[dependabot]

Bumps the production group with 17 updates in the / directory:

Package	From	To
@modelcontextprotocol/server	2.0.0	2.3.1
@tanstack/react-router	1.170.32	1.170.44
@tanstack/react-start	1.168.49	1.169.2
cn	0.2.5	0.4.0
lenis	1.3.26	1.3.27
lucide-react	1.41.0	1.57.0
radix-ui	1.6.7	1.8.1
react	19.2.8	19.3.1
react-dom	19.2.8	19.3.1
@ff-labs/fff-bun	0.10.6	0.11.0
@huggingface/transformers	4.2.0	4.3.1
@oxlint/plugins	1.81.0	1.88.0
@types/bun	1.4.0	1.4.3
@types/node	26.4.1	26.6.5
oxfmt	0.66.0	0.73.0
oxlint	1.81.0	1.88.0
zod	4.5.4	4.6.7

Updates @modelcontextprotocol/server from 2.0.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

• #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

• Updated dependencies []:

  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

• Updated dependencies []:
  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

• #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [633dd3e]:

  • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

• #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

• #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

• #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

  What keeps working without a change:

  • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
  • A handler that builds a new server and a new stateless transport for each request.
  • One server and one transport per session (a transport with a sessionIdGenerator).
  • Connecting a server again after close().
  • Client.

  What fails now, how it shows, and what to change:

  • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
  • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
  • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
  • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

  What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

  The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

• #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• a202a36 Version Packages (#2896)
• 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
• b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
• Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.32 to 1.170.44

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.44

Patch Changes

• Updated dependencies [d6ba115]:
  • @​tanstack/router-core@​1.171.37

@​tanstack/react-router@​1.170.43

Patch Changes

• Updated dependencies [94d6d8e]:
  • @​tanstack/router-core@​1.171.36

Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.44

Patch Changes

• Updated dependencies [d6ba115]:
  • @​tanstack/router-core@​1.171.37

1.170.43

Patch Changes

• Updated dependencies [94d6d8e]:
  • @​tanstack/router-core@​1.171.36

1.170.42

Patch Changes

• #8594 2413cc0 - reduce component nesting per route match

• #8602 efc2042 - Links of a route that the pending navigation leaves skip deriving the destination location, and clicks and preloads follow the href a Link displays. buildLocation now builds mask and routeMasks locations from the same _fromLocation as the destination.

• #8602 efc2042 - Fixed Link destinations that resolve to a route mask are now reused across navigations instead of being rebuilt every time. A mounted Link now follows changes to its href and reloadDocument props, and React Links no longer each subscribe to a hydration flag.

• #8579 d35aab4 - Cancel pending link preload timers when starting navigation to avoid redundant preloading while the destination is loading.

• Updated dependencies [dfe3dea, dfe3dea, dfe3dea, efc2042, efc2042, dfe3dea, 663282b]:

  • @​tanstack/history@​1.162.5
  • @​tanstack/router-core@​1.171.35

1.170.41

Patch Changes

• #8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

• #8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

• #8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

• #8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

• Updated dependencies [d521abd]:

  • @​tanstack/router-core@​1.171.34

1.170.40

Patch Changes

• #8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

... (truncated)

Commits

• 4ff63eb ci: Version Packages (#8700)
• 80e2eab ci: Version Packages (#8661)
• c79c620 ci: Version Packages (#8580)
• f6d21de revert: keep server-rendered pending UI of no-SSR routes through hydration (#...
• ff9f753 fix: keep server-rendered pending UI of no-SSR routes through hydration (#8643)
• df8bbf2 docs: use new query methods (#7100)
• efc2042 perf(router): skip Link work for routes a navigation leaves (#8602)
• c4cb0e4 test(router): Link tests that hold on main, ahead of the departing-Link work ...
• 2413cc0 perf(react-router): reduce component nesting per route match (#8594)
• d35aab4 fix(router): cancel pending link preload before navigation (#8579)
• Additional commits viewable in compare view

Updates @tanstack/react-start from 1.168.49 to 1.169.2

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.169.2

Patch Changes

• Updated dependencies [71d9694, fdc10fa, 923d98b]:
  • @​tanstack/start-server-core@​1.169.43
  • @​tanstack/start-plugin-core@​1.171.53
  • @​tanstack/router-utils@​1.162.4
  • @​tanstack/react-start-server@​1.167.50
  • @​tanstack/react-start-rsc@​0.1.63

@​tanstack/react-start@​1.169.1

Patch Changes

• Updated dependencies [740b0ce, d6ba115]:
  • @​tanstack/start-server-core@​1.169.42
  • @​tanstack/react-start-server@​1.167.49
  • @​tanstack/start-plugin-core@​1.171.52
  • @​tanstack/react-start-rsc@​0.1.62
  • @​tanstack/start-client-core@​1.170.37
  • @​tanstack/react-router@​1.170.44
  • @​tanstack/react-start-client@​1.168.42

@​tanstack/react-start@​1.169.0

Minor Changes

• #8696 f243c61 - TanStack Start is stable. To upgrade from a release candidate, follow Migrate from the Release Candidate.

Patch Changes

• #8694 550f478 - Remove the deprecated .inputValidator() from createServerFn and createMiddleware. Use .validator(), which takes the same validator.

• #7588 94d6d8e - Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

• #7588 94d6d8e - Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

  createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

  Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

• #8696 f243c61 - Require Vite 8 for Vite builds. Vite 7 is no longer supported.

• Updated dependencies [94d6d8e, 550f478, 94d6d8e, f3d7ee3, 4104b8e, 94d6d8e, 94d6d8e, 94d6d8e, f243c61, 19524cc]:

  • @​tanstack/start-server-core@​1.169.41
  • @​tanstack/start-client-core@​1.170.36
  • @​tanstack/start-plugin-core@​1.171.51
  • @​tanstack/react-start-server@​1.167.48
  • @​tanstack/react-start-rsc@​0.1.61
  • @​tanstack/react-router@​1.170.43
  • @​tanstack/react-start-client@​1.168.41

Changelog

Sourced from @​tanstack/react-start's changelog.

1.169.2

Patch Changes

• Updated dependencies [71d9694, fdc10fa, 923d98b]:
  • @​tanstack/start-server-core@​1.169.43
  • @​tanstack/start-plugin-core@​1.171.53
  • @​tanstack/router-utils@​1.162.4
  • @​tanstack/react-start-server@​1.167.50
  • @​tanstack/react-start-rsc@​0.1.63

1.169.1

Patch Changes

• Updated dependencies [740b0ce, d6ba115]:
  • @​tanstack/start-server-core@​1.169.42
  • @​tanstack/react-start-server@​1.167.49
  • @​tanstack/start-plugin-core@​1.171.52
  • @​tanstack/react-start-rsc@​0.1.62
  • @​tanstack/start-client-core@​1.170.37
  • @​tanstack/react-router@​1.170.44
  • @​tanstack/react-start-client@​1.168.42

1.169.0

Minor Changes

• #8696 f243c61 - TanStack Start is stable. To upgrade from a release candidate, follow Migrate from the Release Candidate.

Patch Changes

• #8694 550f478 - Remove the deprecated .inputValidator() from createServerFn and createMiddleware. Use .validator(), which takes the same validator.

• #7588 94d6d8e - Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

• #7588 94d6d8e - Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

  createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

  Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

• #8696 f243c61 - Require Vite 8 for Vite builds. Vite 7 is no longer supported.

• Updated dependencies [94d6d8e, 550f478, 94d6d8e, f3d7ee3, 4104b8e, 94d6d8e, 94d6d8e, 94d6d8e, f243c61, 19524cc]:

  • @​tanstack/start-server-core@​1.169.41
  • @​tanstack/start-client-core@​1.170.36
  • @​tanstack/start-plugin-core@​1.171.51
  • @​tanstack/react-start-server@​1.167.48
  • @​tanstack/react-start-rsc@​0.1.61

... (truncated)

Commits

• 140efa4 ci: Version Packages (#8701)
• 4ff63eb ci: Version Packages (#8700)
• 80e2eab ci: Version Packages (#8661)
• f243c61 Start stable (#8696)
• 94d6d8e response reconciliation (#7588)
• c79c620 ci: Version Packages (#8580)
• df8bbf2 docs: use new query methods (#7100)
• 57e126e ci: Version Packages (#8531)
• f0e751d ci: Version Packages (#8497)
• ddad69a ci: Version Packages (#8486)
• Additional commits viewable in compare view

Updates cn from 0.2.5 to 0.4.0

Release notes

Sourced from cn's releases.

cn@0.4.0

Minor Changes

• #153 2691a38 Thanks @​shadcn! - cn build and the plugins now register the theme scales declared in your Tailwind CSS.

cn@0.3.3

Patch Changes

• #152 00daa7e Thanks @​shadcn! - Calls with an interpolated argument, such as cn(base, "translate-x-[" + x + "px]"), no longer thrash the argument cache. 2,213 → 80 ns per call on that shape; stable arguments are unchanged.

• #150 6f5ccfa Thanks @​shadcn! - cn build -o *.ts output now typechecks under noUncheckedIndexedAccess and the rest of the @tsconfig/strictest flags. The .mjs output is unchanged.

cn@0.3.2

Patch Changes

• #147 e703bfe Thanks @​shadcn! - Custom animate-* classes are no longer merged, matching tailwind-merge. Only the default theme animations (spin, ping, pulse, bounce), animate-none, and arbitrary values share the animate group, so plugin classes such as animate-in, animate-once, and animate-duration-500 are never dropped.

cn@0.3.1

Patch Changes

• #144 19a9a66 Thanks @​shadcn! - Axis utilities now override the logical sides they cover, matching tailwind-merge 3.7.0. px-2 replaces ps-* and pe-*, py-2 replaces pbs-* and pbe-*, and the same applies to mx/my, inset-x/inset-y, border-x/border-y widths and colors, and scroll-mx/scroll-my/scroll-px/scroll-py.

cn@0.3.0

Minor Changes

• #137 9a9c9b5 Thanks @​shadcn! - Add cn/build, the library behind cn build. The CLI now parses arguments and prints; scanning, subsetting, compiling, and writing run in build(options) so build scripts and bundler plugins can call it directly.

• #139 829b6e1 Thanks @​shadcn! - Add cn/vite and cn/next.

cn@0.2.6

Patch Changes

• #74 947e624 Thanks @​shadcn! - Fix merging for custom animations, containment, legacy gradients, and missing Tailwind v4 utilities.

Changelog

Sourced from cn's changelog.

0.4.0

Minor Changes

• #153 2691a38 Thanks @​shadcn! - cn build and the plugins now register the theme scales declared in your Tailwind CSS.

0.3.3

Patch Changes

• #152 00daa7e Thanks @​shadcn! - Calls with an interpolated argument, such as cn(base, "translate-x-[" + x + "px]"), no longer thrash the argument cache. 2,213 → 80 ns per call on that shape; stable arguments are unchanged.

• #150 6f5ccfa Thanks @​shadcn! - cn build -o *.ts output now typechecks under noUncheckedIndexedAccess and the rest of the @tsconfig/strictest flags. The .mjs output is unchanged.

0.3.2

Patch Changes

• #147 e703bfe Thanks @​shadcn! - Custom animate-* classes are no longer merged, matching tailwind-merge. Only the default theme animations (spin, ping, pulse, bounce), animate-none, and arbitrary values share the animate group, so plugin classes such as animate-in, animate-once, and animate-duration-500 are never dropped.

0.3.1

Patch Changes

• #144 19a9a66 Thanks @​shadcn! - Axis utilities now override the logical sides they cover, matching tailwind-merge 3.7.0. px-2 replaces ps-* and pe-*, py-2 replaces pbs-* and pbe-*, and the same applies to mx/my, inset-x/inset-y, border-x/border-y widths and colors, and scroll-mx/scroll-my/scroll-px/scroll-py.

0.3.0

Minor Changes

• #137 9a9c9b5 Thanks @​shadcn! - Add cn/build, the library behind cn build. The CLI now parses arguments and prints; scanning, subsetting, compiling, and writing run in build(options) so build scripts and bundler plugins can call it directly.

• #139 829b6e1 Thanks @​shadcn! - Add cn/vite and cn/next.

0.2.6

Patch Changes

• #74 947e624 Thanks @​shadcn! - Fix merging for custom animations, containment, legacy gradients, and missing Tailwind v4 utilities.

Commits

• 84db832 chore(release): version packages (#154)
• 2691a38 feat(build): register theme scales from the Tailwind CSS entry (#153)
• acfba70 chore(release): version packages (#151)
• 00daa7e fix(engine): stop the arg cache thrashing on interpolated arguments (#152)
• 6f5ccfa fix(build): typecheck .ts output under noUncheckedIndexedAccess (#150)
• 210353b chore(release): version packages (#148)
• e703bfe fix(config): stop merging custom animate classes (#147)
• 8f12110 chore(release): version packages (#145)
• 19a9a66 fix(config): override logical sides with axis utilities (#144)
• 398d55a chore(release): version packages (#138)
• Additional commits viewable in compare view

Updates lenis from 1.3.26 to 1.3.27

Release notes

Sourced from lenis's releases.

v1.3.27

• fix lenis class coming back after destroy()
• scrollTo() accepts SVG elements

Commits

• e01eefb Merge pull request #558 from darkroomengineering/release/v1.3.27
• 08868fc v1.3.27
• 1f60fb9 Merge pull request #557 from darkroomengineering/fix/svg-scroll-targets-v1
• ef84677 fix(core): accept SVG elements as scrollTo targets
• ad99a23 Merge pull request #542 from cipherprofessor/fix/clear-reset-velocity-timeout...
• bc152f9 chore: point CODEOWNERS at the engineering team (#547)
• 2e14ce8 fix(core): clear pending native-scroll velocity timeout on destroy()
• See full diff in compare view

Updates lucide-react from 1.41.0 to 1.57.0

Release notes

Sourced from lucide-react's releases.

Version 1.57.0

What's Changed

• feat(icons): added folder-user and folder-user icons by @​rrod497 in lucide-icons/lucide#4603
• feat(icons): added calendar-chevrons-left icon by @​karsa-mistmere in lucide-icons/lucide#5001
• feat(icons): added users-collaboration icon by @​rrod497 in lucide-icons/lucide#4922
• feat(icons): added Belarusian ruble icon by @​js-best in lucide-icons/lucide#4984
• feat(icons): added circle-fading-play icon by @​tatianatsiguleva in lucide-icons/lucide#4990
• feat(icons): add cpu-ai icon by @​signalgridco in lucide-icons/lucide#4992
• feat(icons): added guitar-electric icon by @​rrod497 in lucide-icons/lucide#4917
• feat(icons): added graph-star icon by @​Nitero in lucide-icons/lucide#4983
• chore(deps-dev): bump the svelte-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#4996
• chore(deps-dev): bump preact from 11.0.0 to 11.0.1 in the preact-deps group by @​dependabot[bot] in lucide-icons/lucide#4999
• chore(deps-dev): bump @​vitejs/plugin-react from 6.1.1 to 6.1.2 in the react-deps group by @​dependabot[bot] in lucide-icons/lucide#4995
• feat(icons): added perfume icon by @​rrod497 in lucide-icons/lucide#4426

New Contributors

• @​js-best made their first contribution in lucide-icons/lucide#4984
• @​tatianatsiguleva made their first contribution in lucide-icons/lucide#4990
• @​signalgridco made their first contribution in lucide-icons/lucide#4992
• @​Nitero made their first contribution in lucide-icons/lucide#4983

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

• feat(icons): added server-nas icon by @​benhaube in lucide-icons/lucide#4537
• fix(icons,categories): fix notifications category name and refine circle-x tags by @​Rachit315 in lucide-icons/lucide#4994
• feat(icons): add message-circle-text icon by @​ericfennis in lucide-icons/lucide#4898

New Contributors

• @​Rachit315 made their first contribution in lucide-icons/lucide#4994

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

• feat(icons): added mail-dot icon by @​elenakovelskikh in lucide-icons/lucide#3230
• ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @​ericfennis in lucide-icons/lucide#4982
• chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @​dependabot[bot] in lucide-icons/lucide#4987
• chore(deps): bump next from 16.3.6 to 16.3.8 by @​dependabot[bot] in lucide-icons/lucide#4988
• test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @​grzdev in lucide-icons/lucide#4967
• feat(icons): added phone-log icon by @​Levi-Bensley in lucide-icons/lucide#3598
• chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @​ericfennis in lucide-icons/lucide#4989
• feat(icons): added wifi-lock icon by @​benhaube in lu...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 36505376-a247-43d5-9876-ac5232cbf4bd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark comparison

main 294ff73 → PR 05db220.

7 measured rounds per revision; one discarded warm-up round. Medians ± median absolute deviation; lower is better.

