[dependabot]

Bumps the major-updates group with 2 updates: @hookform/resolvers and graphql-yoga.

Updates @hookform/resolvers from 5.9.2 to 6.0.0

Release notes

Sourced from @​hookform/resolvers's releases.

v6.0.0

6.0.0 (2026-10-19)

Features

• effect-ts: support Effect v4 (#880) (a5ab308), closes #878

BREAKING CHANGES

• effect-ts: the effect-ts resolver now requires effect@^4.0.0; Effect v3 is no longer supported. Schemas must be migrated to the Effect v4 Schema API (e.g. Schema.nonEmptyString() -> .check(Schema.isNonEmpty()), Schema.Union(a, b) -> Schema.Union([a, b]), Schema.transform -> Schema.decodeTo). Error type values follow Effect v4 issue tags: Type -> InvalidType, Missing -> MissingKey, Refinement -> Filter, Unexpected -> UnexpectedKey, plus new AnyOf and InvalidValue. Default error messages now come from Effect v4 (e.g. is missing -> Missing key, and the received value is no longer included).

• chore(deps): sync bun.lock with ata-validator ^1.23.0

Commits

• a5ab308 feat(effect-ts): support Effect v4 (#880)
• See full diff in compare view

Updates graphql-yoga from 5.24.6 to 6.0.1

Release notes

Sourced from graphql-yoga's releases.

graphql-yoga@6.0.1

Patch Changes

• #4634 d73f61c Thanks @​ardatan! - dependencies: bump @whatwg-node/server to ^0.13.1 so native Request subclasses (Next.js NextRequest, including the App Router proxyNextRequest Proxy) are classified as the platform Fetch API. The body-size limiter no longer throws a cross-realm TypeError / 500 on those requests; oversized bodies still return 413.

  See graphql-hive/graphql-yoga#4633 and ardatan/whatwg-node#3717.

graphql-yoga@6.0.0

Major Changes

• #4575 862447a Thanks @​egoodwinx! - Use @graphql-hive/logger and add correlated, per-request logging (closes #4048)

  Every request now gets its own logger, available as context.log (and serverContext.log in plugin hooks), tagged with a requestId. Everything logged while handling a request can be correlated by that id.

  The request id is taken from the host integration if it already assigned one (e.g. Fastify's request.id), otherwise from the incoming x-request-id header, otherwise generated. It is also sent back in the x-request-id response header. Configure it with the new requestId option:

  createYoga({
    requestId: {
      // don't trust the incoming header, recommended when clients can reach the server directly
      trustHeader: false,
      headerName: 'x-correlation-id',
      generateRequestId: () => myId()
    }
  })

  Pass requestId: false to disable it.

  At the info level, a single "Request processed" line is logged per request with the method, path, operation name and type, response status, error count and duration. At the debug level, more details about request processing are logged.

  Masked errors are now logged with the request's logger, so they can be traced back to the request that caused them. Custom maskError functions receive the request's context as an optional fourth

... (truncated)

Changelog

Sourced from graphql-yoga's changelog.

6.0.1

Patch Changes

• #4634 d73f61c Thanks @​ardatan! - dependencies: bump @whatwg-node/server to ^0.13.1 so native Request subclasses (Next.js NextRequest, including the App Router proxyNextRequest Proxy) are classified as the platform Fetch API. The body-size limiter no longer throws a cross-realm TypeError / 500 on those requests; oversized bodies still return 413.

  See graphql-hive/graphql-yoga#4633 and ardatan/whatwg-node#3717.

6.0.0

Major Changes

• #4575 862447a Thanks @​egoodwinx! - Use @graphql-hive/logger and add correlated, per-request logging (closes #4048)

  Every request now gets its own logger, available as context.log (and serverContext.log in plugin hooks), tagged with a requestId. Everything logged while handling a request can be correlated by that id.

  The request id is taken from the host integration if it already assigned one (e.g. Fastify's request.id), otherwise from the incoming x-request-id header, otherwise generated. It is also sent back in the x-request-id response header. Configure it with the new requestId option:

  createYoga({
    requestId: {
      // don't trust the incoming header, recommended when clients can reach the server directly
      trustHeader: false,
      headerName: 'x-correlation-id',
      generateRequestId: () => myId()
    }
  })

  Pass requestId: false to disable it.

  At the info level, a single "Request processed" line is logged per request with the method, path, operation name and type, response status, error count and duration. At the debug level, more details about request processing are logged.

... (truncated)

Commits

• 9d7bb3a chore(release): update monorepo packages versions (#4635)
• d73f61c test(yoga): cover Request subclass body-size limit (#4633) (#4634)
• 88c3a06 chore(release): update monorepo packages versions (#4629)
• 862447a feat!: update logging to use hive logger and add more logging (#4575)
• be89d05 chore(deps)!: bump @graphql-tools/* to majors (utils@13) (#4623)
• 5334079 fix(yoga): drop redundant native TransformStream swap in body-size limit (#4622)
• 79b0e8b chore(deps)!: drop support for node <22 and graphql <16 (#4574)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 27, 2026 3:23am UTC

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1793071591586
• lhr-1793071602746
• lhr-1793071613610
• lhr-1793071624014
• lhr-1793071634440
• lhr-1793071644794
• lhr-1793071655193
• lhr-1793071665600
• lhr-1793071675977

Reports are also available as workflow artifacts