chore(deps)(deps): bump the minor-and-patch group with 21 updates by dependabot[bot] · Pull Request #75 · archmaxai/archmax

dependabot · 2026-06-29T04:23:13Z

Bumps the minor-and-patch group with 21 updates:

Package	From	To
turbo	`2.9.18`	`2.10.0`
@hono/node-server	`2.0.5`	`2.0.6`
@langchain/core	`1.2.0`	`1.2.1`
@langchain/openai	`1.5.1`	`1.5.3`
better-auth	`1.6.20`	`1.6.22`
hono	`4.12.26`	`4.12.27`
mongodb	`7.3.0`	`7.4.0`
mongoose	`9.7.1`	`9.7.3`
@astrojs/starlight	`0.40.0`	`0.41.1`
starlight-image-zoom	`0.14.2`	`0.15.0`
@playwright/test	`1.61.0`	`1.61.1`
@tanstack/react-query	`5.101.0`	`5.101.2`
@xyflow/react	`12.11.0`	`12.11.1`
lucide-react	`1.21.0`	`1.22.0`
recharts	`3.8.1`	`3.9.0`
@vitejs/plugin-react	`6.0.2`	`6.0.3`
postcss	`8.5.15`	`8.5.16`
vite	`8.0.16`	`8.1.0`
bullmq	`5.79.1`	`5.79.2`
@langchain/anthropic	`1.5.0`	`1.5.1`
langchain	`1.5.0`	`1.5.2`

Updates turbo from 2.9.18 to 2.10.0

Release notes

Sourced from turbo's releases.

Turborepo v2.10.0

What's Changed

create-turbo

feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in vercel/turborepo#6747

chore: Update dependencies found in audits by @anthonyshew in vercel/turborepo#12586

@turbo/codemod

feat: Handle package manager catalogs in migration codemod by @anthonyshew in vercel/turborepo#12496

fix: Always update $schema URL to versioned format during migration by @anthonyshew in vercel/turborepo#12529

fix: Support turbo.jsonc in codemod transforms by @anthonyshew in vercel/turborepo#12532

fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in vercel/turborepo#12542

eslint

chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in vercel/turborepo#12604

@turbo/repository

feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in vercel/turborepo#12487

chore: Update to Rust 1.95.0 by @ognevny in vercel/turborepo#12636

@turbo/telemetry

fix: Suppress telemetry alert when running on Vercel by @anthonyshew in vercel/turborepo#12576

Examples

feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in vercel/turborepo#12414

build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in vercel/turborepo#12537

fix: Add missing @types/node to with-svelte example apps by @anthonyshew in vercel/turborepo#12585

feat(sandbox): Bump @vercel/sandbox from v1 to beta by @marc-vercel in vercel/turborepo#12595

chore: Update examples to Turbo 2.9.6 by @cursor[bot] in vercel/turborepo#12600

examples: Add Ultracite example by @haydenbleasel in vercel/turborepo#12615

Changelog

docs: Release post for 2.9 by @anthonyshew in vercel/turborepo#12441

docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in vercel/turborepo#12500

fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in vercel/turborepo#12506

Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in vercel/turborepo#12507

fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in vercel/turborepo#12509

fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in vercel/turborepo#12503

docs: Document turbo.* generator variables by @anthonyshew in vercel/turborepo#12511

fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in vercel/turborepo#12514

fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in vercel/turborepo#12516

fix: Update AI-generated response disclaimer to include human attribution by @anthonyshew with @Copilot in vercel/turborepo#12517

fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in vercel/turborepo#12520

fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in vercel/turborepo#12519

feat: Add incremental task caching by @anthonyshew in vercel/turborepo#12531

docs: Send siteId as label on feedback GitHub issues by @molebox in vercel/turborepo#12527

Replace local ai-agent-detection with @vercel/agent-readability by @molebox in vercel/turborepo#12528

fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in vercel/turborepo#12535

fix: Only enforce signature key length for keys that exist by @anthonyshew in vercel/turborepo#12538

fix: Validate engine concurrency after task-level filtering by @anthonyshew in vercel/turborepo#12540

feat: Allow --affected and --filter to be combined by @anthonyshew in vercel/turborepo#12543

fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in vercel/turborepo#12513

fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in vercel/turborepo#12545

fix: Bun workspace lockfile pruning producing invalid output by @JRoy in vercel/turborepo#12548

fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in vercel/turborepo#12557

... (truncated)

