build(deps): bump the minor-and-patch group across 1 directory with 19 updates

[dependabot]

Bumps the minor-and-patch group with 19 updates in the / directory:

Package	From	To
@trycua/cua-driver	0.20.0	0.27.0
posthog-js	1.415.6	1.429.5
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
@oxlint/plugins	1.80.0	1.82.0
@types/node	26.2.0	26.5.1
oxlint	1.80.0	1.82.0
typebox	1.3.7	1.3.30
wrangler	4.123.0	4.131.0
cnfast	0.1.0	0.2.0
fumadocs-core	16.14.5	16.15.9
fumadocs-mdx	15.3.0	15.4.0
next	16.3.2	16.3.4
postcss	8.5.26	8.5.28
@cloudflare/workers-types	5.20260825.1	5.20260911.1
better-auth	1.7.1	1.7.4
@cloudflare/vitest-plugin	1.0.0	1.1.7

Updates @trycua/cua-driver from 0.20.0 to 0.27.0

Release notes

Sourced from @​trycua/cua-driver's releases.

cua-driver-rs: v0.27.0

Cua Driver 0.27.0

Summary

This release adds 1 features and includes 3 fixes.

Features

• share typed MCP connection across language bindings. (#3715)

Fixes

• eliminate duplicate Swift bridge symbols. (#3680) Thanks @​grishy.
• normalize repeated macOS consent labels. (#3706)
• retry safe Hyprland stale geometry refusals. (#3732)

Contributors

Thanks to @​grishy for contributing to this release.

Install

macOS and Linux:

/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"

Windows:

irm https://cua.ai/driver/install.ps1 | iex

Cua Driver ships universal macOS binaries, x86_64 and arm64 Windows builds, and Linux preview builds. Release assets also include tag-pinned installer and uninstaller scripts.

Why GitHub says “Pre-release”

GitHub's label is used only to keep this monorepo's repository-wide “Latest” pointer from switching between independently released products. A plain Cua Driver SemVer is a stable release; npm and PyPI publish it on their normal stable channels, and the installers resolve the versioned cua-driver-rs-v* releases directly.

SHA256 Checksums

</tr></table> 

... (truncated)

Commits

• 082de43 chore(main): release cua-driver-rs 0.27.0 (#3717)
• 27078d8 fix(cua-driver): retry safe Hyprland stale geometry refusals (#3732)
• 481f3ec feat(cua-driver): share typed MCP connection across language bindings (#3715)
• 1fc279d fix(fleet): bound streamed HTTP responses (#3733)
• 88eda3e ci(fleet): promote cua-fleet 0.1.17 wheels (#3734)
• c918c7e fix(fleet-sdk): bound streamed HTTP responses (#7727)
• 88933ac ci(cua-driver): support headless hosted macOS capture
• 5d89b57 ci(cua-driver): fix hosted probe runner context
• 6730c57 ci(cua-driver): add a hosted macOS E2E environment probe
• 55f4304 test(cua-driver): scale Linux screenshot coordinates (#3724)
• Additional commits viewable in compare view

Updates posthog-js from 1.415.6 to 1.429.5

Release notes

Sourced from posthog-js's releases.

posthog-js@1.429.5

1.429.5

Patch Changes

• #4579 19e78cc Thanks @​turnipdabeets! - Cap the retry delay for log exports at 30 seconds, the ceiling the logs contract states. It previously doubled to 64 times the flush interval — 192s on web, 640s on React Native — so a log export now resumes within 30 seconds of a failing endpoint recovering, at the cost of more retry requests while that endpoint is down. (2026-09-10)

• #4579 19e78cc Thanks @​turnipdabeets! - Keep backing off a failing log flush while new records arrive, instead of the next record resetting the retry to the flush interval. (2026-09-10)

• #4579 19e78cc Thanks @​turnipdabeets! - Logs and metrics now always send service.name and telemetry.sdk.*, even when a resourceAttributes value is too large to encode in full. Previously that value could crowd them out, and the records reached PostHog with no service attribution. (2026-09-10)

• Updated dependencies [19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc, 19e78cc]:

  • @​posthog/core@​1.53.0
  • @​posthog/types@​1.411.0

posthog-js@1.429.4

1.429.4

Patch Changes

• #4862 3278cd0 Thanks @​pauldambra! - Call the original console method with the console as its receiver when recording console logs. The wrapper passed undefined instead, and passed no receiver at all when reporting its own failures, which a console implementation is free to reject. (2026-09-10)

• #4887 0da006c Thanks @​posthog! - Error tracking no longer counts an injected script as your own code. A stack frame is in_app only when its filename names a script your app was served — http(s), file, blob, app, capacitor, ionic, a bundler scheme, or a bare path. A frame served over any other scheme, such as an in-app browser bridge on iabjs:// or an extension content script on chrome-extension://, is kept for context but no longer groups the issue under your code. (2026-09-10)

• #4837 99b4fc7 Thanks @​pauldambra! - Stop recording autoplay attribute mutations on <video> and <audio> during session replay. The check compared a lowercase tag name against Element.tagName, which is uppercase for HTML elements, so a looping background video emitted a mutation for every autoplay toggle. (2026-09-10)

• Updated dependencies [0da006c]:

  • @​posthog/core@​1.52.2

posthog-js@1.429.3

1.429.3

Patch Changes

• #4878 14ba783 Thanks @​dustinbyrne! - Allow null bootstrap values and treat null or empty distinct IDs as missing. (2026-09-10)

• #4831 9498567 Thanks @​posthog! - Log a console message when advanced_disable_feature_flags stops surveys from displaying (2026-09-10)

• Updated dependencies [14ba783, 9498567]:

  • @​posthog/types@​1.410.1

posthog-js@1.429.2

1.429.2

Patch Changes

... (truncated)

Commits

• 1bef871 chore: update versions and lockfile [version bump]
• 19e78cc feat(node): distributed tracing spans (#4579)
• 58ec8d6 chore: update versions and lockfile [version bump]
• 39420d8 feat(mcp): capture resource discovery and reads (#4830)
• 3c85b4e chore: update versions and lockfile [version bump]
• 0da006c fix(error-tracking): classify in_app by filename scheme (#4887)
• dbd6def ci: explain npm lag on immutable S3 upload conflicts (#4905)
• 99b4fc7 fix(replay): ignore autoplay mutations regardless of tag name case (#4837)
• 3278cd0 fix(replay): bind console log wrapper to the logger it patched (#4862)
• 0733aa5 chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (#36752)
• 900ae09 [flow] Bump flow to v0.317.0 (#36701)
• fbb1370 [flow] Bump flow to v0.307.1 (#36199)
• 56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
• 74568e8 [Flight] Transport AggregateErrors.errors (#36156)
• e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
• db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
• 3e1abcc [tests] Require exact error messages in assertConsole helpers (#35497)
• Additional commits viewable in compare view

Updates @types/react from 19.2.18 to 19.3.0

Commits

• See full diff in compare view

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without repo...

  Description has been truncated

[DivyamTalwar]

Closing as blocked by a confirmed schema incompatibility. The aggregate update includes Better Auth 1.7.4, and its Registry CI fails 28 tests with requiring the migration. It also bundles multiple majors and broad runtime changes, so it needs to be split into migration-aware, independently tested updates rather than merged as one batch.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[DivyamTalwar]

Clarification: the failing Registry job reported BetterAuthError: Database schema mismatch; Better Auth requires the account.issuer schema migration before this dependency can be adopted. The aggregate also combines runtime, framework, and tooling changes, so it should be regenerated as smaller migration-aware PRs rather than merged as one batch.