758)
  • Fixed oidc-provider and mcp plugins accepting invalid redirect_uri schemes such as javascript: and data: (#9838)
  • Fixed organization logo not accepting null, preventing users from clearing an existing logo on create and update (#9842)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SAML Single Logout leaving the user signed in due to session deletion matching on row ID instead of session token
  • Fixed ambiguous internalAdapter helper methods that could silently match the wrong account or wipe all sessions for a user (#9818)
  • Fixed a high-severity XML injection vulnerability in signed SAML assertions by updating samlify to 2.13.1 (GHSA-34r5-q4jw-r36m) (#9821)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

  • Fixed verifyApiKey rejecting keys created under a non-default configId when the request omitted configId (#9794)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed a silent failure in consumeOne when an adapter's deleteMany returned a non-numeric value, now surfacing a clear error (#9831)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed sign-in being lost on Expo when a provider issues large tokens, by splitting oversized account cookies across multiple storage keys (#9815)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.6.13

Patch Changes

  • #9837 17ab66c Thanks @​gustavovalverde! - Enforce the clientPrivileges create check on dynamic client registration.

    POST /oauth2/register reached OAuth client persistence without the create gate that /oauth2/create-client and /admin/oauth2/create-client enforced. A deployment that restricted client creation through clientPrivileges could still let any authenticated user register a confidential client and receive a client_secret. The create check now runs at the single client-creation chokepoint, so every registration route enforces it by construction.

    Unauthenticated public-client registration through allowUnauthenticatedClientRegistration is unchanged.

  • Updated dependencies [d3919dc, 5f282bd, 43c08a2, 43c08a2, be32012, 87c1a0c, 5c3e248, 9c8ded6, 23d7cbf]:

    • better-auth@1.6.13
    • @​better-auth/core@​1.6.13

1.6.12

Patch Changes

Commits
  • a6f38c7 chore: release v1.6.13 (#9804)
  • 17ab66c fix(oauth-provider): enforce clientPrivileges on dynamic client registration ...
  • be32012 fix(oauth): validate redirect_uri schemes in oidc-provider and mcp (#9838)
  • c0c574e chore: release v1.6.12 (#9590)
  • d64174e fix(oauth-provider): hide DCR endpoint unless enabled (#9448)
  • 8401d11 fix(oauth-provider): serve path-prefixed issuer metadata aliases (#9668)
  • f77060a fix: consumeVerificationValue returns null for expired rows (#9624)
  • 938efee fix(oauth-provider): preserve colons in Basic Auth client secret (#9601)
  • 87f5a8f fix(oauth-provider): return NOT_FOUND when consent update references a missin...
  • See full diff in compare view

Updates better-auth from 1.6.11 to 1.6.13

Release notes

Sourced from better-auth's releases.

v1.6.13

better-auth

Features

  • Added support for server-side accountInfo calls with an optional userId parameter, allowing trusted callers to read provider profiles without constructing session headers (#9813)

Bug Fixes

  • Clarified that viewBackupCodes is a server-only function not accessible via HTTP in its API documentation (#9822)
  • Fixed Google One Tap authenticating the wrong user when the presented Google account is already linked to a different local user, by resolving identity through the shared OAuth path
  • Fixed storeStateStrategy defaulting to "cookie" instead of "database" when only secondaryStorage is configured, preventing oversized-cookie errors on platforms like AWS Lambda (#9591)
  • Fixed updateUserInfoOnLink not being applied when linking accounts through the standard OAuth redirect flow (#8758)
  • Fixed oidc-provider and mcp plugins accepting invalid redirect_uri schemes such as javascript: and data: (#9838)
  • Fixed organization logo not accepting null, preventing users from clearing an existing logo on create and update (#9842)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

  • Fixed SAML Single Logout leaving the user signed in due to session deletion matching on row ID instead of session token
  • Fixed ambiguous internalAdapter helper methods that could silently match the wrong account or wipe all sessions for a user (#9818)
  • Fixed a high-severity XML injection vulnerability in signed SAML assertions by updating samlify to 2.13.1 (GHSA-34r5-q4jw-r36m) (#9821)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

