chore(deps): update all non-major dependencies

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.23.0 -> 1.24.3
@pandacss/dev (source)	1.5.1 -> 1.7.0
@pandacss/preset-base (source)	1.5.1 -> 1.7.0
@pandacss/preset-panda (source)	1.5.1 -> 1.7.0
@shikijs/rehype (source)	3.17.0 -> 3.19.0
@shikijs/transformers (source)	3.17.0 -> 3.19.0
@sveltejs/kit (source)	2.49.0 -> 2.49.2
@tanstack/svelte-form (source)	1.26.0 -> 1.27.2
@types/bun (source)	1.3.3 -> 1.3.4
@types/node (source)	24.10.1 -> 24.10.3
@types/pg (source)	8.15.6 -> 8.16.0
@vitejs/plugin-react (source)	5.1.1 -> 5.1.2
better-auth (source)	1.4.4 -> 1.4.6
effect (source)	3.19.8 -> 3.19.11
lefthook	2.0.4 -> 2.0.9
lucide-react (source)	0.555.0 -> 0.560.0
lucide-solid (source)	0.555.0 -> 0.560.0
lucide-svelte (source)	0.555.0 -> 0.560.0
lucide-vue-next (source)	0.555.0 -> 0.560.0
next (source)	15.5.7 -> 15.5.8
next (source)	15.5.6 -> 15.5.8
nuxt (source)	4.2.1 -> 4.2.2
prettier (source)	3.7.3 -> 3.7.4
react (source)	19.2.1 -> 19.2.2
react (source)	19.2.0 -> 19.2.2
react-dom (source)	19.2.1 -> 19.2.2
react-dom (source)	19.2.0 -> 19.2.2
react-hook-form (source)	7.67.0 -> 7.68.0
release-it	19.0.6 -> 19.1.0
shiki (source)	3.17.0 -> 3.19.0
svelte (source)	5.45.2 -> 5.45.9
velite	0.3.0 -> 0.3.1
vercel (source)	49.1.2 -> 49.2.0
vinxi (source)	0.5.8 -> 0.5.9
vite (source)	7.2.4 -> 7.2.7
vue-router (source)	4.6.3 -> 4.6.4
vue-tsc (source)	3.1.5 -> 3.1.8

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.24.3

Compare Source

What's Changed

• chore: fix dev dependency security vulnerabilities by @​felixweinberger in #​1227
• chore(deps): bump express from 5.0.1 to 5.2.1 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​1228
• fix: release HTTP connections after POST responses by @​mattzcarey in #​1214
• fix: skip priming events and closeSSEStream for old protocol versions by @​felixweinberger in #​1233
• chore: bump version for patch release by @​felixweinberger in #​1235

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.2...1.24.3

v1.24.2

Compare Source

What's Changed

• feat: add optional resource annotations by @​vhorvath2010 in #​954
• chore: refresh CLAUDE.md by @​LucaButBoring in #​1217
• refactor: make Server class framework-agnostic by moving express to separate module by @​cytle in #​1223
• chore: bump version to 1.24.2 by @​pcarleton in #​1224

New Contributors

• @​vhorvath2010 made their first contribution in #​954
• @​cytle made their first contribution in #​1223

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.1...1.24.2

v1.24.1

Compare Source

What's Changed

• fix(streamableHttp): fix infinite retries when maxRetries is set to 0 by @​mrorigo in #​1216
• chore: update protocol version to 2025-11-25 by @​dsp-ant in #​1218
• chore: bump version for release by @​felixweinberger in #​1219

New Contributors

• @​mrorigo made their first contribution in #​1216

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.0...1.24.1

v1.24.0

Compare Source

Summary

This release brings us up to speed with the latest MCP spec 2025-11-25. Take a look at the latest spec as well as the release blog post.

