[aryasaatvik]

Summary

Monthly dependency sweep across packages/* (the two published adapters), all 14 examples/* workspaces, and the root toolchain. Branch cut from main at 18cf053d6b92a7f29c8195eb8c7def98faabc638 after git fetch origin main, then a clean rm -rf node_modules packages/*/node_modules examples/*/node_modules + bun install (bun 1.4.4, matching packageManager) before bun outdated -r.

One combined PR. No stack, no separate major PRs — see Majors for why every major qualified for this PR rather than needing code changes.

Packages

Patch and minor (in range)

Package	From	To	Where
@astrojs/cloudflare	14.4.2	14.4.4	astro-email
astro	7.4.2	7.4.5	astro-email
@better-auth/memory-adapter	1.7.12	1.7.17	better-auth-nextjs
better-auth	1.7.12	1.7.17	better-auth-nextjs, @samva/better-auth dev
next	16.4.2	16.4.5	better-auth-nextjs, clerk-webhook, nextjs-transactional
@clerk/nextjs	7.9.19	7.9.24	clerk-webhook
@react-email/render	2.1.1	2.2.0	clerk-webhook, @samva/better-auth dev
react-email	6.11.3	6.11.6	react-email-samva, supabase-auth-hook (+ that example's Deno import map)
hono	4.13.13	4.13.16	hono-cloudflare-workers
@cloudflare/workers-types	5.20261023.1	5.20261104.1	hono-cloudflare-workers
svelte-check	4.7.7	4.7.8	sveltekit-transactional
@sveltejs/kit	3.1.0	3.1.1	sveltekit-transactional
@sveltejs/adapter-node	6.0.0	6.0.1	sveltekit-transactional
@vitejs/plugin-react	6.1.2	6.2.1	tanstack-start-transactional
wrangler	4.152.0	4.157.0	astro-email, hono-cloudflare-workers
oxfmt	0.75.0	0.76.0	root
oxlint	1.89.0	1.91.0	root
tsdown	0.23.1	0.23.5	root
vitest	5.0.5	5.1.0	root, inbound-email-replies, mailbox-agent, supabase-auth-hook

Majors (no code changes required)

Package	From	To	Where	Why no code change
effect	4.0.6	4.1.2	effect-sdk	Example imports only Effect, Data from the core barrel and Client/Email/catchAuthError/isRetryable from samva/effect. 4.1.2 satisfies the samva/effect peer ^4.0.4. 4.1's breaking changes are confined to effect/Crypto → effect/crypto/* services, Decision image fields, and CliOutput/HelpDoc — none used here. Typecheck, bun build, and smoke all pass untouched.
@types/node	24.19.2 / 22.20.5	26.6.6	every example that declared it (9)	Types-only. Full typecheck across all 18 projects passes; no source or tsconfig types edits needed.
@samva/markup	^0.18.0	^0.22.1	tsx-template	Templates use defineTemplate, jsonSchema, @samva/markup/email primitives — all stable across 0.18 → 0.22.
@samva/vite	^0.18.0	^0.22.1	tsx-template	Loaded by the CLI from the project root (Bun.resolveSync("@samva/vite/build")); its only peer is vite@^8.2.2, already satisfied by 8.3.5.
@samva/cli	^0.25.0	^0.29.2	tsx-template	0.25 pins the authoring line to markup 0.18.0 (package_default2.version in its bundle) and refuses to drive a newer project. 0.29.2 carries markup 0.22.1, which is why the three @samva authoring packages move as one family.
nitro	3.0.260311-beta	3.0.261103-rc	tanstack-start-transactional	Pre-1.0 date-stamped channel; nitro/vite plugin API unchanged. vite build + tsgo --noEmit pass.

Majors deliberately deferred

typescript 6.0.3 → 7.0.2 in examples/astro-email and examples/sveltekit-transactional. Both were attempted and both fail inside the checker, not in this repo's code:

• astro check — [ERROR] [check] astro check does not currently support TypeScript 7.0. To continue using astro check, install TypeScript 6 instead.
• svelte-kit sync/svelte-check — Cannot read properties of undefined (reading 'readFile') in @sveltejs/kit's load_tsconfig; @sveltejs/kit 3.1.1 still peers typescript@^6.0.0 and svelte-check peers ^5.0.0 || ^6.0.0.

Every other workspace is already on TypeScript 7.0.2 and stays there. These two move when astro check and Kit/svelte-check accept TS 7.

Removals

None. knip and depcheck were both run across all 17 workspaces; their only hits were false positives that resolve through tooling rather than an import statement:

• @samva/vite in tsx-template-samva — the CLI resolves @samva/vite/build from the project root. Verified by removing it: samva templates check fails with @samva/vite is not installed in this project.
• @astrojs/check, svelte-check, @cloudflare/workers-types, @samva/cli — invoked as binaries or referenced from tsconfig types.
• typescript, @types/*, @types/bun — referenced from tsconfig types / the tsgo binary.

@react-email/components, server-only, standardwebhooks, zod, effect, nitro are all genuinely imported. No dependency in any manifest is unused.

