build(deps): Bump the all group across 1 directory with 12 updates by dependabot[bot] · Pull Request #5 · itsvedantkumar/keystatic-passkeys

dependabot · 2026-10-01T12:59:25Z

Bumps the all group with 12 updates in the / directory:

Package	From	To
@keystatic/core	`0.6.5`	`0.6.9`
@simplewebauthn/browser	`13.3.0`	`14.0.0`
@simplewebauthn/server	`13.3.2`	`14.0.3`
@upstash/ratelimit	`2.0.8`	`2.2.0`
@upstash/redis	`1.38.2`	`1.39.0`
next	`16.3.1`	`16.3.6`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.4`	`19.3.0`
@types/node	`26.2.0`	`26.6.3`
@types/react	`19.2.18`	`19.3.0`
@types/react-dom	`19.2.4`	`19.3.0`
postcss	`8.5.26`	`8.5.28`

Updates @keystatic/core from 0.6.5 to 0.6.9

Changelog

Sourced from @keystatic/core's changelog.

0.6.9

Patch Changes

Updated dependencies [dbb0bb5]:

@keystar/ui@0.10.0

0.6.8

Patch Changes

#1610 e16a55a Thanks @emmatown! - @keystar/ui is now depended with a ~ instead of an exact version

Updated dependencies [28c823f]:

@keystar/ui@0.9.6

0.6.7

Patch Changes

#1604 41aa38f Thanks @emmatown! - Reduce size of package.json

Updated dependencies [4688f77, 41aa38f]:

@keystar/ui@0.9.5

0.6.6

Patch Changes

#1601 4dca0ca Thanks @emmatown! - Support GitHub rulesets to automatically create a branch when pull requests are required

#1602 3c34f58 Thanks @emmatown! - Update to minimatch@10

#1603 b4371f5 Thanks @emmatown! - Update to match-sorter@8

Updated dependencies [16373ad]:

@keystar/ui@0.9.4

Commits

b65d4a5 Version Packages (#1613)
dbb0bb5 Add @keystar/ui/router with useNavigate, usePathname and useSearch (#1612)
f002804 Version Packages (#1609)
e16a55a Update changesets and depend on @keystar/ui in @keystatic/core with a ~ (#1610)
bdbce90 Version Packages (#1605)
6f9917d Version Packages (#1600)
b4371f5 Update to match-sorter@8 (#1603)
3c34f58 Update to minimatch@10 (#1602)
4dca0ca Support GitHub rulesets to automatically create a branch when pull requests a...
ae0800b Use vitest (#1591)
See full diff in compare view

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @simplewebauthn/server from 13.3.2 to 14.0.3

Release notes

Sourced from @simplewebauthn/server's releases.

v14.0.3

Changes:

[server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

v14.0.1

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

... (truncated)

Changelog

Sourced from @simplewebauthn/server's changelog.

v14.0.3

Changes:

[server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

v14.0.1

Changes:

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

... (truncated)

Commits

084e601 Update server version to v14.0.3
cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
7e3c4c4 Kinda makes more sense to do the AKI check first
21f99a2 Update server version to v14.0.2
f03758a Merge commit from fork
0bfdc3b Update server version to v14.0.1
4831ce2 Fix X.509 parsing to support PQC use in attestation statements (#800)
3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
4b189bd Update server version to 13.3.3
Additional commits viewable in compare view

Updates @upstash/ratelimit from 2.0.8 to 2.2.0

Release notes

Sourced from @upstash/ratelimit's releases.

v2.2.0

What's Changed

fix: use last token successfully on cachedFixedWindow cache hits by @Tyagiquamar in upstash/ratelimit-js#157

fix: avoid negative setTimeout delay in blockUntilReady by @MisterJimson in upstash/ratelimit-js#159

Reject token-bucket requests that exceed the remaining tokens by @eeshsaxena in upstash/ratelimit-js#156

feat: support decimal values and week unit in duration parser by @Tyagiquamar in upstash/ratelimit-js#158

New Contributors

@Tyagiquamar made their first contribution in upstash/ratelimit-js#157

@MisterJimson made their first contribution in upstash/ratelimit-js#159

@eeshsaxena made their first contribution in upstash/ratelimit-js#156

Full Changelog: upstash/ratelimit-js@v2.1.0...v2.2.0

v2.1.0

What's Changed

DX-2363: add skill files by @CahidArda in upstash/ratelimit-js#148

DX-2278: update release to use npm OIDC by @CahidArda in upstash/ratelimit-js#149

DX-2861: add sdk telemetry by @ytkimirti in upstash/ratelimit-js#153

chore: add npm bugs and homepage metadata, fix repository URL by @XananasX7 in upstash/ratelimit-js#152

DX-2954: poll npm for the ci version instead of a fixed sleep by @CahidArda in upstash/ratelimit-js#155

feat: run lua scripts with allow-key-locking flag by @CahidArda in upstash/ratelimit-js#154

New Contributors

@XananasX7 made their first contribution in upstash/ratelimit-js#152

Full Changelog: upstash/ratelimit-js@v2.0.8...v2.1.0

v2.1.0-rc

What's Changed

DX-2363: add skill files by @CahidArda in upstash/ratelimit-js#148

DX-2278: update release to use npm OIDC by @CahidArda in upstash/ratelimit-js#149

DX-2861: add sdk telemetry by @ytkimirti in upstash/ratelimit-js#153

Full Changelog: upstash/ratelimit-js@v2.0.8...v2.1.0-rc

Commits

fccd840 feat: support decimal values and week unit in duration parser (#158)
a955a3c Reject token-bucket requests that exceed the remaining tokens (#156)
8f641c6 fix: avoid negative setTimeout delay in blockUntilReady (#159)
75a956e fix: use last token successfully on cachedFixedWindow cache hits (#157)
7e071b9 feat: run lua scripts with allow-key-locking flag (#154)
89c481b DX-2954: poll npm for the ci version instead of a fixed sleep (#155)
91c0bad chore: add npm bugs and homepage metadata, fix repository URL (#152)
f2fc2c7 DX-2861: add sdk telemetry (#153)
5b5448a DX-2479: fix package.version
589cc3e Rename skill from 'ratelimit-ts' to 'upstash-ratelimit-ts'
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @upstash/ratelimit since your current version.

Updates @upstash/redis from 1.38.2 to 1.39.0

Release notes

Sourced from @upstash/redis's releases.

@upstash/redis@1.39.0

Minor Changes

6801501: Add array commands: arset, armset, arget, armget, argetrange, arscan, argrep, ardel, ardelrange, arcount, arlen, arinsert, arring, arlastitems, arnext, arseek, arop and arinfo, available on the client, in pipelines and in transactions.

3f6e286: Support search indexes over Redis streams: redis.search.createIndex({ dataType: "stream", stream: "events", schema }) indexes every entry of the stream as a document keyed by its entry ID. describe() reports dataType: "stream" with the stream key in prefixes.

33658bc: Add vector index support: redis.vector.createIndex() / redis.vector.index() return a VectorIndex with add, get, query, delete, count, info and drop, backed by the new VECTOR.CREATE, VECTOR.ADD, VECTOR.GET, VECTOR.QUERY, VECTOR.DEL, VECTOR.COUNT, VECTOR.INFO and VECTOR.DROP commands.

@upstash/redis@1.39.0-canary-20260826110341-795a33599494ef4034259bd4f7d36db70c44f368

Full Changelog: https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.3...@upstash/redis@1.39.0-canary-20260826110341-795a33599494ef4034259bd4f7d36db70c44f368

@upstash/redis@1.38.4

Patch Changes

7ac8182: Fix read-your-writes sending a stale upstash-sync-token

A read issued straight after a write travelled with the token from before that write, so the server was under no obligation to serve the write and readYourWrites silently did not hold.

HttpClient.request() snapshotted the outgoing headers with mergeHeaders(this.headers, ...) and only afterwards wrote the freshest token into this.headers, so the token learned from response N first shipped with request N+2. The assignment now happens before the merge.

This regressed in 1.34.5. In 1.34.0–1.34.4 the request options held headers: this.headers by reference, so the late write was still picked up before fetch; 1.34.5 introduced per-request header merging, which turned that reference into a copy without moving the assignment.

@upstash/redis@1.38.3

Patch Changes

f020866: Send an Upstash-Telemetry-Retry header with the retry count on retried requests so retry rates are visible in server-side telemetry

777dc30: Trim telemetry header values before deduplicating so whitespace around existing values does not defeat the dedup check

@upstash/redis@1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

What's Changed

DX-2861: trim telemetry dedup values by @ytkimirti in upstash/redis-js#1442

Full Changelog: https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.2...@upstash/redis@1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

Commits

6b27727 chore: version packages (#1456)
33658bc DX-2963: add vector index commands and redis.vector namespace (#1446)
6801501 DX-3009: add array commands (#1451)
3f6e286 DX-3010: support search indexes over redis streams (#1452)
73fbe1a chore: version packages (#1448)
7ac8182 DX-2995: fix read-your-writes sending a stale upstash-sync-token (#1447)
1bec566 ci: poll npm for the ci version instead of a fixed sleep (#1444)
74da1df chore: version packages (#1443)
f020866 DX-2960: send Upstash-Telemetry-Retry header with the attempt number (DX-2960...
777dc30 fix: trim telemetry values before dedup and cover distinct-version case (#1442)
See full diff in compare view

Updates next from 16.3.1 to 16.3.6

Release notes

Sourced from next's releases.

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)

next/image: Reject empty images when reading/writing to the disk cache (#98186)

Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)

Add CSP nonce to script tags of loading and template files (#98403)

Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

a758ffc v16.3.6
868fad3 [active-lts] Harden next/og SVG serialization
8c81cbb [lts-active] test: remove unsupported deployment ID builder cases (#98821)
ca2c75e v16.3.5
14fb290 [backport] Fix use cache prerender signal retention (#98448)
2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
4b56cee [16.3.x] Backport docs fixes (#98317)
5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935<...
Description has been truncated

Bumps the all group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@keystatic/core](https://github.com/Thinkmill/keystatic/tree/HEAD/packages/keystatic) | `0.6.5` | `0.6.9` | | [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/browser) | `13.3.0` | `14.0.0` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `13.3.2` | `14.0.3` | | [@upstash/ratelimit](https://github.com/upstash/ratelimit-js) | `2.0.8` | `2.2.0` | | [@upstash/redis](https://github.com/upstash/redis-js) | `1.38.2` | `1.39.0` | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.6` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.3` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` | Updates `@keystatic/core` from 0.6.5 to 0.6.9 - [Changelog](https://github.com/Thinkmill/keystatic/blob/main/packages/keystatic/CHANGELOG.md) - [Commits](https://github.com/Thinkmill/keystatic/commits/@keystatic/core@0.6.9/packages/keystatic) Updates `@simplewebauthn/browser` from 13.3.0 to 14.0.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.0/packages/browser) Updates `@simplewebauthn/server` from 13.3.2 to 14.0.3 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.3/packages/server) Updates `@upstash/ratelimit` from 2.0.8 to 2.2.0 - [Release notes](https://github.com/upstash/ratelimit-js/releases) - [Commits](upstash/ratelimit-js@v2.0.8...v2.2.0) Updates `@upstash/redis` from 1.38.2 to 1.39.0 - [Release notes](https://github.com/upstash/redis-js/releases) - [Commits](https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.2...@upstash/redis@1.39.0) Updates `next` from 16.3.1 to 16.3.6 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.1...v16.3.6) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@types/node` from 26.2.0 to 26.6.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `postcss` from 8.5.26 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.26...8.5.28) --- updated-dependencies: - dependency-name: "@keystatic/core" dependency-version: 0.6.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: "@simplewebauthn/browser" dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all - dependency-name: "@simplewebauthn/server" dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all - dependency-name: "@upstash/ratelimit" dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: "@upstash/redis" dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: next dependency-version: 16.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all - dependency-name: "@types/node" dependency-version: 26.6.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all - dependency-name: postcss dependency-version: 8.5.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

Navigation Menu

Repository navigation

build(deps): Bump the all group across 1 directory with 12 updates - #5

build(deps): Bump the all group across 1 directory with 12 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-30699652f6

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026

0.6.9

Patch Changes

0.6.8

Patch Changes

0.6.7

Patch Changes

0.6.6

Patch Changes

v14.0.0 - The one after they go quantum

Breaking Changes

v13.3.3

v13.3.2

v13.3.1

v14.0.0 - The one after they go quantum

v14.0.3

v14.0.2

v14.0.1

v14.0.0 - The one after they go quantum

Breaking Changes

v14.0.3

v14.0.2

v14.0.1

v14.0.0 - The one after they go quantum

v2.2.0

What's Changed

New Contributors

v2.1.0

What's Changed

New Contributors

v2.1.0-rc

What's Changed

@​upstash/redis@​1.39.0

Minor Changes

@​upstash/redis@​1.39.0-canary-20260826110341-795a33599494ef4034259bd4f7d36db70c44f368

@​upstash/redis@​1.38.4

Patch Changes

@​upstash/redis@​1.38.3

Patch Changes

@​upstash/redis@​1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

What's Changed

v16.3.6

v16.3.5

v16.3.4

Credits

v16.3.3

v16.3.2

Core Changes

Credits

19.3.0 (September 9, 2026)

New React Features

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@upstash/redis@1`.39.0

`@upstash/redis@1`.39.0-canary-20260826110341-795a33599494ef4034259bd4f7d36db70c44f368

`@upstash/redis@1`.38.4

`@upstash/redis@1`.38.3

`@upstash/redis@1`.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900