[dependabot]

Bumps the minor-and-patch group with 20 updates in the / directory:

Package	From	To
@types/node	24.19.1	24.19.2
dotenv	18.0.6	18.0.9
@base-ui/react	1.8.0	1.9.0
@dagrejs/dagre	3.1.1	3.1.3
@next/third-parties	16.4.2	16.4.5
@xyflow/react	12.12.0	12.12.1
better-auth	1.7.7	1.7.18
jose	6.2.12	6.2.15
lucide-react	1.53.0	1.69.0
next	16.4.3	16.4.5
posthog-js	1.438.3	1.447.1
posthog-node	5.55.1	5.63.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
@next/bundle-analyzer	16.4.0	16.4.5
@tailwindcss/postcss	4.3.3	4.3.4
eslint-config-next	16.3.8	16.4.5
postcss	8.5.29	8.5.32
prettier	3.9.9	3.9.10
tailwindcss	4.3.3	4.3.4

Updates @types/node from 24.19.1 to 24.19.2

Commits

• See full diff in compare view

Updates dotenv from 18.0.6 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

• Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

Commits

• 8d1ab85 18.0.9
• 59a40ce changelog
• 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
• bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
• 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
• 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• Additional commits viewable in compare view

Updates @base-ui/react from 1.8.0 to 1.9.0

Release notes

Sourced from @​base-ui/react's releases.

v1.9.0

General changes

• Export CssVariables and DataAttributes types (#5243) by @​superhooman
• Fix stale focused field state (#5345) by @​atomiks
• Fix animation waits retaining detached elements (#5719) by @​flaviendelangle
• Keep item registration in sync when items change under Strict Mode (#5862) by @​atomiks
• Avoid re-rendering inactive triggers on open and close (#5865) by @​atomiks

Accordion

• Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
• Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

• Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

• Prefer aria-label over associated labels (#5787) by @​atomiks

Collapsible

• Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @​atomiks
• Finish closing when the render function removes the panel (#5890) by @​michaldudak
• Restore animations when a removed panel reopens (#5891) by @​michaldudak
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Combobox

• Fix stale chip focus after returning to the input (#5879) by @​mdm317
• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
• Fix label focus in Shadow DOM (#5871) by @​lyzno1
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Reset typeahead state when closing without moving focus (#5816) by @​mdm317
• Accept readonly arrays for multiple values (#5710) by @​MonstraG
• Share item indicator implementation (#5728) by @​flaviendelangle
• Improve mount performance of large lists (#5819) by @​atomiks
• Combine item store subscriptions (#5863) by @​atomiks

Dialog

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

• Export CssVariables and DataAttributes types (#5243) by @​superhooman
• Fix stale focused field state (#5345) by @​atomiks
• Fix animation waits retaining detached elements (#5719) by @​flaviendelangle
• Keep item registration in sync when items change under Strict Mode (#5862) by @​atomiks
• Avoid re-rendering inactive triggers on open and close (#5865) by @​atomiks

Accordion

• Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
• Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

• Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

• Prefer aria-label over associated labels (#5787) by @​atomiks

Collapsible

• Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @​atomiks
• Finish closing when the render function removes the panel (#5890) by @​michaldudak
• Restore animations when a removed panel reopens (#5891) by @​michaldudak
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Combobox

• Fix stale chip focus after returning to the input (#5879) by @​mdm317
• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
• Fix label focus in Shadow DOM (#5871) by @​lyzno1
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Reset typeahead state when closing without moving focus (#5816) by @​mdm317
• Accept readonly arrays for multiple values (#5710) by @​MonstraG

... (truncated)

Commits

• ad7ecda [release] v1.9.0 (#5906)
• 3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
• 69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
• 51b70db [menu] Strip internal filter components from public types (#5923)
• 8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
• aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
• ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
• 1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
• bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
• 147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
• Additional commits viewable in compare view

Updates @dagrejs/dagre from 3.1.1 to 3.1.3

Changelog

Sourced from @​dagrejs/dagre's changelog.

v3.1.3

Fixes & Improvements

• ESM & Package Exports (PR #516): Added "type": "module" to package.json and renamed the CommonJS bundle to dist/dagre.cjs so both ESM import and CommonJS require() resolve properly. Re-exported Graph with default generic parameters for backward compatibility.
• Dynamic Layout State Isolation (PR #515): Scoped remembered dynamic layout state to the input graph rather than module-level state to prevent state leaks across layouts.
• Cluster Edge Routing (PR #523): Restored internal edge routes inside clusters with custom rankdir directions.
• Zero-Width Node Intersections (PR #524): Fixed vertical edge route intersection calculations with zero-width nodes.
• Parallel Edge Subgraph Sorting (PR #522): Fixed sortSubgraph so each parallel-edge dummy node is paired at most once when laying out three or more parallel edges.
• Flat Graph Conflict Scan Optimization (PR #520): Skipped findType2Conflicts scan when no border dummy nodes are present in flat graphs.
• Release & Tooling (PR #526, PR #527): Added a preflight release check to ensure changelog.md is updated before releasing, and added .pre-commit-config.yaml to run tests.
• Dependency Updates: Updated @dagrejs/graphlib to 4.0.6.

