Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Record the CI-generated dependency graph for #12994.
Co-Authored-By: lockfile-bot <lockfile-bot@users.noreply.github.com>
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.13 to
3.4.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.14</h2>
<ul>
<li>Fixed an issue with possible bypasses when risky tags are
allow-listed, thanks <a
href="https://github.com/AlirezaRouhbakhsh"><code>@AlirezaRouhbakhsh</code></a></li>
<li>Fixed a couple of edge cases with mixed document contexts, thanks <a
href="https://github.com/fishjojo1"><code>@fishjojo1</code></a></li>
<li>Added the SVG <code>pointer-events</code> and
<code>vector-effect</code> presentation attributes to the allow-list,
thanks <a
href="https://github.com/Jaybhade"><code>@Jaybhade</code></a></li>
<li>Conducted another refactoring run, removed dead branches and
duplicated logic, flattened attribute validation</li>
<li>Updated the documentation in several spots, README, wiki, etc.,
thanks <a
href="https://github.com/Akokonunes"><code>@Akokonunes</code></a></li>
<li>Updated several development dependencies and CI workflow
actions</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e6fe24173"><code>4e6fe24</code></a>
release: 3.4.14 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1587">#1587</a>)</li>
<li>See full diff in <a
href="https://github.com/cure53/DOMPurify/compare/3.4.13...3.4.14">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3)
from 3.1120.0 to 3.1122.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's
releases</a>.</em></p>
<blockquote>
<h2>v3.1122.0</h2>
<h4>3.1122.0(2026-08-31)</h4>
<h5>Documentation Changes</h5>
<ul>
<li><strong>client-controltower:</strong> Updated the descriptions for
the AWS Control Tower ListEnabledControls API parameters to make them
more accurate and intuitive. (<a
href="c54ac4e601">c54ac4e6</a>)</li>
</ul>
<h5>New Features</h5>
<ul>
<li><strong>client-pinpoint-sms-voice-v2:</strong> AWS End User
Messaging SMS now returns ConditionalBehavior on
DescribeRegistrationFieldDefinitions, allowing you to programmatically
discover which registration fields are required, optional, or disallowed
based on the values of other fields in the same form. (<a
href="9cbace1398">9cbace13</a>)</li>
<li><strong>client-customer-profiles:</strong> This release introduces
new APIs for segment membership events allowing segment definition
membership events to be exported to a kinesis stream for downstream
processing. Additionally, includes new calculated attribute statistic
and 2 new segment dimension types. (<a
href="be1a9dab42">be1a9dab</a>)</li>
<li><strong>client-sagemaker:</strong> Amazon SageMaker Batch Transform
now supports G6e instances, powered by NVIDIA L40S Tensor Core GPUs. G6e
instances are the most cost-efficient GPU instances for deploying
generative AI models and the highest-performance GPU instances for
spatial computing workloads. (<a
href="b063cf77a9">b063cf77</a>)</li>
<li><strong>client-quicksight:</strong> This release adds support for
managing apps in Amazon QuickSight with ListApps, SearchApps,
DescribeApp, DescribeAppPermissions, UpdateAppPermissions, and DeleteApp
(<a
href="98a49570d5">98a49570</a>)</li>
<li><strong>client-connect:</strong> Added support for global routing on
Amazon Connect Global Resiliency instances. New APIs
GetCrossRegionRouting and UpdateCrossRegionRouting allow you to view and
control cross-region contact routing between linked instances, so both
Regions are active at all times. (<a
href="ce41026342">ce410263</a>)</li>
<li><strong>client-agent-registry-control:</strong> AWS Agent Registry
becomes Generally Available (<a
href="e41244e930">e41244e9</a>)</li>
<li><strong>client-kinesis:</strong> Adds support for data delivery to
Amazon S3 Tables (Apache Iceberg) and general purpose Amazon S3 buckets
with new CreateChannel, UpdateChannel, DeleteChannel, DescribeChannel,
and ListChannels APIs for Amazon Kinesis Data Streams. (<a
href="64ebb058e0">64ebb058</a>)</li>
<li><strong>client-agent-registry:</strong> AWS Agent Registry becomes
Generally Available (<a
href="e60306f198">e60306f1</a>)</li>
<li><strong>client-devops-agent:</strong> Adds support for Slack
bidirectional communication configuration in AWS DevOps Agent agent
spaces. (<a
href="75bc6d6da3">75bc6d6d</a>)</li>
<li><strong>client-kafkaconnect:</strong> Amazon MSK Connect now
supports restarting newly created connectors via the asynchronous
RestartConnector API. Restart all tasks or only failed tasks, while
preserving configuration and committed offsets. This returns a connector
operation ARN that you can track with DescribeConnectorOperation. (<a
href="8771afafd4">8771afaf</a>)</li>
<li><strong>client-support:</strong> AWS Support now allows up to 10
attachments (150 MB each) per case correspondence, up from 3 at 5 MB.
Customers can share large diagnostic logs, heap dumps, and packet
captures directly in cases to reduce back-and-forth and speed up
resolution. Available in US East, US West, and Europe (Ireland). (<a
href="4ddd79c106">4ddd79c1</a>)</li>
<li><strong>client-workspaces-instances:</strong> Amazon WorkSpaces Core
managed instances now support nested virtualization. Customers can
enable nested virtualization with supported instance types at launch via
CpuOptions.NestedVirtualization in CreateWorkspaceInstance to run
hypervisors and virtual machines inside their WorkSpaces Instance. (<a
href="29587d1236">29587d12</a>)</li>
</ul>
<hr />
<p>For list of updated packages, view
<strong>updated-packages.md</strong> in
<strong>assets-3.1122.0.zip</strong></p>
<h2>v3.1121.0</h2>
<h4>3.1121.0(2026-08-28)</h4>
<h5>New Features</h5>
<ul>
<li><strong>client-ecs:</strong> Amazon Elastic Container Service - This
release adds support for early success criteria on ECS rolling
deployments, letting deployment complete once a configurable percentage
of tasks are healthy, with configurable BLOCKING (required) or DEFERRED
(asynchronous) cleanup of previous service revisions. (<a
href="ef22d750f2">ef22d750</a>)</li>
<li><strong>client-healthlake:</strong> New HealthLake API,
RestoreFHIRDatastore, providing the capability to restore active
datastores to a point in time within the last 30 days or recover a
deleted datastore from the delete snapshot. (<a
href="6249174262">62491742</a>)</li>
<li><strong>client-bedrock-agentcore:</strong> AgentCore Memory now
supports direct ingestion into long-term memory via IngestData API (<a
href="20d652de56">20d652de</a>)</li>
<li><strong>client-partnercentral-selling:</strong> Releasing PARC, new
APN Program that lets sellers add solftware revenue details to aws
opportunity summary (<a
href="2b6350f012">2b6350f0</a>)</li>
<li><strong>client-cognito-identity-provider:</strong> Adds two new
operations - GetClientToken which allows M2M auth through the SDK, and
DescribeTermsByClient to find which Terms are associated with a
user-pool client without knowing the Terms resource id. (<a
href="86dffd282f">86dffd28</a>)</li>
<li><strong>client-bedrock-agent:</strong> Adds an optional syncSchedule
field to CreateDataSource and UpdateDataSource for Managed Knowledge
Bases data source connectors, so a data source can sync automatically on
a daily, weekly, or monthly schedule. (<a
href="a8d3714a75">a8d3714a</a>)</li>
</ul>
<hr />
<p>For list of updated packages, view
<strong>updated-packages.md</strong> in
<strong>assets-3.1121.0.zip</strong></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's
changelog</a>.</em></p>
<blockquote>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1121.0...v3.1122.0">3.1122.0</a>
(2026-08-31)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1120.0...v3.1121.0">3.1121.0</a>
(2026-08-28)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e1cf460a1e"><code>e1cf460</code></a>
Publish v3.1122.0</li>
<li><a
href="e53a25aafb"><code>e53a25a</code></a>
Publish v3.1121.0</li>
<li>See full diff in <a
href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1122.0/clients/client-s3">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [react-i18next](https://github.com/i18next/react-i18next) from
17.0.11 to 17.0.12.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.12</h2>
<ul>
<li>fix(IcuTrans): key-less <code>icu.macro</code> nodes
(<code><Trans>Welcome, {name}!</Trans></code>,
<code><Select></code>, <code><Plural></code> without
<code>i18nKey</code>) rendered an empty string since 17.0.0. The macro
now emits <code><IcuTrans defaultTranslation="…"></code>
without a key and <code>IcuTrans</code> passed <code>undefined</code> to
<code>t()</code>, which returns <code>''</code>. Like
<code>Trans</code>, <code>IcuTrans</code> now uses
<code>defaultTranslation</code> as the key when <code>i18nKey</code> is
not provided.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ea721fb58d"><code>ea721fb</code></a>
17.0.12</li>
<li><a
href="6c2a71e1c0"><code>6c2a71e</code></a>
fix(IcuTrans): use defaultTranslation as key when no i18nKey is
given</li>
<li><a
href="258c96daab"><code>258c96d</code></a>
chore(examples): upgrade all example apps off unmaintained
toolchains</li>
<li><a
href="b8677c805c"><code>b8677c8</code></a>
chore: update dependencies to close dependabot alerts</li>
<li><a
href="aa9c92bd7f"><code>aa9c92b</code></a>
docs: point Trans component links at the current docs (<a
href="https://redirect.github.com/i18next/react-i18next/issues/1929">#1929</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v17.0.11...v17.0.12">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [i18next](https://github.com/i18next/i18next) from 26.3.6 to
26.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.4.0</h2>
<ul>
<li>perf: cache <code>toResolveHierarchy</code> results per <code>(code,
fallbackCode)</code> pair. The hierarchy resolver runs on every
<code>t()</code> call and calls <code>Intl.getCanonicalLocales</code>
multiple times, which showed up prominently when profiling render-heavy
UIs (e.g. virtualized data grids); with the cache the per-call cost
drops from ~886 ns to ~41 ns. The cache is invalidated automatically
when <code>options.fallbackLng</code> changes (reassignment or in-place
array mutation); if you mutate other resolution-relevant options at
runtime (<code>load</code>, <code>lowerCaseLng</code>,
<code>cleanCode</code>, <code>nonExplicitSupportedLngs</code>), call
<code>i18next.services.languageUtils.clearCache()</code> afterwards.
