chore(deps)(deps): Bump the runtime-deps group across 1 directory with 9 updates by dependabot[bot] · Pull Request #189 · prisma/composer

dependabot · 2026-07-31T11:19:50Z

Bumps the runtime-deps group with 9 updates in the / directory:

Package	From	To
tsdown	`0.22.12`	`0.22.14`
@aws-sdk/client-s3	`3.1087.0`	`3.1091.0`
tar	`7.5.21`	`7.5.22`
@prisma/management-api-sdk	`1.47.0`	`1.51.0`
better-auth	`1.6.24`	`1.6.25`
hono	`4.12.31`	`4.12.32`
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`
next	`16.2.10`	`16.2.11`

Updates tsdown from 0.22.12 to 0.22.14

Release notes

Sourced from tsdown's releases.

v0.22.14

   🚀 Features

Add CLI build concurrency option - by @sxzz and Jeroen Zwartepoorte (8a14c)

    View changes on GitHub

v0.22.13

   🚀 Features

deps: Support neverBundle: true to externalize all dependencies - by @sxzz (d30a7)

   🐞 Bug Fixes

Prevent tinyexec from modifying PATH - by @sxzz (d84c5)

    View changes on GitHub

Commits

ff3bdbd chore: release v0.22.14
8a14c35 feat: add CLI build concurrency option
0525465 docs: add note about cjsDefault only applying to explicit entry modules
a3a3551 refactor: fix lint
3dec506 refactor: use native Promise.withResolvers
e0266c1 docs: add tsdown users image
a733505 refactor: upgrade verkit, simplify version parse
e5fe2ca style: format
3e1fc63 chore: release v0.22.13
a6c8734 chore: upgrade deps
Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1087.0 to 3.1091.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1091.0

3.1091.0(2026-07-20)

Documentation Changes

client-organizations: Updated InvalidInputException error documentation to clarify that the service validates free-text field values against common cross-site scripting (XSS) patterns. (6ac1bf08)

client-marketplace-metering: For new SaaS product integrations, CustomerIdentifier is not populated in ResolveCustomer responses and is not supported in BatchMeterUsage. Use CustomerAWSAccountId and LicenseArn instead. (f1ff8983)

New Features

client-quicksight: Adds support for custom permissions for Triggers, allowing administrators to control user access to Schedule, Inbound Email and Quick Event triggers. (fbe7d94d)

client-bedrock-agentcore: Add W3C trace context headers (traceparent, tracestate, baggage) and X-Amzn-Trace-Id to InvokeHarness request for end-to-end observability propagation. Add toolResultMetadata to the streaming content block delta for MCP tool result meta delivery without oversized SSE frames. (4cf22ef3)

client-bedrock-agentcore-control: This release adds support for specifying a connector version on Gateway targets to pin the connector's tool schema. It also introduces web-search connector version 1.2.0, which adds agent-side domain filtering, published date range filtering, and admin-side domain allowlisting. (2c37055a)

client-sesv2: Amazon SES introduces three new Pricing Plans (Essentials, Pro, Enterprise), which bundle SES features under one pricing umbrella. The new PutAccountPricingAttributes API lets the user set the account's plan, while current plan retrievalif done through the new PricingAttributes field on GetAccount. (751dc8df)

client-mediatailor: This change adds api support for configuring ad decision server timeouts and concurrency fields on MediaTailor playback configurations (97ea965e)

client-inspector2: Adds Windows path support for deep inspection. Fixes tag propagation for connector CloudFormation stack operations. (2263613f)

Tests

middleware-sdk-route53: loosen date in path assertion (#8212) (e5225182)

For list of updated packages, view updated-packages.md in assets-3.1091.0.zip

v3.1090.0

3.1090.0(2026-07-17)

New Features

clients: update client endpoints as of 2026-07-17 (857153f3)

client-kinesis-analytics-v2: Support for Flink 2.3 in Managed Service for Apache Flink (1ad0421f)

client-gameliftstreams: Amazon GameLift Streams now supports assigning an IAM role to a stream session, enabling your application to securely access resources in your AWS account, such as Amazon S3 buckets and DynamoDB tables. (cf945cdb)

client-rds: Adds the AssociatedRoles parameter to CreateDBCluster, RestoreDBClusterFromSnapshot, RestoreDBClusterToPointInTime, and RestoreDBClusterFromS3, letting customers associate IAM roles with an Aurora DB cluster at create or restore time instead of calling AddRoleToDBCluster afterward. (48b74a43)

client-odb: Adds support for sourcing Autonomous Database admin and wallet passwords from customer-managed AWS Secrets Manager secrets, including password source configuration and summaries, and enabling or disabling the OCI IAM service role for Secrets Manager integration via InitializeService. (d5619c8b)

client-cognito-identity-provider: Amazon Cognito user pools now support sending SMS via AWS End User Messaging. A new EumsSms object in SmsConfigurationType lets you deliver MFA and verification texts through AWS End User Messaging, alongside the existing Amazon SNS option. (600cf8d5)

For list of updated packages, view updated-packages.md in assets-3.1090.0.zip

v3.1089.0

3.1089.0(2026-07-16)

Chores

enable pkg json sorting (#8200) (926898ee)

remove redundant type assertions (#8193) (b41fbb0e)

... (truncated)

Changelog

Sourced from @aws-sdk/client-s3's changelog.

3.1091.0 (2026-07-20)

Note: Version bump only for package @aws-sdk/client-s3

3.1090.0 (2026-07-17)

Note: Version bump only for package @aws-sdk/client-s3

3.1089.0 (2026-07-16)

Note: Version bump only for package @aws-sdk/client-s3

3.1088.0 (2026-07-15)

Note: Version bump only for package @aws-sdk/client-s3

Commits

a1269f7 Publish v3.1091.0
eb268ed Publish v3.1090.0
60e8b54 Publish v3.1089.0
91723d2 docs(client-s3): Documentation update for removing the 30 day minimum restric...
73de389 Publish v3.1088.0
d43e5bf chore(codegen): sync to use typesVersions entries for submodules (#8195)
7d14409 chore: migrate eslint/prettier to oxlint/oxfmt (#8192)
See full diff in compare view

Updates tar from 7.5.21 to 7.5.22

Commits

2a22bfc 7.5.22
df1cd8d Allow transform to be falsey
See full diff in compare view

Updates @prisma/management-api-sdk from 1.47.0 to 1.51.0

Commits

See full diff in compare view

Updates better-auth from 1.6.24 to 1.6.25

Release notes

Sourced from better-auth's releases.

v1.6.25

better-auth

Bug Fixes

Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)

Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)

Fixed $fetch and $store not being exposed on the Solid client (#10444)

Fixed internal adapter queries being routed to the wrong table when a built-in table's modelName was set to another table's schema key (e.g. user.modelName = "account").

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@birkskyum, @jsj, @krish-vachhani

Full changelog: v1.6.24...v1.6.25

Changelog

Sourced from better-auth's changelog.

1.6.25

Patch Changes

#10479 5124c34 Thanks @krish-vachhani! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.

#10444 7439359 Thanks @birkskyum! - Expose the real $fetch instance and $store atoms from the Solid client instead of resolving them as dynamic API routes.

Updated dependencies [0ffd1fb]:

@better-auth/core@1.6.25

@better-auth/drizzle-adapter@1.6.25

@better-auth/kysely-adapter@1.6.25

@better-auth/memory-adapter@1.6.25

@better-auth/mongo-adapter@1.6.25

@better-auth/prisma-adapter@1.6.25

@better-auth/telemetry@1.6.25

Commits

07a646e chore: release v1.6.25 (#10491)
7439359 fix(solid): expose $fetch and $store on the solid client (#10444)
dac701c chore(deps): bump next from 16.2.6 to 16.2.11 (#10493)
5124c34 fix(one-tap): enforce google provider signup restrictions (#10479)
See full diff in compare view

Updates hono from 4.12.31 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates next from 16.2.10 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
fe28768 [16.x] fix(next/image): improve performance of detectContentType()
d8afb8d [16.x] Performance improvements when decoding React Server function payloads
Additional commits viewable in compare view

dependabot · 2026-07-31T11:19:51Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

pkg-pr-new · 2026-07-31T11:21:57Z

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@189

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@189

commit: bf4da54

…h 9 updates Bumps the runtime-deps group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tsdown](https://github.com/rolldown/tsdown) | `0.22.12` | `0.22.14` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1087.0` | `3.1091.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.21` | `7.5.22` | | [@prisma/management-api-sdk](https://github.com/prisma/pdp-control-plane/tree/HEAD/packages/management-api-sdk) | `1.47.0` | `1.51.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.24` | `1.6.25` | | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.12.32` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [next](https://github.com/vercel/next.js) | `16.2.10` | `16.2.11` | Updates `tsdown` from 0.22.12 to 0.22.14 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.22.12...v0.22.14) Updates `@aws-sdk/client-s3` from 3.1087.0 to 3.1091.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1091.0/clients/client-s3) Updates `tar` from 7.5.21 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.21...v7.5.22) Updates `@prisma/management-api-sdk` from 1.47.0 to 1.51.0 - [Commits](https://github.com/prisma/pdp-control-plane/commits/HEAD/packages/management-api-sdk) Updates `better-auth` from 1.6.24 to 1.6.25 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.6.25/packages/better-auth) Updates `hono` from 4.12.31 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.12.32) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `next` from 16.2.10 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.10...v16.2.11) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1091.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime-deps - dependency-name: "@prisma/management-api-sdk" dependency-version: 1.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime-deps - dependency-name: better-auth dependency-version: 1.6.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: tar dependency-version: 7.5.22 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: tsdown dependency-version: 0.22.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot force-pushed the dependabot/npm_and_yarn/main/runtime-deps-3dc02f1ee8 branch from ab61b6d to bf4da54 Compare July 31, 2026 15:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)(deps): Bump the runtime-deps group across 1 directory with 9 updates - #189

chore(deps)(deps): Bump the runtime-deps group across 1 directory with 9 updates#189
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/runtime-deps-3dc02f1ee8

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 31, 2026

Uh oh!

pkg-pr-new Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.22.14

🚀 Features

View changes on GitHub

v0.22.13

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v3.1091.0

3.1091.0(2026-07-20)

Documentation Changes

New Features

Tests

v3.1090.0

3.1090.0(2026-07-17)

New Features

v3.1089.0

3.1089.0(2026-07-16)

Chores

3.1091.0 (2026-07-20)

3.1090.0 (2026-07-17)

3.1089.0 (2026-07-16)

3.1088.0 (2026-07-15)

v1.6.25

better-auth

Bug Fixes

Contributors

1.6.25

Patch Changes

v4.12.32

What's Changed

19.2.8 (July 21st, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

v16.2.11

Uh oh!

dependabot Bot commented on behalf of github Jul 31, 2026

Labels

Uh oh!

pkg-pr-new Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

`better-auth`

pkg-pr-new Bot commented Jul 31, 2026 •

edited

Loading