Dependency Upgrade Report
Historical dependency upgrade notes from 2026-05-17.
Scope: repo-wide direct dependency refresh for Bun workspaces, Rust crates, and the FastAPI
uv project.
Verification
bun outdated --recursive --no-progress --network-concurrency=4bun install --ignore-scripts --no-progress --network-concurrency=4PRISMA_SCHEMA_ENGINE_BINARY=/tmp/prisma-schema-engine bun run --cwd apps/hono-api db:generatecargo update --manifest-path apps/rust/Cargo.tomlcargo update --dry-run --verbose --manifest-path apps/rust/Cargo.tomluv lock --upgradeuv lock --checkbun run formatbun run lintbun run typecheckbun run testbun run buildgit diff --check
Notes:
bun update --latest --recursivehung in dependency resolution, so the manifests were updated frombun outdatedregistry results and locked withbun install.- Prisma 7.8 generation failed through Prisma's downloader even though the engine URL worked with
curl. The generated client was refreshed by downloading the schema engine to/tmpand usingPRISMA_SCHEMA_ENGINE_BINARY; no engine binary was committed. - Expo CLI
expo install --checktimed out on network access. Mobile core versions remain aligned to Expo SDK 55, which publishes React Native 0.83, React 19.2.0, and React Native Web 0.21.0.
Bun Workspaces
| Workspace | Package | From | To | Reason | Version URL |
|---|---|---|---|---|---|
| root | bun packageManager | 1.3.11 | 1.3.13 | match installed current Bun used for the lockfile | https://github.com/oven-sh/bun/releases/tag/bun-v1.3.13 |
| root | @biomejs/biome | 2.4.14 | 2.4.15 | latest Biome patch | https://www.npmjs.com/package/@biomejs/biome/v/2.4.15 |
| root | lightningcss | 1.30.1 | 1.32.0 | latest CSS engine and override alignment | https://www.npmjs.com/package/lightningcss/v/1.32.0 |
| root | turbo | 2.9.9 | 2.9.14 | latest Turborepo patch | https://www.npmjs.com/package/turbo/v/2.9.14 |
| web, ui | @base-ui/react | 1.3.0 | 1.4.1 | latest shared UI primitive runtime | https://www.npmjs.com/package/@base-ui/react/v/1.4.1 |
| web | @hugeicons/core-free-icons | 4.1.1 | 4.1.4 | latest icon package patch | https://www.npmjs.com/package/@hugeicons/core-free-icons/v/4.1.4 |
| web | @tanstack/react-query | 5.100.9 | 5.100.10 | latest React Query patch | https://www.npmjs.com/package/@tanstack/react-query/v/5.100.10 |
| web, docs | next | 16.2.2 | 16.2.6 | latest Next.js patch | https://github.com/vercel/next.js/releases/tag/v16.2.6 |
| web, docs | react | 19.2.4 | 19.2.6 | latest React patch for web apps | https://www.npmjs.com/package/react/v/19.2.6 |
| web, docs | react-dom | 19.2.4 | 19.2.6 | latest React DOM patch for web apps | https://www.npmjs.com/package/react-dom/v/19.2.6 |
| web | shadcn | 4.1.2 | 4.7.0 | latest shadcn CLI | https://www.npmjs.com/package/shadcn/v/4.7.0 |
| web, docs, ui | tailwind-merge | 3.5.0 | 3.6.0 | latest Tailwind merge utility | https://www.npmjs.com/package/tailwind-merge/v/3.6.0 |
| web | @playwright/test | 1.59.0 | 1.60.0 | latest Playwright test runner | https://www.npmjs.com/package/@playwright/test/v/1.60.0 |