Function-valued <code>fallbackLng</code> and per-call array/object
<code>fallbackLng</code> options are never cached, so dynamic fallbacks
keep working as before. Thanks <a
href="https://github.com/equaterina"><code>@equaterina</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2444">#2444</a>).</li>
<li>chore: update all devDependencies (Babel stays on 7.x until
<code>@rollup/plugin-babel</code> supports 8, eslint on 9.x for
neostandard). Removed the unused <code>coveralls</code> package (CI uses
the Coveralls GitHub Action) and replaced <code>sinon</code> with
<code>nise</code> + <code>vitest.spyOn</code> in the v1 compatibility
tests, which resolves all open <code>npm audit</code> findings (0
vulnerabilities) and should close the dependabot alerts on the
lockfile.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.4.0</h2>
<ul>
<li>perf: cache <code>toResolveHierarchy</code> results per <code>(code,
fallbackCode)</code> pair. The hierarchy resolver runs on every
<code>t()</code> call and calls <code>Intl.getCanonicalLocales</code>
multiple times, which showed up prominently when profiling render-heavy
UIs (e.g. virtualized data grids); with the cache the per-call cost
drops from ~886 ns to ~41 ns. The cache is invalidated automatically
when <code>options.fallbackLng</code> changes (reassignment or in-place
array mutation); if you mutate other resolution-relevant options at
runtime (<code>load</code>, <code>lowerCaseLng</code>,
<code>cleanCode</code>, <code>nonExplicitSupportedLngs</code>), call
<code>i18next.services.languageUtils.clearCache()</code> afterwards.
Function-valued <code>fallbackLng</code> and per-call array/object
<code>fallbackLng</code> options are never cached, so dynamic fallbacks
keep working as before. Thanks <a
href="https://github.com/equaterina"><code>@equaterina</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2444">#2444</a>).</li>
<li>chore: update all devDependencies (Babel stays on 7.x until
<code>@rollup/plugin-babel</code> supports 8, eslint on 9.x for
neostandard). Removed the unused <code>coveralls</code> package (CI uses
the Coveralls GitHub Action) and replaced <code>sinon</code> with
<code>nise</code> + <code>vitest.spyOn</code> in the v1 compatibility
tests, which resolves all open <code>npm audit</code> findings (0
vulnerabilities) and should close the dependabot alerts on the
lockfile.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="652847e70f"><code>652847e</code></a>
26.4.0</li>
<li><a
href="6c6025f87e"><code>6c6025f</code></a>
prettier fix</li>
<li><a
href="742b9a95dd"><code>742b9a9</code></a>
chore: update dependencies and clean up dev tooling</li>
<li><a
href="06924d961c"><code>06924d9</code></a>
fix: invalidate toResolveHierarchy cache on in-place fallbackLng
mutation</li>
<li><a
href="bb80369e14"><code>bb80369</code></a>
perf: cache toResolveHierarchy (<a
href="https://redirect.github.com/i18next/i18next/issues/2444">#2444</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v26.3.6...v26.4.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot)
from 1.3.0 to 1.3.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md">@radix-ui/react-slot's
changelog</a>.</em></p>
<blockquote>
<h2>1.3.2, 1.3.3</h2>
<ul>
<li>Reverted breaking changes that caused compatibility issues with
React Server Components.</li>
</ul>
<h2>1.3.1</h2>
<ul>
<li>Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an
attestation.</li>
<li>Updated dependencies: <code>@radix-ui/primitive@1.1.7</code>,
<code>@radix-ui/react-compose-refs@1.1.4</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps @pierre/diffs from 1.3.5 to 1.3.6.
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~ije">ije</a>, a new releaser for
<code>@pierre/diffs</code> since your current version.</p>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react)
from 4.7.0 to 6.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's
releases</a>.</em></p>
<blockquote>
<h2>plugin-react@6.1.1</h2>
<h3>Add <code>compiler.logDiagnostics</code> option</h3>
<p>Recoverable React Compiler diagnostics are no longer logged by
default. Set <code>compiler.logDiagnostics</code> to <code>true</code>
to log them through Vite. Fatal diagnostics are always logged and fail
the transform.</p>
<h3>Respect environment sourcemap option for React Compiler transform
when <code>builder.sharedPlugins</code> is enabled (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1439">#1439</a>)</h3>
<p>The React Compiler transform was using the top-level sourcemap option
instead of the environment sourcemap option. This caused a problem when
the experimental <code>builder.sharedPlugins</code> was enabled.</p>
<h2>plugin-react@6.1.0</h2>
<h3>Add experimental native React Compiler support (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1419">#1419</a>)</h3>
<p>Add experimental native React Compiler support.</p>
<p>You can use it by installing <code>oxc-transform-react</code> and
enabling it via the <code>compiler</code> option:</p>
<pre lang="sh"><code>npm install -D oxc-transform-react
</code></pre>
<pre lang="js"><code>import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
<p>export default defineConfig({<br />
plugins: [<br />
react({ compiler: true })<br />
]<br />
})<br />
</code></pre></p>
<h2>plugin-react@6.0.5</h2>
<h3>Fixed the react compiler preset filter to be linear (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3>
<p>The improved filter in v6.0.3 was non-linear and caused a performance
regression (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>).
The filter was changed to be linear to avoid that.</p>
<h2>plugin-react@6.0.4</h2>
<h3>Fixed <code>$RefreshSig$ is not defined</code> error when running
<code>vite dev</code> with <code>NODE_ENV=production</code></h3>
<p>When running <code>vite dev</code> with
<code>NODE_ENV=production</code>, the app errored with
<code>$RefreshSig$ is not defined</code>.
