chore(deps): bump the workspace-minor-patch group with 78 updates

[dependabot]

Bumps the workspace-minor-patch group with 78 updates:

Package	From	To
@biomejs/biome	2.3.6	2.4.16
prettier	3.6.2	3.8.3
prettier-plugin-tailwindcss	0.1.13	0.8.0
turbo	2.6.0	2.9.16
@icons-pack/react-simple-icons	13.8.0	13.13.0
@mux/mux-player-react	3.8.0	3.13.0
@next/mdx	16.1.6	16.2.7
@radix-ui/react-accordion	1.2.12	1.2.13
@radix-ui/react-avatar	1.1.11	1.1.12
@radix-ui/react-checkbox	1.3.3	1.3.4
@radix-ui/react-collapsible	1.1.12	1.1.13
@radix-ui/react-dialog	1.1.15	1.1.16
@radix-ui/react-dropdown-menu	2.1.16	2.1.17
@radix-ui/react-label	2.1.8	2.1.9
@radix-ui/react-navigation-menu	1.2.14	1.2.15
@radix-ui/react-popover	1.1.15	1.1.16
@radix-ui/react-radio-group	1.3.8	1.4.0
@radix-ui/react-scroll-area	1.2.10	1.2.11
@radix-ui/react-select	2.2.6	2.3.0
@radix-ui/react-separator	1.1.8	1.1.9
@radix-ui/react-slot	1.2.4	1.2.5
@radix-ui/react-switch	1.2.6	1.3.0
@radix-ui/react-tabs	1.1.13	1.1.14
@radix-ui/react-toggle	1.1.10	1.1.11
@radix-ui/react-toggle-group	1.1.11	1.1.12
@radix-ui/react-tooltip	1.2.8	1.2.9
@radix-ui/react-use-controllable-state	1.2.2	1.2.3
@tabler/icons-react	3.35.0	3.44.0
@tanstack/react-form	1.25.0	1.33.0
@tanstack/zod-adapter	1.136.18	1.167.0
@vercel/toolbar	0.1.41	0.2.6
flags	4.0.2	4.1.0
motion	12.23.24	12.40.0
next-themes	0.2.1	0.4.6
posthog-js	1.285.1	1.381.0
react	19.2.0	19.2.7
@types/react	19.2.2	19.2.17
react-dom	19.2.0	19.2.7
@types/react-dom	19.2.2	19.2.3
rehype-pretty-code	0.14.1	0.14.3
unist-util-visit	5.0.0	5.1.0
autoprefixer	10.4.21	10.5.0
pagefind	1.4.0	1.5.2
postcss	8.5.6	8.5.15
tsx	4.20.6	4.22.4
@514labs/moose-cli-darwin-arm64	0.3.205	0.6.533
@514labs/moose-cli-darwin-x64	0.3.205	0.6.171
@514labs/moose-cli-linux-arm64	0.3.205	0.6.533
@514labs/moose-cli-linux-x64	0.3.205	0.6.533
@types/vscode	1.110.0	1.120.0
typescript-eslint	8.55.0	8.60.1
@radix-ui/react-hover-card	1.1.15	1.1.16
mixpanel	0.18.1	0.22.0
eslint-config-turbo	2.6.0	2.9.16
tsup	8.5.0	8.5.1
@aws-sdk/client-s3	3.922.0	3.1063.0
@clickhouse/client	1.8.1	1.20.0
@clickhouse/client-web	1.5.0	1.20.0
@temporalio/activity	1.13.1	1.17.2
@temporalio/client	1.13.1	1.17.2
@temporalio/common	1.13.1	1.17.2
@temporalio/worker	1.13.1	1.17.2
@temporalio/workflow	1.13.1	1.17.2
fastq	1.17.1	1.20.1
@modelcontextprotocol/sdk	1.27.1	1.29.0
@bufbuild/buf	1.59.0	1.70.0
rimraf	6.1.0	6.1.3
@anthropic-ai/sdk	0.71.2	0.101.0
@grpc/grpc-js	1.14.3	1.14.4
@grpc/proto-loader	0.8.0	0.8.1
@opentelemetry/otlp-transformer	0.211.0	0.218.0
axios	1.7.9	1.17.0
eslint-config-next	16.1.6	16.2.7
js-yaml	4.1.1	4.2.0
mermaid	11.12.0	11.15.0
next	16.1.6	16.2.7
posthog-node	5.21.0	5.36.3
yaml	2.8.3	2.9.0