  • Fixed verifyApiKey rejecting keys created under a non-default configId when the request omitted configId (#9794)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed a silent failure in consumeOne when an adapter's deleteMany returned a non-numeric value, now surfacing a clear error (#9831)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

  • Fixed sign-in being lost on Expo when a provider issues large tokens, by splitting oversized account cookies across multiple storage keys (#9815)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.13

Patch Changes

  • #9813 d3919dc Thanks @​gustavovalverde! - Support server-side accountInfo calls without session headers.

    auth.api.accountInfo now accepts an optional userId, so a trusted server-side caller can read a user's provider profile without constructing session headers. This mirrors getAccessToken and refreshToken. HTTP callers still require a valid session, and a session always takes precedence over a supplied userId.

    The shared "resolve the target user, then fetch a valid access token" logic behind these three endpoints now lives in one place. As part of that, a server-side call that supplies neither a session nor a userId reports USER_ID_OR_SESSION_REQUIRED (400) consistently, rather than UNAUTHORIZED on some endpoints.

  • #9591 5f282bd Thanks @​Vishesh-Verma-07! - When only secondaryStorage is configured (no primary database), storeStateStrategy now defaults to "database" instead of "cookie", preventing oversized-cookie errors on platforms like AWS Lambda. The account cookie that holds OAuth tokens in database-less setups stays enabled, so getAccessToken keeps working.

  • #9818 43c08a2 Thanks @​gustavovalverde! - Fix two buggy internalAdapter helpers.

    Remove findAccount(accountId). It looked accounts up by account ID alone, which is unique neither across providers nor across users, so it returned a non-deterministic match. All callers now use a user-scoped or provider-scoped lookup.

    Replace the ambiguous deleteSessions(string | string[]) with two explicit methods. deleteUserSessions(userId) revokes every session for a user, and deleteSessions(tokens) revokes sessions by token. The old single-string overload silently treated its argument as a user ID, so a caller that meant to delete one session token could instead wipe all of a user's sessions or quietly match nothing.

  • #9818 43c08a2 Thanks @​gustavovalverde! - Fix Google One Tap signing in the wrong user when the presented Google account is already linked to someone else. One Tap now resolves identity through the shared OAuth path, so the user who owns the Google subject is signed in, matching the redirect and signIn.social flows. Previously it matched a local user by the token's email and used the subject only to decide linking, so a Google credential owned by one user could authenticate a different user who happened to share that email.

    /account-info now resolves the account from the signed-in user's own linked accounts and accepts an optional providerId to disambiguate when two providers issue the same account ID. A colliding account ID returns a distinct AMBIGUOUS_ACCOUNT error instead of a misleading "not found", and an account with no configured social provider returns a 400 rather than a 500.

  • #9838 be32012 Thanks @​gustavovalverde! - Validate the scheme of OAuth redirect_uris in the oidc-provider and mcp plugins.

    Both plugins previously accepted any string as a redirect_uri at registration. They now reject the javascript:, data:, and vbscript: schemes, which are never valid OAuth redirect targets. The @better-auth/oauth-provider package already applied this check, so this change brings the two older plugins in line with it.

    The redirect-URI scheme policy now lives in @better-auth/core as a single SafeUrlSchema and an isSafeUrlScheme helper, and the OAuth provider plugins share that one implementation. The client navigation helpers (redirectPlugin, one-tap, and two-factor) also skip navigation when the target uses one of these schemes.

    The change is non-breaking. The http, https, loopback, and custom application schemes still register unchanged. Both oidc-provider and mcp are on the migration path to @better-auth/oauth-provider, which remains the route to its stricter HTTPS-or-loopback policy.

  • #9842 87c1a0c Thanks @​bytaesu! - You can now clear an organization's logo by passing logo: null to createOrganization and updateOrganization. Previously only a string was accepted, so an existing logo could not be removed.

  • #9822 9c8ded6 Thanks @​gustavovalverde! - Document viewBackupCodes as a server-only function so its API comment no longer reads like an HTTP route.

    The JSDoc above auth.api.viewBackupCodes advertised POST /two-factor/view-backup-codes, but the endpoint is server-only: it is not registered on the HTTP router and has no client method. The comment now states that it is callable only from trusted server code and that the userId should come from an authenticated session.

