deps: bump the production-dependencies group across 1 directory with 33 updates

[dependabot]

Bumps the production-dependencies group with 33 updates in the / directory:

Package	From	To
@ai-sdk/google	1.2.22	3.0.75
@auth/upstash-redis-adapter	2.10.0	2.11.2
@fal-ai/client	1.6.2	1.10.1
@hookform/resolvers	5.2.1	5.2.2
@mendable/firecrawl-js	1.29.3	4.24.1
@radix-ui/react-aspect-ratio	1.1.7	1.1.8
@radix-ui/react-avatar	1.1.10	1.1.11
@radix-ui/react-label	2.1.7	2.1.8
@radix-ui/react-progress	1.1.7	1.1.8
@radix-ui/react-separator	1.1.7	1.1.8
@radix-ui/react-slot	1.2.3	1.2.4
@upstash/ratelimit	2.0.6	2.0.8
@upstash/redis	1.35.3	1.38.0
ai	4.3.19	6.0.184
date-fns	3.6.0	4.1.0
js-cookie	3.0.5	3.0.7
lucide-react	0.511.0	1.16.0
next	15.5.12	16.2.6
next-auth	5.0.0-beta.29	5.0.0-beta.31
nodemailer	6.10.1	8.0.7
react	19.1.1	19.2.6
react-compare-slider	3.1.0	4.0.0
react-cookie-consent	9.0.0	10.0.1
react-day-picker	9.11.0	10.0.1
react-dom	19.1.1	19.2.6
react-hook-form	7.62.0	7.76.0
react-resizable-panels	3.0.6	4.11.1
recharts	2.15.4	3.8.1
resend	6.1.0	6.12.3
stripe	16.12.0	22.1.1
tailwind-merge	3.3.1	3.6.0
uuid	11.1.0	14.0.0
zod	3.25.76	4.4.3

Updates @ai-sdk/google from 1.2.22 to 3.0.75

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​3.0.75

Patch Changes

• ab15576: feat(google): update Interactions API implementation to cater for upstream breaking changes coming May 26

@​ai-sdk/google@​3.0.74

Patch Changes

• 3ca0daa: fix(provider/google): support functionCall.id when returned by Gemini API and provide matching functionResponse.id

@​ai-sdk/google@​2.0.73

Patch Changes

• f081ba8: fix(provider/google): support functionCall.id when returned by Gemini API and provide matching functionResponse.id

Changelog

Sourced from @​ai-sdk/google's changelog.

3.0.75

Patch Changes

• ab15576: feat(google): update Interactions API implementation to cater for upstream breaking changes coming May 26

3.0.74

Patch Changes

• 3ca0daa: fix(provider/google): support functionCall.id when returned by Gemini API and provide matching functionResponse.id

3.0.73

Patch Changes

• bb1eb98: feat(google): add fileData support to embedding model

3.0.72

Patch Changes

• b3642fe: feat(provider/google): support cancelling long-running Interactions API agents via AbortSignal, and process their intermittent stream

3.0.71

Patch Changes

• 59530cf: fix(google): emit Vertex no-args streaming tool calls and preserve thoughtSignature

  Vertex emits a no-args function call as a single chunk shaped { functionCall: { name: 'X' } } with no args, no partialArgs, and no willContinue. The streaming parser had no branch for this shape, so the call was dropped along with any thoughtSignature it carried. For Gemini 3 thinking models this caused the next multi-turn step to 400 with missing thought_signature. The unary (doGenerate) path had the same drop.

  Both paths now emit the call as a complete tool call with '{}' input and propagate thoughtSignature provider metadata.

  Fixes #14847.

3.0.70

Patch Changes

• 4f3f564: fix(provider/google): fix lack of image consistency when using Interactions API in stateless mode

3.0.69

Patch Changes

• bb377ba: fix(google): omit passing includeServerSideToolInvocations for Vertex tool_config
• Updated dependencies [f591416]
  • @​ai-sdk/provider-utils@​4.0.27

... (truncated)

Commits

• f8d3003 Version Packages (#15356)
• ab15576 Backport: feat(google): update Interactions API implementation to cater for u...
• 2e7664b Version Packages (#15315)
• 3ca0daa Backport: fix(provider/google): support functionCall.id when returned by Ge...
• e2f1bca Version Packages (#15216)
• bb1eb98 Backport: feat(google): add fileData support to embedding model (#15204)
• d5bbdbc Version Packages (#15174)
• b3642fe Backport: feat(provider/google): support cancelling long-running Interactions...
• e70aab9 Version Packages (#15138)
• 59530cf Backport: fix(google): emit no-args streaming tool calls and preserve thought...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/google since your current version.

Updates @auth/upstash-redis-adapter from 2.10.0 to 2.11.2

Release notes

Sourced from @​auth/upstash-redis-adapter's releases.

@​auth/upstash-redis-adapter@​2.11.2

Other

• @​auth/core: dependency update (67f2b168)

@​auth/upstash-redis-adapter@​2.11.1

Other

• @​auth/core: dependency update (8f3b2c7a)

@​auth/upstash-redis-adapter@​2.11.0

Other

• @​auth/core: dependency update (745751e9)

Commits

• af9daa8 chore(release): bump package version(s) [skip ci]
• d4dab3d chore: sync package versions with npm registry (#13414)
• 8a23c5b chore: fix lockfile (#13411)
• 2018202 docs: fix TypeScript type mismatch in refresh token rotation example (#13396)
• 0eba7e4 adapter-kysely: Update kysely for CVE-2026-33468 (#13407)
• 67f2b16 fix(providers): add issuer to GitHub provider for RFC 9207 compliance (#13410)
• f457068 docs: update middleware.ts references to proxy.ts for Next.js 16 (#13373)
• c7c2cfa docs: update Better Auth migration guide (#13334)
• b4ef14a chore(release): bump version [skip ci]
• 2824fa1 feat: add next 16 support (#13298)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for @​auth/upstash-redis-adapter since your current version.

Updates @fal-ai/client from 1.6.2 to 1.10.1

Release notes

Sourced from @​fal-ai/client's releases.

client-v1.10.1

What's Changed

• fix(client): retry Node-level transport errors in subscribe/dispatch by @​efiop in fal-ai/fal-js#211

Full Changelog: fal-ai/fal-js@client-v1.10.0...client-v1.10.1

client-v1.10.0

What's Changed

• feat(client): allow proxy middleware in non-browser runtimes by @​drochetti in fal-ai/fal-js#209

Full Changelog: fal-ai/fal-js@client-v1.9.6...client-v1.10.0

client-v1.9.6

What's Changed

• fix(realtime): connection closed transition expires token by @​noahgsolomon in fal-ai/fal-js#201
• cleanup realtime state machine and support live references by @​noahgsolomon in fal-ai/fal-js#202
• chore: supply chain security, enforce minimum age for node dependencies by @​wennergr in fal-ai/fal-js#205
• chore: update endpoint types by @​aykutkardas in fal-ai/fal-js#192
• feat(client): expose lifecycle ACL options in storage settings by @​efiop in fal-ai/fal-js#208
• ci: pin GitHub Actions to full commit SHAs by @​wennergr in fal-ai/fal-js#207

New Contributors

• @​wennergr made their first contribution in fal-ai/fal-js#205

Full Changelog: fal-ai/fal-js@client-v1.9.4...client-v1.9.6

client-v1.9.5

What's Changed

• fix(realtime): connection closed transition expires token by @​noahgsolomon in fal-ai/fal-js#201

Full Changelog: fal-ai/fal-js@client-v1.9.4...client-v1.9.5

client-v1.9.4

What's Changed

• fix: use rest.fal.ai by @​dazip in fal-ai/fal-js#198
• fix(realtime): refresh tokens in background without dropping the WebSocket connection by @​noahgsolomon in fal-ai/fal-js#200

Full Changelog: fal-ai/fal-js@client-v1.9.2...client-v1.9.4

client-v1.9.3

What's Changed

• fix: use rest.fal.ai by @​dazip in fal-ai/fal-js#198

Full Changelog: fal-ai/fal-js@client-v1.9.2...client-v1.9.3

... (truncated)

Commits

• 442a757 fix(client): retry Node-level transport errors in subscribe/dispatch (#211)
• f12065b feat(client): allow proxy middleware in non-browser runtimes (#209)
• f22b69e chore(client): release 1.9.6 and update reference docs
• 153ed56 feat(client): expose lifecycle ACL options in storage settings (#208)
• 9830f25 chore: update endpoint types (#192)
• 05d7302 cleanup realtime state machine and support live references (#202)
• 5a97ffa fix(realtime): refresh tokens in background and clear on disconnect (#201)
• b802926 fix(realtime): refresh tokens in background without dropping the WebSocket co...
• ea9fc05 fix: use rest.fal.ai (#198)
• 6603299 feat(client): pass normalized app+path to TokenProvider (#196)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fal-ai/client since your current version.

Updates @hookform/resolvers from 5.2.1 to 5.2.2

Release notes

Sourced from @​hookform/resolvers's releases.

v5.2.2

5.2.2 (2025-09-14)

Bug Fixes

• zod: fix output type for Zod 4 resolver (#803) (e95721d)

Commits

• e95721d fix(zod): fix output type for Zod 4 resolver (#803)
• See full diff in compare view

Updates @mendable/firecrawl-js from 1.29.3 to 4.24.1

Release notes

Sourced from @​mendable/firecrawl-js's releases.

Firecrawl v2.10

Improvements

• /parse endpoint — Upload local files (PDF, DOCX, DOC, ODT, RTF, XLSX, XLS, HTML) up to 50 MB and get back clean, LLM-ready Markdown, JSON, or a summary. Tables and reading order are preserved, with full Zero Data Retention support for enterprise plans. Available in JS, Python, Go, Rust, Java, .NET, PHP, Ruby, and Elixir SDKs.
• Lockdown Mode — Set lockdown: true on /scrape to serve results exclusively from Firecrawl's index with zero outbound requests and zero data retention by default. Gated outbound paths include HTTP fetches, robots.txt, audio downloads, and media. Available in every SDK, the CLI (--lockdown), and MCP.
• question format — Pass a natural-language prompt to /scrape and get a grounded, hallucination-free answer back in data.question. Runs on a managed model chain with automatic fallback, prompt-injection isolation via XML tagging and zero-width-space escaping, and up to 100x fewer tokens per call.
• highlights format — Returns the exact sentences, code blocks, and table rows on a page that match your query. Consecutive sentences re-join into paragraphs, code lines wrap in fenced blocks with their original language, and table rows rebuild into Markdown tables with headers — all from the source page, using up to 100x fewer tokens per call.
• video format — Added video to scrape formats. Returns a signed downloadable video URL for supported sites (e.g. YouTube), with cookie forwarding for authenticated downloads and explicit Lockdown gating.
• /search domain filters — Added includeDomains and excludeDomains parameters to /search for scoping results to a specific set of sites.
• /search feedback endpoint — Submit a rating on a search result with POST /v2/search/:jobId/feedback. Each accepted submission refunds 1 credit, capped per UTC day, with idempotent retries.
• Custom robots.txt user agent — Added robotsUserAgent to crawl requests to evaluate robots.txt rules and crawl delays against a custom agent string, and a separate customRobotsAgent org flag independent from ignoreRobots. Available in JS, Python, and Java SDKs.
• Official Go SDK — Added a first-party Go SDK for the v2 API, replacing the community module. Includes context-aware retry backoff and proper MapData.Links typing.
• Ruby SDK — Added the official Firecrawl Ruby SDK v2 with full endpoint coverage and v2-native typing.
• PHP SDK — Added the official PHP SDK with Laravel support, scrape/search/crawl/map/parse coverage, and a published firecrawl/firecrawl-sdk Composer package.
• .NET SDK — Added the official .NET SDK with v2 API support, parse, and an firecrawl-sdk NuGet package.
• Rust SDK v2 — The Rust SDK has been promoted to the official v2 SDK with parity across scrape, search, crawl, map, agent, and parse.
• /interact suggestion — Calls to /scrape that pass an actions array now return a warning suggesting /interact for stateful browser automation.
• PDF size cap — Raised the PDF upload size limit from 10 MB to 30 MB.
• PDF page-processed billing — Updated PDF billing to reflect pages processed instead of raw page count.
• Docker harness — Exposed HARNESS_STARTUP_TIMEOUT_MS through docker-compose for self-hosted users who need longer startup windows.
• Elixir SDK — Added parse_file/3 to the Elixir SDK for the /parse endpoint.
• JS SDK request timeout — Added an explicit request timeout option to the JS SDK to prevent hanging requests.

Fixes

• Resolved multiple CVEs across the API and SDKs including axios, postcss, fast-xml-parser, protobufjs, follow-redirects, langsmith, lodash, fast-uri, and fast-xml-builder.
• Fixed branding colors.secondary being incorrectly populated when the LLM omitted a value — secondary is now optional and is no longer applied as a default.
• Fixed the Playwright service ignoring the caller's User-Agent request header.
• Fixed screenshot signed URLs returning stale results from cache by forcing a cache miss when the signed URL has expired.
• Fixed Lockdown requests being billed twice for ZDR by treating Lockdown as zero data retention by default.
• Fixed proxy billing for cached scrapes incorrectly charging proxy credits when no proxy egress occurred.
• Fixed YouTube transcript scripts running on audio-only scrapes and audio downloads not receiving CDP cookies.
• Fixed html-to-md conversion service ignoring zero data retention.
• Fixed a stack overflow in marked.parse when handling certain PDF outputs.
• Fixed robotsUserAgent not being honored by the native link filter and not being included in JS SDK crawl payloads.
• Fixed /v1 status endpoints returning 500 on non-UUID job IDs — now returns a proper 400.
• Fixed empty actions: [] arrays being treated as actions in feature flags.
• Fixed JS SDK watcher emitting duplicate events, leaking timeouts, and hanging start() on watcher timeouts.
• Fixed Ruby SDK unwrapping of credit_usage data fields and defaulted skipTlsVerification to false.
• Fixed missing negative-limit validation in Python, Java, and Go SDKs.
• Fixed Java SDK accepting empty API keys and missing async lifecycle methods.
• Fixed billing period timestamps, subscription lookups, and plan credit reporting.
• Fixed crawl-backlog timeouts being unbounded — now capped at 48h.

API

• Added POST /v2/parse for multipart file uploads up to 50 MB. Returns a standard Document. Disallowed scrape options on parse: changeTracking, screenshot, branding, actions, waitFor, location, mobile; proxy is restricted to auto or basic. Errors with PARSE_UNSUPPORTED_OPTIONS on disallowed input.
• Added lockdown: boolean to /scrape. Cache misses return 404 with SCRAPE_LOCKDOWN_CACHE_MISS. Billing: +4 credits when lockdown is enabled, 1 credit on cache miss. Available across all SDKs.
• Added question and highlights to /scrape formats, returning data.question and data.highlights respectively.

... (truncated)

Commits

• See full diff in compare view

Updates @radix-ui/react-aspect-ratio from 1.1.7 to 1.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-avatar from 1.1.10 to 1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.7 to 2.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-progress from 1.1.7 to 1.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-separator from 1.1.7 to 1.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.2.3 to 1.2.4

Commits

• See full diff in compare view

Updates @upstash/ratelimit from 2.0.6 to 2.0.8

Release notes

Sourced from @​upstash/ratelimit's releases.

v2.0.8

What's Changed

• DX-2280: Remove large-group runners by @​CahidArda in upstash/ratelimit-js#144
• Fix React Server Components CVE vulnerabilities by @​vercel[bot] in upstash/ratelimit-js#145
• DX-2316: bump next by @​CahidArda in upstash/ratelimit-js#146
• DX-2254: add global dynamic limit by @​CahidArda in upstash/ratelimit-js#147

New Contributors

• @​vercel[bot] made their first contribution in upstash/ratelimit-js#145

Full Changelog: upstash/ratelimit-js@v2.0.7...v2.0.8

v2.0.7

What's Changed

Features

• DX-1261: allow negative rate values by @​CahidArda in upstash/ratelimit-js#143

Fixes

• Update context7.json by @​enesakar in upstash/ratelimit-js#138, upstash/ratelimit-js#139 and upstash/ratelimit-js#140
• DX-2218: Refactor rate limit test cases and update request timing in TestHarness by @​CahidArda in upstash/ratelimit-js#142

Full Changelog: upstash/ratelimit-js@v2.0.6...v2.0.7

Commits

• a8b1b99 DX-2254: add global dynamic limit (#147)
• 8589adb fix: bump next (#146)
• ade4aa8 Merge pull request #145 from upstash/vercel/react-server-components-cve-vu-qx...
• e19785d Fix React Server Components CVE vulnerabilities
• 67e8bc2 DX-2280: Remove specific runner configuration from test job in GitHub Actions...
• a447320 DX-1261: allow negative rate values (#143)
• 544454b DX-2218: Refactor rate limit test cases and update request timing in TestHarn...
• c12bee3 Update context7.json
• 6bc1514 Update context7.json
• 75f929e Merge pull request #140 from upstash/enesakar-patch-5
• Additional commits viewable in compare view

Updates @upstash/redis from 1.35.3 to 1.38.0

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.0

Minor Changes

• c71f581: Separate read/write commands into separate pipelines in auto pipeline. As a result, mixed read/write Promise.all batches may now be split across multiple pipeline HTTP requests instead of a single request, and read-after-write ordering may no longer be preserved within those mixed batches.

@upstash/redis@1.38.0-canary-20260505130836-8b3b33ccd367ba9ddb5b7f5ca33eb32ccf7e940d

What's Changed

• DX-2506: add redis search into skills by @​CahidArda in upstash/redis-js#1427
• fix: rename redis search analytics demo by @​CahidArda in upstash/redis-js#1428
• DX-2555: add supply chain security settings by @​CahidArda in upstash/redis-js#1429
• fix: add version sync to ci by @​alitariksahin in upstash/redis-js#1430

Full Changelog: https://github.com/upstash/redis-js/compare/@​upstash/redis@1.37.0...@​upstash/redis@1.38.0-canary-20260505130836-8b3b33ccd367ba9ddb5b7f5ca33eb32ccf7e940d

@​upstash/redis@​1.37.0

Minor Changes

• 6f2a831: Release redis search

Patch Changes

• 3980b45: Add monorepo structure

@upstash/redis@1.37.0-canary-20260312092231-7405c30f6a505815bbeb69b713a22978f104ec1f

What's Changed

• DX-2445: redis package version and changeset for search release by @​CahidArda in upstash/redis-js#1423
• DX-2445: fix redis version, add repository.url to search packages by @​CahidArda in upstash/redis-js#1424
• DX-2445: use pnpm publish for search packages to resolve workspace:* deps by @​CahidArda in upstash/redis-js#1425

Full Changelog: https://github.com/upstash/redis-js/compare/@​upstash/redis@1.30.3-canary-20260312082754-96a99a4e83fc560b77c36808627213e528c2f110...@​upstash/redis@1.37.0-canary-20260312092231-7405c30f6a505815bbeb69b713a22978f104ec1f

@​upstash/redis@​1.37.0-canary-20260312084440-fba95e89e54d8ba63f020400247a1ef0dbdd2c84

What's Changed

• DX-2445: redis package version and changeset for search release by @​CahidArda in upstash/redis-js#1423
• DX-2445: fix redis version, add repository.url to search packages by @​CahidArda in upstash/redis-js#1424

Full Changelog: https://github.com/upstash/redis-js/compare/@​upstash/redis@1.30.3-canary-20260312082754-96a99a4e83fc560b77c36808627213e528c2f110...@​upstash/redis@1.37.0-canary-20260312084440-fba95e89e54d8ba63f020400247a1ef0dbdd2c84

Commits

• 7607549 chore: version packages (#1433)
• c71f581 DX-2577: Seperate read/write commands into seperate pipelines in auto pipelin...
• e3a23ab fix: add version sync to ci (#1430)
• 12e9a9e DX-2555: add supply chain security settings (#1429)
• f59fa75 fix: docs link
• c88b8e5 fix: rename redis search analytics demo (#1428)
• 5d8abc1 feat: add redis search into skills (#1427)
• 7e8fbed chore: version packages (#1420)
• 703f6d4 fix: handle FROM field option in SEARCH.DESCRIBE deserialization (#1426)
• 15b4fc9 fix: use pnpm publish for search packages to resolve workspace:* deps (#1425)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​upstash/redis since your current version.

Updates ai from 4.3.19 to 6.0.184

Release notes

Sourced from ai's releases.

ai@6.0.184

Patch Changes

• 40fc5e4: fix(ai): default missing embedding warnings to an empty array

ai@6.0.183

Patch Changes

• Updated dependencies [363cefe]
  • @​ai-sdk/gateway@​3.0.115

Changelog

Sourced from ai's changelog.

6.0.184

Patch Changes

• 40fc5e4: fix(ai): default missing embedding warnings to an empty array

6.0.183

Patch Changes

• Updated dependencies [363cefe]
  • @​ai-sdk/gateway@​3.0.115

6.0.182

Patch Changes

• e76a29a: fix(ai): download tool-result file URLs

6.0.181

Patch Changes

• 538974a: fix(ui): make input optional on output-error tool and dynamic-tool UI message parts

  validateUIMessages rejected persisted assistant messages whose output-error tool parts had no input key. This happened for any errored tool call where the SDK set input: undefined (e.g. NoSuchToolError / InvalidToolInputError): JSON serialization stripped the undefined value, and Zod 4.4+ treats a missing z.unknown() key as a validation failure (previously it was implicitly optional). The schema now matches the runtime shape produced by process-ui-message-stream, so reloading a thread that contains an errored tool call no longer throws AI_TypeValidationError.

6.0.180

Patch Changes

• 253bd5a: fix(gateway): enable retry support for gateway errors
• 57ec10f: fix URL of hero animation in README
• Updated dependencies [253bd5a]
  • @​ai-sdk/gateway@​3.0.114

6.0.179

Patch Changes

• Updated dependencies [ee4de68]
  • @​ai-sdk/gateway@​3.0.113

6.0.178

Patch Changes

• ac6f27e: fix(ai): update opentelemetry pinned version

6.0.177

... (truncated)

Commits

• f8d3003 Version Packages (#15356)
• 40fc5e4 Backport: fix(ai): default missing embedding warnings (#15354)
• 2e7664b Version Packages (#15315)
• 7baadcc chore: diverge test assertions based on node version (#15326)
• 5427555 chore: fix flaky tests diverging on different node versions (#15296)
• c76ce9c Version Packages (#15257)
• c0e4fef Version Packages (#15251)
• e76a29a Backport: fix(ai): download tool-result file URLs (#15246)
• 538974a Backport: fix(ai): Fix validateUIMessages with Zod 4.4 (#15247)
• 43e5359 Version Packages (#15221)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ai since your current version.

Updates date-fns from 3.6.0 to 4.1.0

Release notes

Sourced from date-fns's releases.

v4.1.0

This release adds time zone support to format functions (that I somehow missed when working on the feature) and fixes a few bugs.

Make sure also upgrade TZDate to v1.0.2 as it includes a bunch of critical bug fixes.

Fixed

• Fixed internal constructFrom throwing an exception on null arguments. While null isn't allowed, the functions should rather return Invalid Date or NaN in such cases. See #3885.

Added

• Added missing time zone support to format, formatISO, formatISO9075, formatRelative and formatRFC3339. See #3886.

v4.0.0

I have great news! First, ten years after its release, date-fns finally gets first-class time zone support.

Another great news is that there aren't many breaking changes in this release. All of them are type-related and will affect only those explicitly using internal date-fns types. Finally, it has been less than a year since the last major release, which is an improvement over the previous four years between v2 and v3. I plan on keeping the pace and minimizing breaking changes moving forward.

Read more about the release in the announcement blog post.

- Sasha @​kossnocorp

Added

• Added time zones support via @date-fns/tz's TZDate class and tz helper function. See its README for the details about the API.

• All relevant functions now accept the context in option, which allows to specify the time zone to make the calculations in. If the function also returns a date, it will be in the specified time zone:

  import { addDays, startOfDay } from "date-fns";
  import { tz } from "@date-fns/tz";
  startOfDay(addDays(Date.now(), 5, { in: tz("Asia/Singapore") }));
  //=> "2024-09-16T00:00:00.000+08:00"

  In the example, addDays will get the current date and time in Singapore and add 5 days to it. startOfDay will inherit the date type and return the start of the day in Singapore.

Changed

• The function arguments, as well as Interval's start and end, now can be of different types, allowing you to mix UTCDate, TZDate, Date, and other extensions, as well as primitives (strings and numbers).

  The functions will normalize these values, make calculations, and return the result in the same type, preventing any bugs caused by the discrepancy. If passed, the type will be inferred from the context in option or the first encountered argument object type. The Interval's start and end will be considered separately, starting from start.

  In the given example, the result will be in the TZDate as the first argument is a number, and the start takes precedence over the end.

  clamp(Date.now(), {
    start: new TZDate(start, "Asia/Singapore"),
    end: new UTCDate(),

... (truncated)

Changelog

Sourced from date-fns's changelog.

v4.1.0 - 2024-09-17

This release adds time zone support to format functions (that I somehow missed when working on the feature) and fixes a few bugs.

Make sure also upgrade TZDate to v1.0.2 as it includes a bunch of critical bug fixes.

Fixed

• Fixed internal constructFrom throwing an exception on null arguments. While null isn't allowed, the functions should rather return Invalid Date or NaN in such cases. See #3885.

Added

• Added missing time zone support to format, formatISO, formatISO9075, formatRelative and formatRFC3339. See #3886.

v4.0.0 - 2024-09-16

I have great news! First, ten years after its release, date-fns finally gets first-class time zone support.

Another great news is that there aren't many breaking changes in this release. All of them are type-related and will affect only those explicitly using internal date-fns types. Finally, it has been less than a year since the last major release, which is an improvement over the previous four years between v2 and v3. I plan on keeping the pace and minimizing breaking changes moving forward.

Read more about the release in the announcement blog post.

- Sasha @​kossnocorp

Added

• Added time zones support via @date-fns/tz's TZDate class and tz helper function. See its README for the details about the API.

• All relevant functions now accept the context in option, which allows to specify the time zone to make the calculations in. If the function also returns a date, it will be in the specified time zone:

  import { addDays, startOfDay } from "date-fns";
  import { tz } from "@date-fns/tz";
  startOfDay(addDays(Date.now(), 5, { in: tz("Asia/Singapore") }));
  //=> "2024-09-16T00:00:00.000+08:00"

  In the example, addDays will get the current date and time in Singapore and add 5 days to it. startOfDay will inherit the date type and return the start of the day in Singapore.

Changed

• The function arguments, as well as Interval's start and end, now can be of different types, allowing you to mix UTCDate, TZDate, Date, and other extensions, as well as primitives (strings and numbers).

  The functions will normalize these values, make calculations, and return the result in the same type, preventing any bugs caused by the discrepancy. If passed, the type will be inferred from the context in option or the first encountered argument object type. The Interval's start and end will be considered separately, starting from start.

  In the given example, the result will be in the TZDate as the first argument is a number, and the start takes precedence over the end.

  clamp(Date.now(), {

... (truncated)

Commits

• 313b902 Fix v4.1.0 change log entry
• 26cd336 Promote to v4.1.0
• 97b53b9 Cover time zone edge cases
• 59b7563 Add missing time zone support to format, formatISO, formatISO9075, formatRela...
• 0121164 Prevent constructFrom from throwing an error on null
• bd87ef5 Update @​date-fns/docs
• 99b4e67 Prepare v4.0
• 8df1706 Rewrite the time zones doc
• e351977 Promote to v4.0.0-beta.1
• 8523656 Fix scripts/test/types.sh
• Additional commits viewable in compare view

Updates js-cookie from 3.0.5 to 3.0.7

Release notes

Sourced from js-cookie's releases.

v3.0.7

• Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)
• Add Partitioned attribute to readme (b994768)
• Publish to npm registry via trusted publisher exclusively (4dc71be)
• Ensure consistent behaviour for get('name') + get() (1953d30)

Commits

• 17bacba Craft v3.0.7 release
• adb823c Fix release workflow halting at git tag
• 5f9e759 May remove Git user config from release workflow
• 6ac9211 Fix release workflow not able to push commit + tag
• 2278bc5 Fix missing package version bump
• eb3c40e Prevent cookie attribute injection
• f6f157f Bump globals from 17.5.0 to 17.6.0
• f409d02 Bump eslint from 10.2.0 to 10.3.0
• a686883 Bump protobufjs in the npm_and_yarn group across 1 directory
• c6112d2 Bump @​protobufjs/utf8 in the npm_and_yarn group across 1 directory
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates lucide-react from 0.511.0 to 1.16.0

Release notes

Sourced from lucide-react's releases.

Version 1.16.0

What's Changed

• feat(icons): added blender icon by @​rrod497 in lucide-icons/lucide#3884

Full Changelog: lucide-icons/lucide@1.15.0...1.16.0

Version 1.15.0

What's Changed

• fix: remove 'less' from brand stopwords by @​jguddas in lucide-icons/lucide#4331
• fix(@​lucide/vue): Clone slots before passing to icon by @​axtho in lucide-icons/lucide#4339
• fix(icons): changed text-cursor icon by @​jamiemlaw in lucide-icons/lucide#4340
• fix(icons): changed landmark icon by @​jamiemlaw in lucide-icons/lucide#4334
• chore(deps-dev): bump nitropack from 2.13.1 to 2.13.4 by @​dependabot[bot] in lucide-icons/lucide#4352
• chore(deps-dev): bump simple-git from 3.33.0 to 3.36.0 by @​dependabot[bot] in lucide-icons/lucide#4349
• fix(icons): changed candy-cane icon by @​jguddas in lucide-icons/lucide#4148
• fix(icons): changed volleyball icon by @​jamiemlaw in lucide-icons/lucide#4338
• fix(icons): changed chart-no-axes-combined icon by @​jguddas in lucide-icons/lucide#3567
• feat(icon): added broccoli icon by @​swastik7805 in lucide-icons/lucide#4263
• chore(site): Updates to site and updated carbon ads by @​ericfe...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
imagine	Error		May 18, 2026 3:57am

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69e6c75498

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Replace removed Next lint command

When this dependency bump installs Next 16, the existing pnpm lint script still invokes next lint from package.json. The official Next 16 upgrade guide says the "next lint command has been removed" and to use ESLint/Biome directly, so any CI or local workflow that runs the lint script will now fail before linting. Please migrate the script/config along with the Next upgrade.

Useful? React with 👍 / 👎.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.