Updates @biomejs/biome from 2.3.6 to 2.4.16

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes

• #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

• #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

  Input:

  <span
    ><!-- 1
  --><span>a</span
    ><!-- 2
  --><span>b</span
    ><!-- 3
  --></span>

  Output:

    <span
  	  ><!-- 1
  - --> <span>a</span<!-- 2
  - --> ><span>b</span><!-- 3
  + --><span>a</span><!-- 2
  + --><span>b</span><!-- 3
    --></span
    >

• #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

• #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

• #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

• #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

• #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

• #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

• #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

• #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.16

Patch Changes

• #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

• #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

  Input:

  <span
    ><!-- 1
  --><span>a</span
    ><!-- 2
  --><span>b</span
    ><!-- 3
  --></span>

  Output:

    <span
  	  ><!-- 1
  - --> <span>a</span<!-- 2
  - --> ><span>b</span><!-- 3
  + --><span>a</span><!-- 2
  + --><span>b</span><!-- 3
    --></span
    >

• #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

• #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

• #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

• #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

• #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

• #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

• #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

• #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Commits

• 5f4ea56 ci: release (#10326)
• de2a33c fix(core): regression in emitted types (#10478)
• d835303 docs: remove redundant default phrase in useConsistentObjectDefinitions rul...
• 4f1aaf2 fix: incorrect build when using build or test (#10426)
• dc73b6b refactor: make plugins opt-in via feature gate (#10418)
• e71f584 feat(useDestructuring): add options for assignment/declaration and improve di...
• 9b1577f fix(config): support trailingCommas in overrides (#10318)
• 9dd3271 ci: release (#10210)
• 7b8d4e1 feat(lint/html/vue): add useVueValidVFor (#10195)
• ba3480e feat(lint/js): add useTestHooksInOrder (#9394)
• Additional commits viewable in compare view

Updates prettier from 3.6.2 to 3.8.3

Release notes

Sourced from prettier's releases.

3.8.3

• SCSS: Prevent trailing comma in if() function (prettier/prettier#18471 by @​kovsu)

🔗 Changelog

3.8.2

• Support Angular v21.2

🔗 Changelog

3.8.1

• Include available printers in plugin type declarations (#18706 by @​porada)

🔗 Changelog

3.8.0

• Support Angular v21.1

diff

🔗 Release note "Prettier 3.8: Support for Angular v21.1"

3.7.4

What's Changed

• Fix comment in union type gets duplicated by @​fisker in prettier/prettier#18393
• Fix unstable comment print in union type by @​fisker in prettier/prettier#18395
• Avoid quote around LWC interpolations by @​kovsu in prettier/prettier#18383

🔗 Changelog

3.7.3

What's Changed

• Fix prettier.getFileInfo() change that breaks VSCode extension by @​fisker in prettier/prettier#18375

🔗 Changelog

3.7.2

What's Changed

• Fix string print when switching quotes by @​fisker in prettier/prettier#18351
• Preserve quote for embedded HTML attribute values by @​kovsu in prettier/prettier#18352
• Fix comment in empty type literal by @​fisker in prettier/prettier#18364

🔗 Changelog

3.7.1

... (truncated)

Changelog

Sourced from prettier's changelog.

3.8.3

diff

SCSS: Prevent trailing comma in if() function (#18471 by @​kovsu)

// Input
$value: if(sass(false): 1; else: -1);
// Prettier 3.8.2
$value: if(
sass(false): 1; else: -1,
);
// Prettier 3.8.3
$value: if(sass(false): 1; else: -1);

3.8.2

diff

Angular: Support Angular v21.2 (#18722, #19034 by @​fisker)

Exhaustive typechecking with @default never;

<!-- Input -->
@switch (foo) {
  @case (1) {}
  @default never;
}
<!-- Prettier 3.8.1 -->
SyntaxError: Incomplete block "default never". If you meant to write the @ character, you should use the "&#64;" HTML entity instead. (3:3)
<!-- Prettier 3.8.2 -->
@​switch (foo) {
@​case (1) {}
@​default never;
}

arrow function and instanceof expressions.