Operation	main	PR	Change	Assessment
Full index (4,096 messages)	112.257 ± 0.789 ms	111.222 ± 3.174 ms	-0.9%	Within noise
Index unchanged files	13.745 ± 0.705 ms	13.910 ± 0.349 ms	1.2%	Within noise
Index one appended session	18.995 ± 0.301 ms	19.012 ± 0.625 ms	0.1%	Within noise
Index unchanged (8 sessions)	3.102 ± 0.080 ms	3.241 ± 0.162 ms	4.5%	Within noise
Index unchanged (128 sessions)	33.139 ± 0.571 ms	33.673 ± 0.485 ms	1.6%	Within noise
Index unchanged (2,048 sessions)	483.104 ± 2.148 ms	492.726 ± 3.331 ms	2.0%	Within noise
Native grep: initialization + first query	63.613 ± 0.311 ms	63.709 ± 0.204 ms	0.2%	Within noise
Native grep: warm query	7.070 ± 0.140 ms	7.006 ± 0.212 ms	-0.9%	Within noise
Native grep: no match	0.104 ± 0.009 ms	0.099 ± 0.008 ms	-4.1%	Within noise
Streaming grep: plain	6.398 ± 0.237 ms	6.270 ± 0.210 ms	-2.0%	Within noise
Streaming grep: regex	6.374 ± 0.192 ms	6.480 ± 0.056 ms	1.7%	Within noise
Streaming grep: fuzzy	6.787 ± 0.159 ms	6.808 ± 0.543 ms	0.3%	Within noise
Streaming grep: no match	12.117 ± 0.396 ms	12.068 ± 0.524 ms	-0.4%	Within noise
FTS: open index	3.938 ± 0.109 ms	3.959 ± 0.106 ms	0.5%	Within noise
FTS: reopen index per query	5.009 ± 0.190 ms	5.169 ± 0.241 ms	3.2%	Within noise
Semantic build: fake engine (4,097 messages)	237.861 ± 2.947 ms	248.353 ± 6.213 ms	4.4%	Within noise
Vector search: SQLite	5.495 ± 0.146 ms	5.479 ± 0.224 ms	-0.3%	Within noise
Vector search: SQLite, selective filter	1.379 ± 0.034 ms	2.000 ± 0.101 ms	45.0%	Slower
Vector search: SQLite, selective filter (16,384 vectors)	1.543 ± 0.207 ms	1.813 ± 0.172 ms	17.5%	Within noise
Vector search: cosine, selective filter	0.417 ± 0.047 ms	0.403 ± 0.012 ms	-3.4%	Within noise
Rank fusion (2 × 100 hits)	0.028 ± 0.003 ms	0.025 ± 0.003 ms	-8.4%	Within noise

A change is flagged only when it exceeds 10% and three times the larger median absolute deviation. This is a noise heuristic, not a statistical significance test. Timing changes are informational. New correctness failures and execution errors fail the job; identical assertion failures in every main and PR round remain visible without blocking the PR.

Runtime: Bun 1.4.0, linux x64, AMD EPYC 9V45 96-Core Processor. Same runner, serial execution, alternating revision order. Suite: f7f0a0530c34.

Fixtures: 32 sessions × 128 messages (~2 MiB), unchanged incremental-index proxies at 8/128/2,048 one-message sessions, 4,096 vectors × 384 dimensions, and a 16,384-vector selective-filter case. Native cold includes finder initialization; filesystem caches are not flushed. Vector retrieval excludes model loading and embedding generation.
Vector retrieval remains exact: SQL predicates reduce the distance input set and LIMIT bounds materialized results, but scalar distance still scans every filtered vector. Approximate vec0/ANN retrieval is deferred pending separate maintainer approval.

Tail latency (p95 of round averages)

Operation	main p95	PR p95
Full index (4,096 messages)	126.525 ms	1900.181 ms
Index unchanged files	14.449 ms	14.969 ms
Index one appended session	22.381 ms	26.156 ms
Index unchanged (8 sessions)	3.204 ms	3.582 ms
Index unchanged (128 sessions)	35.972 ms	45.861 ms
Index unchanged (2,048 sessions)	515.818 ms	519.423 ms
Native grep: initialization + first query	64.303 ms	64.095 ms
Native grep: warm query	7.405 ms	7.399 ms
Native grep: no match	0.116 ms	0.112 ms
Streaming grep: plain	6.781 ms	8.343 ms
Streaming grep: regex	6.642 ms	6.536 ms
Streaming grep: fuzzy	7.256 ms	9.212 ms
Streaming grep: no match	12.840 ms	12.667 ms
FTS: open index	4.099 ms	5.501 ms
FTS: reopen index per query	5.333 ms	5.895 ms
Semantic build: fake engine (4,097 messages)	281.933 ms	293.079 ms
Vector search: SQLite	6.915 ms	5.757 ms
Vector search: SQLite, selective filter	1.486 ms	2.175 ms
Vector search: SQLite, selective filter (16,384 vectors)	1.849 ms	2.058 ms
Vector search: cosine, selective filter	0.605 ms	0.414 ms
Rank fusion (2 × 100 hits)	0.031 ms	0.030 ms

Raw samples and per-case failures are available in the workflow artifact.

Workflow run and raw results