[dependabot]

Bumps the npm-minor-patch group with 46 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.11	2.6.2
fallow	3.21.0	3.35.0
rolldown	1.1.5	1.2.15
turbo	2.10.12	2.11.10
@better-auth/redis-storage	1.7.2	1.7.12
@vercel/blob	2.8.0	2.8.2
@vercel/queue	0.5.1	0.10.0
ai	7.0.84	7.0.152
better-auth	1.7.2	1.7.12
drizzle-orm	0.45.2	0.45.4
zod	4.5.4	4.6.7
@types/node	26.4.0	26.6.5
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.5	19.3.0
shadcn	4.19.1	4.22.1
@tailwindcss/postcss	4.3.1	4.3.3
@testing-library/user-event	14.6.6	14.6.8
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.5	19.3.0
jsdom	30.0.1	30.1.3
tailwindcss	4.3.1	4.3.3
@flags-sdk/vercel	1.4.7	1.5.2
@streamdown/cjk	1.0.3	1.0.4
@streamdown/math	1.0.2	1.0.3
@streamdown/mermaid	1.0.2	1.0.3
@tanstack/react-table	9.2.4	9.3.1
@tiptap/core	3.31.0	3.32.0
@tiptap/pm	3.31.0	3.32.0
@tiptap/react	3.31.0	3.32.0
@tiptap/starter-kit	3.31.0	3.32.0
@vercel/functions	3.7.4	3.10.3
better-call	1.4.0	1.4.4
flags	4.3.0	4.3.1
nanoid	6.0.1	6.0.2
radix-ui	1.6.0	1.8.1
react-day-picker	10.0.1	10.0.2
react-email	6.9.3	6.11.3
resend	6.25.0	6.34.1
streamdown	2.6.0	2.7.1
@next/playwright	16.3.3	16.4.3
@playwright/test	1.62.1	1.64.1
@testing-library/dom	10.4.1	10.4.2
playwright	1.62.1	1.64.1
tsx	4.23.13	4.23.15
drizzle-kit	0.31.10	0.31.11
tailwind-merge	3.6.0	3.7.0

Updates @biomejs/biome from 2.5.11 to 2.6.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.2

2.6.2

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },
      { "path": "local-plugin.grit" }
    ]
  }

  Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

• #11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

  Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.6.2

Patch Changes

• #12494 3f40430 Thanks @​ematipico! - Fix another patch

2.6.1

Patch Changes

• #12492 edaa1db Thanks @​ematipico! - Fixes a problem with npm publishing

2.6.0

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },

... (truncated)

Commits

• 0d9aef6 ci: release (#12495)
• 30ffad1 ci: release (#12493)
• 8c814e1 ci: release (#12065)
• e51cec2 chore: update sponsors (#12428)
• cb88f07 feat(lint): add noSvelteClassDirective (#12254)
• 774b5b5 feat: sorted GraphQL documents (#12318)
• 914dca7 feat(lint/js): add noUselessCall (#12082)
• a3fa0d6 feat(graphql_analyze): implement useSortedArguments (#12282)
• 5f8ea6c feat(lint): add noVueLifecycleAfterAwait (#12229)
• b92638b feat(lint): add noVueShadowNativeEvents (#12136)
• Additional commits viewable in compare view

Updates fallow from 3.21.0 to 3.35.0

Release notes

Sourced from fallow's releases.

v3.35.0: worsened complexity in audit, Vite+ and Egg.js plugins, mutation progress

Features

• fallow audit reports inherited complexity findings that got worse. A complexity finding from the base snapshot is now worsened when its cyclomatic, cognitive, CRAP or line count value is higher than at the base. CRAP counts only when both sides have a score. The line count must grow by at least 5 lines, so a short comment or a formatter rewrap keeps a finding inherited. A function that grows from 80 to 300 lines with the same complexity values is now worsened. The JSON output adds attribution to each complexity finding, worsened_metrics to each finding with a grown value, and attribution.worsened and attribution.complexity_worsened. The human, compact and markdown output add a "Worse than base" section. SARIF and CodeClimate show the values, and the GitHub summary marks each finding as worsened. The --worsened flag and the audit.worsened config key select the effect: warn (default, exit code 0), error (counts like an introduced finding) or off (only growth of an exceeded metric is worsened). The GitHub Action has a worsened input, the GitLab template has FALLOW_AUDIT_WORSENED, and the MCP audit tool has a worsened parameter.