| web, docs | @tailwindcss/postcss | 4.2.2 | 4.3.0 | latest Tailwind PostCSS adapter | https://www.npmjs.com/package/@tailwindcss/postcss/v/4.3.0 |
| web, docs, pwa, logger, nest | @types/node | 22.10.7 / 25.5.x | 25.8.0 | latest Node typings | https://www.npmjs.com/package/@types/node/v/25.8.0 |
| web, docs, pwa, logger, ui, nest | typescript | 5.7.3 / 6.0.2 | 6.0.3 | latest TypeScript line where framework-compatible | https://www.npmjs.com/package/typescript/v/6.0.3 |
| web, hono, logger | vitest | 4.1.2 | 4.1.6 | latest Vitest patch | https://www.npmjs.com/package/vitest/v/4.1.6 |
| web, hono, logger | @vitest/coverage-v8 | 4.1.2 | 4.1.6 | match Vitest version | https://www.npmjs.com/package/@vitest/coverage-v8/v/4.1.6 |
| web, docs, hono | zod | 4.3.6 | 4.4.3 | latest Zod patch | https://www.npmjs.com/package/zod/v/4.4.3 |
| docs | @ai-sdk/react | 3.0.155 | 3.0.186 | latest AI SDK React package | https://www.npmjs.com/package/@ai-sdk/react/v/3.0.186 |
| docs | ai | 6.0.153 | 6.0.184 | latest AI SDK core package | https://www.npmjs.com/package/ai/v/6.0.184 |
| docs | @openrouter/ai-sdk-provider | 2.5.0 | 2.9.0 | latest OpenRouter provider | https://www.npmjs.com/package/@openrouter/ai-sdk-provider/v/2.9.0 |
| docs | fumadocs-core | 16.7.11 | 16.8.11 | latest Fumadocs core | https://www.npmjs.com/package/fumadocs-core/v/16.8.11 |
| docs | fumadocs-mdx | 14.2.11 | 15.0.6 | latest Fumadocs MDX major | https://www.npmjs.com/package/fumadocs-mdx/v/15.0.6 |
| docs | fumadocs-ui | 16.7.11 | 16.8.11 | latest Fumadocs UI | https://www.npmjs.com/package/fumadocs-ui/v/16.8.11 |
| docs | lucide-react | 1.7.0 | 1.16.0 | latest icon package | https://www.npmjs.com/package/lucide-react/v/1.16.0 |
| docs | postcss | 8.5.9 | 8.5.14 | latest PostCSS patch | https://www.npmjs.com/package/postcss/v/8.5.14 |
| web, docs, mobile | tailwindcss | 4.2.2 | 4.3.0 | latest Tailwind CSS | https://www.npmjs.com/package/tailwindcss/v/4.3.0 |
| hono | @prisma/adapter-pg | 7.6.0 | 7.8.0 | latest Prisma adapter | https://www.npmjs.com/package/@prisma/adapter-pg/v/7.8.0 |
| hono | @prisma/client | 7.6.0 | 7.8.0 | latest Prisma client | https://www.npmjs.com/package/@prisma/client/v/7.8.0 |
| hono | prisma | 7.6.0 | 7.8.0 | latest Prisma CLI | https://www.npmjs.com/package/prisma/v/7.8.0 |
| hono | hono | 4.12.9 | 4.12.19 | latest Hono patch | https://www.npmjs.com/package/hono/v/4.12.19 |
| hono | jose | 6.2.2 | 6.2.3 | latest JOSE patch | https://www.npmjs.com/package/jose/v/6.2.3 |
| hono, pwa | @types/bun | latest / 1.3.5 | 1.3.14 | latest Bun typings and deterministic specifier | https://www.npmjs.com/package/@types/bun/v/1.3.14 |
| mobile | @react-navigation/bottom-tabs | 7.15.5 | 7.16.1 | latest React Navigation tabs | https://www.npmjs.com/package/@react-navigation/bottom-tabs/v/7.16.1 |
| mobile | @react-navigation/elements | 2.9.10 | 2.9.18 | latest React Navigation elements | https://www.npmjs.com/package/@react-navigation/elements/v/2.9.18 |
