[github-actions]

Автообновление зависимостей от 2026-11-12 (workflow deps-auto-update): bun update в пределах диапазонов package.json, только minor и patch, прямые и транзитивные пакеты, свежие версии сразу после выхода. Пока PR открыт, ветка пересобирается от последнего commit AgentHits-Dev после каждого push в неё и каждый день в 03:00 UTC.

. — пакетов: 35

Пакет	Было	Стало
@ai-sdk/azure	4.0.122	4.0.123
@ai-sdk/gateway	4.0.142	4.0.143
@ai-sdk/openai	4.0.114	4.0.115
@aws-sdk/client-cloudwatch	3.1166.0	3.1167.0
@aws-sdk/client-cloudwatch-logs	3.1166.0	3.1167.0
@aws-sdk/client-route-53	3.1166.0	3.1167.0
@aws-sdk/client-secrets-manager	3.1166.0	3.1167.0
@aws-sdk/client-ssm	3.1166.0	3.1167.0
@aws-sdk/credential-provider-ini	3.973.29	3.973.30
@aws-sdk/credential-provider-login	3.972.91	3.972.92
@aws-sdk/credential-provider-node	3.972.96	3.972.97
@babel/generator	7.29.13	7.29.14
@babel/helper-member-expression-to-functions	7.29.7	7.29.14
@babel/helper-module-transforms	7.29.13	7.29.14
@babel/helper-string-parser	7.29.13	7.29.14
@babel/helpers	7.29.13	7.29.14
@babel/parser	7.29.13	7.29.14
@babel/plugin-transform-modules-commonjs	7.29.7	7.29.14
@babel/runtime	7.29.13	7.29.14
@babel/runtime-corejs3	7.29.13	7.29.14
@babel/traverse	7.29.13	7.29.14
@babel/types	7.29.11	7.29.14
@hookform/resolvers	7.0.5	7.0.6
@posthog/types	1.424.0	1.424.1
ai	7.0.169	7.0.170
baseline-browser-mapping	2.11.35	2.11.36
brace-expansion	5.0.12	5.0.13
electron-to-chromium	1.5.481	1.5.483
glob	14.0.4	14.0.5
posthog-js	1.447.12	1.447.14
prettier	3.9.10	3.10.1
react-hook-form	7.91.0	7.92.0
tar	7.5.22	7.5.23
tldts	7.4.21	7.4.24
tldts-core	7.4.21	7.4.24

bun audit: 1 vulnerability (1 low)

Вывод bun audit

bun audit v1.4.4 (38afee6c8)

deepmerge@4.3.1
  workspace:dokploy > shadcn > @shadcn/registry > deepmerge
  workspace:dokploy > swagger-ui-react > swagger-client > deepmerge
  workspace:dokploy > @react-email/components > @react-email/render > html-to-text > deepmerge
  workspace:dokploy > resend > @react-email/render > html-to-text > deepmerge
  low: deepmerge mergeObject() allows prototype poisoning of returned objects (>=4.2.0 <=4.3.1) - https://github.com/advisories/GHSA-gcqx-w48m-w2h4

1 vulnerability (1 low)

  bun audit fix           upgrade the vulnerable packages within their ranges
  bun audit fix --latest  also cross major versions

bun outdated: колонка Latest выше Update - это major, их workflow не берёт

bun outdated v1.4.4 (38afee6c8)
|-----------------------------------------------------------------------|
| Package              | Current | Update | Latest | Workspace          |
|----------------------|---------|--------|--------|--------------------|
| inngest              | 4.26.1  | 4.26.1 | 4.26.2 | @dokploy/api       |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/api-key | 1.7.20  | 1.7.20 | 1.7.22 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/passkey | 1.7.20  | 1.7.20 | 1.7.22 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/scim    | 1.7.20  | 1.7.20 | 1.7.22 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/sso     | 1.7.20  | 1.7.20 | 1.7.22 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| better-auth          | 1.7.20  | 1.7.20 | 1.7.22 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| ssh2                 | 1.16.0  | 1.16.0 | 1.17.0 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| stripe               | 17.2.1  | 17.2.1 | 23.1.0 | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| bullmq               | 5.81.5  | 5.81.5 | 6.7.5  | @dokploy/schedules |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/api-key | 1.7.20  | 1.7.20 | 1.7.22 | @dokploy/server    |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/passkey | 1.7.20  | 1.7.20 | 1.7.22 | @dokploy/server    |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/scim    | 1.7.20  | 1.7.20 | 1.7.22 | @dokploy/server    |
|----------------------|---------|--------|--------|--------------------|
| @better-auth/sso     | 1.7.20  | 1.7.20 | 1.7.22 | @dokploy/server    |
|----------------------|---------|--------|--------|--------------------|
| better-auth          | 1.7.20  | 1.7.20 | 1.7.22 | @dokploy/server    |
|----------------------|---------|--------|--------|--------------------|
| ssh2                 | 1.16.0  | 1.16.0 | 1.17.0 | @dokploy/server    |
|----------------------|---------|--------|--------|--------------------|
| @biomejs/biome (dev) | 2.6.6   | 2.6.6  | 2.6.7  | dokploy            |
|----------------------|---------|--------|--------|--------------------|
| auth (dev)           | 1.7.20  | 1.7.20 | 1.7.22 | @dokploy/server    |
|-----------------------------------------------------------------------|

---

Перед merge: зелёные прогоны pull-request.yml bun-migration-docker-check.yml с событием workflow_dispatch на голове PR (workflow запускает их сам: push от GITHUB_TOKEN событие pull_request не создаёт). Commit в эту ветку останавливает пересборку. Major - отдельными PR.