• The VS Code extension has a fallow.audit.worsened setting. The values are warn, error and off, the same as fallow audit --worsened. The default auto uses audit.worsened from the project config. The extension sends the flag only to a CLI that supports it. With an older CLI, the audit runs without the flag and the output channel shows a note.

• A human fallow mutation run shows phase progress on stderr. The lines name the runner setup, the baseline run and the mutant runs with done and total counts. They also name the retries, the final worktree check and the report. A long phase prints a line at a fixed interval, also in non-TTY output, so a slow run does not look stalled. --quiet and --format json print no progress lines, and stdout does not change. The programmatic API has run_mutation_with_progress with MutationProgress events. (#3599)

• fallow mutation --runner-config <path> selects the Vitest config of a run. A project that keeps its integration, UI or browser tests in a separate Vitest config can now run mutants against those tests. The mutation.runnerConfig config key sets the same file, and the flag wins. The file must exist inside the project root, and only the Vitest runner accepts it. A static test file that the selected config does not include stays visible as a test-files-not-discovered error. --config still selects the Fallow config. (#3598)

• Mutation JSON shows the edit of each mutant and the history of each retry. Each mutant in the mutation report and the mutation-plan document has a change object, for example {"from": "??", "to": "&&"}. The values come from a fixed vocabulary of operator tokens, literals and placeholders, so the report still holds no source text (#3658). A retried mutant has a new attempts array with the status, the duration and the killing test, failure kind or runtime-error reason of each run. You can now see if a flaky result was timeout -> survived or survived -> killed (#3656).

• fallow mutation mutates fluent chains in module-level const initializers. The new removed-chain-link operator removes one call link of a chain. For example, z.number().int().positive() gives a mutant without .int() and a mutant without .positive(). A validation schema with no literal or operator now has mutants. The operator is on by default, and --operators and mutation.operators accept its name. (#3662)

• Fallow reads Vite+ projects. A vite-plus dependency, or a root vite.config.* that imports vite-plus, enables the new vite-plus plugin. The pack.entry values are entry points, and the lint.jsPlugins, lint.overrides[].jsPlugins and lint.extends packages count as used. The vite-plus dependency also enables the Vitest plugin. The vp, vpr and vpx binaries credit vite-plus. Fallow reads vp test -c <file>, vp exec <binary> and vp run <task>. It also reads the commands of the staged and run.tasks blocks and the .vite-hooks/ scripts. The file targets of vp lint and vp fmt are not entry points. A vi.mock call through vite-plus/test counts as a Vitest mock.

• Fallow detects Egg.js and tegg projects. The new egg plugin activates on egg, @eggjs/core or @eggjs/tegg, or on an egg, eggPlugin or eggModule key in package.json. Entry points are the files that the Egg loader loads by convention: app.js, agent.js, the router, controllers, services, middleware, extensions, schedules and config files, also in nested example and test fixture apps. Every file of a tegg module is an entry point. The plugin credits the packages that config/plugin.* names, the egg.framework package and the default egg framework to the package.json that owns the app.

• Fallow reads the entry files of a JavaScript GitHub Action. When action.yml or action.yaml sets runs.using to a node runtime, the runs.pre, runs.main and runs.post files are entry points. A path in dist/ maps to its source file, with the same rules as a package.json main field. A composite or Docker action adds no entry points.

• A dead-code baseline records if node_modules existed. A --save-baseline run writes analysis_identity.node_modules as present or missing. A later run in the other install state adds a baseline-install-state-mismatch entry to workspace_diagnostics and prints a warning, also under --quiet. Findings that need installed packages can differ between the two states, so such a run can report baseline findings as new.

• External plugins can opt a config pattern out of the default export credit. List the pattern in configDefaultExportOptOut when the tool reads named exports, or when the pattern also matches ordinary source files.

• Fallow reports a missing workspace directory and analyzes nested pnpm projects. A positive workspace pattern whose directory does not exist now gets the workspace-pattern-dir-missing diagnostic, with degrades_analysis: true. While such a pattern exists, the run does not report unused-catalog-entries for any catalog, because the missing packages can use catalog entries. This also applies to a pattern for a directory that does not exist yet, such as packages/* in a template. A directory that exists but holds no package does not turn off the check. Create the directory before the run or remove the pattern to get the check back. A directory with its own package.json and pnpm-workspace.yaml that no root pattern declares is an independent pnpm project. Fallow analyzes it as a workspace and reports the information-only nested-project-root diagnostic. (#3710)

• Each release publishes a CycloneDX SBOM for every target. The files are named fallow-<target>.cdx.json. .vex/openvex.json states why fallow is not affected by each advisory that the repository ignores. SECURITY.md lists the supported versions and the code scanning policy.