This error is now fixed.</p>
<h2>plugin-react@6.0.3</h2>
<p>No release notes provided.</p>
<h2>plugin-react@6.0.2</h2>
<h3>Allow all options in reactCompilerPreset (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1189">#1189</a>)</h3>
<p>This is a type only change. Only <code>compilationMode</code> and
<code>target</code> options were available for
<code>reactCompilerPreset</code>.</p>
<h2>plugin-react@6.0.1</h2>
<h3>Expand <code>@rolldown/plugin-babel</code> peer dep range (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1146">#1146</a>)</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's
changelog</a>.</em></p>
<blockquote>
<h2>6.1.1 (2026-08-28)</h2>
<h3>Add <code>compiler.logDiagnostics</code> option</h3>
<p>Recoverable React Compiler diagnostics are no longer logged by
default. Set <code>compiler.logDiagnostics</code> to <code>true</code>
to log them through Vite. Fatal diagnostics are always logged and fail
the transform.</p>
<h3>Respect environment sourcemap option for React Compiler transform
when <code>builder.sharedPlugins</code> is enabled (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1439">#1439</a>)</h3>
<p>The React Compiler transform was using the top-level sourcemap option
instead of the environment sourcemap option. This caused a problem when
the experimental <code>builder.sharedPlugins</code> was enabled.</p>
<h2>6.1.0 (2026-08-19)</h2>
<h3>Add experimental native React Compiler support (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1419">#1419</a>)</h3>
<p>Add experimental native React Compiler support.</p>
<p>You can use it by installing <code>oxc-transform-react</code> and
enabling it via the <code>compiler</code> option:</p>
<pre lang="sh"><code>npm install -D oxc-transform-react
</code></pre>
<pre lang="js"><code>import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
<p>export default defineConfig({<br />
plugins: [<br />
react({ compiler: true })<br />
]<br />
})<br />
</code></pre></p>
<h2>6.0.5 (2026-07-30)</h2>
<h3>Fixed the react compiler preset filter to be linear (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3>
<p>The improved filter in v6.0.3 was non-linear and caused a performance
regression (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>).
The filter was changed to be linear to avoid that.</p>
<h2>6.0.4 (2026-07-22)</h2>
<h3>Fixed <code>$RefreshSig$ is not defined</code> error when running
<code>vite dev</code> with <code>NODE_ENV=production</code></h3>
<p>When running <code>vite dev</code> with
<code>NODE_ENV=production</code>, the app errored with
<code>$RefreshSig$ is not defined</code>.
This error is now fixed.</p>
<h2>6.0.3 (2026-06-23)</h2>
<h3>Improve the react compiler preset filter to reduce false-positives
(<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1138">#1138</a>)</h3>
<p>Improved the filter in the react compiler babel preset to reduce the
false-positives so that less modules are processed by the react
compiler.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="04cac5020e"><code>04cac50</code></a>
release: plugin-react@6.1.1 (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1440">#1440</a>)</li>
<li><a
href="82d35abe49"><code>82d35ab</code></a>
fix(react): respect environment sourcemap option when
<code>builder.sharedPlugins</code>...</li>
<li><a
href="397e8471a5"><code>397e847</code></a>
fix(react): make logging diagnostics an opt-in for React Compiler (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1431">#1431</a>)</li>
<li><a
href="61006e6f52"><code>61006e6</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1433">#1433</a>)</li>
<li><a
href="e2a649cbaa"><code>e2a649c</code></a>
chore: use <code>deps.neverBundle</code> instead of
<code>external</code> in tsdown config (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1430">#1430</a>)</li>
<li><a
href="fb2d6f3635"><code>fb2d6f3</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1427">#1427</a>)</li>
<li><a
href="39b31735bf"><code>39b3173</code></a>
release: plugin-react@6.1.0 (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1428">#1428</a>)</li>
<li><a
href="f1340b0c76"><code>f1340b0</code></a>
feat(react): add native React Compiler support (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1419">#1419</a>)</li>
<li><a
href="9ab698eafc"><code>9ab698e</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1375">#1375</a>)</li>
<li><a
href="68c0cb8796"><code>68c0cb8</code></a>
release: plugin-react@6.0.5 (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1362">#1362</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@vitejs/plugin-react</code> since your current
version.</p>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Use full dependency resolution in automated lockfile repair paths, add regression coverage, and refresh the stale Rollup snapshot.
Co-Authored-By: Dotta <cryppadotta@users.noreply.github.com>
Co-Authored-By: Codex <codex@openai.com>
Co-Authored-By: lockfile-bot <lockfile-bot@users.noreply.github.com>
Bumps
[@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3)
from 3.1115.0 to 3.1120.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's
releases</a>.</em></p>
<blockquote>
<h2>v3.1120.0</h2>
<h4>3.1120.0(2026-08-27)</h4>
<h5>Documentation Changes</h5>
<ul>
<li><strong>client-opensearch:</strong> Updating SDK and CLI
documentation for AttachDataSource API. (<a
href="d696fe7602">d696fe76</a>)</li>
</ul>
<h5>New Features</h5>
<ul>
<li><strong>client-lambda-microvms:</strong> Added
InsufficientCapacityException to RunMicrovm for capacity-related
failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to
ListManagedMicrovmImageVersions. Added ConflictException to
CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered
MicroVMs. (<a
href="72a8ff8092">72a8ff80</a>)</li>
<li><strong>client-codedeploy:</strong> Added a deploymentMode parameter
to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises
fleet, using the last successful revision, honoring Deployment
Configuration. (<a
href="78d4f9640b">78d4f964</a>)</li>
<li><strong>client-cloudwatch-logs:</strong> Added resultCount to
QueryStatistics in GetQueryResults. This field returns the total number
of output rows in the final result set, helping customers
programmatically determine whether a query produced results after all
operations including post-aggregation filters. (<a
href="0e4d242b71">0e4d242b</a>)</li>
<li><strong>client-datazone:</strong> Add cascadeDelete to DeleteDomain.
When specified, DataZone recursively deletes all projects, environments,
subscriptions, and their underlying AWS resources before removing the
domain. Deletion progress is reported via deleteProgress and resource
failures via failureReasons on GetDomain. (<a
href="3a74dc4b94">3a74dc4b</a>)</li>
<li><strong>client-rds:</strong> Adding support for the full snapshot
size, in bytes, of DB instance snapshots. (<a
href="ab2f66f5f5">ab2f66f5</a>)</li>
<li><strong>client-ec2:</strong> EC2 allows AMI owners to define
compatible instance types on their AMIs, blocking RunInstances calls
automatically for launches on non-permitted instance types. (<a
href="311b3b26db">311b3b26</a>)</li>
<li><strong>client-cognito-identity-provider:</strong> Adds the
AdminDeleteSoftwareToken API operation, enabling administrators to
remove a user's registered TOTP (software token) MFA configuration from
a user pool. (<a
href="f661bebc4d">f661bebc</a>)</li>
</ul>
<hr />
<p>For list of updated packages, view
<strong>updated-packages.md</strong> in
<strong>assets-3.1120.0.zip</strong></p>
<h2>v3.1119.0</h2>
<h4>3.1119.0(2026-08-26)</h4>
<h5>Chores</h5>
<ul>
<li><strong>codegen:</strong> smithy-aws-typescript-codegen 0.53.0 (<a
href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8276">#8276</a>)
(<a
href="dffb383bdc">dffb383b</a>)</li>
</ul>
<h5>New Features</h5>
<ul>
<li><strong>client-sagemaker:</strong> Amazon SageMaker AI now supports
ml.g7 instances for model optimization. You can now run model
optimization jobs on ml.g7 instances, in supported AWS Regions. (<a
href="6d5e106634">6d5e1066</a>)</li>
<li><strong>client-devops-agent:</strong> AWS DevOps Agent now supports
trigger filter groups for Release Readiness Review, letting you control
when the capability auto-triggers based on webhook events and target
branches. (<a
href="bc3d53d550">bc3d53d5</a>)</li>
<li><strong>client-license-manager-user-subscriptions:</strong> Released
support for License Expiry field in ListProductSubscriptions API (<a
href="454d7f7ffb">454d7f7f</a>)</li>
<li><strong>client-ec2:</strong> Adds deleting state to possible VPC
States. (<a
href="43091d55b3">43091d55</a>)</li>
<li><strong>client-network-firewall:</strong> Adding new status enum for
Firewalls. (<a
href="4cb21cb3b8">4cb21cb3</a>)</li>
</ul>
<hr />
<p>For list of updated packages, view
<strong>updated-packages.md</strong> in
<strong>assets-3.1119.0.zip</strong></p>
<h2>v3.1118.0</h2>
<h4>3.1118.0(2026-08-25)</h4>
<h5>Documentation Changes</h5>
<ul>
<li><strong>client-marketplace-metering:</strong> Updated documentation
to clarify duplicate-billing prevention and BatchMeterUsage retry
guidance (<a
href="322310259e">32231025</a>)</li>
</ul>
<h5>New Features</h5>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's
changelog</a>.</em></p>
<blockquote>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1119.0...v3.1120.0">3.1120.0</a>