Commits

12fb0d9 publish 2.10.0 to registry
a12323b release(turborepo): 2.9.19-canary.10 (#13130)
65175fe fix: Hash selected dependency outputs instead of tasks (#13129)
5ba8917 fix: Improve watch graceful shutdown (#13128)
75ee2cc chore: Update to Rust 1.96.0 (#12974)
6dccf5a fix: Restart deferred hash consumers in watch (#13127)
4ebb50f feat: Add deferred hashing for task inputs (#13125)
517e1a5 docs: Fix stderr debugging guidance (#13122)
0220b35 fix: Respect task inputs when stopping interruptible persistent tasks in watc...
6988692 fix: Add ComSpec and PATHEXT to default Windows env passthrough (#13114)
Additional commits viewable in compare view

Updates @hono/node-server from 2.0.5 to 2.0.6

Release notes

Sourced from @hono/node-server's releases.

v2.0.6

What's Changed

ci: publish to npm from CI with OIDC trusted publishing and bump np by @yusukebe in honojs/node-server#361

ci: use npm Staged publishing by @yusukebe in honojs/node-server#364

fix: preserve status and statusText when cloning a Response with liveheaders by @usualoma in honojs/node-server#363

Full Changelog: honojs/node-server@v2.0.5...v2.0.6

Commits

ff75c61 2.0.6
814720f fix: preserve status and statusText when cloning a Response with live headers...
a76209a ci: use npm Staged publishing (#364)
44c365a ci: publish to npm from CI with OIDC trusted publishing and bump np (#361)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates @langchain/core from 1.2.0 to 1.2.1

Release notes

Sourced from @langchain/core's releases.

@langchain/core@1.2.1

Patch Changes

#10674 f017708 Thanks @christian-bromann! - fix: classify provider 429s before retrying

#11092 7918bbd Thanks @aolsenjazz! - fix(core): only treat arrays of content blocks as ToolMessage content

Fix tool outputs that are arrays of plain objects being forwarded as malformed message content. An array is now only treated as message content blocks when every element is an object with a type; otherwise it is JSON-stringified.

Commits

1ee0df0 chore: version packages (#11097)
f017708 fix(core): better 429 error handling (#10674)
05936ab fix(openai): omit empty reasoning item id in Responses API input (#11045)
798cb70 fix(openai): route standard url file blocks to native input_file in Responses...
80c790b fix(openai): stream built-in tool progress events (#11090)
d2e6afc fix(groq): require @langchain/core >= 1.1.30 in peer dependency (#11072)
c66870e feat(weaviate): add X-Weaviate-Client-Integration telemetry header (#11088)
baa57ba fix(anthropic): omit default disabled thinking from requests (#11073)
04edb8d docs(ibm): fix "Recieved" typo in tool_choice error message (#11066)
2b7f368 chore(deps): bump uuid from 14.0.0 to 14.0.1 (#11094)
Additional commits viewable in compare view

Updates @langchain/openai from 1.5.1 to 1.5.3

Release notes

Sourced from @langchain/openai's releases.

@langchain/openai@1.5.3

Patch Changes

#11100 3205b35 Thanks @colifran! - fix(langchain, openai): decouple strict tools from strict structured output response

@langchain/openai@1.5.2

Patch Changes

#11045 05936ab Thanks @jackjin1997! - fix(openai): omit empty id and content on reasoning items in Responses API input

Reasoning blocks reassembled from streaming chunks (e.g. via streamEvents) never carry an id, since OpenAI's streaming protocol only includes it in non-streaming responses. When such a message was replayed as Responses API input on the next turn, the reasoning item was emitted with id: "", which OpenAI rejects with 400 Invalid 'input[n].id': ''. The id field is now omitted when absent.

A second error surfaced immediately after that fix: the same converter set a populated content array on the reasoning input item, which the Responses API also rejects (400 Invalid 'input[n].content': array too long. Expected an array with maximum length 0). Reasoning input items only carry summary, so content is no longer forwarded. Thanks to @csrujanreddy for catching the second issue and verifying both fixes against the live API.

#11065 798cb70 Thanks @rxits! - fix(openai): route standard url file blocks to native input_file in Responses API

#11090 80c790b Thanks @nikhilpakhloo! - fix(openai): stream built-in tool progress events

Commits

f1d64ff chore: version packages (#11101)
72ffc4b fix(aws): add Bedrock stream idle timeout (#11098)
3205b35 fix(langchain, openai): decouple strict tools from strict structured output r...
1ee0df0 chore: version packages (#11097)
f017708 fix(core): better 429 error handling (#10674)
05936ab fix(openai): omit empty reasoning item id in Responses API input (#11045)
798cb70 fix(openai): route standard url file blocks to native input_file in Responses...
80c790b fix(openai): stream built-in tool progress events (#11090)
d2e6afc fix(groq): require @langchain/core >= 1.1.30 in peer dependency (#11072)
c66870e feat(weaviate): add X-Weaviate-Client-Integration telemetry header (#11088)
Additional commits viewable in compare view

Updates better-auth from 1.6.20 to 1.6.22

Release notes

Sourced from better-auth's releases.

v1.6.22

better-auth

Bug Fixes

Fixed unproven credentials not being revoked during magic link and email OTP sign-in (#10239)

Fixed server-side OAuth requests to refuse redirect responses instead of following them (#10241)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

Fixed SCIM write-path operations to be properly scoped and to correctly honor the active attribute (#10242)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

Added account-level verification lockout for two-factor authentication (#10240)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@gustavovalverde

Full changelog: v1.6.21...v1.6.22

v1.6.21

better-auth

Bug Fixes

Fixed rate limits to be enforced before plugin request handlers run (#10191)

Fixed admin permission changes and bans to take effect immediately, even when session cookie cache is enabled (#10187)

Fixed deviceAuthorization() throwing a ZodError when called without a schema option under Zod v4 (#9939)

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.22

Patch Changes

#10239 c06a56d Thanks @gustavovalverde! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.

If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.

#10240 3a035e9 Thanks @gustavovalverde! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.

Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return 429 with the ACCOUNT_TEMPORARILY_LOCKED error code. Configure it with twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } }).

Run a database migration after upgrading: this adds failedVerificationCount and lockedUntil columns to the twoFactor table.

Updated dependencies [8bd43d9]:

@better-auth/core@1.6.22

@better-auth/drizzle-adapter@1.6.22

@better-auth/kysely-adapter@1.6.22

@better-auth/memory-adapter@1.6.22

@better-auth/mongo-adapter@1.6.22

@better-auth/prisma-adapter@1.6.22

@better-auth/telemetry@1.6.22

1.6.21

Patch Changes

#10212 e0762a1 Thanks @bytaesu! - In root-mounted deployments, requests whose path does not start with the configured basePath now return 404 instead of resolving to an endpoint.

#10187 882cf9e Thanks @ping-maxwell! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.

#9939 f52e1ab Thanks @benpsnyder! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option

#10196 b5bec19 Thanks @Paola3stefania! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked input: false. Input-allowed additional fields still persist from mapProfileToUser, and schema defaults still apply when OAuth creates a user. Apps that used mapProfileToUser to fill input: false fields should set those fields in server-side provisioning code instead.

#10197 816d7f9 Thanks @Paola3stefania! - Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim.

Google One Tap now applies the configured Google hosted-domain restriction before creating a session.

#10192 239bcc8 Thanks @bytaesu! - Validate PayPal user info against the verified ID token subject during social sign-in.

#10228 1bc370a Thanks @gustavovalverde! - The SIWE plugin no longer binds a provided email that already belongs to another account. With anonymous set to false, /siwe/verify previously created the new account using that email even when it was already in use; it now keeps the wallet-derived address in that case, so one email cannot be attached to two accounts.