Changed

• fallow audit --gate new-only reports growth of an already exceeded complexity metric as worsened. Before, such a finding was introduced. A function that exceeded a threshold on the base and grows a little in the PR no longer fails the audit by default. With the default audit.worsened: warn, the verdict is warn and the exit code is 0. The finding stays introduced when the growth moves it to a higher severity tier. It also stays introduced when it now exceeds a metric that it did not exceed on the base, and that metric grew. The exceeded flags and the tier come from the base run. A threshold override in the same PR does not make an old finding introduced.

• fallow audit --gate new-only no longer fails on a CRAP score from estimated coverage alone. Without a coverage map, fallow estimates CRAP from static test reachability, and this estimate does not measure the change. A finding that exceeds only the CRAP threshold with estimated coverage now has effective_severity: warn and SARIF level warning. A finding that also exceeds the cyclomatic or cognitive threshold still gates. CRAP from measured coverage still gates, and --gate all does not change.

• fallow audit no longer fails on a complexity finding in a test file. A long it(...) or describe(...) callback often exceeds the cognitive threshold. Such a finding now has effective_severity: warn and the new field gate_exemption: "test-file", with a verdict of at least warn and exit code 0. This applies to --gate new-only and --gate all. The human, markdown and compact views list these findings under "Test files, not gated". fallow health does not change. (#3753)

• The GitHub Action requests the branded token only when it posts. The token step now runs only on a pull_request event with comment: true or review-comments: true. The branded-token input now defaults to auto. auto posts as the Fallow app when the workflow grants id-token: write. Without that permission, it falls back to github-token without a log line. An explicit branded-token: true keeps one short fallback line, and false behaves as before. (#3755)

• --type-aware class-member refinement is faster on large projects. The symbol-use scan now checks the name first and keeps one alias answer for each symbol. On a large TypeScript project, the scan takes 4 to 12 s instead of 35 to 70 s, with the same decisions. The scan now also sends only the names that a query can reach to the checker for TypeScript files. JavaScript files keep the full scan, because require bindings also create aliases. (#3765)

• fallow mutation with Vitest isolate: false no longer repeats the setup of unrelated test files. Each static mutant runs in a new runner process, and that process now dry-runs only the test files that cover the mutant. A covering test that fails its dry run is still a baseline failure. (#3650)

• The fallow skill shows the review loop that fallow checks. One short example runs fallow audit, reads the walkthrough guide, writes a judgment, and validates it with --walkthrough-file. The example saves the guide and the judgment in the temporary folder, because a new file in the project tree makes the judgment stale.

Bug fixes

• fallow mutation makes fewer equivalent mutants. No test can kill these mutants, so they no longer appear:
  • an empty-string or swapped-boolean case label with the same body as default, only when all labels are literals and both bodies exit unconditionally (#3639);
  • i != N for the test of a counted for loop with an integer let counter and no other write (#3649);

... (truncated)

Commits

• 1f5a08d chore: release v3.35.0
• 96c3b10 chore(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /editors/vscode i...
• e950d68 chore(deps-dev): bump follow-redirects (#3726)
• d2d3671 ci: skip the pull request title lint for bot pull requests (#3774)
• d6e6fb7 ci: check Dependabot merge list fields before a merge (#3773)
• d01e42c ci: keep Dependabot squash subjects within 100 characters (#3772)
• ab193e8 perf(type-aware): send only reachable identifiers to the checker (#3765)
• cb91b1e docs: name plugin_credits in the skill and the entry export credit for plugin...
• a0a15ce docs: note that config discovery probes ancestor directories (#3769)
• 6aa0d63 ci: drop sign-off trailers from Dependabot repair commits (#3768)
• Additional commits viewable in compare view

Updates rolldown from 1.1.5 to 1.2.15

Release notes

Sourced from rolldown's releases.

v1.2.15

[1.2.15] - 2026-10-21

🚀 Features

• rolldown_plugin_vite_resolve: add isBundled to pick the browser-external stub format (#11260) by @​h-a-n-a
• dev: mark entry modules in the HMR module graph (#11252) by @​h-a-n-a
• mark module starts with // <id> comments instead of #region pairs (#11235) by @​IWANABETHATGUY

