[dependabot]

Bumps the bun group with 12 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	3.1152.0	3.1156.0
@better-auth/api-key	1.7.10	1.7.12
@better-auth/drizzle-adapter	1.7.10	1.7.12
@better-auth/passkey	1.7.10	1.7.12
better-auth	1.7.10	1.7.12
@biomejs/biome	2.5.15	2.6.2
@cloudflare/workers-types	5.20261016.1	5.20261023.1
@happy-dom/global-registrator	21.0.3	21.0.4
@scalar/api-reference	1.74.0	1.75.1
@scalar/openapi-parser	0.29.13	0.29.15
@types/bun	1.4.3	1.4.4
auth	1.7.10	1.7.12

Updates @aws-sdk/client-s3 from 3.1152.0 to 3.1156.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1156.0

3.1156.0(2026-10-22)

Documentation Changes

• client-lambda: AWS Lambda durable functions now supports payloads up to 1 MB for checkpoints, callback completion, and error details. (cdd6c609)

New Features

• clients: update client endpoints as of 2026-10-22 (e5cd1562)
• client-opensearchserverless: Adds APIs to create, get, list, and cancel ingestion jobs, and to create, get, list, and delete ingestion streams, for ingesting data from Amazon S3 into OpenSearch Serverless collections. (7712bce0)
• client-continuum: Releasing Continuum for Code Vulnerabilities APIs for SDKs (0cbbd64c)
• client-connect: Adds support for customer queryable replication errors. (4507ef01)
• client-ec2: AWS Transit Gateway now provides managed one-to-one NAT directly on its attachments, through integration with Regional Private NAT Gateway. Use ModifyTransitGatewayAttachmentNatConfiguration to enable NAT and configure NAT rules, and GetTransitGatewayAttachmentNatConfiguration to view them. (68bea2ce)
• client-bedrock-agentcore: Adds the dimension name to evaluation results and batch evaluation summaries. For multi-dimensional LLM-as-a-Judge evaluators, each result and summary now identifies which dimension it corresponds to. (185f264b)
• client-networkmanager: AWS Cloud WAN now provides managed one-to-one NAT directly on it's core network attachments, through integration with Regional Private NAT Gateway. Use UpdateAttachmentNatConfiguration to enable NAT and configure NAT rules, and ListAttachmentNatConfigurations to view them. (944335d4)
• client-bedrock-agentcore-control: Adds model-based routing and fallback to AgentCore Gateway rules. Rules can match the requested model, route to a specific model, and fall back across inference targets with an optional circuit breaker. Adds multi-dimensional rating scales for AgentCore Evaluations LLM-as-a-Judge evaluators. (9c2b09c2)
• client-elementalinference: Elemental Inference now supports feed scheduling, letting you apply feed configuration changes at a time you choose instead of building your own automation. (b4108829)
• client-glue: Add support for large worker types in AWS Glue (89ac4073)
• client-kafkaconnect: Amazon MSK Connect now supports pausing and resuming connectors via the asynchronous PauseConnector and ResumeConnector APIs. Paused connectors keep their configuration and committed offsets and resume where they left off. Each call returns an operation ARN to track with DescribeConnectorOperation. (f5a4343a)
• client-ivs-realtime: Adds RevokeConnectionToken operation for Amazon IVS Real-Time Streaming. (7c85a26a)

---

For list of updated packages, view updated-packages.md in assets-3.1156.0.zip

v3.1155.0

3.1155.0(2026-10-21)

Chores

• temporarily disconnect from eclipse for Java formatting (#8375) (6d14aac7)
• codegen: sync for JSON string serializer buffer fix and retryMode docs link (#8373) (5f53137d)
• finspace: Remove finspace and finspace-data clients following the service shutdown (#8369) (48e34c48)
• tnb: Remove tnb clients following shutdown (#8370) (e37bf8c2)

New Features

• client-quicksight: Adds support for SharePoint and OneDrive two-legged OAuth certificate credentials and Google Workspace service account credentials when creating data sources (d0d47ac9)
• client-sfn: Release minor updates to API model (6bb8593f)
• client-network-firewall: Adds support for Network Firewall Resolved IP validation. (6a634360)
• client-datazone: Added custom designations support with new CRUD APIs. The designation field in project membership and policy grant APIs supports a new enum for custom designations. These APIs also support a new field for custom designation id. (10021565)
• client-ec2: Adds new response fields to DescribeInstanceStatus and Network Insights analysis results. (8e379695)
• client-lightsail: This release adds support for metrics related to system-disk performance. (d21dd9d9)
• client-healthlake: Update the UpdateProfileWithAgent API to return a streaming response to provide more frequent updates on what the agent is doing. (c2730b30)
• client-polly: Added support for the new voices - Kenneth (en-US), Nate (en-US), Tina (de-DE), Carlos (es-US), Carolina (pt-BR), Leo (pt-BR), Curtis (en-AU), Kiara (en-IN), Arjun (en-IN) and Hyunduk (ko-KR). They are available as a Generative voices only. (4494f473)
• client-connect: Added support for AWS-managed security profiles. (04f0c0b5)
• client-auto-scaling: EC2 Auto Scaling now supports account settings, letting you manage account-level configuration for Auto Scaling. (d0cdb396)
• client-lex-models-v2: Adds support for Assisted NLU - Dialog Manager mode allowing usage of LLMs as the default NLU system and dialog management (671f2125)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1156.0 (2026-10-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1155.0 (2026-10-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1154.0 (2026-10-20)

Note: Version bump only for package @​aws-sdk/client-s3

3.1153.0 (2026-10-19)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

• 163a566 Publish v3.1156.0
• 7c2f089 Publish v3.1155.0
• 5f53137 chore(codegen): sync for JSON string serializer buffer fix and retryMode docs...
• f6ff312 Publish v3.1154.0
• 3508584 Publish v3.1153.0
• 3e350b5 chore(codegen): sync for JSON codec and schema server plugin (#8353)
• See full diff in compare view

Updates @better-auth/api-key from 1.7.10 to 1.7.12

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.12

1.7.11

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• See full diff in compare view

Updates @better-auth/drizzle-adapter from 1.7.10 to 1.7.12

Release notes

Sourced from @​better-auth/drizzle-adapter's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from @​better-auth/drizzle-adapter's changelog.

1.7.12

1.7.11

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• See full diff in compare view

Updates @better-auth/passkey from 1.7.10 to 1.7.12

Release notes

Sourced from @​better-auth/passkey's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from @​better-auth/passkey's changelog.

1.7.12

1.7.11

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• 52ab801 chore: release v1.7.11 (#11827)
• See full diff in compare view

Updates better-auth from 1.7.10 to 1.7.12

Release notes

Sourced from better-auth's releases.

v1.7.12

[!IMPORTANT] Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​alpcanaydin, @​bytaesu

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.12

Patch Changes

• #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

• #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

• #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

• Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

  • @​better-auth/core@​1.7.12
  • @​better-auth/drizzle-adapter@​1.7.12
  • @​better-auth/kysely-adapter@​1.7.12
  • @​better-auth/memory-adapter@​1.7.12
  • @​better-auth/mongo-adapter@​1.7.12
  • @​better-auth/prisma-adapter@​1.7.12
  • @​better-auth/telemetry@​1.7.12

1.7.11

Patch Changes

• #10719 bd65db0 Thanks @​rendermani! - Recognize PostgreSQL int8 as a valid number type in migration diffs. Kysely's introspector reports pg_type.typname, so Better Auth's own bigint columns (such as the database-backed rate limiter's lastRequest) came back as int8 and were reported as a type mismatch on every run.

• #11521 37a75c9 Thanks @​aryan1306! - Fix database-backed rate limiting returning an excessively large X-Retry-After header instead of the remaining seconds in the rate-limit window.

• Updated dependencies [ce96569, 2f6ca3f, dfd8dd2]:

  • @​better-auth/core@​1.7.11
  • @​better-auth/drizzle-adapter@​1.7.11
  • @​better-auth/kysely-adapter@​1.7.11
  • @​better-auth/memory-adapter@​1.7.11
  • @​better-auth/mongo-adapter@​1.7.11
  • @​better-auth/prisma-adapter@​1.7.11
  • @​better-auth/telemetry@​1.7.11

Commits

• f4260a9 chore: release v1.7.12 (#11922)
• b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
• fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
• 681aa5c fix(session): keep the cause of session lookup failures (#11924)
• 52ab801 chore: release v1.7.11 (#11827)
• 37a75c9 fix(rate-limit): convert a string lastRequest before computing X-Retry-After ...
• bd65db0 fix(db): recognize postgres int8 as a number type in migration diffs (#10719)
• See full diff in compare view

Updates @biomejs/biome from 2.5.15 to 2.6.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.2

2.6.2

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },
      { "path": "local-plugin.grit" }
    ]
  }

  Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

• #11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

  Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.6.2

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },
      { "path": "local-plugin.grit" }
    ]
  }

  Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

• #11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

  Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

• #11477 ab05554 Thanks @​nhedger! - Added automatic Git VCS integration when running biome init inside a Git repository, including from nested directories and Git worktrees. The generated configuration sets vcs.enabled and vcs.useIgnoreFile to true, with vcs.clientKind set to "git".

... (truncated)

Commits

• 0d9aef6 ci: release (#12495)
• 30ffad1 ci: release (#12493)
• 8c814e1 ci: release (#12065)
• e51cec2 chore: update sponsors (#12428)
• cb88f07 feat(lint): add noSvelteClassDirective (#12254)
• 774b5b5 feat: sorted GraphQL documents (#12318)
• 914dca7 feat(lint/js): add noUselessCall (#12082)
• a3fa0d6 feat(graphql_analyze): implement useSortedArguments (#12282)
• 5f8ea6c feat(lint): add noVueLifecycleAfterAwait (#12229)
• b92638b feat(lint): add noVueShadowNativeEvents (#12136)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261016.1 to 5.20261023.1

Commits

• See full diff in compare view

Updates @happy-dom/global-registrator from 21.0.3 to 21.0.4

Release notes

Sourced from @​happy-dom/global-registrator's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• See full diff in compare view

Updates @scalar/api-reference from 1.74.0 to 1.75.1

Changelog

Sourced from @​scalar/api-reference's changelog.