  • #8758 23d7cbf Thanks @​bytaesu! - Apply accountLinking.updateUserInfoOnLink across every OAuth link flow.

    Enabling updateUserInfoOnLink only synced the user's profile when linking through a direct ID token. Linking through the standard OAuth redirect (linkSocial, the generic OAuth oauth2.link endpoint, and implicit linking on social sign-in) ignored the option, so the name and image never changed. Every link path now honors it.

    The synced fields match the sign-up path: name, image, and any fields your mapProfileToUser adds. The local email and emailVerified are never changed on a link, so linking a provider cannot rebind the account's identity.

    Implicit linking on social sign-in also returned the pre-update user, so the freshly issued session served stale profile data from its cookie cache until the cache expired. The new session now carries the updated profile.

  • Updated dependencies [43c08a2, 5c3e248]:

    • @​better-auth/core@​1.6.13
    • @​better-auth/drizzle-adapter@​1.6.13
    • @​better-auth/kysely-adapter@​1.6.13
    • @​better-auth/memory-adapter@​1.6.13
    • @​better-auth/mongo-adapter@​1.6.13

... (truncated)

Commits
  • a6f38c7 chore: release v1.6.13 (#9804)
  • 87c1a0c fix(organization): allow null logo on create and update (#9842)
  • be32012 fix(oauth): validate redirect_uri schemes in oidc-provider and mcp (#9838)
  • 9c8ded6 docs(two-factor): mark viewBackupCodes as server-only in its API comment (#...
  • 43c08a2 fix(account): scope OAuth account identity and fix buggy internalAdapter help...
  • 23d7cbf fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow (#8758)
  • d3919dc feat(account): support server-side accountInfo calls without session header...
  • 5f282bd fix(account): default storeStateStrategy to "database" when using `secondar...
  • c0c574e chore: release v1.6.12 (#9590)
  • c5b9f93 fix(generic-oauth): add accessTokenExpiresIn for providers that omit `expir...
  • Additional commits viewable in compare view

Updates lucide-react from 1.16.0 to 1.17.0

Release notes

Sourced from lucide-react's releases.

Version 1.17.0

What's Changed

Full Changelog: lucide-icons/lucide@1.16.0...1.17.0

Commits

Updates fumadocs-core from 16.9.1 to 16.9.3

Release notes

Sourced from fumadocs-core's releases.

fumadocs-core@16.9.3

Patch Changes

  • 42f0255: Support invalidate & revalidate on dynamic loader
  • a807798: Improve source API utils & types
Commits
  • 34b75a0 Version Packages (#3324)
  • 73b9cec docs: fix build
  • d35d0d6 fix(mdx): respect root in Vite config
  • a9f95ff chore: bump deps
  • 783c048 fix(preview): fix invalid content type in /img endpoint
  • 42f0255 feat(core): support invalidate & revalidate on dynamic loader
  • a807798 fix(core): improve source API utils & types
  • 8b17019 docs: document LLM_GATEWAY_MODEL for Ask AI (#3319)
  • cad622e Merge pull request #3318 from smakosh/feat/llmgateway-ai-provider
  • ee98724 fix(openapi): newer scalar client
  • Additional commits viewable in compare view

Updates fumadocs-mdx from 15.0.8 to 15.0.10

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.0.10

Patch Changes

  • d35d0d6: Respect root in Vite config
  • Updated dependencies [42f0255]
  • Updated dependencies [a807798]
    • fumadocs-core@16.9.3

fumadocs-mdx@15.0.9

Patch Changes

  • cd04425: Support _fumadocs_skipViteConfig internal flag
Commits
  • 34b75a0 Version Packages (#3324)
  • 73b9cec docs: fix build
  • d35d0d6 fix(mdx): respect root in Vite config
  • a9f95ff chore: bump deps
  • 783c048 fix(preview): fix invalid content type in /img endpoint
  • 42f0255 feat(core): support invalidate & revalidate on dynamic loader
  • a807798 fix(core): improve source API utils & types
  • 8b17019 docs: document LLM_GATEWAY_MODEL for Ask AI (#3319)
  • cad622e Merge pull request #3318 from smakosh/feat/llmgateway-ai-provider
  • ee98724 fix(openapi): newer scalar client
  • Additional commits viewable in compare view

Updates fumadocs-ui from 16.9.1 to 16.9.3

Release notes

Sourced from fumadocs-ui's releases.

fumadocs-ui@16.9.3

Patch Changes

  • Updated dependencies [42f0255]
  • Updated dependencies [a807798]
    • fumadocs-core@16.9.3
Commits
  • 34b75a0 Version Packages (#3324)
  • 73b9cec docs: fix build
  • d35d0d6 fix(mdx): respect root in Vite config
  • a9f95ff chore: bump deps
  • 783c048 fix(preview): fix invalid content type in /img endpoint
  • 42f0255 feat(core): support invalidate & revalidate on dynamic loader<...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 1, 2026
@vercel

vercel Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
spec Ready Ready Preview, Comment Jun 1, 2026 10:51am

Request Review

@github-actions github-actions Bot added documentation Improvements or additions to documentation size/s labels Jun 1, 2026
@dependabot
chore(deps)(deps): bump the production-dependencies group across 1 di…
736b55a 
…rectory with 11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.3` | `4.22.4` |
| [@ai-sdk/gateway](https://github.com/vercel/ai/tree/HEAD/packages/gateway) | `3.0.120` | `3.0.121` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.191` | `6.0.193` |
| [@better-auth/core](https://github.com/better-auth/better-auth/tree/HEAD/packages/core) | `1.6.11` | `1.6.13` |
| [@better-auth/oauth-provider](https://github.com/better-auth/better-auth/tree/HEAD/packages/oauth-provider) | `1.6.11` | `1.6.13` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.11` | `1.6.13` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.16.0` | `1.17.0` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.9.1` | `16.9.3` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.0.8` | `15.0.10` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.9.1` | `16.9.3` |



Updates `tsx` from 4.22.3 to 4.22.4
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.3...v4.22.4)

Updates `@ai-sdk/gateway` from 3.0.120 to 3.0.121
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/gateway@3.0.121/packages/gateway/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/gateway@3.0.121/packages/gateway)

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `ai` from 6.0.191 to 6.0.193
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.193/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.193/packages/ai)

Updates `@better-auth/core` from 1.6.11 to 1.6.13
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/@better-auth/core@1.6.13/packages/core)

Updates `@better-auth/oauth-provider` from 1.6.11 to 1.6.13
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/oauth-provider/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/@better-auth/oauth-provider@1.6.13/packages/oauth-provider)

Updates `better-auth` from 1.6.11 to 1.6.13
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.13/packages/better-auth)

Updates `lucide-react` from 1.16.0 to 1.17.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.17.0/packages/lucide-react)

Updates `fumadocs-core` from 16.9.1 to 16.9.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-core@16.9.1...fumadocs-core@16.9.3)

Updates `fumadocs-mdx` from 15.0.8 to 15.0.10
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.0.8...fumadocs-mdx@15.0.10)

Updates `fumadocs-ui` from 16.9.1 to 16.9.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-ui@16.9.1...fumadocs-ui@16.9.3)

---
updated-dependencies:
- dependency-name: "@ai-sdk/gateway"
  dependency-version: 3.0.121
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@better-auth/core"
  dependency-version: 1.6.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@better-auth/oauth-provider"
  dependency-version: 1.6.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 6.0.193
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: better-auth
  dependency-version: 1.6.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-core
  dependency-version: 16.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-mdx
  dependency-version: 15.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fumadocs-ui
  dependency-version: 16.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tsx
  dependency-version: 4.22.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps)(deps): bump the production-dependencies group with 11 updates chore(deps)(deps): bump the production-dependencies group across 1 directory with 11 updates Jun 1, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-743dad7eaf branch from f5e8188 to 736b55a Compare June 1, 2026 10:48
@hotlong hotlong merged commit 9148d35 into main Jun 1, 2026
12 of 13 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-743dad7eaf branch June 1, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation javascript Pull requests that update javascript code size/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hotlong