| mobile | @react-navigation/native | 7.1.33 | 7.2.4 | latest React Navigation native | https://www.npmjs.com/package/@react-navigation/native/v/7.2.4 |
| mobile | expo | 55.0.12 | 55.0.24 | latest Expo SDK 55 patch | https://www.npmjs.com/package/expo/v/55.0.24 |
| mobile | expo-* SDK packages | 55.0.x | latest 55.0.x | latest SDK 55-compatible patches | https://expo.dev/changelog/sdk-55 |
| mobile | lucide-react-native | 1.14.0 | 1.16.0 | latest native icon package | https://www.npmjs.com/package/lucide-react-native/v/1.16.0 |
| mobile | react-native-svg | 15.15.4 | 15.15.5 | latest SVG patch | https://www.npmjs.com/package/react-native-svg/v/15.15.5 |
| mobile | uniwind | 1.6.2 | 1.6.5 | latest Uniwind patch | https://www.npmjs.com/package/uniwind/v/1.6.5 |
| mobile | @expo/metro-config | 55.0.9 | 55.0.21 | latest SDK 55 Metro config | https://www.npmjs.com/package/@expo/metro-config/v/55.0.21 |
| mobile | typescript | 5.9.2 | 5.9.3 | latest Expo-compatible TypeScript line | https://www.npmjs.com/package/typescript/v/5.9.3 |
| nest | @nestjs/common | 11.0.17 | 11.1.21 | latest NestJS patch | https://www.npmjs.com/package/@nestjs/common/v/11.1.21 |
| nest | @nestjs/core | 11.0.1 | 11.1.21 | latest NestJS core | https://www.npmjs.com/package/@nestjs/core/v/11.1.21 |
| nest | @nestjs/platform-express | 11.1.11 | 11.1.21 | latest NestJS Express platform | https://www.npmjs.com/package/@nestjs/platform-express/v/11.1.21 |
| nest | bcryptjs | 3.0.2 | 3.0.3 | latest bcryptjs patch | https://www.npmjs.com/package/bcryptjs/v/3.0.3 |
| nest | class-validator | 0.14.2 | 0.15.1 | latest validation library | https://www.npmjs.com/package/class-validator/v/0.15.1 |
| nest | uuid | 11.1.0 | 14.0.0 | latest UUID major | https://www.npmjs.com/package/uuid/v/14.0.0 |
| nest | @nestjs/cli | 11.0.0 | 11.0.21 | latest Nest CLI patch | https://www.npmjs.com/package/@nestjs/cli/v/11.0.21 |
| nest | @nestjs/schematics | 11.0.0 | 11.1.0 | latest Nest schematics | https://www.npmjs.com/package/@nestjs/schematics/v/11.1.0 |
| nest | @nestjs/testing | 11.0.1 | 11.1.21 | latest Nest testing package | https://www.npmjs.com/package/@nestjs/testing/v/11.1.21 |
| nest | @swc/cli | 0.6.0 | 0.8.1 | latest SWC CLI | https://www.npmjs.com/package/@swc/cli/v/0.8.1 |
| nest | @swc/core | 1.10.8 | 1.15.33 | latest SWC core | https://www.npmjs.com/package/@swc/core/v/1.15.33 |
| nest | @types/jest | 29.5.14 | 30.0.0 | match Jest 30 typings | https://www.npmjs.com/package/@types/jest/v/30.0.0 |
| nest | @types/supertest | 6.0.2 | 7.2.0 | latest Supertest typings | https://www.npmjs.com/package/@types/supertest/v/7.2.0 |
| nest | jest | 29.7.0 | 30.4.2 | latest Jest major | https://www.npmjs.com/package/jest/v/30.4.2 |
| nest | ts-jest | 29.2.5 | 29.4.9 | latest ts-jest, compatible with Jest 30 and TypeScript 6 | https://www.npmjs.com/package/ts-jest/v/29.4.9 |
Rust
| Package | From | To | Reason | Version URL |
|---|---|---|---|---|
