chore(deps): bump the dependencies group with 6 updates by dependabot[bot] · Pull Request #128 · vantern-org/questbot

dependabot · 2026-08-09T11:35:50Z

Bumps the dependencies group with 6 updates:

Package	From	To
@biomejs/biome	`2.5.6`	`2.5.7`
countries-and-timezones	`3.9.0`	`3.10.0`
ipaddr.js	`2.4.0`	`2.5.0`
undici	`8.9.0`	`8.10.0`
tsx	`4.23.4`	`4.23.9`
better-auth	`1.6.25`	`1.6.26`

Updates @biomejs/biome from 2.5.6 to 2.5.7

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes
#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.7

Patch Changes
#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
The following code is also now invalid, because map(() => 42) returns 42:
type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

191d051 ci: release (#11119)
9847e68 feat(lint): add noNonScalableViewport rule (#11168)
e63354c feat(lint): add noExtendNative nursery rule (#11136)
2fa0a62 docs: rework CLI (#11134)
e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
See full diff in compare view

Updates countries-and-timezones from 3.9.0 to 3.10.0

Release notes

Sourced from countries-and-timezones's releases.

v3.10.0

Changed

Updated with 2026c IANA Time Zone Database.

Changelog

Sourced from countries-and-timezones's changelog.

[3.10.0] - 2026-08-02

Changed

Updated with 2026c IANA Time Zone Database.

Commits

7c60cc0 feat: update to 2026c IANA db
See full diff in compare view

Updates ipaddr.js from 2.4.0 to 2.5.0

Changelog

Sourced from ipaddr.js's changelog.

2.5.0 - 2026-08-04

remove ipaddr.min.js, end users must provide own minification/bundling

fix: compress the leftmost zero run in toString (RFC 5952, 4.2.3)

fix: strict IPv6 validation — reject :: with zero compression and hextets >4 hex digits

fix: reject non-numeric prefix length in subnetMaskFromPrefixLength

fix: compress trailing zero run in toString when a zoneIndex is present

fix: throw a descriptive error for malformed input in IPv6.parse

Commits

See full diff in compare view

Updates undici from 8.9.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

feat: namespace h2 options by @metcoder95 in nodejs/undici#5498

test: update WPT expectations by @mcollina in nodejs/undici#5587

test: add cache/dedupe + dns re-dispatch integration tests by @GiHoon1123 in nodejs/undici#5535

fix(websocket): support process.unref by @mcollina in nodejs/undici#5578

fix(h2): ensure every request settles by @mcollina in nodejs/undici#5603

fix(readable): consume a body whose end has already been emitted by @marko1olo in nodejs/undici#5617

fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @marko1olo in nodejs/undici#5610

fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by @marceli1404 in nodejs/undici#5606

fix(env-http-proxy-agent): match bare IPv6 addresses in no_proxy by @marko1olo in nodejs/undici#5623

test: handle aggregate balanced pool errors by @marko1olo in nodejs/undici#5377

fix(readable): keep body bytes that arrive after setEncoding() by @mcollina in nodejs/undici#5620

fix(socks5): evict unused origin pools by @Kkartik14 in nodejs/undici#5595

fix: skip deduplication for upgrade requests by @Ram-blip in nodejs/undici#5593

fix(retry): forward informational responses by @mcollina in nodejs/undici#5625

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by @marko1olo in nodejs/undici#5619

fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by @marko1olo in nodejs/undici#5628

build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in nodejs/undici#5633

build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by @dependabot[bot] in nodejs/undici#5634

build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in nodejs/undici#5636

fix(mock): emit request body lifecycle hooks by @marko1olo in nodejs/undici#5367

fix(h2): detach upgrade close handler after GOAWAY by @pacocartones in nodejs/undici#5641

fix: retry refused HTTP/2 streams by @mcollina in nodejs/undici#5598

fix: preserve DNS origin hostname on sockets by @cyphercodes in nodejs/undici#5577

New Contributors

@marceli1404 made their first contribution in nodejs/undici#5606

@Kkartik14 made their first contribution in nodejs/undici#5595

@pacocartones made their first contribution in nodejs/undici#5641

@cyphercodes made their first contribution in nodejs/undici#5577

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

Commits

c8d80e6 Bumped v8.10.0 (#5644)
66923b4 fix: preserve DNS origin hostname on sockets (#5577)
3926499 fix: retry refused HTTP/2 streams (#5598)
73d6e9e fix(h2): detach upgrade close handler after GOAWAY (#5641)
b111adb fix(mock): emit request body lifecycle hooks (#5367)
ae4a3e3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5636)
ec3fbf1 build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 (#5634)
2151720 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5633)
b96a116 fix(interceptors): allow interceptors without opts.origin (#5628)
a18ef2d fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r...
Additional commits viewable in compare view

Updates tsx from 4.23.4 to 4.23.9

Release notes

Sourced from tsx's releases.

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

map Node test locations (2f55884)

support data URLs in tsImport (b94f46f)

This release is also available on:

npm package (@latest dist-tag)

v4.23.8

4.23.8 (2026-08-05)

Bug Fixes

preserve package subpath resolution (be1315e)

preserve typeless ESM dependency exports (70dfc5e)

This release is also available on:

npm package (@latest dist-tag)

v4.23.7

4.23.7 (2026-08-05)

Bug Fixes

prevent tsImport cache collisions (4e5a138)

This release is also available on:

npm package (@latest dist-tag)

v4.23.6

4.23.6 (2026-08-05)

Bug Fixes

compose resolver URL metadata (5040762)

preserve Node resolution with allowJs (2046d9e)

preserve resolver URL metadata (a91df46)

This release is also available on:

... (truncated)

Commits

2f55884 fix: map Node test locations
de935d5 docs: document Node source-map stack formatting
b94f46f fix: support data URLs in tsImport
be1315e fix: preserve package subpath resolution
5efba41 docs: organize transform backend research
70dfc5e fix: preserve typeless ESM dependency exports
a74ee91 docs: document engineering principles
4e5a138 fix: prevent tsImport cache collisions
205868f test: wait for complete PTY lines
5040762 fix: compose resolver URL metadata
Additional commits viewable in compare view

Updates better-auth from 1.6.25 to 1.6.26

Release notes

Sourced from better-auth's releases.

v1.6.26

better-auth

Bug Fixes

Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)

Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)

Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)

Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)

Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)

Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)

Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)

Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)

Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)

Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)

Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @Emmaccen, @gustavovalverde, @jashkarangiya, @jeroenvandermerwe, @jlucaso1, @krish-vachhani, @mrosberghaus, @XXMOHAMED012

Full changelog: v1.6.25...v1.6.26

Changelog

Sourced from better-auth's changelog.

1.6.26

Patch Changes

#10619 9ede805 Thanks @jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

#10608 5a811f1 Thanks @bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

#10605 d8327f1 Thanks @XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

#10513 e2c73fb Thanks @mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

#10635 af50c45 Thanks @krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

#10633 701cd43 Thanks @gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

#10599 e7b0eba Thanks @bytaesu! - Preserve Apple user data from form_post callbacks when using oAuthProxy.

#10552 2b4a14f Thanks @bytaesu! - Allow users to retry email OTP password resets after entering an invalid password.

#10467 7552a3b Thanks @jlucaso1! - Improve nextCookies performance in instrumented Next.js applications.

#10580 ea38fca Thanks @Emmaccen! - Skip invalid secondary-storage session entries without discarding other valid sessions.

#10520 a03e4c1 Thanks @bytaesu! - Ensure deleting a user also removes their sessions from secondary storage.

Updated dependencies [a30e274]:

@better-auth/core@1.6.26

@better-auth/drizzle-adapter@1.6.26

@better-auth/kysely-adapter@1.6.26

@better-auth/memory-adapter@1.6.26

@better-auth/mongo-adapter@1.6.26

@better-auth/prisma-adapter@1.6.26

@better-auth/telemetry@1.6.26

Commits

a16b30e chore: release v1.6.26 (#10521)
9ede805 fix(rate-limit): await database cleanup by default (#10619)
af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
d8327f1 fix(email-otp): verify OTP before revealing whether the email exists (#10605)
e7b0eba fix(oauth-proxy): preserve Apple user data (#10599)
5a811f1 fix(email-otp): pass verification type on sign-up (#10608)
e18606b chore(deps): upgrade OpenTelemetry to v2 (#10601)
ea38fca fix(db): skip null-parsed session token in findSessions instead of returning ...
7552a3b perf(next-js): reuse the next/headers import promise in production (#10467)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.7` | | [countries-and-timezones](https://github.com/manuelmhtr/countries-and-timezones) | `3.9.0` | `3.10.0` | | [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.4.0` | `2.5.0` | | [undici](https://github.com/nodejs/undici) | `8.9.0` | `8.10.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.4` | `4.23.9` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.25` | `1.6.26` | Updates `@biomejs/biome` from 2.5.6 to 2.5.7 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome) Updates `countries-and-timezones` from 3.9.0 to 3.10.0 - [Release notes](https://github.com/manuelmhtr/countries-and-timezones/releases) - [Changelog](https://github.com/manuelmhtr/countries-and-timezones/blob/dev/CHANGELOG.md) - [Commits](manuelmhtr/countries-and-timezones@v3.9.0...v3.10.0) Updates `ipaddr.js` from 2.4.0 to 2.5.0 - [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md) - [Commits](https://github.com/whitequark/ipaddr.js/commits) Updates `undici` from 8.9.0 to 8.10.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.9.0...v8.10.0) Updates `tsx` from 4.23.4 to 4.23.9 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.4...v4.23.9) Updates `better-auth` from 1.6.25 to 1.6.26 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.26/packages/better-auth) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: countries-and-timezones dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ipaddr.js dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: undici dependency-version: 8.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tsx dependency-version: 4.23.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: better-auth dependency-version: 1.6.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 9, 2026

Navigation Menu

Uh oh!

Uh oh!

chore(deps): bump the dependencies group with 6 updates - #128

chore(deps): bump the dependencies group with 6 updates#128
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-010e126e00

dependabot Bot commented on behalf of github Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 9, 2026

Biome CLI v2.5.7

2.5.7

Patch Changes

2.5.7

Patch Changes

v3.10.0

Changed

[3.10.0] - 2026-08-02

Changed

2.5.0 - 2026-08-04

v8.10.0

What's Changed

New Contributors

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

v4.23.8

4.23.8 (2026-08-05)

Bug Fixes

v4.23.7

4.23.7 (2026-08-05)

Bug Fixes

v4.23.6

4.23.6 (2026-08-05)

Bug Fixes

v1.6.26

better-auth

Bug Fixes

@better-auth/core

Features

@better-auth/redis-storage

Bug Fixes

Contributors

1.6.26

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`better-auth`

`@better-auth/core`

`@better-auth/redis-storage`