</tr></table> 

... (truncated)

Commits

• d7108a7 Release 3.8.3
• 177f908 Prevent trailing comma in SCSS if() function (#18471)
• 1cd4066 Release @​prettier/plugin-oxc@​0.1.4
• a8700e2 Update oxc-parser to v0.125.0
• 752157c Fix tests
• 053fd41 Bump Prettier dependency to 3.8.2
• 904c636 Clean changelog_unreleased
• dc1f7fc Update dependents count
• b31557c Release 3.8.2
• 96bbaed Support Angular v21.2 (#18722)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier since your current version.

Updates prettier-plugin-tailwindcss from 0.1.13 to 0.8.0

Release notes

Sourced from prettier-plugin-tailwindcss's releases.

v0.8.0

Changed

• Require at least Prettier 3.7.x (#420)

Added

• Export public sorting APIs to /sorter (#438)

Fixed

• Remove top-level await (#420)
• Improve load-time performance (#420)
• Improve config resolution caching with directory-based cache (#432)
• Load compatible plugins on demand and tighten plugin detection (#437)
• Load v3/v4 modules only when needed (#439)
• Remove recast/ast-types deps and optimize dynamic JS attribute handling (#440)
• Remove unused deps (#441)
• Use the plugin that has already been imported rather than dynamically importing it again (#442)
• Skip visiting non-node children (#443)
• Optimize whitespace-only class detection (#429)
• Fix v3 config loading with Jiti re-exports (#448)
• Collapse whitespace in template literals with adjacent quasis (#427)
• Improve canCollapseWhitespaceIn handling for "tailwindPreserveWhitespace": true (#428)

v0.7.4

Same as v0.7.2, since v0.7.3 contained breaking changes.

v0.7.3

Changed

• Remove top-level await (#420)
• Improve load-time performance (#420)

Fixed

• Collapse whitespace in template literals with adjacent quasis (#427)

v0.7.2

Fixed

• Load compatible plugins sequentially to work around race conditions in Node.js (#412)
• Fix compatibility with prettier-plugin-svelte when using Prettier v3.7+ (#418)

v0.7.1

Fixed

• Match against correct name of dynamic attributes when using regexes (#410)

v0.7.0

... (truncated)

Changelog

Sourced from prettier-plugin-tailwindcss's changelog.

[0.8.0] - 2026-04-27

Changed

• Require at least Prettier 3.7.x (#420)

Added

• Export public sorting APIs to /sorter (#438)

Fixed

• Remove top-level await (#420)
• Improve load-time performance (#420)
• Improve config resolution caching with directory-based cache (#432)
• Load compatible plugins on demand and tighten plugin detection (#437)
• Load v3/v4 modules only when needed (#439)
• Remove recast/ast-types deps and optimize dynamic JS attribute handling (#440)
• Remove unused deps (#441)
• Use the plugin that has already been imported rather than dynamically importing it again (#442)
• Skip visiting non-node children (#443)
• Optimize whitespace-only class detection (#429)
• Fix v3 config loading with Jiti re-exports (#448)
• Collapse whitespace in template literals with adjacent quasis (#427)
• Improve canCollapseWhitespaceIn handling for "tailwindPreserveWhitespace": true (#428)

[0.7.2] - 2025-12-01

Fixed

• Load compatible plugins sequentially to work around race conditions in Node.js (#412)
• Fix compatibility with prettier-plugin-svelte when using Prettier v3.7+ (#418)

[0.7.1] - 2025-10-17

Fixed

• Match against correct name of dynamic attributes when using regexes (#410)

[0.7.0] - 2025-10-14

Added

• Format quotes in @source, @plugin, and @config (#387)
• Sort in function calls in Twig (#358)
• Sort in callable template literals (#367)
• Sort in function calls mixed with property accesses (#367)
• Support regular expression patterns for attributes (#405)
• Support regular expression patterns for function names (#405)

... (truncated)

Commits

• f77532e 0.8.0
• 4815377 Update the changelog for recent PRs (#449)
• 0a7ddcb Fix insiders tags sometimes published to latest channel (#453)
• 8066e85 release on published event
• 3b0ed57 move --silent flag before the script
• f7d2598 0.7.3
• 9a51191 merge release.yml and release-insiders.yml
• 3997fbd Use explicit import() expressions in plugin load arrays for bundler compatibi...
• 125a8bc Fix v3 config loading with Jiti re-exports (#448)
• 2ac6e70 Enable minify: "dce-only in tsdown (#447)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier-plugin-tailwindcss since your current version.