What's Changed

• fix: update spec links from latest to draft by @​domdomegg in #​1171
• Make sure to consume HTTP error response bodies by @​GreenStage in #​1173
• docs: add GET request handling for streamableHttp stateless mode by @​saharis9988 in #​1161
• SEP-1686: Tasks by @​LucaButBoring in #​1041
• Fix JSON parse error on SSE events with empty data by @​felixweinberger in #​1184
• Fix StreamableHTTPClientTransport instantiation by @​yuwzho in #​944
• feat: eslint rule to prefer node protocols by @​mattzcarey in #​1187
• fix: call tasks/result to deliver side-channel messages by @​felixweinberger in #​1185
• Add invalid_target oauth error (rfc 8707) by @​GreenStage in #​1183
• fix(client): use StreamableHTTPError instead of plain Error in send() by @​yamadashy in #​1178
• coerce 'expires_in' to be a number by @​adam-kuhn in #​1111
• Allow HTTP issuer URLs when MCP_DEV_MODE is enabled by @​jerome3o-anthropic in #​1189
• fix: update registerTool signature for proper typed ToolCallback by @​mattzcarey in #​1188
• SEP-1046: Client credentials flow for M2M without user interaction by @​KKonstantinov in #​1157
• adds the transitive @​types/express-serve-static-core dependency as a direct devDependency by @​mgyarmathy in #​1078
• Fix optional argument handling in prompts for Zod V4 by @​filip-bartuska-ipf in #​1199
• fix hanging stdio servers by @​mattzcarey in #​1200
• README refactor by @​KKonstantinov in #​1197
• [Docs] Fix typo by @​koic in #​1067
• feat: add closeSSEStream callback to RequestHandlerExtra by @​felixweinberger in #​1166
• fix: improve SSE reconnection behavior by @​felixweinberger in #​1191
• fix: normalize headers in sse transport by @​marcrasi in #​856
• feat: add closeStandaloneSSEStream for GET stream polling by @​felixweinberger in #​1203
• fix: normalize null to undefined in ElicitResultSchema content field by @​mattzcarey in #​1204
• Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection. by @​jacopoc in #​1205
• fix: allow zod 4 transformations by @​mattzcarey in #​1213
• feat: backwards-compatible createMessage overloads for SEP-1577 by @​felixweinberger in #​1212
• chore: bump version for release by @​felixweinberger in #​1215

New Contributors

• @​GreenStage made their first contribution in #​1173
• @​saharis9988 made their first contribution in #​1161
• @​yuwzho made their first contribution in #​944
• @​yamadashy made their first contribution in #​1178
• @​adam-kuhn made their first contribution in #​1111
• @​mgyarmathy made their first contribution in #​1078
• @​filip-bartuska-ipf made their first contribution in #​1199
• @​koic made their first contribution in #​1067
• @​marcrasi made their first contribution in #​856
• @​jacopoc made their first contribution in #​1205

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.24.0

v1.23.1

Compare Source

Fixed:

• Disabled SSE priming events to fix backwards compatibility - 1.23.x clients crash on empty SSE data (JSON.parse(""))

This is a patch for servers still on 1.23.x that were breaking clients not handling the the 2025-11-25 priming event behavior with empty SSE data fields. See #​1233 for more details.

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.23.1

chakra-ui/panda (@​pandacss/dev)

v1.7.0

Compare Source

Minor Changes

• 86b30b1: Add panda spec command to generate specification files for your theme (useful for documentation). This
  command generates JSON specification files containing metadata, examples, and usage information.

  # Generate all spec files
  panda spec
  
  # Custom output directory
  panda spec --outdir custom/specs

  Token Spec Structure:

  {
    "type": "tokens",
    "data": [
      {
        "type": "aspectRatios",
        "values": [{ "name": "square", "value": "1 / 1", "cssVar": "var(--aspect-ratios-square)" }],
        "tokenFunctionExamples": ["token('aspectRatios.square')"],
        "functionExamples": ["css({ aspectRatio: 'square' })"],
        "jsxExamples": ["<Box aspectRatio=\"square\" />"]
      }
    ]
  }

  Spec Usage:

  import tokens from 'styled-system/specs/tokens'
  import recipes from 'styled-system/specs/recipes'

Patch Changes

• Updated dependencies [86b30b1]
  • @​pandacss/node@​1.7.0
  • @​pandacss/types@​1.7.0
  • @​pandacss/postcss@​1.7.0
  • @​pandacss/config@​1.7.0
  • @​pandacss/logger@​1.7.0
  • @​pandacss/preset-base@​1.7.0
  • @​pandacss/preset-panda@​1.7.0
  • @​pandacss/token-dictionary@​1.7.0
  • @​pandacss/shared@​1.7.0

v1.6.1

Compare Source

Patch Changes

• @​pandacss/node@​1.6.1
• @​pandacss/postcss@​1.6.1
• @​pandacss/config@​1.6.1
• @​pandacss/logger@​1.6.1
• @​pandacss/preset-base@​1.6.1
• @​pandacss/preset-panda@​1.6.1
• @​pandacss/shared@​1.6.1
• @​pandacss/token-dictionary@​1.6.1
• @​pandacss/types@​1.6.1

v1.6.0

Compare Source

Minor Changes

• 8aa3c64: Add --splitting flag to cssgen command for per-layer CSS output.