🐛 Bug Fixes

• plugin: stop this.resolve recursion between plugins with skipSelf: true (#11181) by @​anzal1
• rolldown_plugin_vite_resolve: handle external require for ssr.target: 'webworker' (#11205) by @​sapphi-red
• rolldown_plugin_vite_build_import_analysis: only wrap dynamic imports with static specifiers in __vitePreload (#10879) by @​smeng9
• strict-execution-order: wrap eager modules that forward wrapped definers (#11186) by @​hyfdev
• chunk-import-map: keep common chunk keys unique when enabling inline common chunks (#11230) by @​hyfdev
• only register signal-exit handler when a trace subscriber is active (#11208) by @​DaniilIsupov

🧪 Testing

• fold hand-unrolled Rust test tables (#11212) by @​Brooooooklyn

⚙️ Miscellaneous Tasks

• deps: upgrade oxc to 0.155.0 (#11228) by @​Dunqing
• rollup-tests: retriage failed tests (#11251) by @​sapphi-red
• deps: update rollup submodule for tests to v4.64.12 (#11249) by @​rolldown-guard[bot]
• deps: update test262 submodule for tests (#11242) by @​rolldown-guard[bot]

❤️ New Contributors

• @​anzal1 made their first contribution in #11181
• @​smeng9 made their first contribution in #10879
• @​DaniilIsupov made their first contribution in #11208

Co-authored-by: shulaoda 165626830+shulaoda@users.noreply.github.com

v1.2.14

[1.2.14] - 2026-10-14

🚀 Features

• add output.charset option (#11194) by @​sapphi-red
• code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

• handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red
• tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev
• sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.15] - 2026-10-21

🚀 Features

• rolldown_plugin_vite_resolve: add isBundled to pick the browser-external stub format (#11260) by @​h-a-n-a
• dev: mark entry modules in the HMR module graph (#11252) by @​h-a-n-a
• mark module starts with // <id> comments instead of #region pairs (#11235) by @​IWANABETHATGUY

🐛 Bug Fixes

• plugin: stop this.resolve recursion between plugins with skipSelf: true (#11181) by @​anzal1
• rolldown_plugin_vite_resolve: handle external require for ssr.target: 'webworker' (#11205) by @​sapphi-red
• rolldown_plugin_vite_build_import_analysis: only wrap dynamic imports with static specifiers in __vitePreload (#10879) by @​smeng9
• strict-execution-order: wrap eager modules that forward wrapped definers (#11186) by @​hyfdev
• chunk-import-map: keep common chunk keys unique when enabling inline common chunks (#11230) by @​hyfdev
• only register signal-exit handler when a trace subscriber is active (#11208) by @​DaniilIsupov

🧪 Testing

• fold hand-unrolled Rust test tables (#11212) by @​Brooooooklyn

⚙️ Miscellaneous Tasks

• deps: upgrade oxc to 0.155.0 (#11228) by @​Dunqing
• rollup-tests: retriage failed tests (#11251) by @​sapphi-red
• deps: update rollup submodule for tests to v4.64.12 (#11249) by @​rolldown-guard[bot]
• deps: update test262 submodule for tests (#11242) by @​rolldown-guard[bot]

❤️ New Contributors

• @​anzal1 made their first contribution in #11181
• @​smeng9 made their first contribution in #10879
• @​DaniilIsupov made their first contribution in #11208

[1.2.14] - 2026-10-14

🚀 Features

• add output.charset option (#11194) by @​sapphi-red
• code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

• handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red
• tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev
• sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red
• strict-execution-order: account for init imports during code splitting (#11162) by @​hyfdev
• strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @​hyfdev
• tree-shake expression statements that coerce known constants (#10825) by @​IWANABETHATGUY

... (truncated)

Commits

• 89d821c release: v1.2.15 (#11261)
• 3b0841e feat(rolldown_plugin_vite_resolve): add isBundled to pick the browser-exter...
• a973d41 chore(deps): upgrade oxc to 0.155.0 (#11228)
• 5bfb74e feat(dev): mark entry modules in the HMR module graph (#11252)
• fb0a8db fix(rolldown_plugin_vite_resolve): handle external require for `ssr.target:...
• 547a5a7 fix(rolldown_plugin_vite_build_import_analysis): only wrap dynamic imports wi...
• 648591f feat: mark module starts with // \<id> comments instead of #region pairs (...
• 3f03741 fix(chunk-import-map): keep common chunk keys unique when enabling inline com...
• 33a987d fix: only register signal-exit handler when a trace subscriber is active (#11...
• c9a8cda release: v1.2.14 (#11210)
• Additional commits viewable in compare view