Updates turbo from 2.6.0 to 2.9.16

Release notes

Sourced from turbo's releases.

Turborepo v2.9.16

What's Changed

Changelog

• release(turborepo): 2.9.15 by @​github-actions[bot] in vercel/turborepo#12955
• fix: Avoid hanging PTY shutdown by @​anthonyshew in vercel/turborepo#12958
• fix: Retry npm tlog publish failures by @​anthonyshew in vercel/turborepo#12959
• release(turborepo): 2.9.16-canary.1 by @​anthonyshew in vercel/turborepo#12960
• fix: Preserve nested Bun dependency versions by @​anthonyshew in vercel/turborepo#12963
• Revert "fix: Preserve nested Bun dependency versions" by @​anthonyshew in vercel/turborepo#12964
• release(turborepo): 2.9.16-canary.2 by @​github-actions[bot] in vercel/turborepo#12961
• fix: Preserve nested Bun dependency versions by @​anthonyshew in vercel/turborepo#12965
• fix: Don't delete existing .git when using --no-git flag by @​anthonyshew in vercel/turborepo#12968

Full Changelog: vercel/turborepo@v2.9.15...v2.9.16

Turborepo v2.9.16-canary.2

What's Changed

Changelog

• release(turborepo): 2.9.15-canary.7 by @​github-actions[bot] in vercel/turborepo#12935
• fix: Restore a few internal invariant checks by @​anthonyshew in vercel/turborepo#12933
• fix: Improve profile tracing coverage by @​anthonyshew in vercel/turborepo#12936
• fix: Use build-scale OTel duration buckets by @​anthonyshew in vercel/turborepo#12939
• fix: Preserve pnpm injected peer package entries by @​anthonyshew in vercel/turborepo#12940
• feat: Add heap allocation profiling by @​anthonyshew in vercel/turborepo#12943
• release(turborepo): 2.9.15-canary.8 by @​anthonyshew in vercel/turborepo#12945
• docs: Correct attribute presence claims in turborepo-otel by @​adityasingh2400 in vercel/turborepo#12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @​mvanhorn in vercel/turborepo#12948
• chore: Switch Geist font imports to npm geist package by @​christopherkindl in vercel/turborepo#12952
• fix: Respect root gitignore during prune by @​anthonyshew in vercel/turborepo#12953
• fix: Harden OTEL endpoint validation by @​anthonyshew in vercel/turborepo#12954
• release(turborepo): 2.9.15 by @​github-actions[bot] in vercel/turborepo#12955
• fix: Avoid hanging PTY shutdown by @​anthonyshew in vercel/turborepo#12958
• fix: Retry npm tlog publish failures by @​anthonyshew in vercel/turborepo#12959
• release(turborepo): 2.9.16-canary.1 by @​anthonyshew in vercel/turborepo#12960

New Contributors

• @​adityasingh2400 made their first contribution in vercel/turborepo#12932
• @​mvanhorn made their first contribution in vercel/turborepo#12948
• @​christopherkindl made their first contribution in vercel/turborepo#12952

Full Changelog: vercel/turborepo@v2.9.15-canary.7...v2.9.16-canary.2

Turborepo v2.9.15

... (truncated)

Commits

• 5e2d466 publish 2.9.16 to registry
• b4aa626 fix: Don't delete existing .git when using --no-git flag (#12968)
• 7952b46 fix: Preserve nested Bun dependency versions (#12965)
• 5e5b248 release(turborepo): 2.9.16-canary.2 (#12961)
• 3b1b6e9 Revert "fix: Preserve nested Bun dependency versions" (#12964)
• 8d4eaf8 fix: Preserve nested Bun dependency versions (#12963)
• 2284fa9 release(turborepo): 2.9.16-canary.1 (#12960)
• 5317f65 fix: Retry npm tlog publish failures (#12959)
• 52e81bd fix: Avoid hanging PTY shutdown (#12958)
• c85d410 release(turborepo): 2.9.15 (#12955)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for turbo since your current version.

