tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-10 05:12:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,979 Commits 11 Branches 539 Tags
ba4e34f09ecdd3f2be60b8da8d4ff1fededfd55a
Commit Graph
205 Commits
Author SHA1 Message Date
Marc-André Bombeck 97b1603cb9 Pin mysql2 past GHSA-3f6p-5ww8-9rcr in both installs 
The dependency audit went red on the release branch: mysql2 below 3.22.0
downgrades its auth plugin to mysql_clear_password and leaks the
credential. It reaches the tree only through prisma's MySQL driver, which
this app never opens, but the gate does not distinguish reachable from
present. Pinned to ^3.22.0 in the workspace overrides and mirrored with
npm's own override for the /opt/prisma-cli install, the pair the
lockstep guard holds together. The audit reads three moderates, below
the gate.
 2026-09-01 20:53:47 +02:00
Marc-André Bombeck b1d6765790 Merge pull request #875 from MBombeck/dependabot/npm_and_yarn/vitejs/plugin-react-6.1.0 
chore(deps-dev): bump @vitejs/plugin-react from 6.0.4 to 6.1.0
 2026-08-30 22:24:11 +02:00
Marc-André Bombeck 78921399fb Merge pull request #877 from MBombeck/dependabot/npm_and_yarn/radix-ui-1.6.7 
chore(deps): bump radix-ui from 1.6.2 to 1.6.7
 2026-08-30 22:07:32 +02:00
Marc-André Bombeck e7d40e22b0 Merge pull request #876 from MBombeck/dependabot/npm_and_yarn/lucide-react-1.34.0 
chore(deps): bump lucide-react from 1.27.0 to 1.34.0
 2026-08-30 22:05:58 +02:00
Marc-André Bombeck 68f33dad5f Merge pull request #874 from MBombeck/dependabot/npm_and_yarn/next/bundle-analyzer-16.3.3 
chore(deps-dev): bump @next/bundle-analyzer from 16.3.1 to 16.3.3
 2026-08-30 22:00:18 +02:00
Marc-André Bombeck 0be1663989 Merge pull request #873 from MBombeck/dependabot/npm_and_yarn/hookform/resolvers-5.9.1 
chore(deps): bump @hookform/resolvers from 5.4.0 to 5.9.1
 2026-08-30 21:58:27 +02:00
dependabot[bot] c532f60c57 chore(deps): bump radix-ui from 1.6.2 to 1.6.7 
Bumps [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) from 1.6.2 to 1.6.7.
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui)

---
updated-dependencies:
- dependency-name: radix-ui
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 19:17:23 +00:00
dependabot[bot] 07b32617d2 chore(deps): bump lucide-react from 1.27.0 to 1.34.0 
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 1.27.0 to 1.34.0.
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 19:02:53 +00:00
dependabot[bot] 098cc9d5d4 chore(deps-dev): bump @vitejs/plugin-react from 6.0.4 to 6.1.0 
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.0.4 to 6.1.0.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 19:02:16 +00:00
dependabot[bot] 5898742fa3 chore(deps-dev): bump @next/bundle-analyzer from 16.3.1 to 16.3.3 
Bumps [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) from 16.3.1 to 16.3.3.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.3/packages/next-bundle-analyzer)

---
updated-dependencies:
- dependency-name: "@next/bundle-analyzer"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 19:01:40 +00:00
dependabot[bot] 2e6e133409 chore(deps): bump @hookform/resolvers from 5.4.0 to 5.9.1 
Bumps [@hookform/resolvers](https://github.com/react-hook-form/resolvers) from 5.4.0 to 5.9.1.
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](https://github.com/react-hook-form/resolvers/compare/v5.4.0...v5.9.1)

---
updated-dependencies:
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 19:00:56 +00:00
Marc-André Bombeck 9f07a46633 fix: declare pg as the runtime dependency it already was 
The Dockerfile asserts that the standalone image can resolve pg, because
pg-boss loads it through native Node resolution. That assertion has been
passing on a coincidence: pg sat in devDependencies, and the version our own
entry pinned happened to match the one @prisma/adapter-pg pulled in, so both
names resolved to a single copy in the store and Next's file tracer packed it
whole.

