Deliberately held (need separate, tested upgrades)
better-auth trio (better-auth, @better-auth/oauth-provider, @better-auth/sso): kept pinned at 1.6.11 (1.6.18 available). Pinned together after the SSO stabilization in 3.16/3.17 (#307, #313); bumping needs an end-to-end SSO test, not a routine refresh.
Major bumps held: TypeScript 6 (from 5.9), lucide-react 1 (from 0.577), uuid 14 (from 13), @astrojs/mdx 6 (from 5), jsdom 29 (from 28). Each can introduce breaking changes that aren't locally verifiable here, so they're left for individual, tested upgrades.
Verification
App: bun test green (339 pass / 4 skip / 0 fail).
Build / typecheck / E2E and the website build are left to CI (app build + astro check + E2E; Cloudflare Pages for www).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/RayLabsHQ/gitea-mirror/pull/325
**Author:** [@arunavo4](https://github.com/arunavo4)
**Created:** 6/14/2026
**Status:** ✅ Merged
**Merged:** 6/14/2026
**Merged by:** [@arunavo4](https://github.com/arunavo4)
**Base:** `main` ← **Head:** `chore/deps-update`
---
### 📝 Commits (2)
- [`07de531`](https://github.com/RayLabsHQ/gitea-mirror/commit/07de531bf1b4e47105baa4354449ef9d431b58d1) chore(deps): update app dependencies to latest in-range versions
- [`9638da0`](https://github.com/RayLabsHQ/gitea-mirror/commit/9638da062b6b8f2cd5a51d5e7c6d2573870c853f) chore(deps): update website (www) dependencies to latest in-range versions
### 📊 Changes
**4 files changed** (+1093 additions, -1095 deletions)
<details>
<summary>View changed files</summary>
📝 `bun.lock` (+315 -313)
📝 `package.json` (+42 -42)
📝 `www/package.json` (+11 -11)
📝 `www/pnpm-lock.yaml` (+725 -729)
</details>
### 📄 Description
Comprehensive in-range dependency refresh across both the app and the website (`www`), replacing the piecemeal dependabot PR (#324, closed).
## Updated (safe, within existing semver ranges)
**App** (`bun update` + one pinned bump): astro 6.0.4 → 6.4.6, react/react-dom 19.2.4 → 19.2.7, all Radix UI components, tailwindcss + @tailwindcss/vite 4.2 → 4.3, zod 4.3 → 4.4, fuse.js 7.1 → 7.4, @tanstack/react-virtual, @astrojs/react → 5.0.7, @astrojs/check → 0.9.9, nanoid, dotenv, uuid 13.0.0 → 13.0.2, plus dev deps (vitest 4.1.8, @playwright/test 1.60.0, tsx, @types/*, drizzle-kit). `@astrojs/node` (pinned) bumped 10.0.1 → 10.1.4.
**Website** (`pnpm update`): astro 6.4.6, react/react-dom 19.2.7, tailwindcss 4.3.1, @astrojs/react 5.0.7, @splinetool/runtime, @radix-ui/react-slot, tailwind-merge.
## Deliberately held (need separate, tested upgrades)
- **better-auth trio** (`better-auth`, `@better-auth/oauth-provider`, `@better-auth/sso`): kept pinned at 1.6.11 (1.6.18 available). Pinned together after the SSO stabilization in 3.16/3.17 (#307, #313); bumping needs an end-to-end SSO test, not a routine refresh.
- **Major bumps held:** TypeScript 6 (from 5.9), lucide-react 1 (from 0.577), uuid 14 (from 13), @astrojs/mdx 6 (from 5), jsdom 29 (from 28). Each can introduce breaking changes that aren't locally verifiable here, so they're left for individual, tested upgrades.
## Verification
- App: `bun test` green (339 pass / 4 skip / 0 fail).
- Build / typecheck / E2E and the website build are left to CI (app build + astro check + E2E; Cloudflare Pages for `www`).
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/RayLabsHQ/gitea-mirror/pull/325
Author: @arunavo4
Created: 6/14/2026
Status: ✅ Merged
Merged: 6/14/2026
Merged by: @arunavo4
Base:
main← Head:chore/deps-update📝 Commits (2)
07de531chore(deps): update app dependencies to latest in-range versions9638da0chore(deps): update website (www) dependencies to latest in-range versions📊 Changes
4 files changed (+1093 additions, -1095 deletions)
View changed files
📝
bun.lock(+315 -313)📝
package.json(+42 -42)📝
www/package.json(+11 -11)📝
www/pnpm-lock.yaml(+725 -729)📄 Description
Comprehensive in-range dependency refresh across both the app and the website (
www), replacing the piecemeal dependabot PR (#324, closed).Updated (safe, within existing semver ranges)
App (
bun update+ one pinned bump): astro 6.0.4 → 6.4.6, react/react-dom 19.2.4 → 19.2.7, all Radix UI components, tailwindcss + @tailwindcss/vite 4.2 → 4.3, zod 4.3 → 4.4, fuse.js 7.1 → 7.4, @tanstack/react-virtual, @astrojs/react → 5.0.7, @astrojs/check → 0.9.9, nanoid, dotenv, uuid 13.0.0 → 13.0.2, plus dev deps (vitest 4.1.8, @playwright/test 1.60.0, tsx, @types/*, drizzle-kit).@astrojs/node(pinned) bumped 10.0.1 → 10.1.4.Website (
pnpm update): astro 6.4.6, react/react-dom 19.2.7, tailwindcss 4.3.1, @astrojs/react 5.0.7, @splinetool/runtime, @radix-ui/react-slot, tailwind-merge.Deliberately held (need separate, tested upgrades)
better-auth,@better-auth/oauth-provider,@better-auth/sso): kept pinned at 1.6.11 (1.6.18 available). Pinned together after the SSO stabilization in 3.16/3.17 (#307, #313); bumping needs an end-to-end SSO test, not a routine refresh.Verification
bun testgreen (339 pass / 4 skip / 0 fail).www).🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.