rust-version | 1.83 | 1.86 | SQLx 0.9 alpha requires Rust 1.86+ | https://crates.io/crates/sqlx/0.9.0-alpha.1 |
axum | 0.7 | 0.8.9 | latest Axum major | https://crates.io/crates/axum/0.8.9 |
tokio | 1 | 1.52.3 | latest Tokio patch | https://crates.io/crates/tokio/1.52.3 |
serde | 1.0 | 1.0.228 | latest Serde patch | https://crates.io/crates/serde/1.0.228 |
serde_json | 1.0 | 1.0.149 | latest Serde JSON patch | https://crates.io/crates/serde_json/1.0.149 |
tower-http | 0.5 | 0.6.10 | latest Tower HTTP major | https://crates.io/crates/tower-http/0.6.10 |
sqlx | 0.8 | 0.9.0-alpha.1 | newest crates.io release; build and tests pass | https://crates.io/crates/sqlx/0.9.0-alpha.1 |
dotenvy | 0.15 | 0.15.7 | latest dotenvy patch | https://crates.io/crates/dotenvy/0.15.7 |
jsonwebtoken | 9.3.1 | 10.4.0 | latest JWT major | https://crates.io/crates/jsonwebtoken/10.4.0 |
uuid | 1.20.0 | 1.23.1 | latest UUID patch | https://crates.io/crates/uuid/1.23.1 |
time | 0.3.45 | 0.3.47 | latest time patch | https://crates.io/crates/time/0.3.47 |
axum-extra | 0.9.3 | 0.12.6 | latest Axum Extra major | https://crates.io/crates/axum-extra/0.12.6 |
cargo update --dry-run --verbose reports only transitive generic-array and matchit behind
their latest versions due upstream compatible constraints.
FastAPI / uv
| Package | From | To | Reason | Version URL |
|---|---|---|---|---|
fastapi[standard] | 0.135.3 | 0.135.4 | latest FastAPI patch | https://pypi.org/project/fastapi/0.135.4/ |
ruff | 0.15.9 | 0.15.13 | latest Ruff patch | https://pypi.org/project/ruff/0.15.13/ |
certifi | 2026.2.25 | 2026.4.22 | latest transitive CA bundle | https://pypi.org/project/certifi/2026.4.22/ |
click | 8.3.2 | 8.4.0 | latest transitive CLI runtime | https://pypi.org/project/click/8.4.0/ |
starlette | 0.49.x | 1.0.0 | latest FastAPI-compatible Starlette | https://pypi.org/project/starlette/1.0.0/ |
pydantic | 2.12.x | 2.13.4 | latest FastAPI-compatible Pydantic | https://pypi.org/project/pydantic/2.13.4/ |
websockets | 15.x | 16.0 | latest Uvicorn standard extra | https://pypi.org/project/websockets/16.0/ |
Compatibility Exceptions
These remain behind raw npm latest intentionally because Expo SDK 55 depends on React Native
0.83 and React 19.2.0:
| Workspace | Package | Kept | Raw npm latest | Reason |
|---|---|---|---|---|
| mobile | react | 19.2.0 | 19.2.6 | Expo SDK 55 compatibility |
| mobile | react-dom | 19.2.0 | 19.2.6 | Expo SDK 55 compatibility |
| mobile | react-native | 0.83.4 | 0.85.3 | Expo SDK 55 compatibility |
| mobile | react-native-gesture-handler | 2.30.1 | 2.31.2 | Expo SDK 55 compatibility |
| mobile | react-native-reanimated | 4.2.1 | 4.3.1 | Expo SDK 55 compatibility |
| mobile | react-native-screens | 4.23.0 | 4.25.0 | Expo SDK 55 compatibility |
| mobile | react-native-worklets | 0.7.2 | 0.8.3 | Expo SDK 55 compatibility |
| mobile | typescript | 5.9.3 | 6.0.3 | Expo/React Native tooling compatibility |
Sources:
- Expo SDK reference: https://docs.expo.dev/versions/latest/
- Expo SDK 55 changelog: https://expo.dev/changelog/sdk-55