Bumping the adapter to 7.10.0 moves its transitive pg to 8.23.0 while ours
stayed at 8.22.0. The tracer packs only the copy the adapter reaches, the
top-level link points at the other one, and the image fails to build on both
architectures:

    Error: Cannot find module '/app/node_modules/pg/lib/index.js'

Move pg into dependencies at ^8.23.0. The lockfile now carries one pg version
instead of two, so the two resolutions cannot drift apart again on the next
adapter release. Carries the adapter bump from #865, which cannot build alone.
 2026-08-30 20:49:46 +02:00
Marc-André Bombeck eb49580271 Merge pull request #868 from MBombeck/dependabot/npm_and_yarn/zod-openapi-6.0.1 
chore(deps): bump zod-openapi from 6.0.0 to 6.0.1
 2026-08-30 20:47:35 +02:00
Marc-André Bombeck 95a75cd9e0 Merge pull request #862 from MBombeck/dependabot/npm_and_yarn/knip-6.32.3 
chore(deps-dev): bump knip from 6.32.2 to 6.32.3
 2026-08-30 20:47:27 +02:00
Marc-André Bombeck 58de37cf52 Merge pull request #869 from MBombeck/dependabot/npm_and_yarn/simplewebauthn/server-13.3.3 
chore(deps): bump @simplewebauthn/server from 13.3.2 to 13.3.3
 2026-08-30 20:19:17 +02:00
dependabot[bot] e87d44952c chore(deps-dev): bump knip from 6.32.2 to 6.32.3 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 6.32.2 to 6.32.3.
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.3/packages/knip)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.32.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 18:16:04 +00:00
dependabot[bot] a425cf58bf chore(deps): bump @simplewebauthn/server from 13.3.2 to 13.3.3 
Bumps [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) from 13.3.2 to 13.3.3.
- [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases)
- [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md)
- [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v13.3.3/packages/server)

---
updated-dependencies:
- dependency-name: "@simplewebauthn/server"
  dependency-version: 13.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 15:56:00 +00:00
dependabot[bot] 89b630060d chore(deps): bump zod-openapi from 6.0.0 to 6.0.1 
Bumps [zod-openapi](https://github.com/samchungy/zod-openapi) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/samchungy/zod-openapi/releases)
- [Changelog](https://github.com/samchungy/zod-openapi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/samchungy/zod-openapi/compare/zod-openapi@6.0.0...zod-openapi@6.0.1)

---
updated-dependencies:
- dependency-name: zod-openapi
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 15:55:30 +00:00
dependabot[bot] b16f5f9947 chore(deps): bump @node-rs/argon2 from 2.0.2 to 2.1.0 
Bumps [@node-rs/argon2](https://github.com/napi-rs/node-rs) from 2.0.2 to 2.1.0.
- [Release notes](https://github.com/napi-rs/node-rs/releases)
- [Commits](https://github.com/napi-rs/node-rs/compare/@node-rs/argon2@2.0.2...@node-rs/argon2@2.1.0)

---
updated-dependencies:
- dependency-name: "@node-rs/argon2"
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-30 15:55:00 +00:00
Marc-André Bombeck ba3cf30035 Override flatted, js-yaml and minimatch past their advisories 
- flatted 3.3.3 → 3.4.4: prototype pollution and unbounded recursion in
  parse(), fixed in 3.4.2 / 3.4.0.
- js-yaml 4.1.1 → 4.3.1: quadratic CPU on merge-key chains and !!omap
  resolution. The override is bounded to >=4.0.0 so a hypothetical 3.x
  consumer is never dragged onto a new major.
- minimatch 3.1.3 → 3.1.5: ReDoS via nested extglobs. The scanner
  suggested 10.x, but the fix is backported — only <3.1.4 is vulnerable —
  so the 3.x line stays where its consumers (eslint) expect it. The 5.x,
  9.x and 10.x copies in the tree were never affected.

The refreshed lockfile also carries brace-expansion 1.1.12 → 1.1.18
transitively, which clears that package's DoS advisories. pnpm audit
reports none of these packages afterwards.
 2026-08-29 19:21:00 +02:00
Marc-André Bombeck b9fe29c066 Bump knip from 6.16.1 to 6.32.2 
The newer resolver tracks each re-export as its own reference site, so a
barrel line that nothing imports is now reported instead of being counted
as used whenever the underlying symbol was used anywhere. The gate goes
from zero findings to 206 on unchanged code.
 2026-08-23 19:11:12 +02:00
dependabot[bot] 8ecf7e5595 Bump @napi-rs/canvas from 1.0.2 to 1.0.7 (#836) 
Bumps [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) from 1.0.2 to 1.0.7.
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Brooooooklyn/canvas/compare/v1.0.2...v1.0.7)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:55:24 +02:00
dependabot[bot] b217bb2618 Bump @next/bundle-analyzer from 16.2.12 to 16.3.1 (#834) 
Bumps [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) from 16.2.12 to 16.3.1.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.1/packages/next-bundle-analyzer)

---
updated-dependencies:
- dependency-name: "@next/bundle-analyzer"
  dependency-version: 16.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:36:00 +02:00
dependabot[bot] ff133eacdf Bump @tailwindcss/postcss from 4.3.0 to 4.3.3 (#835) 
Bumps [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) from 4.3.0 to 4.3.3.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss)