1.75.1

Patch Changes

• #10669: fix: wrap long operation paths in request example cards instead of truncating them, and move the client picker below the path when it does not fit

• #10685: Support OpenAPI and AsyncAPI context and search results in Ask AI, preserve the selected API description when switching sources, and keep HTTP execution separate from unsupported messaging actions.

• #10647: Wrap the operation header actions (authentication badge and Markdown copy button) on narrow screens instead of pushing them past the page edge.

• #10646: Give the endpoint links in the tag operations list an href, so keyboard users can reach them and modified clicks open the operation in a new tab.

• #10672: Give the endpoint links in the tag operations list a 24px minimum height, so they meet the WCAG 2.5.8 target size.

• #10661: Align AsyncAPI operation spacing, headings, responsive authentication placement, and schema/example columns with OpenAPI. Simplify message and reply rendering, collapse messages by default, and remove redundant tags.

  Render supported binding schema fields with the shared schema renderer and configured schema options. Unify address typography, example cards, and introduction metadata.

• #10689: fix: name the tag "Show More" button by its visible text and describe it with the tag title

• #10656: Use AsyncAPI summaries as heading and description fallbacks without repeating introductory text.

1.75.0

Minor Changes

• #10616: Render AsyncAPI operation replies with expandable message schemas, channel links, static addresses, and dynamic reply address expressions.

• #10600: Display AsyncAPI application, server, operation, and message tags, including trait tags, and filter navigation by tags while preserving channel grouping.

• #10604: Display AsyncAPI server, channel, operation, and message binding details, including versions, referenced bindings, and unfamiliar fields.

• #10213: Add per-reference Markdown rendering hooks and an explicitly loaded Mermaid plugin with interactive diagrams, keyboard panning, and zoom controls.

  Provide Markdown hooks before mounting the embedded client modal so its initial render receives the configured hooks. The Mermaid viewer uses customizable Scalar theme styles and an intentional light drawing surface.

  Isolate Markdown plugin cleanup failures so other plugins still release their resources when content changes or unmounts.

Patch Changes

• #10597: Render AsyncAPI string discriminators with inherited schema variants and effective discriminator values.

• #10530: Render AsyncAPI external documentation on servers, channels, operations, messages, tags, and schemas, with referenced objects and descriptions, using the existing OpenAPI link presentation.

  Keep AsyncAPI messages searchable when navigation renders them beneath operations.

• #10599: Preserve recursive schemas when generating request bodies, code samples, and response examples instead of replacing recursion points with null or empty arrays.

• #10608: Keep shared component styles from overriding host page body backgrounds and margins, including hosts using CSS layers. Keep full-page body styling in the standalone bundles.

• #10594: Update AI SDK dependencies to address GHSA-866g-f22w-33x8 in response body handling.

• #10365: Preserve document-backed API key name edits for export, allow clearing configured names, and release configured overrides when their default name is restored.

• #10628: Add developer-tools controls for parameter and schema expansion, model names, required properties, and schema property ordering. Preserve explicit toggle overrides of supplied configuration.

• #10588: Ignore sibling properties on AsyncAPI Reference Objects when rendering content, navigation, search, and schemas.

• #10587: Display AsyncAPI channel parameter locations alongside their descriptions, examples, and constraints.

• #10595: Display AsyncAPI channel summaries and addresses separately, and label missing or null addresses as unknown in channel content and search results.

• #10603: Display AsyncAPI message content types, inherit document defaults, and format examples for their effective media type.

• #10615: Render AsyncAPI Avro, Protobuf, and other schema formats as labeled, copyable source instead of dropping them or treating them as JSON Schema.

• #10617: Index response schema fields on operations and webhook request/response fields. Search nested objects, arrays, compositions, and resolved references with bounded, cycle-safe traversal while keeping field names ranked above descriptive prose.

• #10614: Clean up API reference lint warnings while preserving existing behavior.

Commits

• See full diff in compare view

Updates @scalar/openapi-parser from 0.29.13 to 0.29.15

Changelog

Sourced from @​scalar/openapi-parser's changelog.

0.29.15

Patch Changes

• #10643: Distinguish reference locations from schema name maps and literal data when validating, dereferencing, and collecting external references. Preserve $ref properties with object or boolean schemas, leave examples and default/enum/const values unchanged, and retain errors for malformed references.

  Retain reference context across external files and fragments. Resolve custom operations while preserving OAuth scope names, discriminator mappings, Link payloads, and specification extension data.

0.29.14

Commits

• See full diff in compare view

Updates @types/bun from 1.4.3 t...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: bunkerlab-net/bunkerplan
• Branch: master
• File: .coderabbit.yaml
• Commit: dbabca9
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c6346ffe-45e8-4f7f-b18e-15986231a81b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[rblaine95]

@dependabot rebase