(2026-08-27)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1118.0...v3.1119.0">3.1119.0</a>
(2026-08-26)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1117.0...v3.1118.0">3.1118.0</a>
(2026-08-25)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1116.0...v3.1117.0">3.1117.0</a>
(2026-08-24)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
<h1><a
href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1115.0...v3.1116.0">3.1116.0</a>
(2026-08-21)</h1>
<p><strong>Note:</strong> Version bump only for package
<code>@aws-sdk/client-s3</code></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d6be6f8dd3"><code>d6be6f8</code></a>
Publish v3.1120.0</li>
<li><a
href="ba4e4498a7"><code>ba4e449</code></a>
Publish v3.1119.0</li>
<li><a
href="c65dd6533d"><code>c65dd65</code></a>
Publish v3.1118.0</li>
<li><a
href="78b069ac77"><code>78b069a</code></a>
Publish v3.1117.0</li>
<li><a
href="d760a00859"><code>d760a00</code></a>
Publish v3.1116.0</li>
<li><a
href="8369ada75d"><code>8369ada</code></a>
chore(codegen): update to sync with the latest smithy-ts (<a
href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8272">#8272</a>)</li>
<li>See full diff in <a
href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1120.0/clients/client-s3">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.16.1 to
11.17.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mermaid-js/mermaid/releases">mermaid's
releases</a>.</em></p>
<blockquote>
<h2>mermaid@11.17.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/8125">#8125</a>
<a
href="178d7c79fc"><code>178d7c7</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! - fix:
restore the <code>edgePaths</code> class on the edge group in rendered
SVG, and point the flowchart, block and user journey stylesheets at
it</li>
</ul>
<h2>mermaid@11.17.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/8092">#8092</a>
<a
href="31ce60a596"><code>31ce60a</code></a>
Thanks <a
href="https://github.com/pbrolin47"><code>@pbrolin47</code></a>! -
fix(c4): wrap element labels to <code>c4.width</code> again</p>
<p>C4 element labels (<code>System</code>, <code>Container</code>,
<code>Component</code>, <code>Person</code> and their <code>_Ext</code>
variants) stopped wrapping in 11.17.0, so long descriptions rendered on
one unbroken line and the shape grew sideways well past the configured
<code>c4.width</code>. The unified-shapes label helper gated wrapping on
the root-level <code>wrap</code> option, which has no schema default and
is therefore <code>undefined</code>; it now gates on
<code>c4.wrap</code> (default <code>true</code>), which is what the
legacy renderer used.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/8088">#8088</a>
<a
href="c66200bc23"><code>c66200b</code></a>
Thanks <a
href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>!
- fix: neo-look arrowheads and crow's-foot markers no longer fall back
to default theme colours/stroke widths on the first render with
<code>layout: elk</code>. State diagram arrowheads stayed dark on dark
themes, and ER / requirement markers were drawn at the default stroke
width, because markers were created from the layout package's own
bundled copy of mermaid, whose config had not been initialized yet.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/8079">#8079</a>
<a
href="281cd7b070"><code>281cd7b</code></a>
Thanks <a
href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>!
- fix(class): class diagram relation markers (composition, aggregation,
extension, dependency, lollipop) no longer scale with the edge stroke
width, so they stay outside the class box boundary in themes that set
<code>strokeWidth: 2</code> (<code>redux</code>,
<code>redux-dark</code>, <code>redux-color</code>,
<code>redux-dark-color</code>, <code>neo</code>, <code>neo-dark</code>)
with the default <code>classic</code> look.</p>
</li>
</ul>
<h2>mermaid@11.17.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7842">#7842</a>
<a
href="3670b4e2d9"><code>3670b4e</code></a>
Thanks <a
href="https://github.com/filipsajdak"><code>@filipsajdak</code></a>! -
feat(c4): render C4 elements through the unified shape system, using the
new person shape</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7812">#7812</a>
<a
href="cdfc0ea65f"><code>cdfc0ea</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! -
feat(class): route <code>classDiagram</code> to the unified (v2)
renderer by default</p>
<p>Set <code>class: { defaultRenderer: 'dagre-d3' }</code> in the config
to restore the legacy renderer.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7785">#7785</a>
<a
href="c45cde9582"><code>c45cde9</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! -
feat(flowchart): add collapsible flowchart subgraphs via
<code>subgraphId@{ view: collapsed }</code></p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7828">#7828</a>
<a
href="8eb3afc08c"><code>8eb3afc</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! -
feat(elk): add <code>elk.keepEntryNodeOnTop</code> config option to keep
a recursive flow's entry node on top</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7803">#7803</a>
<a
href="74e44ebf86"><code>74e44eb</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! -
feat(elk): add <code>elk.nodePlacementAlignment</code> config option</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7792">#7792</a>
<a
href="ea55b31bcf"><code>ea55b31</code></a>
Thanks <a
href="https://github.com/RodrigojndSantos"><code>@RodrigojndSantos</code></a>!
- feat(er): add subgraph support to ER diagrams.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7970">#7970</a>
<a
href="a2c0fb6cdf"><code>a2c0fb6</code></a>
Thanks <a
href="https://github.com/filipsajdak"><code>@filipsajdak</code></a>! -
feat(flowchart): add <code>folder</code>, <code>bucket</code>,
<code>console</code> (terminal window) and <code>browser</code>
shapes</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7842">#7842</a>
<a
href="ae3e1157c1"><code>ae3e115</code></a>
Thanks <a
href="https://github.com/filipsajdak"><code>@filipsajdak</code></a>! -
feat(flowchart): add <code>person</code> shape (circular head above a
rounded body), usable in flowcharts via <code>A@{ shape: person
}</code></p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7724">#7724</a>
<a
href="0fd7a9fe0d"><code>0fd7a9f</code></a>
Thanks <a
href="https://github.com/xdumaine"><code>@xdumaine</code></a>! -
feat(xyChart): add legends for named line and bar series</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7847">#7847</a>
<a
href="215fe89d3e"><code>215fe89</code></a>
Thanks <a
href="https://github.com/filipsajdak"><code>@filipsajdak</code></a>! -
fix(c4): named attributes such as <code>$tags</code>, <code>$link</code>
and <code>$sprite</code> are no longer clobbered to undefined when they
arrive in an earlier positional slot of
Person/System/Container/Component/Boundary/Rel statements.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7871">#7871</a>
<a
href="8d874c49fa"><code>8d874c4</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! -
fix(flowchart): stop dagre layout from spamming <code>warn</code>-level
logs on every node/edge/cluster</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/8071">#8071</a>
<a
href="b3d1f63167"><code>b3d1f63</code></a>
Thanks <a
href="https://github.com/pbrolin47"><code>@pbrolin47</code></a>! -
fix(block): sibling blocks overlapping in block diagrams when one has a
label wider than 200px</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7870">#7870</a>
<a
href="71b8843fb5"><code>71b8843</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! - fix: a
<code>RangeError: Invalid array length</code> crash when rendering
certain edges.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7924">#7924</a>
<a
href="9cbef5d94f"><code>9cbef5d</code></a>
Thanks <a
href="https://github.com/nightt5879"><code>@nightt5879</code></a>! -
fix(treeView): icons disappearing after strict security
sanitization.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dcb694ddb5"><code>dcb694d</code></a>
Version Packages (<a
href="https://redirect.github.com/mermaid-js/mermaid/issues/8130">#8130</a>)</li>
<li><a
href="178d7c79fc"><code>178d7c7</code></a>
fix: restore edgePaths class on the edge group (<a
href="https://redirect.github.com/mermaid-js/mermaid/issues/8125">#8125</a>)</li>
<li><a
href="569f46e261"><code>569f46e</code></a>
Version Packages (<a
href="https://redirect.github.com/mermaid-js/mermaid/issues/8114">#8114</a>)</li>
<li><a
href="3054836688"><code>3054836</code></a>
Version Packages</li>
<li><a
href="5b17e0a38f"><code>5b17e0a</code></a>
Merge pull request <a
href="https://redirect.github.com/mermaid-js/mermaid/issues/8092">#8092</a>
from mermaid-js/hotfix/11.17.1</li>
<li><a
href="655211a065"><code>655211a</code></a>
Reverted change of wrap-options</li>
<li><a
href="8a23480200"><code>8a23480</code></a>
Updated doc from feedback</li>
<li><a
href="412c80abb7"><code>412c80a</code></a>
Update doc and consistent handlig in c4 as for seq diags</li>
<li><a
href="b433a9aad5"><code>b433a9a</code></a>
Updated changeset to describe specifik diagram affected</li>
<li><a
href="6bae15eb59"><code>6bae15e</code></a>
Updated tests to Playwright API</li>
<li>Additional commits viewable in <a
href="https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Thinking Path
> - Paperclip uses a frozen pnpm lockfile to create the same dependency
graph for each build.