  When enabled, CSS is emitted as separate files instead of a single styles.css:

  styled-system/
  ├── styles.css              # @​layer declaration + @​imports
  └── styles/
      ├── reset.css           # Preflight/reset CSS
      ├── global.css          # Global CSS
      ├── tokens.css          # Design tokens
      ├── utilities.css       # Utility classes
      ├── recipes/
      │   ├── index.css       # @​imports all recipe files
      │   └── {recipe}.css    # Individual recipe styles
      └── themes/
          └── {theme}.css     # Theme tokens (not auto-imported)
  

  Usage:

  panda cssgen --splitting

Patch Changes

• Updated dependencies [8aa3c64]
  • @​pandacss/node@​1.6.0
  • @​pandacss/postcss@​1.6.0
  • @​pandacss/config@​1.6.0
  • @​pandacss/logger@​1.6.0
  • @​pandacss/preset-base@​1.6.0
  • @​pandacss/preset-panda@​1.6.0
  • @​pandacss/shared@​1.6.0
  • @​pandacss/token-dictionary@​1.6.0
  • @​pandacss/types@​1.6.0

chakra-ui/panda (@​pandacss/preset-base)

v1.7.0

Compare Source

Patch Changes

• Updated dependencies [86b30b1]
  • @​pandacss/types@​1.7.0

v1.6.1

Compare Source

Patch Changes

• @​pandacss/types@​1.6.1

v1.6.0

Compare Source

Patch Changes

• @​pandacss/types@​1.6.0

chakra-ui/panda (@​pandacss/preset-panda)

v1.7.0

Compare Source

Patch Changes

• Updated dependencies [86b30b1]
  • @​pandacss/types@​1.7.0

v1.6.1

Compare Source

Patch Changes

• @​pandacss/types@​1.6.1

v1.6.0

Compare Source

Patch Changes

• @​pandacss/types@​1.6.0

shikijs/shiki (@​shikijs/rehype)

v3.19.0

Compare Source

   🚀 Features

• Support rootStyle: false option  -  by @​khushthecoder and @​antfu in #​1184 (baf9a)
• transformers:
  • Add classActiveCode option to notation transformers  -  by @​GreenHacker420 in #​1171 (a6a44)
  • Add transformerRemoveComments  -  by @​Bitshifter-9, Copilot, @​crazylogic03 and @​antfu in #​1144 (f2ee3)
• twoslash:
  • Add context parameter to filter option  -  by @​siddu-09 in #​1173 (ac7f5)

   🐞 Bug Fixes

• Add typesVersions for legacy resolution support  -  by @​khushthecoder in #​1179 (100b7)
• core: Check embeddedLanguages in registry dependency check  -  by @​vamsi2246 in #​1178 (6ad16)
• monaco: Correctly handle sparse color map updates  -  by @​wcr-karan in #​1169 (38c7f)

    View changes on GitHub

v3.18.0

Compare Source

   🚀 Features

• transformers: Support zeroIndexed option to transformerMetaHighlight  -  by @​manak-sharma20 in #​1149 (c39ff)

   🐞 Bug Fixes

• core:
  • Correct offset calculation in mergeWhitespaceTokens  -  by @​Karthikeya1500 in #​1162 (15e73)
  • Allow langAlias to special languages, close #​1164  -  by @​antfu in #​1164 (45ab1)

    View changes on GitHub

v3.17.1

Compare Source

   🚀 Features

• core: Enhance string utils with robust edge case handling  -  by @​shekhar-narayan-mishra in #​1154 (a2b68)

   🐞 Bug Fixes

• core: Correctly parse 4-digit hex colors in dimColor  -  by @​shalini-saloni in #​1151 (fcdd3)
• monaco: Ensure correct color map update when switching themes  -  by @​shivank-1011 in #​1155 (d2e94)

    View changes on GitHub

sveltejs/kit (@​sveltejs/kit)

v2.49.2

Compare Source

Patch Changes

• fix: Stop re-loading already-loaded CSS during server-side route resolution (#​15014)

• fix: posixify the instrumentation file import on Windows (#​14993)

• fix: Correctly handle shared memory when decoding binary form data (#​15028)

v2.49.1

Compare Source

Patch Changes

• fix: suppress state_referenced_locally warnings in .svelte-kit/generated/root.svelte (#​15013)

• fix: TypeError when doing response.clone() in page load (#​15005)

TanStack/form (@​tanstack/svelte-form)

v1.27.2

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/form-core@​1.27.2

v1.27.1

Compare Source

Patch Changes

• Updated dependencies [3b080ec]:
  • @​tanstack/form-core@​1.27.1

v1.27.0

Compare Source

Minor Changes

• Add createFormCreator API (#​1713)

Patch Changes

• Updated dependencies [8afbfc3, 4e92a91]:
  • @​tanstack/form-core@​1.27.0

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v5.1.2

Compare Source

better-auth/better-auth (better-auth)

v1.4.6

Compare Source

   🚀 Features

• Add ctx.isTrustedDomain helper  -  by @​jonathansamines in #​6462 (197e8)
• Drizzle pg supports JSON  -  by @​dvanmali in #​6518 (59b61)
• Add Refresh Token Support to Kick OAuth Provider  -  by @​CesarRodrigu in #​6263 (e9543)
• admin: Prevent impersonating admins by default [breaking]  -  by @​jslno and @​Bekacru in #​6454 (9d452)
• expo: Last-login-method client plugin  -  by @​jslno and @​himself65 in #​6413 (b7d32)
• multi-session: Allow to infer additional fields  -  by @​jslno in #​6585 (812a6)
• organization: Allow invited users to see organization name  -  by @​GautamBytes and Copilot in #​6602 (cda99)
• sso: Use domain verified flag to trust providers automatically  -  by @​Paola3stefania (312fc)

   🐞 Bug Fixes

• Avoid throwing on client side  -  by @​landoncolburn and @​Bekacru in #​6361 (bd987)
• Export organization plugin types  -  by @​pffigueiredo in #​6490 (630c5)
• Prematurely deleting active sessions in secondary storage  -  by @​DevDuki in #​3885 (7d0a6)
• Pathname should be normalized when basePath is set to root  -  by @​Bekacru (126e4)
• Make sure non-chunked session data cookie is cleared  -  by @​Bekacru (aa2fb)
• Array field handling across adapters and schema generation  -  by @​ping-maxwell and @​Bekacru in #​6601 (6494d)
• StoreStateStrategy default to database if provided  -  by @​himself65 in #​6619 (49c6b)
• Should always remove 2FA verification token after successful verification  -  by @​delfortrie in #​6604 (c47b5)
• adapter:
  • Add logger creation in adapter factory  -  by @​ping-maxwell in #​6597 (99b4f)
  • Allow run internal adapter outside context  -  by @​himself65 in #​6617 (adb75)
• admin:
  • Clear admin session cookie on stopImpersonating  -  by @​jslno in #​6568 (8e6c6)
• cli:
  • secret generates empty  -  by @​himself65 in #​6504 (0ca6d)
  • Deduplicate drizzle schema relationships  -  by @​ping-maxwell in #​6547 (a501b)
• core:
  • Allow returning null in getUserInfo in provider options  -  by @​Zollerboy1 in #​6528 (d4957)
• db:
  • Correctly unwrap validator result in schema parsing  -  by @​GautamBytes in #​6488 (89030)
• deps:
  • Update dependency next to v16.0.7 [security]  -  in #​6501 (aeb0b)
  • Update dependency @​react-email/components to v1  -  in #​6600 (c4d27)
• kysely:
  • Wrong affected row count in updateMany & deleteMany  -  by @​jslno in #​6572 (df8be)
• magic-link:
  • Handle query params in errorCallbackUrl  -  by @​martinriviere in #​6383 (69b88)
• oidc:
  • Compatibility with exact-optional-property  -  by @​ping-maxwell in #​6502 (51e46)
• openapi:
  • Mark /get-session response as nullable  -  by @​GautamBytes in #​6540 (be00f)
• prisma:
  • Use findFirst instead of findMany for findOne  -  by @​Bekacru in #​6429 (d814c)
• saml:
  • Enforce trusted provider check  -  by @​Paola3stefania in #​6551 (816f1)
• sso:
  • Safely parse provider configs on registration  -  by @​Paola3stefania and @​Bekacru in #​6550 (cfafc)
• username:
  • Await username validator  -  by @​jslno in #​6611 (b4320)

    View changes on GitHub

v1.4.5

Compare Source

Effect-TS/effect (effect)

v3.19.11

Compare Source

Patch Changes

• #​5888 38abd67 Thanks @​gcanti! - filter non-JSON values from schema examples and defaults, closes #​5884

  Introduce JsonValue type and update JsonSchemaAnnotations to use it for
  type safety. Add validation to filter invalid values (BigInt, cyclic refs)
  from examples and defaults, preventing infinite recursion on cycles.

• #​5885 44e0b04 Thanks @​gcanti! - feat(JSONSchema): add missing options for target JSON Schema version in make function, closes #​5883

v3.19.10

Compare Source

Patch Changes

• #​5874 [bd08028](https://redirect.github.com/Effect-TS/eff

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
ark-docs	Ready	Preview	Dec 11, 2025 9:09pm