---

[3.1.0] - 2026

New Features

• Per-Cluster Direction Support (PR #511): Each cluster/subgraph can now specify its own rankdir, ranksep, nodesep, and align settings. The layout engine recursively applies these settings, enabling complex nested cluster hierarchies with independent flow directions. Fully backward compatible with global rankdir and legacy layouts.
• Dynamic Graph Layout Support (PR #512): Added support for dynamic graph layouts via useDynamic and corePath configuration options in LayoutConfig. Enables persistent node ordering and layout stability when modifying graph structures.

Refactoring & Fixes

• TypeScript & Type Safety Improvements: Added ClusterNodeLabel and NodeCollection types, updated NodeLabel interfaces, and eliminated any type assertions across the codebase.
• Nested Cluster Fixes: Resolved edge cases in nested cluster isolation and improved edge routing for cross-cluster edges.

---

[3.0.0] - 2026

Major Improvements: TypeScript Migration

• Full TypeScript Rewrite (PR #509): Migrated the entire core codebase from JavaScript to TypeScript for improved type safety, better IDE autocompletion, and easier maintenance.
• Native Type Definitions: Removed the need for external @types/dagre packages; high-quality types are now shipped directly with the library.
• Modern Build Pipeline: * Replaced JSHint with ESLint for stricter code quality.
  • Replaced Browserify/Karma with modern bundling and testing tools.
  • Standardized project indentation to 2 spaces (aligning .eslintrc and .editorconfig).

Refactoring & Fixes

• Dependency Cleanup: Removed deprecated dependencies including bower.json and legacy test configurations.
• Module Exports: Standardized ESM and CommonJS exports to ensure compatibility with modern bundlers like Webpack 5, Vite, and Rollup.
• Internal Logic: Refined internal graph traversal algorithms to utilize TypeScript interfaces, reducing "undefined" runtime errors.

---

[2.0.0] - Legacy Modernization

Major Changes

• Organization Transfer: Formally moved the repository to the @dagrejs GitHub organization.
• Package Renaming: Published under the @dagrejs/dagre npm scope.
• Dropped Legacy Environments: Discontinued support for extremely old Node.js versions (pre-v10) and legacy browsers that do not support ES6 features.

Fixes

... (truncated)

Commits

• a73acbf Bumping for release
• a037580 Merge pull request #527 from dagrejs/check-release-notes
• 17757d9 Adding a check on release notes to the release
• 744d6e1 Bump version and set as pre-release
• a5ea31c Building for release
• 89b75d9 Merge pull request #526 from dagrejs/pre-commit
• 09913ac chore: add .pre-commit-config.yaml to run tests
• daa9324 Merge pull request #524 from dajiaohuang/fix/zero-width-edge-intersections-20...
• 77c6330 Merge branch 'master' into fix/zero-width-edge-intersections-20261015
• a4cfd26 chore: revert dist changes and move tests to layout-test.ts
• Additional commits viewable in compare view

Updates @next/third-parties from 16.4.2 to 16.4.5

Release notes

Sourced from @​next/third-parties's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

Commits

• 4e5335a v16.4.5
• b175f52 v16.4.4
• 29bbeab v16.4.3
• See full diff in compare view

Updates @xyflow/react from 12.12.0 to 12.12.1

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.1

Patch Changes

• #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

• #6097 d150c38 - Don't mutate the internal selection state

• #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

• #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

• #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

• Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

  • @​xyflow/system@​0.0.84

Changelog

Sourced from @​xyflow/react's changelog.

12.12.1

Patch Changes

• #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

• #6097 d150c38 - Don't mutate the internal selection state

• #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

• #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

• #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

• Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

  • @​xyflow/system@​0.0.84

Commits

• 7599c7f chore(packages): bump
• d4bc936 Merge pull request #5650 from keepmhwn/fix/path-options-type
• c4fdcb1 Merge pull request #6097 from xyflow/fix/internal-selection
• 5c90af4 fix(react): cleanup internal selection handling #6096
• 93b7a91 chore(pane): cleanup
• 7abb6f0 Add Svelte pane cancellation and merge latest main
• b235ea0 fix: respect flow nodeOrigin in root node intersections
• 22388df chore(useResizeHandler): cleanup
• 7813eeb fix(react): cancel click connections on pane click
• c7d0fcb fix: disconnect ResizeObservers when a flow unmounts
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.18

Release notes

Sourced from better-auth's releases.

v1.7.18

[!IMPORTANT] Action required

• If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

• Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
• Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
• Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• fix(core): accept introspected tokens when verifyOptions.typ is set (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​gustavovalverde

Full changelog: v1.7.17...v1.7.18

v1.7.17

better-auth

Bug Fixes

• Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
• Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
• Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
• Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
• Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
• Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
• Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.18

Patch Changes

• #12259 9e2a0ec Thanks @​gustavovalverde! - Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase so that sessions created while the revocation runs are revoked too. Sessions created by a session.delete.after hook still stay active.

• #12244 85f4342 Thanks @​gustavovalverde! - getTestInstance with testWith: "mysql" no longer hangs. It expects a MySQL server at 127.0.0.1:3306 whose root password is root_password, and it creates and drops a separate database for each instance, so several instances can run in one test file.

• #12250 278bb28 Thanks @​gustavovalverde! - getTestInstance from better-auth/test now closes the Postgres connection pool and the SQLite database it created when the test file finishes. Previously both stayed open until the test worker exited. With Vitest's default sequence.hooks: "stack", afterAll hooks in your test files still run before this cleanup and can keep using the instance.

• Updated dependencies [9342a73]:

  • @​better-auth/core@​1.7.18
  • @​better-auth/drizzle-adapter@​1.7.18
  • @​better-auth/kysely-adapter@​1.7.18
  • @​better-auth/memory-adapter@​1.7.18
  • @​better-auth/mongo-adapter@​1.7.18
  • @​better-auth/prisma-adapter@​1.7.18
  • @​better-auth/telemetry@​1.7.18

1.7.17

Patch Changes

• #12181 b6a87ad Thanks @​aliamanatali! - A remembered sign-in or sign-up now refreshes its session like any other remembered session, even if an earlier sign-in in the same browser used rememberMe: false. Previously the earlier choice stayed in a dont_remember cookie until the browser closed, so the new session stopped sliding and expired expiresIn after it was created.

• #12216 cff7c1c Thanks @​bytaesu! - Denying a device authorization request now rejects a session that was revoked but still present in the cookie cache, matching the behavior of approving a request.

• #12217 16aa412 Thanks @​bytaesu! - IP wildcard trusted origins such as exp://192.168.*.*:* no longer match custom-scheme hosts with out-of-range or zero-padded octets like 192.168.999.999.

• #12219 9150314 Thanks @​bytaesu! - Signing up with an empty phoneNumber with the phone number plugin no longer stores the empty string or makes later sign-ups fail. Linking an account whose profile maps an empty phone number no longer replaces the user's verified number.

• #12212 f5be351 Thanks @​bytaesu! - Fixed sessions created by a session.delete.after hook during "revoke all sessions" being treated as revoked immediately when secondaryStorage is used with storeSessionInDatabase.

• #12211 98bcd98 Thanks @​bytaesu! - Fixed TOTP verification rejecting sessions created from an API key, so API-key sessions can now finish two-factor enrollment.

• #12228 fbff537 Thanks @​bytaesu! - Trusted devices are honored again when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP.

• Updated dependencies [fc2e00b]:

  • @​better-auth/kysely-adapter@​1.7.17
  • @​better-auth/core@​1.7.17
  • @​better-auth/drizzle-adapter@​1.7.17
  • @​better-auth/memory-adapter@​1.7.17
  • @​better-auth/mongo-adapter@​1.7.17
  • @​better-auth/prisma-adapter@​1.7.17
  • @​better-auth/telemetry@​1.7.17

1.7.16

Patch Changes

... (truncated)

Commits

• 38f43e3 chore: release v1.7.18 (#12252)
• 9e2a0ec fix(session): revoke sessions created while bulk revocation runs (#12259)
• 278bb28 fix(test-utils): close the instance's own Postgres and SQLite handles (#12250)
• 85f4342 fix(test-utils): make testWith mysql work and run it in CI (#12244)
• e3ae9e1 chore: release v1.7.17 (#12214)
• b6a87ad fix(cookies): clear the dont_remember marker on a remembered sign-in (#12181)
• fbff537 fix(two-factor): honor trusted devices when the sign-in step runs on custom p...
• 16aa412 fix(origin-check): validate IPv4 octets in IP wildcard trusted origins (#12217)
• 9150314 fix(phone-number): treat empty phone number as missing (#12219)
• cff7c1c fix(device-authorization): reject revoked cached sessions on deny (#12216)
• Additional commits viewable in compare view

Updates jose from 6.2.12 to 6.2.15

Release notes

Sourced from jose's releases.

v6.2.15

Fixes

• jwe: cancel decompression when output exceeds the limit (67541aa)
• jwks: reject negative cache durations (a3b296f)
• jwt: reject negative clockTolerance (67d6c83)

v6.2.14

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

v6.2.13

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

Changelog

Sourced from jose's changelog.

6.2.15 (2026-11-01)

Fixes

• jwe: cancel decompression when output exceeds the limit (67541aa)
• jwks: reject negative cache durations (a3b296f)
• jwt: reject negative clockTolerance (67d6c83)

6.2.14 (2026-10-29)

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

6.2.13 (2026-10-20)

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

Commits

• f931aa5 chore(release): 6.2.15
• c2dd2ff test: verify decompression is cancelled on output limit
• 67d6c83 fix(jwt): reject negative clockTolerance
• 67541aa fix(jwe): cancel decompression when output exceeds the limit
• a3b296f fix(jwks): reject negative cache durations
• f3737f9 chore(deps-dev): bump electron from 45.0.0 to 45.1.0 in /tap/electron
• f2fbc97 chore(deps-dev): bump workerd in /tap/workerd
• 4533e9d chore(deps): bump the actions group with 4 updates
• f9cee77 chore: cleanup after release