chore: bump the medusa group with 3 updates

[dependabot]

Bumps the medusa group with 3 updates: @medusajs/cli, @medusajs/framework and @medusajs/medusa.

Updates @medusajs/cli from 2.15.5 to 2.16.0

Release notes

Sourced from @​medusajs/cli's releases.

v2.16.0

Highlights

This release comes with many improvements and bug fixes. We highly recommend updating to leverage these changes in your application.

For the Medusa MCP users, you can ask your AI agent to update your project with the following prompt:

update my Medusa project to v2.16.0

It will fetch the necessary changes needed to update your project.

<role>
You are a Medusa upgrade specialist. You work inside a user's Medusa application — a Medusa backend project and, when present, its companion storefront. You know Medusa's conventions for project config, auth/email verification, the JS SDK (`@medusajs/js-sdk`), MikroORM data access, and ESLint tooling. You make no change the user has not approved.
</role>
<task>
Investigate this project and produce a migration plan to upgrade it from its current Medusa version to v2.16.0, then present the plan for the user's approval before making any edits.
</task>
<context>
v2.16.0 is a minor release with several breaking changes that require code or config updates. This prompt covers only the required upgrade steps and breaking changes — additive features in this release (tax line context hook, multi-shipping-method carts, new/custom admin injection zones) are intentionally out of scope; do not implement them.
The breaking changes in scope:

Package version bump to v2.16.0 for all @medusajs/* packages.
MikroORM bumped to 6.6.14 (security fix for CVE-2026-44680). manager.find now throws on relations that don't exist on an entity instead of silently ignoring them.
react-router-dom bumped to 6.30.4 (defensive security update). Admin customizations may break if not updated.
ESLint plugin (@medusajs/eslint-plugin). New projects ship with it; existing projects should add it. Once configured, medusa build and medusa develop run linting by default.
Email verification config change: the emailpass provider's require_verification boolean option is removed, replaced by http.authVerificationsPerActor.
Email verification flow change (storefront): verification is now triggered at login, not registration, and uses new actor-agnostic routes.
Verification routes changed: /auth/[actor]/[provider]/verification/request and /auth/[actor]/[provider]/verification/confirm are removed, replaced by /auth/verification/request and /auth/verification/confirm.
JS SDK email-verification signature changes for auth.register, auth.login, auth.verification.request, and auth.verification.confirm.
Default JWT and cookie secrets removed: the supersecret fallback is gone. In production, the app throws and fails to start if http.jwtSecret / http.cookieSecret are not set.

For anything not covered here, consult the official Medusa documentation at https://docs.medusajs.com or the Medusa MCP server before acting. Do not guess at APIs, config keys, or route shapes — verify them.
</context>
<inputs>
You are given access to the project's working directory. You must discover the following yourself; do not assume:

Project shape: standalone Medusa project vs. monorepo (e.g. apps/backend + workspaces). Check for a root package.json with workspaces and an apps/ directory.
Storefront presence: a separate storefront app/repo or directory that uses @medusajs/js-sdk. If no storefront is in this workspace, treat storefront steps as guidance to surface to the user, not edits you can make.
Current Medusa version: read from package.json dependencies.
Whether the project uses email verification: search for require_verification, authVerificationsPerActor, /auth/*/verification/, sdk.auth.verification, or verification_required.
Whether secrets are configured: inspect medusa-config.ts/.js for http.jwtSecret / http.cookieSecret and the environment for JWT_SECRET / COOKIE_SECRET.
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/cli's changelog.

2.16.0

Patch Changes

• #15635 699a9a85c795e13f9e787056e0fb65cfea0115dc Thanks @​dsumeet14! - chore(cli): Replace the unmaintained pg-god dependency with a direct pg.Pool CREATE DATABASE call during medusa new, detecting an existing database via the Postgres 42P04 error code.

• #15719 a1fd4d648b923cbd68240dba49f1c46ad0e98f39 Thanks @​shahednasser! - feat(cli, eslint-plugin, medusa): add linting to medusa CLI

• Updated dependencies [8a6664d6d445f875f56078fad21fe12a185b9627, 34450089041ee90ebbeca40ad7977e945a53a7b7, 735e0aa51ef64274257057a59046776af54203f4, dc3e213a3be9d5ae8637863461eab0404bbc0e16, 9f5194267fc5abdece31531af3822b0d05ed1fcc, 8b3b9f7dc97731688e4a5f1c0bb2714e00483bc6, 801dbdb2ae70152aaa5917590885bd36bd44efc4, beb1b5e6bcbfeda02659cbaa0e04d5dbc1ba64cd, 1c5ce279aaf792789be371fae70ca304f710cb73, 456813f8b36ab1086dec09c6a89655d7ab0bae5b, 18474de124868370298addf195e5229ca6792f81, 14af163eae35be9a204f37c5a87d0b2b59b14054, 740132b7576d937b82e913c1ccf4cfabe56777d6]:

  • @​medusajs/utils@​2.16.0
  • @​medusajs/deps@​2.16.0
  • @​medusajs/telemetry@​2.16.0

Commits

• 699a9a8 fix(cli): replace unmaintained pg-god with direct pg.Pool CREATE DATA… (#15635)
• See full diff in compare view

Updates @medusajs/framework from 2.15.5 to 2.16.0

Release notes

Sourced from @​medusajs/framework's releases.

v2.16.0

Highlights

This release comes with many improvements and bug fixes. We highly recommend updating to leverage these changes in your application.

For the Medusa MCP users, you can ask your AI agent to update your project with the following prompt:

update my Medusa project to v2.16.0

It will fetch the necessary changes needed to update your project.

<role>
You are a Medusa upgrade specialist. You work inside a user's Medusa application — a Medusa backend project and, when present, its companion storefront. You know Medusa's conventions for project config, auth/email verification, the JS SDK (`@medusajs/js-sdk`), MikroORM data access, and ESLint tooling. You make no change the user has not approved.
</role>
<task>
Investigate this project and produce a migration plan to upgrade it from its current Medusa version to v2.16.0, then present the plan for the user's approval before making any edits.
</task>
<context>
v2.16.0 is a minor release with several breaking changes that require code or config updates. This prompt covers only the required upgrade steps and breaking changes — additive features in this release (tax line context hook, multi-shipping-method carts, new/custom admin injection zones) are intentionally out of scope; do not implement them.
The breaking changes in scope:

Package version bump to v2.16.0 for all @medusajs/* packages.
MikroORM bumped to 6.6.14 (security fix for CVE-2026-44680). manager.find now throws on relations that don't exist on an entity instead of silently ignoring them.
react-router-dom bumped to 6.30.4 (defensive security update). Admin customizations may break if not updated.
ESLint plugin (@medusajs/eslint-plugin). New projects ship with it; existing projects should add it. Once configured, medusa build and medusa develop run linting by default.
Email verification config change: the emailpass provider's require_verification boolean option is removed, replaced by http.authVerificationsPerActor.
Email verification flow change (storefront): verification is now triggered at login, not registration, and uses new actor-agnostic routes.
Verification routes changed: /auth/[actor]/[provider]/verification/request and /auth/[actor]/[provider]/verification/confirm are removed, replaced by /auth/verification/request and /auth/verification/confirm.
JS SDK email-verification signature changes for auth.register, auth.login, auth.verification.request, and auth.verification.confirm.
Default JWT and cookie secrets removed: the supersecret fallback is gone. In production, the app throws and fails to start if http.jwtSecret / http.cookieSecret are not set.

For anything not covered here, consult the official Medusa documentation at https://docs.medusajs.com or the Medusa MCP server before acting. Do not guess at APIs, config keys, or route shapes — verify them.
</context>
<inputs>
You are given access to the project's working directory. You must discover the following yourself; do not assume:

Project shape: standalone Medusa project vs. monorepo (e.g. apps/backend + workspaces). Check for a root package.json with workspaces and an apps/ directory.
Storefront presence: a separate storefront app/repo or directory that uses @medusajs/js-sdk. If no storefront is in this workspace, treat storefront steps as guidance to surface to the user, not edits you can make.
Current Medusa version: read from package.json dependencies.
Whether the project uses email verification: search for require_verification, authVerificationsPerActor, /auth/*/verification/, sdk.auth.verification, or verification_required.
Whether secrets are configured: inspect medusa-config.ts/.js for http.jwtSecret / http.cookieSecret and the environment for JWT_SECRET / COOKIE_SECRET.
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/framework's changelog.

2.16.0

Patch Changes

• #15600 8a6664d6d445f875f56078fad21fe12a185b9627 Thanks @​shahednasser! - chore(framework, utils, medusa): centralize NODE_ENV production check and tighten secret defaults

• #15601 20352f4fa2f31e5b491c8b1b244c407392939fbf Thanks @​shahednasser! - fix(framework): change for session cookies

• #15577 90af038c95c835dee5168ffd19cda5182d81b904 Thanks @​sapirbaruch! - fix(framework): match build ignore list against path segments instead of substrings

  medusa build no longer silently drops user files whose name merely contains an ignored substring (e.g. src/scripts/seed-test-accounts.ts). The build ignore list (integration-tests, test, unit-tests, src/admin) is now matched against path segments rather than via String.includes.

• #15726 66610b87efb112e37b78c7c9536d95070b8d6b11 Thanks @​NicolasGorga! - fix(framework,medusa): surface real error and terminate process on db commands

• Updated dependencies [8a6664d6d445f875f56078fad21fe12a185b9627, 528b12cbd50f85079e157b920be306dec7c89938, 34450089041ee90ebbeca40ad7977e945a53a7b7, 55be5103e41ffe367400cc9317a3bd6dbaa1e0cf, 46271f2c4f9b4d107a43b588b1082a3e572fbe76, 735e0aa51ef64274257057a59046776af54203f4, 699a9a85c795e13f9e787056e0fb65cfea0115dc, dc3e213a3be9d5ae8637863461eab0404bbc0e16, 9f5194267fc5abdece31531af3822b0d05ed1fcc, 8b3b9f7dc97731688e4a5f1c0bb2714e00483bc6, 801dbdb2ae70152aaa5917590885bd36bd44efc4, beb1b5e6bcbfeda02659cbaa0e04d5dbc1ba64cd, 06b05343b4158e7bb96f8f0fbd7e6836a1818e44, 1c5ce279aaf792789be371fae70ca304f710cb73, 2bd3b0d18d7d4fe9c6f36bdffb76d1104f58f47b, 456813f8b36ab1086dec09c6a89655d7ab0bae5b, 18474de124868370298addf195e5229ca6792f81, 30f6d407cfaca510939ad161fbbe74feebb97883, 1344c10503f34e392bd03f733820bcd5a12a2766, a46961ed421dc69fe991891d02b0f1c66f6180ab, b74b5b19569534412a67835ffae8fb3afbf6f5c5, 13c5dd22802593f5fb5c0a97076a966704aa56c9, 14af163eae35be9a204f37c5a87d0b2b59b14054, 740132b7576d937b82e913c1ccf4cfabe56777d6, a1fd4d648b923cbd68240dba49f1c46ad0e98f39, 60d63bd2c0e400f06b985d5275b86c72681e4f62]:

  • @​medusajs/utils@​2.16.0
  • @​medusajs/types@​2.16.0
  • @​medusajs/cli@​2.16.0
  • @​medusajs/workflows-sdk@​2.16.0
  • @​medusajs/deps@​2.16.0
  • @​medusajs/telemetry@​2.16.0
  • @​medusajs/modules-sdk@​2.16.0
  • @​medusajs/orchestration@​2.16.0

Commits

• a46961e fix(core-flows, auth, types, medusa): bind password reset tokens to a single-...
• 20352f4 fix(framework): change for session cookies (#15601)
• 8a6664d chore(framework, utils, medusa): centralize NODE_ENV production check and tig...
• See full diff in compare view

Updates @medusajs/medusa from 2.15.5 to 2.16.0

Release notes

Sourced from @​medusajs/medusa's releases.

v2.16.0

Highlights

This release comes with many improvements and bug fixes. We highly recommend updating to leverage these changes in your application.

For the Medusa MCP users, you can ask your AI agent to update your project with the following prompt:

update my Medusa project to v2.16.0

It will fetch the necessary changes needed to update your project.

<role>
You are a Medusa upgrade specialist. You work inside a user's Medusa application — a Medusa backend project and, when present, its companion storefront. You know Medusa's conventions for project config, auth/email verification, the JS SDK (`@medusajs/js-sdk`), MikroORM data access, and ESLint tooling. You make no change the user has not approved.
</role>
<task>
Investigate this project and produce a migration plan to upgrade it from its current Medusa version to v2.16.0, then present the plan for the user's approval before making any edits.
</task>
<context>
v2.16.0 is a minor release with several breaking changes that require code or config updates. This prompt covers only the required upgrade steps and breaking changes — additive features in this release (tax line context hook, multi-shipping-method carts, new/custom admin injection zones) are intentionally out of scope; do not implement them.
The breaking changes in scope:

Package version bump to v2.16.0 for all @medusajs/* packages.
MikroORM bumped to 6.6.14 (security fix for CVE-2026-44680). manager.find now throws on relations that don't exist on an entity instead of silently ignoring them.
react-router-dom bumped to 6.30.4 (defensive security update). Admin customizations may break if not updated.
ESLint plugin (@medusajs/eslint-plugin). New projects ship with it; existing projects should add it. Once configured, medusa build and medusa develop run linting by default.
Email verification config change: the emailpass provider's require_verification boolean option is removed, replaced by http.authVerificationsPerActor.
Email verification flow change (storefront): verification is now triggered at login, not registration, and uses new actor-agnostic routes.
Verification routes changed: /auth/[actor]/[provider]/verification/request and /auth/[actor]/[provider]/verification/confirm are removed, replaced by /auth/verification/request and /auth/verification/confirm.
JS SDK email-verification signature changes for auth.register, auth.login, auth.verification.request, and auth.verification.confirm.
Default JWT and cookie secrets removed: the supersecret fallback is gone. In production, the app throws and fails to start if http.jwtSecret / http.cookieSecret are not set.

For anything not covered here, consult the official Medusa documentation at https://docs.medusajs.com or the Medusa MCP server before acting. Do not guess at APIs, config keys, or route shapes — verify them.
</context>
<inputs>
You are given access to the project's working directory. You must discover the following yourself; do not assume:

Project shape: standalone Medusa project vs. monorepo (e.g. apps/backend + workspaces). Check for a root package.json with workspaces and an apps/ directory.
Storefront presence: a separate storefront app/repo or directory that uses @medusajs/js-sdk. If no storefront is in this workspace, treat storefront steps as guidance to surface to the user, not edits you can make.
Current Medusa version: read from package.json dependencies.
Whether the project uses email verification: search for require_verification, authVerificationsPerActor, /auth/*/verification/, sdk.auth.verification, or verification_required.
Whether secrets are configured: inspect medusa-config.ts/.js for http.jwtSecret / http.cookieSecret and the environment for JWT_SECRET / COOKIE_SECRET.
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/medusa's changelog.

2.16.0

Minor Changes

• 30f6d407cfaca510939ad161fbbe74feebb97883 - feat(auth-emailpass, types, medusa): require verification by actor type

Patch Changes

• #15528 2b7e6782c61af8b38ec9789736f3c708576b2620 Thanks @​NicolasGorga! - fix(medusa): add missing policies for translation module

• #15600 8a6664d6d445f875f56078fad21fe12a185b9627 Thanks @​shahednasser! - chore(framework, utils, medusa): centralize NODE_ENV production check and tighten secret defaults

• #15511 7cea59f0c674a49380acb3638cbf86c590461b23 Thanks @​puneetdixit200! - Include address_name in default customer address fields for store and admin customer address responses.

• #15407 46271f2c4f9b4d107a43b588b1082a3e572fbe76 Thanks @​NicolasGorga! - feat(core-flows,medusa,types): add multi shipping method carts support

• #15523 68f7a0e792a90c2edc04f27454178b75fd3b05f4 Thanks @​addemod! - fix(plugin:develop): invoke yalc via process.execPath on Windows

  The watch-mode publisher in medusa plugin:develop now spawns the yalc CLI with node yalc.js … instead of relying on yalc's shebang. Windows does not honor shebangs, so the previous execFile(yalcBin, …) threw Error: spawn EFTYPE on every file change and the post-build yalc push never ran — yarn dev was effectively unusable for plugin authors on Windows.

• #15619 5cd86b7b0899bb3bace07da3299cc70826afbd64 Thanks @​sanidhyasin! - fix(medusa): allow updating buyget promotions via PATCH /admin/promotions/:id

• #15595 beb1b5e6bcbfeda02659cbaa0e04d5dbc1ba64cd Thanks @​leobenzol! - feat(medusa,utils): plugin type augmentations

• #14674 06b05343b4158e7bb96f8f0fbd7e6836a1818e44 Thanks @​fPolic! - feat(dashboard,admin-shared,core-flows,js-sdk,types,medusa,link-modules): RBAC admin dashboard CRUD

• #15561 1344c10503f34e392bd03f733820bcd5a12a2766 Thanks @​GBreg19! - feat(medusa,core-flows,js-sdk,types): allow provider_id when marking a payment collection as paid

  The mark-as-paid admin route and the markPaymentCollectionAsPaid workflow now accept an optional provider_id. When provided, the captured payment is recorded under that provider instead of always using pp_system_default. Omitting it preserves the previous behavior. This completes the admin payment-provider flow started in #15169.

• a46961ed421dc69fe991891d02b0f1c66f6180ab - fix(core-flows, auth, types, medusa): bind password reset tokens to a single-use server record

• #15630 740132b7576d937b82e913c1ccf4cfabe56777d6 Thanks @​shahednasser! - chore(create-medusa-app, telemetry, dashboard, medusa): update react-router-dom and uuid packages

• #15726 66610b87efb112e37b78c7c9536d95070b8d6b11 Thanks @​NicolasGorga! - fix(framework,medusa): surface real error and terminate process on db commands

• 8a27881086307b14bfd1f74f13e2b9db51cc0c03 - fix(medusa): clear session cookie on DELETE /auth/session

  The logout route now sends a Set-Cookie header to clear the session cookie on the client after destroying the server-side session. Previously, req.session.destroy() was called fire-and-forget and no clearing header was emitted, leaving a stale cookie in the browser after logout (contradicting the documented behavior). The cookie name and options are sourced from the project config so customized session names continue to work.

• #15732 3f3b339ea732670de449ee6ace4635523ff44ab0 Thanks @​shahednasser! - fix(core-flows, loyalty-plugin, medusa): fix medusa lint errors

• #15719 a1fd4d648b923cbd68240dba49f1c46ad0e98f39 Thanks @​shahednasser! - feat(cli, eslint-plugin, medusa): add linting to medusa CLI

• #15690 60d63bd2c0e400f06b985d5275b86c72681e4f62 Thanks @​Tusharkhadde! - feat(dashboard,medusa,types): add internal note support to order edits

• f58de022857e00d12fa60f55fb80fcc7eff357d8 - fix(medusa): type product category create response

• #15605 af4dc161cf3ca90f68214138212416bc7b54209b Thanks @​shahednasser! - chore(dashboard, medusa): validate http(s) scheme on fulfillment label URLs

... (truncated)

Commits

• 5cd86b7 fix(medusa): allow updating buyget promotions via PATCH /admin/promotions/:id...
• beb1b5e feat(medusa,utils): plugin type augmentations (#15595)
• f58de02 fix(medusa): type product category create response (#15588)
• 1344c10 feat(medusa,core-flows,js-sdk,types): allow provider_id when marking a paymen...
• 68f7a0e fix(plugin:develop): invoke yalc via process.execPath on Windows (#15523)
• 8a27881 fix(medusa): clear session cookie on DELETE /auth/session (#15510)
• 7cea59f fix(medusa): include address_name in customer address defaults (#15511)
• 740132b chore(create-medusa-app, telemetry, dashboard, medusa): update react-router-d...
• 06b0534 feat(dashboard,admin-shared,core-flows,js-sdk,types,medusa,link-modules): RBA...
• a46961e fix(core-flows, auth, types, medusa): bind password reset tokens to a single-...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions