chore(deps): bump the dependencies group with 32 updates by dependabot[bot] · Pull Request #22 · commet-labs/billsdk

dependabot · 2026-05-16T16:25:14Z

Bumps the dependencies group with 32 updates:

Package	From	To
@biomejs/biome	`2.3.11`	`2.4.15`
@changesets/changelog-github	`0.5.2`	`0.7.0`
@changesets/cli	`2.29.8`	`2.31.0`
turbo	`2.7.5`	`2.9.14`
fumadocs-core	`16.4.8`	`16.8.11`
fumadocs-mdx	`14.2.6`	`14.3.2`
fumadocs-ui	`16.4.8`	`16.8.11`
lucide-react	`0.563.0`	`0.577.0`
next	`16.2.1`	`16.2.6`
react	`19.1.0`	`19.2.6`
@types/react	`19.1.8`	`19.2.14`
react-dom	`19.2.4`	`19.2.6`
tailwind-merge	`3.4.0`	`3.6.0`
@tailwindcss/postcss	`4.1.18`	`4.3.0`
@types/node	`22.15.29`	`22.19.19`
postcss	`8.5.6`	`8.5.14`
tailwindcss	`4.1.18`	`4.3.0`
defu	`6.1.4`	`6.1.7`
zod	`4.3.5`	`4.4.3`
vitest	`4.0.17`	`4.1.6`
@clack/prompts	`1.0.0`	`1.4.0`
c12	`3.3.3`	`3.3.4`
dotenv	`17.2.3`	`17.4.2`
prettier	`3.8.1`	`3.8.3`
drizzle-orm	`0.45.1`	`0.45.2`
jiti	`2.6.1`	`2.7.0`
tsx	`4.21.0`	`4.22.0`
stripe	`14.0.0`	`14.25.0`
better-auth	`1.4.18`	`1.6.11`
nuqs	`2.8.7`	`2.8.9`
postgres	`3.4.8`	`3.4.9`
drizzle-kit	`0.31.8`	`0.31.10`

Updates @biomejs/biome from 2.3.11 to 2.4.15

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.4.15

2.4.15

Patch Changes
#9394 ba3480e Thanks @dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.
#10254 e0a54cc Thanks @dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

For example, the following snippet triggers the rule:
import { nextTick } from "vue";
nextTick(() => {
updateDom();
});
#10219 64aee45 Thanks @dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

For example, the following snippet triggers the rule:
<input @keyup.13="submit" />
#10195 7b8d4e1 Thanks @dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.

#10238 1110256 Thanks @dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.

#10201 1a08f89 Thanks @realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.

#9574 3bd2b6a Thanks @Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.
#10205 a704a6c Thanks @Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.
{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
      }
    }
  }
}

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.4.15

Patch Changes
#9394 ba3480e Thanks @dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.
#10254 e0a54cc Thanks @dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

For example, the following snippet triggers the rule:
import { nextTick } from "vue";
nextTick(() => {
updateDom();
});
#10219 64aee45 Thanks @dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

For example, the following snippet triggers the rule:
<input @keyup.13="submit" />
#10195 7b8d4e1 Thanks @dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.

#10238 1110256 Thanks @dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.

#10201 1a08f89 Thanks @realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.

#9574 3bd2b6a Thanks @Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.
#10205 a704a6c Thanks @Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.
{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
      }
    }
  }
}

... (truncated)

Commits

9dd3271 ci: release (#10210)
7b8d4e1 feat(lint/html/vue): add useVueValidVFor (#10195)
ba3480e feat(lint/js): add useTestHooksInOrder (#9394)
e0a54cc feat(lint/js/vue): add useVueNextTickPromise (#10254)
1110256 feat(lint/vue): add noVueImportCompilerMacros (#10238)
7f7419c fix: grammar in extends docstring (#10263)
0ae5840 feat(lint/js): add useThisForClassMethods (#9807)
83f7385 feat(lint/js): add noBaseToString (#9838)
64aee45 feat(lint/html/vue): add noVueVOnNumberValues (#10219)
46393e0 ci: release (#10100)
Additional commits viewable in compare view

Updates @changesets/changelog-github from 0.5.2 to 0.7.0

Release notes

Sourced from @changesets/changelog-github's releases.

@changesets/changelog-github@0.7.0

Minor Changes

#1255 94578cf Thanks @Kauhsa! - Added disableThanks option

@changesets/changelog-github@0.6.0

Minor Changes

#1850 fd0bc2e Thanks @mixelburg! - Linkify issue references in changelog entries.

Patch Changes

#1810 27fd8f4 Thanks @hirasso! - Replace deprecated String.prototype.trimRight with String.prototype.trimEnd

Updated dependencies [d4b8ad8, e462d89]:

@changesets/get-github-info@0.8.0

Commits

d1ef2d8 Version Packages (#1950)
7af5876 Restrict publish job to the npm env (#1972)
ff767d2 Sync config-file-options documentation with schema.json and source code (#1683)
951094b fix: pin 2 unpinned action(s) (#1915)
94578cf Added disableThanks option (#1255)
d87334d Support dark mode banner in readme (#1943)
87472a7 Update .vscode/settings.json (#1944)
317a373 Disable publish_pr job
9cce6db Version Packages (#1897)
d2121dc Fix npm auth for path-based registries during publish by preserving configure...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @changesets/changelog-github since your current version.

Updates @changesets/cli from 2.29.8 to 2.31.0

Release notes

Sourced from @changesets/cli's releases.

@changesets/cli@2.31.0

Minor Changes

#1889 96ca062 Thanks @mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.

#1873 42943b7 Thanks @mixelburg! - Respond to --help on all subcommands. Previously, --help was only handled when it was the sole argument; passing it alongside a subcommand (e.g. changeset version --help) would silently execute the command instead. Now --help always exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.

Patch Changes

d2121dc Thanks @Andarist! - Fix npm auth for path-based registries during publish by preserving configured registry URLs instead of normalizing them.

#1888 036fdd4 Thanks @mixelburg! - Fix several changeset version issues with workspace protocol dependencies. Valid explicit workspace: ranges and aliases are no longer rewritten unnecessarily, and workspace path references are handled correctly during versioning.

#1903 5c4731f Thanks @Andarist! - Gracefully handle stale npm info data leading to duplicate publish attempts.

#1867 f61e716 Thanks @Andarist! - Improved detection for published state of prerelease-only packages without latest dist-tag on GitHub Packages registry.

Updated dependencies [036fdd4, 036fdd4, 036fdd4]:

@changesets/assemble-release-plan@6.0.10

@changesets/get-dependents-graph@2.1.4

@changesets/apply-release-plan@7.1.1

@changesets/get-release-plan@4.0.16

@changesets/config@3.1.4

@changesets/cli@2.30.0

Minor Changes

#1840 057cca2 Thanks @wotan-allfather! - Add --since flag to add command

The add command now supports a --since flag that allows you to specify which branch, tag, or git ref to use when detecting changed packages. This is useful for gitflow workflows where you have multiple target branches and the baseBranch config option doesn't cover all use cases.

Example: changeset add --since=develop

If not provided, the command falls back to the baseBranch value in your .changeset/config.json.

#1845 2b4a66a Thanks @Andarist! - Delegate OTP prompting to the package manager instead of handling it in-process. This allows Changesets to use the package manager's native web auth support.

#1774 667fe5a Thanks @bluwy! - Support importing custom commit option ES module. Previously, it used require() which only worked for CJS modules, however now it uses import() which supports both CJS and ES modules.

#1839 73b1809 Thanks @leochiu-a! - Add a --message (-m) flag to changeset add (and default changeset) so the changeset summary can be provided from the command line. When --message is present, the summary prompt is skipped while the final confirmation step is kept.

#1806 0e8e01e Thanks @luisadame! - Changeset CLI can now be run from the nested directories in the project, where the .changeset directory has to be found in one of the parent directories

Patch Changes

#1849 9dc3230 Thanks @Andarist! - Compute the terminal's size lazily to avoid spurious stderr output in non-interactive mode

#1857 2a73025 Thanks @mixelburg! - Fix confusing prompt labels when entering changeset summary after external editor fallback

#1842 6df3a5e Thanks @RodrigoHamuy! - Allow private packages to depend on skipped packages without requiring them to also be skipped. Private packages are not published to npm, so it is safe for them to have dependencies on ignored or unversioned packages.

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @changesets/cli since your current version.

Updates turbo from 2.7.5 to 2.9.14

Release notes

Sourced from turbo's releases.

Turborepo v2.9.14

[!NOTE] This release contains important security fixes.

High:

GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation

GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

release(turborepo): 2.9.12 by @github-actions[bot] in vercel/turborepo#12774

fix: Restore docs mobile menu by @anthonyshew in vercel/turborepo#12782

ci: Use pull_request for PR title linting by @anthonyshew in vercel/turborepo#12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in vercel/turborepo#12788

test: Validate lockfiles without dependency downloads by @anthonyshew in vercel/turborepo#12789

Removed unneeded import form hash creation script in docs by @dancrumb in vercel/turborepo#12799

fix: Validate auth callback state by @anthonyshew in vercel/turborepo#12802

fix: Harden VS Code extension command execution by @anthonyshew in vercel/turborepo#12800

fix: Avoid project-local Yarn during detection by @anthonyshew in vercel/turborepo#12801

chore: Release 2.9.13 by @anthonyshew in vercel/turborepo#12803

New Contributors

@dancrumb made their first contribution in vercel/turborepo#12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

Turborepo v2.9.13-canary.1

What's Changed

Changelog

release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in vercel/turborepo#12768

fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in vercel/turborepo#12770

release(turborepo): 2.9.11 by @github-actions[bot] in vercel/turborepo#12771

fix: Allow transit nodes in LSP diagnostics by @anthonyshew in vercel/turborepo#12773

release(turborepo): 2.9.12 by @github-actions[bot] in vercel/turborepo#12774

fix: Restore docs mobile menu by @anthonyshew in vercel/turborepo#12782

ci: Use pull_request for PR title linting by @anthonyshew in vercel/turborepo#12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in vercel/turborepo#12788

test: Validate lockfiles without dependency downloads by @anthonyshew in vercel/turborepo#12789

Removed unneeded import form hash creation script in docs by @dancrumb in vercel/turborepo#12799

fix: Validate auth callback state by @anthonyshew in vercel/turborepo#12802

fix: Harden VS Code extension command execution by @anthonyshew in vercel/turborepo#12800

fix: Avoid project-local Yarn during detection by @anthonyshew in vercel/turborepo#12801

... (truncated)

Commits

fc62fe0 publish 2.9.14 to registry
fb8c9ae chore: Release 2.9.13 (#12803)
e8e629d fix: Avoid project-local Yarn during detection (#12801)
91c90cb fix: Harden VS Code extension command execution (#12800)
84f4508 fix: Validate auth callback state (#12802)
1779ad7 Removed unneeded import form hash creation script in docs (#12799)
71f8c90 test: Validate lockfiles without dependency downloads (#12789)
5fcb960 ci: Scope GitHub Actions caches by branch (#12788)
4cf9fab ci: Use pull_request for PR title linting (#12787)
859c629 fix: Restore docs mobile menu (#12782)
Additional commits viewable in compare view

Updates fumadocs-core from 16.4.8 to 16.8.11

Release notes

Sourced from fumadocs-core's releases.

fumadocs-core@16.8.11

Patch Changes

1dc86c7: loosen the range for waku

fumadocs-core@16.8.10

Patch Changes

062beab: fix internal types

505cfe0: Add remark-block-id plugin

fumadocs-core@16.8.8

No release notes provided.

fumadocs-core@16.8.7

No release notes provided.

fumadocs-core@16.8.6

No release notes provided.

fumadocs-core@16.8.5

Patch Changes

79d3209: Narrow schema type for private OpenAPI properties

fumadocs-core@16.8.4

Patch Changes

61b15e9: fix Shiki languages not loaded under lazy mode

1a5433c: Support $ in locale for page tree generation

fumadocs-core@16.8.3

No release notes provided.

fumadocs-core@16.8.2

No release notes provided.

fumadocs-core@16.8.1

No release notes provided.

fumadocs-core@16.7.16

Patch Changes

9cf33e9: Improve inline code output

9cf33e9: Support async hooks in Shiki transformers

fumadocs-core@16.7.15

Patch Changes

e1567e2: use local fork of Shiki rehype integration

... (truncated)

Commits

See full diff in compare view

Updates fumadocs-mdx from 14.2.6 to 14.3.2

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@14.3.2

Patch Changes

79d3209: Deprecate forwarded schemas at fumadocs-mdx/config, recommend fumadocs-core/source/schema instead.

Updated dependencies [79d3209]

fumadocs-core@16.8.5

fumadocs-mdx@14.3.0

Minor Changes

fa9f678: Make Next.js config ESM only

Newer Next.js supported .mts extension for Next.js config files, see Next.js docs for more info.

fumadocs-mdx@14.2.14

Patch Changes

eb62304: Make mdx-remote optional for dynamic mode

Updated dependencies [e1567e2]

Updated dependencies [9a200c8]

Updated dependencies [c731a92]

Updated dependencies [a4189ce]

fumadocs-core@16.7.15

Commits

See full diff in compare view

Updates fumadocs-ui from 16.4.8 to 16.8.11

Release notes

Sourced from fumadocs-ui's releases.

fumadocs-ui@16.8.11

Patch Changes

Updated dependencies [1dc86c7]

fumadocs-core@16.8.11

fumadocs-ui@16.8.10

Patch Changes

Updated dependencies [062beab]

Updated dependencies [505cfe0]

fumadocs-core@16.8.10

fumadocs-ui@16.8.8

Patch Changes

b494c8d: Support copy ID in headings

03626ba: [Search UI] show ctrl for Linux machines

fumadocs-core@16.8.8

fumadocs-ui@16.8.7

Patch Changes

34f37f3: hotfix TOC

fumadocs-core@16.8.7

fumadocs-ui@16.8.6

Patch Changes

1aa48d0: fix RTL layout for Clerk style

fumadocs-core@16.8.6

fumadocs-ui@16.8.5

Patch Changes

Updated dependencies [79d3209]

fumadocs-core@16.8.5

fumadocs-ui@16.8.4

Patch Changes

b5ff03b: Support new OG image design for Takumi

Updated dependencies [61b15e9]

Updated dependencies [1a5433c]

fumadocs-core@16.8.4

fumadocs-ui@16.8.3

Patch Changes

8082ef6: Add legacy/layout for versions prior to 16.2

... (truncated)

Commits

See full diff in compare view

Updates lucide-react from 0.563.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

chore(deps): bump rollup from 4.53.3 to 4.59.0 by @dependabot[bot] in lucide-icons/lucide#4106

fix(repo): correctly ignore docs/releaseMetadata via .gitignore by @bhavberi in lucide-icons/lucide#4100

feat(icons): added ellipse icon by @KISHORE-KUMAR-S in lucide-icons/lucide#3749

New Contributors

@bhavberi made their first contribution in lucide-icons/lucide#4100

@KISHORE-KUMAR-S made their first contribution in lucide-icons/lucide#3749

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Added zodiac signs by @karsa-mistmere in lucide-icons/lucide#712

fix(icons): fixes guideline violations in package-* icons. by @karsa-mistmere in lucide-icons/lucide#4074

fix(icons): changed receipt icon by @karsa-mistmere in lucide-icons/lucide#4075

fix(icons): updated cuboid icon tags and categories by @karsa-mistmere in lucide-icons/lucide#4095

fix(icons): changed cuboid icon by @jamiemlaw in lucide-icons/lucide#4098

fix(lucide-font, lucide-static): Fixing stable code points by @ericfennis in lucide-icons/lucide#3894

feat(icons): added fishing-rod icon by @7ender in lucide-icons/lucide#3839

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

feat(icons): added message-square-check icon by @karsa-mistmere in lucide-icons/lucide#4076

fix(lucide): Fix ESM Module output path in build by @ericfennis in lucide-icons/lucide#4084

feat(icons): added metronome icon by @edwloef in lucide-icons/lucide#4063

fix(icons): remove execution permission of SVG files by @duckafire in lucide-icons/lucide#4053

fix(icons): changed file-pen-line icon by @jguddas in lucide-icons/lucide#3970

feat(icons): added square-arrow-right-exit and square-arrow-right-enter icons by @EthanHazel in lucide-icons/lucide#3958

fix(icons): renamed flip-* to square-centerline-dashed-* by @jguddas in lucide-icons/lucide#3945

New Contributors

@edwloef made their first contribution in lucide-icons/lucide#4063

@duckafire made their first contribution in lucide-icons/lucide#4053

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

fix(icons): changed rocking-chair icon by @jamiemlaw in lucide-icons/lucide#3445

fix(icons): flipped coins icon by @jguddas in lucide-icons/lucide#3158

feat(icons): added x-line-top icon by @jguddas in lucide-icons/lucide#2838

feat(icons): added mouse-left icon by @marvfash in lucide-icons/lucide#2788

feat(icons): added mouse-right icon by @marvfash in lucide-icons/lucide#2787

New Contributors

... (truncated)

Commits

f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
See full diff in compare view

Updates next from 16.2.1 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

fix: preserve HTTP access fallbacks during prerender recovery (#92231)

Fix fallback route params case in app-page handler (#91737)

Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)

Patch setHeader for direct route handlers (#93101)

Include deployment id in cacheHandlers keys (#93453)

Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

... (truncated)

Commits

ee6e79b v16.2.6
afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
97a154e Turbopack: Fix middleware matcher suffix (#93590)
83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
7b222b9 [backport][test] Pin package manager to patch versions (#93595)
a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
766148f v16.2.5
0dd9483 fix: add explicit checks for RSC header (#83) (#98)
d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
9d50c0b Strip next-resume header from incoming requests (#92)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates react from 19.1.0 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @gnoff, @lubieowoce, @sebmarkbage, @unstubbable)

19.2.3 (December 11th, 2025)

React Server Components

Add extra loop protection to React Server Functions (@sebmarkbage #35351)

19.2.2 (December 11th, 2025)

React Server Components

Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@eps1lon facebook/react#35290)

Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289, #35345)

19.2.1 (December 3rd, 2025)

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

<Activity>: A new API to hide and restore the UI and internal state of its children.

useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.

cacheSignal (for RSCs) lets your know when the cache() lifetime is over.

React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

Added resume APIs for partial pre-rendering with Web Streams:

resume: to resume a prerender to a stream.

resumeAndPrerender: to resume a prerender to HTML.

Added resume APIs for partial pre-rendering with Node Streams:

resumeToPipeableStream: to resume a prerender to a stream.

Description has been truncated

Bumps the dependencies group with 32 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.3.11` | `2.4.15` | | [@changesets/changelog-github](https://github.com/changesets/changesets) | `0.5.2` | `0.7.0` | | [@changesets/cli](https://github.com/changesets/changesets) | `2.29.8` | `2.31.0` | | [turbo](https://github.com/vercel/turborepo) | `2.7.5` | `2.9.14` | | [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.4.8` | `16.8.11` | | [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `14.2.6` | `14.3.2` | | [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.4.8` | `16.8.11` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.563.0` | `0.577.0` | | [next](https://github.com/vercel/next.js) | `16.2.1` | `16.2.6` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.1.0` | `19.2.6` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.1.8` | `19.2.14` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.6` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.4.0` | `3.6.0` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.1.18` | `4.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.15.29` | `22.19.19` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.14` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.1.18` | `4.3.0` | | [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` | | [zod](https://github.com/colinhacks/zod) | `4.3.5` | `4.4.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.17` | `4.1.6` | | [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.0.0` | `1.4.0` | | [c12](https://github.com/unjs/c12) | `3.3.3` | `3.3.4` | | [dotenv](https://github.com/motdotla/dotenv) | `17.2.3` | `17.4.2` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.1` | `0.45.2` | | [jiti](https://github.com/unjs/jiti) | `2.6.1` | `2.7.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.0` | | [stripe](https://github.com/stripe/stripe-node) | `14.0.0` | `14.25.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.4.18` | `1.6.11` | | [nuqs](https://github.com/47ng/nuqs/tree/HEAD/packages/nuqs) | `2.8.7` | `2.8.9` | | [postgres](https://github.com/porsager/postgres) | `3.4.8` | `3.4.9` | | [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.31.8` | `0.31.10` | Updates `@biomejs/biome` from 2.3.11 to 2.4.15 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.15/packages/@biomejs/biome) Updates `@changesets/changelog-github` from 0.5.2 to 0.7.0 - [Release notes](https://github.com/changesets/changesets/releases) - [Commits](https://github.com/changesets/changesets/compare/@changesets/read@0.5.2...@changesets/changelog-github@0.7.0) Updates `@changesets/cli` from 2.29.8 to 2.31.0 - [Release notes](https://github.com/changesets/changesets/releases) - [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@2.31.0) Updates `turbo` from 2.7.5 to 2.9.14 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.7.5...v2.9.14) Updates `fumadocs-core` from 16.4.8 to 16.8.11 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/commits/fumadocs-core@16.8.11) Updates `fumadocs-mdx` from 14.2.6 to 14.3.2 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/commits/fumadocs-mdx@14.3.2) Updates `fumadocs-ui` from 16.4.8 to 16.8.11 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/commits/fumadocs-ui@16.8.11) Updates `lucide-react` from 0.563.0 to 0.577.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react) Updates `next` from 16.2.1 to 16.2.6 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.2.1...v16.2.6) Updates `react` from 19.1.0 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `@types/react` from 19.1.8 to 19.2.14 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.4 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `tailwind-merge` from 3.4.0 to 3.6.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](dcastil/tailwind-merge@v3.4.0...v3.6.0) Updates `@tailwindcss/postcss` from 4.1.18 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-postcss) Updates `@types/node` from 22.15.29 to 22.19.19 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.1.8 to 19.2.14 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `postcss` from 8.5.6 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.14) Updates `tailwindcss` from 4.1.18 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `zod` from 4.3.5 to 4.4.3 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.3.5...v4.4.3) Updates `vitest` from 4.0.17 to 4.1.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/vitest) Updates `@clack/prompts` from 1.0.0 to 1.4.0 - [Release notes](https://github.com/bombshell-dev/clack/releases) - [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md) - [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.4.0/packages/prompts) Updates `c12` from 3.3.3 to 3.3.4 - [Release notes](https://github.com/unjs/c12/releases) - [Changelog](https://github.com/unjs/c12/blob/v3.3.4/CHANGELOG.md) - [Commits](unjs/c12@v3.3.3...v3.3.4) Updates `dotenv` from 17.2.3 to 17.4.2 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.2.3...v17.4.2) Updates `prettier` from 3.8.1 to 3.8.3 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.8.3) Updates `drizzle-orm` from 0.45.1 to 0.45.2 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.1...0.45.2) Updates `jiti` from 2.6.1 to 2.7.0 - [Release notes](https://github.com/unjs/jiti/releases) - [Changelog](https://github.com/unjs/jiti/blob/main/CHANGELOG.md) - [Commits](unjs/jiti@v2.6.1...v2.7.0) Updates `tsx` from 4.21.0 to 4.22.0 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.22.0) Updates `stripe` from 14.0.0 to 14.25.0 - [Release notes](https://github.com/stripe/stripe-node/releases) - [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-node@v14.0.0...v14.25.0) Updates `better-auth` from 1.4.18 to 1.6.11 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) Updates `nuqs` from 2.8.7 to 2.8.9 - [Release notes](https://github.com/47ng/nuqs/releases) - [Commits](https://github.com/47ng/nuqs/commits/v2.8.9/packages/nuqs) Updates `postgres` from 3.4.8 to 3.4.9 - [Release notes](https://github.com/porsager/postgres/releases) - [Changelog](https://github.com/porsager/postgres/blob/master/CHANGELOG.md) - [Commits](porsager/postgres@v3.4.8...v3.4.9) Updates `drizzle-kit` from 0.31.8 to 0.31.10 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.8...drizzle-kit@0.31.10) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.4.15 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@changesets/changelog-github" dependency-version: 0.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@changesets/cli" dependency-version: 2.31.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: turbo dependency-version: 2.9.14 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: fumadocs-core dependency-version: 16.8.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: fumadocs-mdx dependency-version: 14.3.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: fumadocs-ui dependency-version: 16.8.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: lucide-react dependency-version: 0.577.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: next dependency-version: 16.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/react" dependency-version: 19.2.14 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: tailwind-merge dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 22.19.19 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/react" dependency-version: 19.2.14 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: postcss dependency-version: 8.5.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: tailwindcss dependency-version: 4.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: defu dependency-version: 6.1.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: zod dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: vitest dependency-version: 4.1.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@clack/prompts" dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: c12 dependency-version: 3.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: dotenv dependency-version: 17.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: prettier dependency-version: 3.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: drizzle-orm dependency-version: 0.45.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: jiti dependency-version: 2.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tsx dependency-version: 4.22.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: stripe dependency-version: 14.25.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: nuqs dependency-version: 2.8.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: postgres dependency-version: 3.4.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: drizzle-kit dependency-version: 0.31.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-05-16T16:25:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
billsdk-demo	Ready	Preview, Comment	May 16, 2026 4:30pm
billsdk-website	Error		May 16, 2026 4:30pm

decker-dev · 2026-05-16T17:13:27Z

Closing: dependency update causes type errors in renewal-service.ts. Will investigate which dep introduced the breaking change.

dependabot · 2026-05-16T17:13:30Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 16, 2026

vercel Bot had a problem deploying to Preview – billsdk-website May 16, 2026 16:29 Failure

vercel Bot deployed to Preview – billsdk-demo May 16, 2026 16:30 View deployment

decker-dev closed this May 16, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-2ec54c1a13 branch May 16, 2026 17:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the dependencies group with 32 updates#22

chore(deps): bump the dependencies group with 32 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-2ec54c1a13

dependabot Bot commented on behalf of github May 16, 2026

Uh oh!

vercel Bot commented May 16, 2026 •

edited

Loading

Uh oh!

decker-dev commented May 16, 2026

Uh oh!

dependabot Bot commented on behalf of github May 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 16, 2026

Biome CLI v2.4.15

2.4.15

Patch Changes

2.4.15

Patch Changes

@​changesets/changelog-github@​0.7.0

Minor Changes

@​changesets/changelog-github@​0.6.0

Minor Changes

Patch Changes

@​changesets/cli@​2.31.0

Minor Changes

Patch Changes

@​changesets/cli@​2.30.0

Minor Changes

Patch Changes

Turborepo v2.9.14

High:

Low:

What's Changed

Changelog

New Contributors

Turborepo v2.9.13-canary.1

What's Changed

Changelog

fumadocs-core@16.8.11

Patch Changes

fumadocs-core@16.8.10

Patch Changes

fumadocs-core@16.8.8

fumadocs-core@16.8.7

fumadocs-core@16.8.6

fumadocs-core@16.8.5

Patch Changes

fumadocs-core@16.8.4

Patch Changes

fumadocs-core@16.8.3

fumadocs-core@16.8.2

fumadocs-core@16.8.1

fumadocs-core@16.7.16

Patch Changes

fumadocs-core@16.7.15

Patch Changes

fumadocs-mdx@14.3.2

Patch Changes

fumadocs-mdx@14.3.0

Minor Changes

fumadocs-mdx@14.2.14

Patch Changes

fumadocs-ui@16.8.11

Patch Changes

fumadocs-ui@16.8.10

Patch Changes

fumadocs-ui@16.8.8

Patch Changes

fumadocs-ui@16.8.7

Patch Changes

fumadocs-ui@16.8.6

Patch Changes

fumadocs-ui@16.8.5

Patch Changes

fumadocs-ui@16.8.4

Patch Changes

fumadocs-ui@16.8.3

Patch Changes

Version 0.577.0

What's Changed

New Contributors

Version 0.576.0

What's Changed

Version 0.575.0

What's Changed

New Contributors

Version 0.574.0

What's Changed

New Contributors

v16.2.6

Security Fixes

`@changesets/changelog-github@0`.7.0

`@changesets/changelog-github@0`.6.0

`@changesets/cli@2`.31.0

`@changesets/cli@2`.30.0

vercel Bot commented May 16, 2026 •

edited

Loading