Changelog highlights

• Effect 4.1.0 — breaking crypto rework: effect/Crypto is replaced by family-specific effect/crypto/* services with explicit layers (NodeCrypto, BunCrypto, DenoCrypto, BrowserCrypto); effect/testing/TestCrypto is replaced by Layer.mock. Also removes DecideOptions.images in favor of Decision.Image input fields, and moves inherited CLI flags to HelpDoc.inheritedFlags. Additive highlights: Schema.isAscii, CircuitBreaker onRejection/probe, SchemaBinary.int32/uint32/int64/uint64. This repo touches none of the changed surfaces.
• @types/node 26 — tracks Node 26 typings; workspace engines still require Node >=24.10.0, and this is a types-only dependency for the examples.
• @samva/cli 0.29 — drives authoring line 0.22 and refuses to operate on a project newer than its own line, which is what forces markup/vite/cli to move together.
• oxfmt 0.76 — one breaking change, formatting parser:html files with oxc_formatter_htmlish. No .html files are formatted by this repo (format:check covers 227 files, unchanged and clean).
• vitest 5.1 — no breaking changes; all 139 tests pass unchanged.

Code changes

No source-code changes. Manifests and bun.lock, plus the version pins quoted in docs:

• examples/supabase-auth-hook/deno.json — react-email import map pin → 6.11.6 (caught in review: the manifest bump alone left the Deno checks resolving 6.11.3 while Vitest rendered 6.11.6)
• cookbooks/supabase-auth.md — same import map, kept in sync
• examples/tsx-template-samva/README.md — stated toolchain pins
• cookbooks/tsx-templates.md — bun add install commands
• examples/effect-sdk/README.md — stated effect pin
• cookbooks/effect-sdk.md — bun add command and the peer-range note

bun.lock was regenerated by bun install; the diff is restricted to the changed selectors, their resolutions, and transitive patch bumps (Astro, Clerk, better-auth, workerd, TanStack query-core).

Not touched on purpose

• samva SDK pins and peers stay at ^0.34.0 everywhere (13 example manifests, both packages' dev + peer, and the Supabase Deno import map). That propagation is a separate flow.
• Published package peer ranges — @samva/better-auth keeps @react-email/render: ^2.0.0 and better-auth: ^1.7.2; only its dev dependencies moved to the newest in-range releases. @samva/email-sdk is unchanged.
• No .tegami note. Neither published package's runtime deps or peer ranges change, so there is nothing to release. See Publishing.

Publishing

Merging this does not publish. There is no .tegami/ changeset in this PR and no release label, and publish.yml only runs for tegami/version-packages or a PR labelled release. Nothing here is version-worthy: @samva/better-auth and @samva/email-sdk keep identical runtime and peer ranges, which the plan release check confirms by completing without a bump.

Local testing

Baseline on main at 18cf053d6b92a7f29c8195eb8c7def98faabc638 was fully green for every command below before any edit, so any failure here is mine, not pre-existing. (The sandbox needed bun@1.4.4 and deno@2.9.5 installed to match packageManager and CI.)

• bun install --frozen-lockfile — 697 installs / 888 packages, no drift
• bun run build — 12/12 tasks
• bun run typecheck — 18/18 tasks
• bun run test — 139 tests, 7 files
• bun run lint — exit 0; same 14 pre-existing no-await-in-loop / no-underscore-dangle / no-named-as-default warnings as main
• bun run format:check — clean, 227 files
• bun run release:packages:check — 2 reproducible Bun tarballs
• bun run validate:agent-plugin — contract valid
• bun --filter effect-sdk-example smoke — Effect 4.1.2 smoke checks passed
• bun --filter tsx-template-samva check and build — all templates compile; artifact reports @samva/markup@0.22.1
• bunx samva templates render receipt --fixture default — renders expected subject and body
• bun --filter sveltekit-transactional-samva build — adapter-node build succeeds
• bun --filter supabase-auth-hook-samva build (deno task typecheck) and test — Deno check clean, 17 tests pass
• bun outdated -r — only the two documented TypeScript 7 holdouts remain

Reproduce locally:

bun install --frozen-lockfile
bun run build
bun run typecheck
bun run test
bun run lint
bun run format:check
bun run release:packages:check
bun run validate:agent-plugin
bun --filter effect-sdk-example smoke
bun --filter tsx-template-samva check
bun --filter sveltekit-transactional-samva build
bun --filter supabase-auth-hook-samva test
bun outdated -r

Related issue

None.

Checklist

• Conventional Commit title
• bun run build passes
• bun run typecheck passes
• bun run test passes
• bun run lint and bun run format:check pass
• Added or updated tests — not applicable; no behavior changed
• Updated the package/example README if behavior changed — updated README/cookbook version pins

  

[github-actions]

Tegami

This repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under .tegami/ before merging.

Create a changelog → · Changelog format

No changelogs yet

This PR has no pending changelog files. If your changes require a release, add a changelog before merging.

Run bun run tegami locally to create a changelog interactively.

_{Managed by Tegami.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with the previous Supabase release mismatch fixed.

Summary

Updates workspace dependencies and the matching version examples in the documentation.

• The TSX template example uses the newer matching Samva authoring tools.
• The Effect example and guide use Effect 4.1.2.
• Example workspaces and developer tools use updated package versions.

_{Reviews (2) · Last reviewed commit: "fix(supabase-auth-hook): pin react-email..." · Reviewed by Greptile}