#10198 570267c Thanks @rachit367! - Honor disableMigration on plugin schema tables. Tables flagged with disableMigration: true are now skipped by better-auth generate (Drizzle and Prisma output) and by the runtime migrator, instead of being emitted and created anyway. The flag was previously dropped while assembling the table list, so it had no effect.

#10182 461ca6f Thanks @bytaesu! - Only store display username fallbacks as usernames when they pass username validation during email sign-up.

#10183 88409b0 Thanks @bytaesu! - Require OAuth proxy profile callbacks to match an issued OAuth state before creating sessions.

#10203 5953157 Thanks @bytaesu! - Rate limiting no longer trusts multi-hop X-Forwarded-For chains, preventing a client behind an appending proxy from spoofing the leftmost hop to bypass the per-IP rate limit. Single-value IP headers continue to work. To key the real client behind a proxy chain, set advanced.ipAddress.trustedProxies to your reverse-proxy IPs or CIDR ranges (the chain is walked right to left, skipping trusted hops), or point advanced.ipAddress.ipAddressHeaders at a single trusted client-IP header.

... (truncated)

Commits

a90d061 chore: release v1.6.22 (#10245)
3a035e9 fix(two-factor): add account-level verification lockout (#10240)
c06a56d fix: revoke unproven credentials on magic-link/email-OTP sign-in (#10239)
414169d chore: release v1.6.21 (#10184)
f52e1ab fix(device-authorization): make schema option optional under Zod v4 (#9939)
882cf9e fix(admin): use authoritative session reads for authorization (#10187)
b5bec19 fix(oauth): apply user input rules to provider profiles (#10196)
471f81c refactor: centralize request IP resolver in core (#10216)
816d7f9 fix(one-tap): apply configured Google hosted domain (hd) on the callback (#10...
1bc370a fix(siwe): reject sign-in when the provided email already belongs to another ...
Additional commits viewable in compare view

Updates hono from 4.12.26 to 4.12.27

Release notes

Sourced from hono's releases.

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

Commits

97c6fe1 4.12.27
aa92177 Merge commit from fork
cd3f6f7 Merge commit from fork
d4853a8 fix(jsx): make merged context-isolation tests pass tsc type check (#5037)
6735fea fix(jsx): cast awaitedFallback through unknown to fix Deno type check (#5036)
fab3b13 Merge commit from fork
9f0dadf ci: use npm Staged publishing (#5035)
See full diff in compare view

Updates mongodb from 7.3.0 to 7.4.0

Release notes

Sourced from mongodb's releases.

v7.4.0

7.4.0 (2026-06-25)

The MongoDB Node.js team is pleased to announce version 7.4.0 of the mongodb package!

Release Notes

Explicit resource management is now stable

The Symbol.asyncDispose methods on MongoClient, ClientSession, ChangeStream, and cursors enable await using for automatic cleanup. These methods were introduced as experimental in v6.9.0. Since then, TC39 Explicit Resource Management proposal reached Stage 4 in 2025, and Node.js enabled explicit resource management as a stable feature in Node.js 24, so the experimental flags have been removed from our APIs and the APIs are now officially supported.

afterClusterTime now sent on writes in causally-consistent sessions

When a session has causal consistency enabled, write operations now include readConcern.afterClusterTime, matching the existing read behavior. This maintains the "read your own writes" guarantee across primary failovers in shareded clusters. There are no API changes.

Features

NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)

NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

Documentation

Reference

API

Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Changelog

Sourced from mongodb's changelog.

7.4.0 (2026-06-25)

Features

NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)

NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

Commits

1c4333e chore(main): release 7.4.0 (#4974)
43ce3eb feat(NODE-7634): remove experimental tag from async dispose methods (#4976)
3abfd26 fix(NODE-7549): send afterClusterTime on writes in causally-consistent sessio...
88ec159 chore(NODE-7418): skip csot tests on latest (#4969)
1f5ac37 chore(NODE-7473): upgrade to chai 5 (#4958)
b17288c chore: skip csfle tests and fix related broken tests (#4965)
5b401aa test(NODE-7493): enable source maps and add nyc-free debug scripts (#4947)
3ba2dd2 docs: clarify release notes verification steps (#4960)
0a434d3 docs: add 7.3 docs (#4959)
See full diff in compare view

Updates mongoose from 9.7.1 to 9.7.3

Release notes

Sourced from mongoose's releases.

9.7.3 / 2026-06-26

types(model): correct Model.validate() return type to Promise #16340 #16338

types: use @standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez

fix(document): avoid accessing special properties in Document.prototype.get()

fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties

docs: update homepage sponsor layout

Changelog

Sourced from mongoose's changelog.

9.7.3 / 2026-06-26

types(model): correct Model.validate() return type to Promise #16340 #16338

types: use @standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez

fix(document): avoid accessing special properties in Document.prototype.get()

fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties

docs: update homepage sponsor layout

Commits

df72bff chore: release 9.7.3
97f0f36 Merge pull request #16341 from Automattic/vkarpov15/gh-16339
aa58b76 types: use @standard-schema/spec for StandardSchema types rather than inlining
0734de7 fix(types): correct Model.validate() return type to Promise<TRawDocType> (#16...
87ade9b chore: release 9.7.2
4e12786 Merge branch 'vkarpov15/fix-security-20260609-master'
b3dd12a docs: flex wrap for major sponsors
d48fee3 fix(documentarray): reindex subdocs after reordering (#16282)
3e0e079 fix(types): correct Model.validate() return type to Promise<TRawDocType>
03bedea docs: add mongodb as sponsor on homepage
Additional commits viewable in compare view

Updates @astrojs/starlight from 0.40.0 to 0.41.1

Release notes

Sourced from @astrojs/starlight's releases.

@astrojs/starlight@0.41.1

Patch Changes

#3967 72e63dc Thanks @HiDeoo! - Adds 2 new icons: link and link-alt.

#3988 ac55cfa Thanks @delucis! - Fixes a dependency resolution issue introduced in Starlight v0.41

#3967 72e63dc Thanks @HiDeoo! - Optimizes the icons of Markdown asides.

@astrojs/starlight@0.41.0

Minor Changes
#3951 1202dd4 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

Upgrade Astro and dependencies

⚠️ BREAKING CHANGE: Astro v6 is no longer supported. Make sure you update Astro and any other official integrations at the same time as updating Starlight:
npx @astrojs/upgrade
Community Starlight plugins and Astro integrations may also need to be manually updated to work with Astro v7. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 111 (released 07 March 2023) and Safari-based browsers prior to version 16.4 (released 27 March 2023). You can find a list of currently supported browsers and their versions using this browserslist query.
Patch Changes

#3953 a935d33 Thanks @HiDeoo! - Fixes Starlight Markdown processing being potentially applied to files that should not be processed.

Changelog

Sourced from @astrojs/starlight's changelog.

0.41.1

Patch Changes

#3967 72e63dc Thanks @HiDeoo! - Adds 2 new icons: link and link-alt.

#3988 ac55cfa Thanks @delucis! - Fixes a dependency resolution issue introduced in Starlight v0.41

#3967 72e63dc Thanks @HiDeoo! - Optimizes the icons of Markdown asides.

0.41.0

Minor Changes
#3951 1202dd4 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

Upgrade Astro and dependencies

⚠️ BREAKING CHANGE: Astro v6 is no longer supported. Make sure you update Astro and any other official integrations at the same time as updating Starlight:
npx @astrojs/upgrade
Community Starlight plugins and Astro integrations may also need to be manually updated to work with Astro v7. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 111 (released 07 March 2023) and Safari-based browsers prior to version 16.4 (released 27 March 2023). You can find a list of currently supported browsers and their versions using this browserslist query.
Patch Changes

#3953 a935d33 Thanks @HiDeoo! - Fixes Starlight Markdown processing being potentially applied to files that should not be processed.

Commits

c1a3d6d [ci] release (#3989)
72e63dc Add link icons and dedupe Markdown/component icons (#3967)
ac55cfa Update astro-expressive-code (#3988)
Cursor Bugbot for commit c78b1c3. Bugbot is set up for automated code reviews on this repo. Configure here.

Bumps the minor-and-patch group with 21 updates: | Package | From | To | | --- | --- | --- | | [turbo](https://github.com/vercel/turborepo) | `2.9.18` | `2.10.0` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.5` | `2.0.6` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.0` | `1.2.1` | | [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.1` | `1.5.3` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.20` | `1.6.22` | | [hono](https://github.com/honojs/hono) | `4.12.26` | `4.12.27` | | [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.3.0` | `7.4.0` | | [mongoose](https://github.com/Automattic/mongoose) | `9.7.1` | `9.7.3` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.40.0` | `0.41.1` | | [starlight-image-zoom](https://github.com/HiDeoo/starlight-image-zoom/tree/HEAD/packages/starlight-image-zoom) | `0.14.2` | `0.15.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.61.0` | `1.61.1` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.0` | `5.101.2` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.0` | `12.11.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.21.0` | `1.22.0` | | [recharts](https://github.com/recharts/recharts) | `3.8.1` | `3.9.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.0.3` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.16` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.1.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.79.1` | `5.79.2` | | [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) | `1.5.0` | `1.5.1` | | [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.0` | `1.5.2` | Updates `turbo` from 2.9.18 to 2.10.0 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.18...v2.10.0) Updates `@hono/node-server` from 2.0.5 to 2.0.6 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.5...v2.0.6) Updates `@langchain/core` from 1.2.0 to 1.2.1 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.0...@langchain/core@1.2.1) Updates `@langchain/openai` from 1.5.1 to 1.5.3 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.1...@langchain/openai@1.5.3) Updates `better-auth` from 1.6.20 to 1.6.22 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.22/packages/better-auth) Updates `hono` from 4.12.26 to 4.12.27 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.12.27) Updates `mongodb` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/mongodb/node-mongodb-native/releases) - [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md) - [Commits](mongodb/node-mongodb-native@v7.3.0...v7.4.0) Updates `mongoose` from 9.7.1 to 9.7.3 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.7.1...9.7.3) Updates `@astrojs/starlight` from 0.40.0 to 0.41.1 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.1/packages/starlight) Updates `starlight-image-zoom` from 0.14.2 to 0.15.0 - [Release notes](https://github.com/HiDeoo/starlight-image-zoom/releases) - [Changelog](https://github.com/HiDeoo/starlight-image-zoom/blob/main/packages/starlight-image-zoom/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-image-zoom/commits/starlight-image-zoom@0.15.0/packages/starlight-image-zoom) Updates `@playwright/test` from 1.61.0 to 1.61.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.0...v1.61.1) Updates `@tanstack/react-query` from 5.101.0 to 5.101.2 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.2/packages/react-query) Updates `@xyflow/react` from 12.11.0 to 12.11.1 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.1/packages/react) Updates `lucide-react` from 1.21.0 to 1.22.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.22.0/packages/lucide-react) Updates `recharts` from 3.8.1 to 3.9.0 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](recharts/recharts@v3.8.1...v3.9.0) Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react) Updates `postcss` from 8.5.15 to 8.5.16 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.16) Updates `vite` from 8.0.16 to 8.1.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.1.0/packages/vite) Updates `bullmq` from 5.79.1 to 5.79.2 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.79.1...v5.79.2) Updates `@langchain/anthropic` from 1.5.0 to 1.5.1 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/anthropic@1.5.0...@langchain/anthropic@1.5.1) Updates `langchain` from 1.5.0 to 1.5.2 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.0...langchain@1.5.2) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@hono/node-server" dependency-version: 2.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@langchain/core" dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@langchain/openai" dependency-version: 1.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: better-auth dependency-version: 1.6.22 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.12.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: mongodb dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mongoose dependency-version: 9.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@astrojs/starlight" dependency-version: 0.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: starlight-image-zoom dependency-version: 0.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@playwright/test" dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.101.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@xyflow/react" dependency-version: 12.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: recharts dependency-version: 3.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vite dependency-version: 8.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: bullmq dependency-version: 5.79.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@langchain/anthropic" dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: langchain dependency-version: 1.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-29T04:23:14Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c78b1c3. Configure here.}

cursor · 2026-06-29T04:24:05Z

  },
  "dependencies": {
-    "@astrojs/starlight": "^0.40.0",
+    "@astrojs/starlight": "^0.41.1",


Starlight 0.41 with Astro 6

Medium Severity

This commit bumps @astrojs/starlight to ^0.41.1 and starlight-image-zoom to ^0.15.0 but leaves astro at ^6.4.8. Starlight 0.41 drops Astro 6 and declares a peer on Astro ^7.0.2, so the docs app’s dependency set is internally inconsistent and @archmax/docs build or dev may fail after install.

^{Reviewed by Cursor Bugbot for commit c78b1c3. Configure here.}

cursor

No security findings in the changed files.

Reviewed PR #75 against the requested threat surfaces:

MCP endpoint auth: no MCP route or handler code changed.
Query execution sandboxing: no execute_query/DuckDB code changed.
Admin auth (Better Auth): only better-auth version bumps; no session, CSRF, or cookie configuration changed.
API input validation: no Hono route handler code changed.
Environment secrets: no env files or source constants with secrets changed.
Dependency exposure: the PR only bumps existing dependencies. pnpm audit --prod reports 15 advisories on the PR head, but the same advisories and severity counts are present on the base commit, so this PR does not introduce a new known-vulnerability finding.

_{Sent by Cursor Automation: archmax Security Review}

dependabot · 2026-07-06T04:25:43Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

cursor Bot reviewed Jun 29, 2026

View reviewed changes

dependabot Bot closed this Jul 6, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-f7b2f73a7d branch July 6, 2026 04:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)(deps): bump the minor-and-patch group with 21 updates#75

chore(deps)(deps): bump the minor-and-patch group with 21 updates#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-f7b2f73a7d

dependabot Bot commented on behalf of github Jun 29, 2026 •

edited

Loading

Upgrade Astro and dependencies

Upgrade Astro and dependencies

Uh oh!

dependabot Bot commented on behalf of github Jun 29, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 29, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

dependabot Bot commented on behalf of github Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Turborepo v2.10.0

What's Changed

create-turbo

@​turbo/codemod

eslint

@​turbo/repository

@​turbo/telemetry

Examples

Changelog

v2.0.6

What's Changed

@​langchain/core@​1.2.1

Patch Changes

@​langchain/openai@​1.5.3

Patch Changes

@​langchain/openai@​1.5.2

Patch Changes

v1.6.22

better-auth

Bug Fixes

@better-auth/scim

Bug Fixes

@better-auth/stripe

Bug Fixes

auth

Bug Fixes

Contributors

v1.6.21

better-auth

Bug Fixes

1.6.22

Patch Changes

1.6.21

Patch Changes

v4.12.27

Security fixes

hono/jsx does not isolate context per request

Server-Side XSS via JSX escaping bypass in cx()

API Gateway v1 adapter can drop a repeated request header value

v7.4.0

7.4.0 (2026-06-25)

Release Notes

Explicit resource management is now stable

afterClusterTime now sent on writes in causally-consistent sessions

Features

Documentation

7.4.0 (2026-06-25)

Features

9.7.3 / 2026-06-26

9.7.2 / 2026-06-22

9.7.3 / 2026-06-26

9.7.2 / 2026-06-22

@​astrojs/starlight@​0.41.1

Patch Changes

@​astrojs/starlight@​0.41.0

Minor Changes

Upgrade Astro and dependencies

Patch Changes

0.41.1

Patch Changes

0.41.0

Minor Changes

Upgrade Astro and dependencies

Patch Changes

Uh oh!

dependabot Bot commented on behalf of github Jun 29, 2026

Labels

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 29, 2026

Choose a reason for hiding this comment

Starlight 0.41 with Astro 6

Uh oh!

cursor Bot left a comment

dependabot Bot commented on behalf of github Jun 29, 2026 •

edited

Loading

`@turbo/codemod`

`@turbo/repository`

`@turbo/telemetry`

`@langchain/core@1`.2.1

`@langchain/openai@1`.5.3

`@langchain/openai@1`.5.2

`better-auth`

`@better-auth/scim`

`@better-auth/stripe`

`auth`

`better-auth`

`@astrojs/starlight@0`.41.1

`@astrojs/starlight@0`.41.0