---
updated-dependencies:
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:35:09 +02:00
dependabot[bot] ece7253a42 Bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0 (#831) 
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.29.0 to 1.30.0.
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:29:10 +02:00
Marc-André Bombeck b8859ae424 Force the patched deepmerge-ts through Prisma's config loader 
A new advisory turned the dependency audit red on the trunk without a line of
our code changing: DeepmergeTS recurses without bound on deeply nested input
until the stack gives out (GHSA-ggr8-5vv4-36mx, fixed in 8.0.0). Re-running the
same job against the same main commit that passed on 16 August confirms it is
the advisory database that moved, not us.

Waiting for Prisma does not help. `@prisma/config` still asks for 7.1.5 on the
current 7.9.1, so the copy never updates on its own, and an override is the only
route to the patched version. The workflow reserves `auditConfig.ignoreCves` for
advisories with no upstream fix, which is not this one.

The reach is the config-loading and CLI path rather than anything under a
request, so the practical exposure was small. The blocked release train was not.

Verified rather than assumed: `pnpm audit --prod --audit-level=high`, the exact
command CI runs, drops from twelve findings with one high to eleven with none
and exits clean. Because this is a major bump under Prisma's own config loader,
`prisma generate` and `prisma validate` were run explicitly alongside typecheck,
lint, format, 21446 unit tests and the production build. All pass.
 2026-08-20 08:58:16 +02:00
Marc-André Bombeck 08fd7c208f Merge pull request #762 from MBombeck/dependabot/npm_and_yarn/playwright/test-1.62.1 
Bump @playwright/test from 1.60.0 to 1.62.1
 2026-08-16 20:11:17 +02:00
Marc-André Bombeck 2435c9cefe Merge pull request #760 from MBombeck/dependabot/npm_and_yarn/pg-boss-12.27.0 
Bump pg-boss from 12.26.0 to 12.27.0
 2026-08-16 20:10:37 +02:00
dependabot[bot] 552f11c21f Bump @playwright/test from 1.60.0 to 1.62.1 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.60.0 to 1.62.1.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.60.0...v1.62.1)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 17:27:52 +00:00
dependabot[bot] c9a3132893 Bump testcontainers from 12.0.3 to 12.1.0 
Bumps [testcontainers](https://github.com/testcontainers/testcontainers-node) from 12.0.3 to 12.1.0.
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.3...v12.1.0)

---
updated-dependencies:
- dependency-name: testcontainers
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 17:27:38 +00:00
Marc-André Bombeck 50e4138ed5 Merge pull request #761 from MBombeck/dependabot/npm_and_yarn/testcontainers/postgresql-12.1.0 
Bump @testcontainers/postgresql from 12.0.3 to 12.1.0
 2026-08-16 19:25:17 +02:00
dependabot[bot] 73c3eff294 Bump @testcontainers/postgresql from 12.0.3 to 12.1.0 
Bumps [@testcontainers/postgresql](https://github.com/testcontainers/testcontainers-node) from 12.0.3 to 12.1.0.
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.3...v12.1.0)

---
updated-dependencies:
- dependency-name: "@testcontainers/postgresql"
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:09 +00:00
dependabot[bot] 238d63f3b9 Bump pg-boss from 12.26.0 to 12.27.0 
Bumps [pg-boss](https://github.com/timgit/pg-boss) from 12.26.0 to 12.27.0.
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](https://github.com/timgit/pg-boss/compare/12.26.0...12.27.0)

---
updated-dependencies:
- dependency-name: pg-boss
  dependency-version: 12.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:07 +00:00
dependabot[bot] cc670633ff Bump prettier from 3.9.1 to 3.9.6 
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.1 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.1...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:05 +00:00
Marc-André Bombeck 5374bed5b7 Raise the nanoid override floor past the zero-size loop advisory 2026-08-13 20:57:58 +02:00
Marc-André Bombeck c2f67c96d4 fix(deps): float nanoid past an infinite-loop flaw 
A fresh advisory names nanoid below 3.3.17: a custom generator can loop
forever when asked for a zero-size id. It reaches the tree only through
next and postcss, but the audit gate rightly blocks on a known HIGH with
a fix available. Bounded override in the established pattern; the audit
drops from one high to none.
 2026-08-07 23:58:34 +02:00
Marc-André Bombeck 315ca5e67c fix(deps): move the PDF renderer past a script-execution flaw 
pdfjs-dist 6.1.200 and a transitive 5.6.205 both sit in the affected range
of a flaw that lets a crafted PDF run JavaScript inside the renderer. The
document vault feeds it every uploaded PDF, so pin the direct dependency to
6.2.108 and add a bounded override so the transitive copy lands there too.
The override stops short of pdf-parse's 5.4.296, which predates the flaw and
drives the local text-extraction path.

The runtime image ships every pdfjs-dist copy in the store, not just the one
that gets loaded, so an unused transitive copy still counted.

Hoisting in the image picked whichever copy the filesystem listed first, and
more than one copy reaches it, so the version named in package.json was not
reliably the one the renderer resolved. Carry the resolved version forward
from the build stage, select it by name, and fail the build when it is
missing rather than leaving another copy in its place.
 2026-08-07 14:35:23 +02:00
Marc-André Bombeck a08aa342b2 Pin ip-address past the leading-zero parsing advisory 
Address4 decoded a leading-zero octet as decimal, so `010.0.0.1` parsed as
10.0.0.1 instead of being rejected. That is precisely the alternate-notation
class `isPublicUrl` was written to catch, and this copy arrives transitively
under the MCP SDK's rate limiter, where nothing of ours screens the value
first. The production tree resolved 10.2.0 while the dev tree already had a
fixed one, so the override names the floor rather than trusting resolution.
 2026-08-04 01:30:57 +02:00
Marc-André Bombeck f41605efba Close two high advisories on the outbound path 
`undici` moves to 8.10.0 and the `fast-uri` override rises to 3.1.5. Both were
published as high after the last run on the trunk, so this is new information
rather than neglect, and both matter here: undici is what backs `safeFetch`,
which is the one documented egress boundary and the place the connect-time
DNS-rebinding pin lives.

The undici advisory is a cross-user information disclosure and a parse-time
crash through degenerate private cache directives. `fast-uri` arrives four ways
through transitive dependencies and the existing override was pinned one patch
short of the fix.

The safe-fetch dispatcher suite passes against the new client, which is the
part that had to be checked rather than assumed: the pin reaches into undici's
connect hook and a client bump is exactly where that could quietly stop being
enforced.
 2026-08-03 22:10:15 +02:00
dependabot[bot] 9e61e73dec build(deps-dev): bump shadcn from 4.13.0 to 4.16.1 
Bumps [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) from 4.13.0 to 4.16.1.
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.16.1/packages/shadcn)

---
updated-dependencies:
- dependency-name: shadcn
  dependency-version: 4.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 16:15:56 +00:00
Marc-André Bombeck a0fc404fb8 Merge pull request #697 from MBombeck/dependabot/npm_and_yarn/tanstack/react-query-5.101.4 
build(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4
 2026-08-03 18:13:01 +02:00
Marc-André Bombeck e621da670c Merge pull request #696 from MBombeck/dependabot/npm_and_yarn/react-hook-form-7.83.0 
build(deps): bump react-hook-form from 7.81.0 to 7.83.0
 2026-08-03 18:12:53 +02:00
Marc-André Bombeck 5da64628ec Merge pull request #695 from MBombeck/dependabot/npm_and_yarn/eslint-config-next-16.2.12 
build(deps-dev): bump eslint-config-next from 16.2.6 to 16.2.12
 2026-08-03 18:12:46 +02:00
dependabot[bot] 15bd7e660a build(deps): bump react-hook-form from 7.81.0 to 7.83.0 
Bumps [react-hook-form](https://github.com/react-hook-form/react-hook-form) from 7.81.0 to 7.83.0.
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.81.0...v7.83.0)

---
updated-dependencies:
- dependency-name: react-hook-form
  dependency-version: 7.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:27 +00:00
dependabot[bot] ad18303f7e build(deps-dev): bump eslint-config-next from 16.2.6 to 16.2.12 
Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.2.6 to 16.2.12.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:23 +00:00
dependabot[bot] 02ff6dff2b build(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4 
Bumps [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) from 5.101.2 to 5.101.4.
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:20 +00:00
dependabot[bot] 8779fb9cc9 build(deps): bump @prisma/adapter-pg from 7.8.0 to 7.9.1 
Bumps [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) from 7.8.0 to 7.9.1.
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.9.1/packages/adapter-pg)

---
updated-dependencies:
- dependency-name: "@prisma/adapter-pg"
  dependency-version: 7.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:01 +00:00
Marc-André Bombeck b1e20f59dc release: prepare v1.34.1 2026-07-29 17:31:31 +02:00
Marc-André Bombeck 4be01a67f0 chore(release): fold in the coach discriminant, the dependency bumps, and the notes the audit found wrong 2026-07-26 18:57:21 +02:00
Marc-André Bombeck 938e84a43a chore(release): v1.32.2 — Next.js 16.2.11, closing four high-severity App Router advisories 2026-07-23 11:41:19 +02:00