Updates turbo from 2.10.12 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

• fix: Allow non-recursive Turbo commands in root tasks by @​sahyl in vercel/turborepo#14814
• chore: Release Turborepo 2.11.9 by @​github-actions[bot] in vercel/turborepo#14824
• chore(deps): Update dependency @​vercel/geistdocs to v2 by @​vercel-gh-bot-4[bot] in vercel/turborepo#14417
• chore: Update with-gatsby example by @​vercel-gh-bot-3[bot] in vercel/turborepo#14796
• fix: Avoid pnpm batch-shim shutdown hangs on Windows by @​sahyl in vercel/turborepo#14819
• chore(deps): Update dependency @​vercel/geistdocs to v2.11.0 by @​vercel-gh-bot-3[bot] in vercel/turborepo#14832
• fix: Exclude tool-managed directories from local dependency inputs by @​PedroRosalba in vercel/turborepo#14696
• fix: Match git's text=auto binary detection in file hashing by @​PedroRosalba in vercel/turborepo#14697
• fix: Drop @​react-router/dev from Remix match list by @​Pcmhacker-piro in vercel/turborepo#14800
• fix: Match package configuration files and directory inputs in task-level affected detection by @​PedroRosalba in vercel/turborepo#14804
• fix: Parse pnpm 8 single-project lockfiles by @​PedroRosalba in vercel/turborepo#14806
• fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @​PedroRosalba in vercel/turborepo#14805
• docs: Generate the sitemap from Geistdocs sources by @​molebox in vercel/turborepo#14865
• fix: Restore cached symlinks when outputs are already on disk by @​PedroRosalba in vercel/turborepo#14807
• chore: Remove CODEOWNERS file by @​anthonyshew with @​Copilot in vercel/turborepo#14810
• feat: Enable WebMCP for Turborepo docs by @​anthonyshew in vercel/turborepo#14828
• fix: Exit quietly when turbo ls output is piped to a closed reader by @​drakeo338 in vercel/turborepo#14868
• fix: Distrust compromised eMudhra intermediate certificates by @​anthonyshew in vercel/turborepo#14876

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

• chore: Release Turborepo 2.11.8 by @​github-actions[bot] in vercel/turborepo#14789
• perf: Prefetch Cargo metadata during lazy graph construction by @​anthonyshew in vercel/turborepo#14497
• perf: Compute Berry lockfile closures once across workspaces by @​anthonyshew in vercel/turborepo#14499
• perf: Check cache hit outputs in place instead of on the blocking pool by @​anthonyshew in vercel/turborepo#14524
• perf: Speed up Berry lockfile loading by @​anthonyshew in vercel/turborepo#14500
• perf: Parse bun.lock without building a JSON syntax tree by @​anthonyshew in vercel/turborepo#14502
• perf: Skip the dry run cache batch window when there is no remote cache by @​anthonyshew in vercel/turborepo#14505
• perf: Emit lockfile closures pre-sorted and cheapen closure interning by @​anthonyshew in vercel/turborepo#14525
• perf: Reuse configuration derived from turbo.json between the shim and the CLI by @​anthonyshew in vercel/turborepo#14521
• feat: Report locked tools-only setup plans by @​anthonyshew in vercel/turborepo#14483
• perf: Compute Bun lockfile closures once across workspaces by @​anthonyshew in vercel/turborepo#14501
• perf: Reuse open parent directories when restoring cache archives by @​anthonyshew in vercel/turborepo#14506
• perf: Skip dropping the run right before turbo run exits by @​anthonyshew in vercel/turborepo#14507
• perf: Match literal input exclusions without compiling globs by @​anthonyshew in vercel/turborepo#14510
• perf: Copy pruned package files in parallel by @​anthonyshew in vercel/turborepo#14512
• feat: Report proposed first-lock and refresh setup plans by @​anthonyshew in vercel/turborepo#14571
• perf: Compress large cache archives with multithreaded zstd by @​anthonyshew in vercel/turborepo#14698
• perf: Read tracked file stats from directory listings on Windows by @​anthonyshew in vercel/turborepo#14633

... (truncated)

Commits

• e521641 publish 2.11.10 to registry
• aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
• 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
• af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
• b42cc68 chore: Remove CODEOWNERS file (#14810)
• 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
• 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
• 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
• 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
• d926d6a fix: Match package configuration files and directory inputs in task-level aff...
• Additional commits viewable in compare view

Updates @better-auth/redis-storage from 1.7.2 to 1.7.12

Release notes

Sourced from @​better-auth/redis-storage's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the is...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tendnote-web	Ready	Preview	Oct 27, 2026 1:03pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5fed76ba-1a66-4a71-ad10-5cf637939537

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}