> - The Claude local adapter now uses
`@agentclientprotocol/claude-agent-acp` version 0.73.0.
> - The root patch configuration contains a patch for version 0.73.0.
> - The committed lockfile did not contain the matching patch record.
> - A frozen install rejected this mismatch and stopped the master
deployment.
> - This pull request regenerates only `pnpm-lock.yaml` from the current
master manifests.
> - The change makes the frozen install valid again.
## Linked Issues or Issue Description
Refs #12730
**What happened?**
The master lockfile did not match the current patched dependency
configuration.
**Expected behavior**
The frozen install must accept the lockfile on master.
**Steps to reproduce**
1. Extract a clean archive of master.
2. Run `NODE_ENV=development CI=true pnpm install --frozen-lockfile
--force`.
3. Observe that pnpm rejects the stale lockfile.
**Paperclip version or commit**
`b1f4910ee57789c7045705a38c31ca34704f3575`
**Deployment mode**
Self-hosted server.
**Installation method**
Built from source with pnpm.
## What Changed
- Added the patch record for
`@agentclientprotocol/claude-agent-acp@0.73.0`.
- Updated the Claude local adapter lock entry to version 0.73.0.
- Added the matching transitive Claude agent SDK lock entries.
## Verification
- `git diff --check` passes.
- A clean archive of commit `236767cdd1832575fe93ea50f50df2890fb2bf1f`
accepts the frozen lockfile.
- `NODE_ENV=development CI=true pnpm install --frozen-lockfile --force`
completes with exit code 0 in that archive.
- Latest-head GitHub checks are green (32/32 success, neutral, or
skipped).
- Greptile passed the same head at 5/5 with zero unresolved threads.
## Risks
- Risk is low because pnpm generated the only changed file.
- The lockfile now records the dependency version that the manifests
already require.
## Model Used
OpenAI Codex with a GPT-5 family model produced this change. The runtime
does not expose the exact deployment ID or context size. The model used
high reasoning and shell execution.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used with the available version and
capability details
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have linked the related public pull request with `Refs #`
- [x] I have not referenced internal or instance-local Paperclip issues
or links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id
- [x] I have run the required local verification and it passes
- [x] Tests do not need source changes for this generated lockfile
correction
- [x] Documentation does not need changes because behavior and commands
are unchanged
- [x] I have considered and documented the risks above
- [x] All Paperclip CI gates are green
- [x] Greptile has no open P2 findings, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before merge
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
## Thinking Path
> - Paperclip uses one lockfile for all workspace packages.
> - The lockfile makes dependency installation repeatable.
> - The root manifest now includes AgentMail.
> - The old lockfile did not include AgentMail.
> - A frozen installation stopped before deployment.
> - This pull request refreshes the lockfile through the master
workflow.
> - The refresh makes the frozen installation complete again.
## Linked Issues or Issue Description
**What happened?**
The root manifest declared `agentmail@^0.5.14`. The root lockfile did
not contain that dependency. The frozen installation failed.
**Expected behavior**
The lockfile must contain all root dependencies. A frozen installation
must complete without changing the lockfile.
**Steps to reproduce**
1. Check out commit `4310b0c947727ef1ce1a6de3f4a556cd6a1e0ae1`.
2. Run `NODE_ENV=development CI=true pnpm install --frozen-lockfile
--force`.
3. Observe the missing dependency error.
**Paperclip version or commit**
`4310b0c947727ef1ce1a6de3f4a556cd6a1e0ae1`
**Deployment mode**
A self-hosted Linux arm64 deployment uses the master branch.
## What Changed
- Added `agentmail@^0.5.14` to the root lockfile importer.
- Added the dependency resolutions required by the current workspace
manifests.
- Kept the change limited to `pnpm-lock.yaml`.
## Verification
- Used Node.js 24.20.0 and pnpm 9.15.4.
- Ran `NODE_ENV=development CI=true pnpm install --frozen-lockfile
--force`.
- Confirmed that the command completed successfully.
- Confirmed that the command did not change `pnpm-lock.yaml`.
## Risks
- Risk is low because this pull request changes only the generated
lockfile.
- The refresh adds packages that the current manifests already declare.
- A future manifest change can require another lockfile refresh.
> This pull request does not change a core feature. It does not overlap
with `ROADMAP.md`.
## Model Used
OpenAI Codex used the `gpt-5` model. The runtime did not provide the
context-window size. The model used reasoning, shell tools, and code
execution.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
## Thinking Path
> - Paperclip uses workspace manifests to declare package dependencies.
> - The lockfile records each workspace link for repeatable installs.
> - PR #12469 added `@paperclipai/shared` to the Grok local adapter
manifest.
> - The `master` lockfile did not include this new workspace link.
> - A frozen install requires the manifest and lockfile to match.
> - This pull request regenerates the lockfile with the repository
workflow.
> - The benefit is a repeatable frozen install from `master`.
## Linked Issues or Issue Description
Refs #12469
## What Changed
- Added the `@paperclipai/shared` workspace link to the Grok local
adapter importer in `pnpm-lock.yaml`.
## Verification
- Ran `CI=true pnpm install --frozen-lockfile` successfully.
- Ran the full pull request CI suite under Node.js 24. All 23 jobs
passed.
## Risks
- Low risk. This pull request changes only one lockfile importer.
- The package manifest already declares the dependency.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
## Model Used
- OpenAI Codex with GPT-5 (`gpt-5`). The runtime does not expose the
context limit. Agentic reasoning, repository tools, API tools, and code
execution were enabled.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Bumps [commander](https://github.com/tj/commander.js) from 13.1.0 to
15.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tj/commander.js/releases">commander's
releases</a>.</em></p>
<blockquote>
<h2>v15.0.0</h2>
<p>Commander 15 is ESM only. This is expected to be seamless for ESM
consumers, but some CommonJS consumers may hit issues with tooling
requiring configuration for ESM-only dependencies. See Migration Tips
below.</p>
<p>The release of Commander 15 moves Commander 14 into maintenance.
Commander 14 will get security updates for
12 months (to May 2027). For more info see <a
href="https://github.com/tj/commander.js/blob/v15.0.0/docs/release-policy.md">Release
Policy</a>.</p>
<h3>Added</h3>
<ul>
<li>show excess command-arguments in error message (<a
href="https://redirect.github.com/tj/commander.js/issues/2384">#2384</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><em>Breaking:</em> only lone <code>--no-*</code> option sets default
option value to <code>true</code>, default not implicitly set when
define both positive and negative option in either order (<a
href="https://redirect.github.com/tj/commander.js/issues/2405">#2405</a>)</li>
<li>update example to use compatible character for MINGW64 (<a
href="https://redirect.github.com/tj/commander.js/issues/2475">#2475</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><em>Breaking:</em> migrated Commander implementation from CommonJS
to ESM (<a
href="https://redirect.github.com/tj/commander.js/issues/2464">#2464</a>)</li>
<li><em>Breaking:</em> Commander 15 requires Node.js v22.12.0 or higher
(for <code>require(esm)</code>).</li>
<li>dev: switch tests from Jest to <code>node:test</code> test runner
(<a
href="https://redirect.github.com/tj/commander.js/issues/2463">#2463</a>)</li>
</ul>
<h3>Deleted</h3>
<ul>
<li><em>Breaking:</em> removed deprecated export of
<code>commander/esm.mjs</code> (<a
href="https://redirect.github.com/tj/commander.js/issues/2464">#2464</a>)</li>
</ul>
<h3>Migration Tips</h3>
<p>Commander 15 is ESM only, but this does not mean you need to migrate
to ESM to use it. Importing ESM from CommonJS is
supported by Node.js, and Bun, and Deno. Hopefully it Just Works for
you! However, you may be using a different runtime or
some other part of your setup that may not yet natively support
importing ESM from CommonJS, such as your testing framework
or bundler.</p>
<p>If you have problems using Commander 15 in your environment, one
option is stay on Commander 14 for now. Commander 14 will
get security updates until May 2027 and things will hopefully improve
for your setup in the meantime.</p>
<h2>v15.0.0-0</h2>
<p>Commander 15 is ESM only. This is expected to be seamless for ESM
consumers, but some CommonJS consumers may hit issues with tooling
requiring configuration for ESM-only dependencies. See Migration Tips
below.</p>
<p>The release of Commander 15 in May 2026 will move Commander 14 into
maintenance. Commander 14 will get security updates for
12 months (to May 2027). For more info see <a
href="https://github.com/tj/commander.js/blob/master/docs/release-policy.md">Release
Policy</a>.</p>
<h3>Added</h3>
<ul>
<li>show excess command-arguments in error message (<a
href="https://redirect.github.com/tj/commander.js/issues/2384">#2384</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><em>Breaking:</em> only lone <code>--no-*</code> option sets default
option value to <code>true</code>, default not implicitly set when
define both positive and negative option in either order (<a
href="https://redirect.github.com/tj/commander.js/issues/2405">#2405</a>)</li>
<li>update example to use compatible character for MINGW64 (<a
href="https://redirect.github.com/tj/commander.js/issues/2475">#2475</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj/commander.js/blob/master/CHANGELOG.md">commander's
changelog</a>.</em></p>
<blockquote>
<h2>[15.0.0] (2026-05-29)</h2>
<p>Commander 15 is ESM only. This is expected to be seamless for ESM
consumers, but some CommonJS consumers may hit issues with tooling
requiring configuration for ESM-only dependencies. See Migration Tips
below.</p>
<p>The release of Commander 15 moves Commander 14 into maintenance.
Commander 14 will get security updates for
12 months (to May 2027). For more info see <a
href="https://github.com/tj/commander.js/blob/master/docs/release-policy.md">Release
Policy</a>.</p>
<h3>Added</h3>
<ul>
<li>show excess command-arguments in error message (<a
href="https://redirect.github.com/tj/commander.js/issues/2384">#2384</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><em>Breaking:</em> only lone <code>--no-*</code> option sets default
option value to <code>true</code>, default not implicitly set when
define both positive and negative option in either order (<a
href="https://redirect.github.com/tj/commander.js/issues/2405">#2405</a>)</li>
<li>update example to use compatible character for MINGW64 (<a
href="https://redirect.github.com/tj/commander.js/issues/2475">#2475</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><em>Breaking:</em> migrated Commander implementation from CommonJS
to ESM (<a
href="https://redirect.github.com/tj/commander.js/issues/2464">#2464</a>)</li>
<li><em>Breaking:</em> Commander 15 requires Node.js v22.12.0 or higher
(for <code>require(esm)</code>).</li>
<li>dev: switch tests from Jest to <code>node:test</code> test runner
(<a
href="https://redirect.github.com/tj/commander.js/issues/2463">#2463</a>)</li>
</ul>
<h3>Deleted</h3>
<ul>
<li><em>Breaking:</em> removed deprecated export of
<code>commander/esm.mjs</code> (<a
href="https://redirect.github.com/tj/commander.js/issues/2464">#2464</a>)</li>
</ul>
<h3>Migration Tips</h3>
<p>Commander 15 is ESM only, but this does not mean you need to migrate
to ESM to use it. Importing ESM from CommonJS is
supported by Node.js, and Bun, and Deno. Hopefully it Just Works for
you! However, you may be using a different runtime or
some other part of your setup that may not yet natively support
importing ESM from CommonJS, such as your testing framework
or bundler.</p>
<p>If you have problems using Commander 15 in your environment, one
option is stay on Commander 14 for now. Commander 14 will
get security updates until May 2027 and things will hopefully improve
for your setup in the meantime.</p>
<h2>[15.0.0-0] (2026-02-22)</h2>
<p>(Released as 15.0.0)</p>
<h2>[14.0.3] (2026-01-31)</h2>
<h3>Added</h3>
<ul>
<li>Release Policy document (<a
href="https://redirect.github.com/tj/commander.js/issues/2462">#2462</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>old major versions now supported for 12 months instead of just
previous major version, to give predictable end-of-life date (<a
href="https://redirect.github.com/tj/commander.js/issues/2462">#2462</a>)</li>
<li>clarify typing for deprecated callback parameter to
<code>.outputHelp()</code> (<a
href="https://redirect.github.com/tj/commander.js/issues/2427">#2427</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ba6d13ddb4"><code>ba6d13d</code></a>
Fix release dates in changelog (<a
href="https://redirect.github.com/tj/commander.js/issues/2523">#2523</a>)</li>
<li><a
href="a752ed909f"><code>a752ed9</code></a>
Pin GitHub actions with hash (<a
href="https://redirect.github.com/tj/commander.js/issues/2521">#2521</a>)</li>
<li><a
href="74d5dfe9b7"><code>74d5dfe</code></a>
Drop EOL node 20 from test matrix, and add node 26 (<a
href="https://redirect.github.com/tj/commander.js/issues/2520">#2520</a>)</li>
<li><a
href="6df9b68b75"><code>6df9b68</code></a>
Update details for 15.0.0 release (<a
href="https://redirect.github.com/tj/commander.js/issues/2519">#2519</a>)</li>
<li><a
href="01ce5d0cd7"><code>01ce5d0</code></a>
Remove jest esm examples (<a
href="https://redirect.github.com/tj/commander.js/issues/2517">#2517</a>)</li>
<li><a
href="d785d8b3b9"><code>d785d8b</code></a>
Update dependencies (<a
href="https://redirect.github.com/tj/commander.js/issues/2518">#2518</a>)</li>
<li><a
href="9098b4863e"><code>9098b48</code></a>
Update dependencies (<a
href="https://redirect.github.com/tj/commander.js/issues/2506">#2506</a>)</li>
<li><a
href="373f660f6f"><code>373f660</code></a>
Use node:util stripVTControlCharacters instead of own code (<a
href="https://redirect.github.com/tj/commander.js/issues/2486">#2486</a>)</li>
<li><a
href="987f28966c"><code>987f289</code></a>
Use simple match in test (to avoid warning about expensive regex) (<a
href="https://redirect.github.com/tj/commander.js/issues/2485">#2485</a>)</li>
<li><a
href="0ea3bb3e88"><code>0ea3bb3</code></a>
Update dependecies and lint (<a
href="https://redirect.github.com/tj/commander.js/issues/2489">#2489</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tj/commander.js/compare/v13.1.0...v15.0.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
Bumps
[better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth)
from 1.6.28 to 1.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/releases">better-auth's
releases</a>.</em></p>
<blockquote>
<h2>v1.7.0</h2>
<p><strong>Blog post:</strong> <a
href="https://better-auth.com/blog/1-7">Better Auth 1.7</a></p>
<h2><code>better-auth</code></h2>
<h3>❗ Breaking Changes</h3>
<ul>
<li>Moved database joins out of <code>experimental</code> into the
stable <code>advanced.database.joins</code> option (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10359">#10359</a>)
<blockquote>
<p><strong>Migration:</strong> Replace <code>experimental: { joins: true
}</code> with <code>advanced: { database: { joins: true } }</code>.
Drizzle and Prisma users should regenerate their schema (<code>npx
auth@latest generate</code>) so it includes the required relations.</p>
</blockquote>
</li>
<li>Scoped account identity by trusted issuer, keying accounts on
<code>(issuer, accountId)</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10403">#10403</a>)
<blockquote>
<p><strong>Migration:</strong> Accounts now require
<code>Account.issuer</code>. Read provider identity from
<code>accountInfo.account.accountId</code>, drop <code>mapping.id</code>
from SSO configs, and give the <code>microsoftEntraId</code> helper a
concrete tenant GUID. Apply the account-identity backfill in the 1.7
upgrade guide before deploying.</p>
</blockquote>
</li>
<li>Required captcha endpoint entries to match full auth paths, with
wildcard support (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10004">#10004</a>)
<blockquote>
<p><strong>Migration:</strong> Replace partial paths such as
<code>/sign-in</code> with explicit wildcards like
<code>/sign-in/*</code> or <code>/sign-in/**</code>.</p>
</blockquote>
</li>
<li>Moved the MCP plugin into its own <code>@better-auth/mcp</code>
package built on the OAuth provider (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9992">#9992</a>)
<blockquote>
<p><strong>Migration:</strong> Install <code>@better-auth/mcp</code> and
<code>@better-auth/cimd</code>, add the now-required <code>jwt()</code>
plugin, and move options nested under <code>oidcConfig</code> to flat
<code>mcp({ ... })</code> options. Rename <code>withMcpAuth</code> to
<code>requireMcpAuth</code> and <code>mcpHandler</code> to
<code>createMcpProtectedRequestHandler</code>. Regenerate the schema
(<code>npx auth migrate</code>): <code>oauthApplication</code> becomes
<code>oauthClient</code>, plus new <code>oauthRefreshToken</code> and
<code>oauthClientAssertion</code> tables.</p>
</blockquote>
</li>
<li>Added OIDC back-channel logout so ending a session cuts off every
connected app's API access (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9304">#9304</a>)
<blockquote>
<p><strong>Migration:</strong> Introspecting an access token whose
session has ended now returns <code>{ active: false }</code>, and
<code>/oauth2/userinfo</code> rejects it. Clients opt into notifications
by registering <code>backchannel_logout_uri</code>. Run the schema
migration for the new <code>oauthClient</code> and
<code>oauthAccessToken</code> columns.</p>
</blockquote>
</li>
<li>Modeled OAuth protected resources explicitly, with per-resource
TTLs, scopes, claims, and signing pins (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9648">#9648</a>)
<blockquote>
<p><strong>Migration:</strong> <code>validAudiences</code> is removed:
move each resource identifier into <code>resources</code> and link
restricted clients through <code>oauthClientResource</code>.
<code>@better-auth/mcp</code> now requires an explicit
<code>resource</code>. Run <code>npx @better-auth/cli generate</code>
and apply the migration before deploying.</p>
</blockquote>
</li>
<li>Decoupled SCIM provisioning from the organization plugin (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10390">#10390</a>)
<blockquote>
<p><strong>Migration:</strong> SCIM configuration, client APIs, database
schema, and the Group model are all replaced, and provisioning state
cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade
guide, including a full directory reprovision, before resuming
traffic.</p>
</blockquote>
</li>
<li>Added OTP-only two-factor enablement with a discriminated
<code>enableTwoFactor</code> response (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9057">#9057</a>)
<blockquote>
<p><strong>Migration:</strong> <code>enableTwoFactor</code> now returns
a <code>method</code> field (<code>"otp"</code> or
<code>"totp"</code>); narrow on it before reading
<code>totpURI</code> and <code>backupCodes</code>. Pass <code>method:
"otp"</code> for OTP enrollment, which requires
<code>otpOptions.sendOTP</code>.</p>
</blockquote>
</li>
<li>Resolved the auth origin from <code>Host</code> by default when
using a dynamic <code>baseURL</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9134">#9134</a>)
<blockquote>
<p><strong>Migration:</strong> If your proxy exposes the public hostname
only through <code>x-forwarded-host</code>, set
<code>advanced.trustedProxyHeaders: true</code>. Deployments where the
proxy rewrites <code>Host</code> (nginx default, Vercel, Cloudflare,
Netlify) are unaffected.</p>
</blockquote>
</li>
<li>Added unique lookup indexes for the device authorization
<code>deviceCode</code> and <code>userCode</code> columns (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10059">#10059</a>)
<blockquote>
<p><strong>Migration:</strong> Resolve duplicate code values before
applying the migration. MySQL and SQL Server installations must also
convert both columns to bounded strings and clean up values longer than
191 characters.</p>
</blockquote>
</li>
<li>Enforced S256 PKCE in the Electron sign-in flow and hardened
custom-scheme origin checks (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9645">#9645</a>)
<blockquote>
<p><strong>Migration:</strong> Upgrade the
<code>@better-auth/electron</code> client and server together and add
your app's scheme to <code>trustedOrigins</code>. The
<code>code_challenge_method</code> parameter and
<code>disableOriginOverride</code> option are removed, and host-bearing
custom-scheme entries now match that host exactly.</p>
</blockquote>
</li>
<li>Identified Microsoft Entra accounts by the stable <code>oid</code>
claim (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10204">#10204</a>)
<blockquote>
<p><strong>Migration:</strong> Migrate existing Microsoft account rows
created from <code>sub</code> before upgrading. Tokens without a valid
<code>oid</code> are rejected.</p>
</blockquote>
</li>
<li>Required a Google client ID before Google One Tap verifies ID tokens
(<a
href="https://redirect.github.com/better-auth/better-auth/pull/10036">#10036</a>)
<blockquote>
<p><strong>Migration:</strong> Configure <code>oneTap({ clientId
})</code> or <code>socialProviders.google.clientId</code>.</p>
</blockquote>
</li>
<li>Removed the deprecated <code>oidcProvider</code> plugin (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10031">#10031</a>)
<blockquote>
<p><strong>Migration:</strong> Move OIDC authorization-server
integrations to <code>@better-auth/oauth-provider</code>.</p>
</blockquote>
</li>
<li>Rewrote the generic OAuth plugin as a first-class social provider
with OAuth 2.1 defaults (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9069">#9069</a>)
<blockquote>
<p><strong>Migration:</strong> Replace <code>signIn.oauth2({ providerId
})</code> with <code>signIn.social({ provider })</code>,
<code>oauth2.link()</code> with <code>linkSocial()</code>, and drop
<code>genericOAuthClient()</code>. Callbacks move to
<code>/api/auth/callback/:id</code>, <code>pkce</code> now defaults to
<code>true</code>, and <code>issuer</code> and
<code>requireIssuerValidation</code> are removed in favor of OIDC
discovery.</p>
</blockquote>
</li>
<li>Separated OAuth device grant ownership into
<code>oauthDeviceAuthorization()</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10746">#10746</a>)
<blockquote>
<p><strong>Migration:</strong> The OAuth integration replaces the
optional <code>resource</code> column with <code>oauthClientId</code>
and <code>resources</code>, so regenerate and apply the schema. Let
pending device codes expire before upgrading from an earlier 1.7
prerelease.</p>
</blockquote>
</li>
<li>Verified provider <code>id_tokens</code> with a single shared
verifier (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9828">#9828</a>)
<blockquote>
<p><strong>Migration:</strong> Custom <code>UpstreamProvider</code>
implementations replace the removed <code>verifyIdToken</code> method
with an <code>idToken</code> config carrying a JWKS source, issuer, and
audience. PayPal client <code>id_token</code> sign-in now returns
<code>ID_TOKEN_NOT_SUPPORTED</code>; its redirect flow is unchanged.</p>
</blockquote>
</li>
</ul>
<h3>Features</h3>
<ul>
<li>Added <code>clientAssertion</code> support to the Microsoft Entra ID
social provider (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9898">#9898</a>)</li>
<li>Made the <code>Auth</code> instance directly fetchable (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9431">#9431</a>)</li>
<li>Added per-provider <code>requireEmailVerification</code> for social
sign-in (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9929">#9929</a>)</li>
<li>Added a <code>user.validateUserInfo</code> gate for rejecting an
identity before a user is created or linked (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9864">#9864</a>)</li>
<li>Added <code>hydrateSession</code> so <code>useSession</code> returns
server-fetched data on the first render (<a
href="https://redirect.github.com/better-auth/better-auth/pull/8733">#8733</a>)</li>
<li>Added compound table indexes to plugin database schemas (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10402">#10402</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's
changelog</a>.</em></p>
<blockquote>
<h2>1.7.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/8733">#8733</a>
<a
href="4e8e4c7fc5"><code>4e8e4c7</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>!
- Add <code>hydrateSession</code> to seed the client with a
server-fetched session so <code>useSession</code> returns data on the
first render.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9930">#9930</a>
<a
href="0cbaf81bed"><code>0cbaf81</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- Anonymous account linking now works after social and generic OAuth
sign-in in Expo and other in-app browsers, where the OAuth callback
returns without the session cookie. <code>onLinkAccount</code> fires and
the anonymous user is migrated; before, it was silently skipped.</p>
<p>Plugins can now carry server-trusted data across an OAuth redirect
with the new <code>addOAuthServerContext</code> API, read back on the
callback via <code>getOAuthState().serverContext</code>. Unlike
<code>additionalData</code>, it cannot be set from the request body, so
it is the right place for values the server must trust.</p>
<p>For <code>@better-auth/oauth-provider</code>, the post-login
authorization query now travels through that server-only channel, so it
can no longer be injected through <code>additionalData</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10004">#10004</a>
<a
href="b36c38f984"><code>b36c38f</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>!
- The captcha plugin now requires endpoint entries to match full auth
paths unless they use wildcard patterns. This prevents requests like
<code>/sign-in//email</code> from bypassing captcha while preserving
trailing-slash matches like <code>/sign-in/email/</code>. To protect
multiple routes, replace partial paths like <code>/sign-in</code> with
explicit wildcards such as <code>/sign-in/*</code> or
<code>/sign-in/**</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10746">#10746</a>
<a
href="6782647d7c"><code>6782647</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- OAuth device grants now use <code>oauthDeviceAuthorization()</code>
alongside <code>oauthProvider()</code> or <code>mcp()</code>. This
single integration replaces both the standalone
<code>deviceCodeGrant()</code> plugin and the shared-grant
configuration. Standalone Device Authorization no longer accepts or
stores RFC 8707 resources, and <code>onDeviceAuthRequest</code> receives
only <code>clientId</code> and <code>scope</code>. The OAuth integration
rejects resource indicators that are not absolute, fragment-free
URIs.</p>
<p>The OAuth integration replaces the optional <code>resource</code>
column with <code>oauthClientId</code> and <code>resources</code>.
Regenerate and apply the schema when using it. Before upgrading from an
earlier 1.7 prerelease, let pending OAuth device codes expire or delete
them because they cannot be exchanged through the new integration.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10402">#10402</a>
<a
href="763a2671c5"><code>763a267</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- Plugin database schemas can now define named or generated table-level
indexes across multiple fields. SQL migrations and generated Drizzle or
Prisma schemas resolve configured table and column names consistently,
while the MongoDB adapter creates the same indexes before the first
index-enforcing write.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9766">#9766</a>
<a
href="bf39cbf13f"><code>bf39cbf</code></a>
Thanks <a
href="https://github.com/GautamBytes"><code>@GautamBytes</code></a>! -
Add a server-only <code>auth.api.consumePhoneNumberOTP</code> API for
custom phone OTP flows that need to verify and consume a code without
creating or updating users or sessions.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10330">#10330</a>
<a
href="081d3c379c"><code>081d3c3</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>!
- Allow the username plugin's separate <code>displayUsername</code>
field to be omitted by
setting <code>displayUsername: false</code> on both the server and
client plugins.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10059">#10059</a>
<a
href="49b5cf650e"><code>49b5cf6</code></a>
Thanks <a
href="https://github.com/GautamBytes"><code>@GautamBytes</code></a>! -
Device Authorization now creates unique database indexes for
<code>deviceCode</code> and <code>userCode</code>, so each generated
code must be unique in its column. Existing installations on every
adapter must resolve duplicate values before applying the migration.
MySQL and SQL Server installations must also convert both columns to
bounded strings and clean up values longer than 191 characters before
running it.</p>
<p>Generated codes are limited to 191 characters. Issuance makes up to 3
attempts to overcome unique-key collisions, then returns
<code>server_error</code> if it cannot create a unique
<code>deviceCode</code> and <code>userCode</code>. Default-generated
user codes accept case changes and readability separators during
verification, approval, and denial; custom codes outside the default
alphabet are matched exactly. The <code>/device</code> limiter allows 5
requests over a window equal to the configured code lifetime, while
<code>/device/token</code> polling keeps its separate interval
behavior.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9645">#9645</a>
<a
href="e0140297a5"><code>e014029</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>!
- Harden the Electron OAuth flow and tighten custom-scheme
trusted-origin matching.</p>
<p>The Electron sign-in flow now mandates PKCE S256. Plain PKCE is
rejected: the <code>code_challenge_method</code> parameter is gone and
every authorization code is verified by hashing the verifier with
SHA-256. The server no longer trusts an <code>electron-origin</code>
header to set the request Origin. The Electron client now sends a real
<code>Origin</code> (for example <code>myapp:/</code>), so upgrade the
<code>@better-auth/electron</code> client and server together and make
sure your app's scheme is in <code>trustedOrigins</code>. The unused
<code>disableOriginOverride</code> option is removed.</p>
<p>Custom-scheme entries in <code>trustedOrigins</code> now match by
scheme and authority instead of string prefix. A host-less entry such as
<code>myapp://</code> or <code>exp://</code> still trusts every host of
that scheme, but a host-bearing entry such as
<code>myapp://callback</code> matches that host exactly, so it is no
longer satisfied by <code>myapp://callback.attacker.tld</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9948">#9948</a>
<a
href="3d04fababb"><code>3d04fab</code></a>
Thanks <a href="https://github.com/yordis"><code>@yordis</code></a>! -
feat(generic-oauth): add <code>refreshTokenParams</code> config to
forward extra params on token refresh</p>
<p>Multi-tenant OIDC providers (Zitadel multi-org, Auth0 with
<code>audience</code>) need to send extra body params on the refresh
call to rescope tokens without a full authorization redirect. The
generic-oauth plugin now accepts a <code>refreshTokenParams</code>
option (object or sync/async function) that is merged into the refresh
request body, with <code>grant_type</code> and
<code>refresh_token</code> protected from override. The function form
receives request metadata for the request that triggered the refresh, so
request-scoped data (headers, cookies) is available without out-of-band
state like AsyncLocalStorage.</p>
<p><code>UpstreamProvider.refreshAccessToken</code> now accepts an
optional second <code>ctx</code> argument; the change is backwards
compatible because existing implementations that take only
<code>refreshToken</code> remain valid. See <a
href="https://redirect.github.com/better-auth/better-auth/issues/7554">#7554</a>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9069">#9069</a>
<a
href="c7d22539ec"><code>c7d2253</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>!
- Rewrite the generic OAuth plugin as a first-class social provider with
OAuth 2.1 security defaults. Providers now use
<code>signIn.social</code> + <code>callback/:id</code> instead of
dedicated plugin endpoints, with PKCE required by default (OAuth 2.1),
RFC 9207 issuer validation, OIDC auto-discovery with <code>openid</code>
scope injection, and typed provider IDs.</p>
<p><strong>Breaking changes:</strong></p>
<ul>
<li><code>signIn.oauth2({ providerId })</code> replaced by
<code>signIn.social({ provider })</code></li>
<li><code>oauth2.link()</code> replaced by
<code>linkSocial()</code></li>
<li>Callback URL changed from <code>/api/auth/oauth2/callback/:id</code>
to <code>/api/auth/callback/:id</code></li>
<li><code>genericOAuthClient()</code> removed; generic OAuth providers
now use the standard social client APIs</li>
<li><code>pkce</code> defaults to <code>true</code> (was
<code>false</code>); set <code>pkce: false</code> for providers that
reject PKCE</li>
<li><code>authorizationUrlParams</code> and <code>tokenUrlParams</code>
only accept <code>Record<string, string></code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ccd57c2dcb"><code>ccd57c2</code></a>
docs(changelog): align v1.7 release notes with final behavior (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10846">#10846</a>)</li>
<li><a
href="f577ec5c76"><code>f577ec5</code></a>
chore: exit pre-release mode for v1.7.0</li>
<li><a
href="69258d1670"><code>69258d1</code></a>
chore: sync main to next</li>
<li><a
href="e84ec5e76d"><code>e84ec5e</code></a>
chore: release v1.6.30 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10840">#10840</a>)</li>
<li><a
href="bc93b27542"><code>bc93b27</code></a>
chore: release v1.7.0-rc.6 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10772">#10772</a>)</li>
<li><a
href="58c49eb97f"><code>58c49eb</code></a>
chore: release v1.6.29 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10809">#10809</a>)</li>
<li><a
href="e6e1b4e814"><code>e6e1b4e</code></a>
perf(db): replace sequential get-then-delete loop with parallel deletes
in de...</li>
<li><a
href="80799e6931"><code>80799e6</code></a>
chore: sync main to next</li>
<li><a
href="3e485bf730"><code>3e485bf</code></a>
docs(username): fix displayUsername release notes (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10776">#10776</a>)</li>
<li><a
href="65fc17c755"><code>65fc17c</code></a>
fix(deps): align <code>drizzle-orm</code> peer range with
drizzle-adapter (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10501">#10501</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/better-auth/better-auth/commits/v1.7.0/packages/better-auth">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
github-actions[bot]
dependabot[bot]