Updates @icons-pack/react-simple-icons from 13.8.0 to 13.13.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​icons-pack/react-simple-icons since your current version.

Updates @mux/mux-player-react from 3.8.0 to 3.13.0

Release notes

Sourced from @​mux/mux-player-react's releases.

@​mux/mux-player-react: v3.13.0

3.13.0 (2026-04-28)

Features

• Add ABR startup quality attributes (#1315) (3cdf0bc)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​mux/mux-player bumped from 3.12.0 to 3.13.0
    • @​mux/playback-core bumped from 0.34.1 to 0.35.0

@​mux/mux-player-react: v3.12.0

3.12.0 (2026-04-24)

Miscellaneous Chores

• @​mux/mux-player-react: Synchronize player versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​mux/mux-player bumped from 3.11.8 to 3.12.0
    • @​mux/playback-core bumped from 0.34.0 to 0.34.1

@​mux/mux-player-react: v3.11.8

3.11.8 (2026-04-16)

Miscellaneous Chores

• @​mux/mux-player-react: Synchronize player versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​mux/mux-player bumped from 3.11.7 to 3.11.8
    • @​mux/playback-core bumped from 0.33.3 to 0.34.0

@​mux/mux-player-react: v3.11.7

3.11.7 (2026-03-25)

... (truncated)

Changelog

Sourced from @​mux/mux-player-react's changelog.

3.13.0 (2026-04-28)

Features

• Add ABR startup quality attributes (#1315) (3cdf0bc)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​mux/mux-player bumped from 3.12.0 to 3.13.0
    • @​mux/playback-core bumped from 0.34.1 to 0.35.0

3.12.0 (2026-04-24)

Miscellaneous Chores

• @​mux/mux-player-react: Synchronize player versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​mux/mux-player bumped from 3.11.8 to 3.12.0
    • @​mux/playback-core bumped from 0.34.0 to 0.34.1

3.11.8 (2026-04-16)

Miscellaneous Chores

• @​mux/mux-player-react: Synchronize player versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​mux/mux-player bumped from 3.11.7 to 3.11.8
    • @​mux/playback-core bumped from 0.33.3 to 0.34.0

3.11.7 (2026-03-25)

Miscellaneous Chores

... (truncated)

Commits

• 4655949 chore: release main (#1325)
• 3cdf0bc feat: Add ABR startup quality attributes (#1315)
• 3a543d3 chore: release main (#1319)
• 38ecde3 chore: release main (#1306)
• 7df4d8c chore: release main (#1296)
• 6da2a05 chore: release main (#1293)
• 9a9c70c chore: release main (#1281)
• b60b4b1 chore: release main (#1275)
• acc6989 chore: release main (#1273)
• ba78ad8 fix(mux-player-react): correct nohotkeys docs wording (#1272)
• Additional commits viewable in compare view

Updates @next/mdx from 16.1.6 to 16.2.7

Release notes

Sourced from @​next/mdx's releases.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
• [backport] Propagate adapter preferred regions (#94200)
• [16.2.x] Don't drop FormData entries (#94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• Cursor Bugbot for commit 871b7d9. Bugbot is set up for automated code reviews on this repo. Configure here.

[dependabot]

Labels

The following labels could not be found: workspace. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Error		Jun 6, 2026 3:36am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 871b7d9. Configure here.}

[cursor]

Moose CLI x64 version skew

Medium Severity

@514labs/moose-cli-darwin-x64 is pinned to 0.6.171 while the other platform optional dependencies are pinned to 0.6.533. Intel macOS installs resolve a different native binary than arm64 and Linux, so CLI behavior and capabilities can diverge across machines and from what release-cli.sh expects (one version for all platforms).

 

^{Reviewed by Cursor Bugbot for commit 871b7d9. Configure here.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml