Skip to content

fix(deps): bump the npm-major group across 1 directory with 30 updates - #6227

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-major-aa297c6e16
Closed

fix(deps): bump the npm-major group across 1 directory with 30 updates#6227
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-major-aa297c6e16

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-major group with 30 updates in the / directory:

Package From To
pkg-pr-new 0.0.82 0.0.87
verdaccio 6.9.0 6.9.2
undici 8.9.0 8.10.0
@supabase/supabase-js 2.111.0 2.112.2
jose 6.2.4 6.2.8
@anthropic-ai/claude-agent-sdk 0.3.220 0.3.226
@anthropic-ai/sdk 0.115.0 0.116.0
@types/react 19.2.17 19.2.18
@vercel/detect-agent 1.2.3 1.2.4
esbuild 0.28.1 0.28.2
pg 8.22.0 8.23.0
@types/pg 8.20.0 8.21.0
posthog-node 5.46.1 5.48.1
semantic-release 25.0.8 25.0.9
fumadocs-core 16.13.0 16.14.3
fumadocs-mdx 15.2.0 15.2.3
fumadocs-ui 16.13.0 16.14.3
next 16.3.0-preview.10 16.3.0
@types/node 26.1.2 26.2.0
@types/react-dom 19.2.3 19.2.4
@effect/atom-react 4.0.0-beta.103 4.0.0-beta.107
@effect/platform-bun 4.0.0-beta.103 4.0.0-beta.107
@effect/platform-node 4.0.0-beta.103 4.0.0-beta.107
@effect/sql-pg 4.0.0-beta.103 4.0.0-beta.107
@effect/vitest 4.0.0-beta.103 4.0.0-beta.107
@nx/devkit 23.1.0 23.1.1
effect 4.0.0-beta.103 4.0.0-beta.107
knip 6.29.0 6.32.1
nx 23.1.0 23.1.1
tldts 6.1.86 7.4.10

Updates pkg-pr-new from 0.0.82 to 0.0.87

Commits

Updates verdaccio from 6.9.0 to 6.9.2

Release notes

Sourced from verdaccio's releases.

v6.9.2

Patch Changes

  • 297dc43: fix: apply package access controls to the starredByUser endpoint

    The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

  • 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

v6.9.1

Patch Changes

  • dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/auth: 8.1.0 → 8.1.1
    • @verdaccio/config: 8.2.0 → 8.2.1
    • @verdaccio/core: 8.2.0 → 8.2.1
    • @verdaccio/hooks: 8.1.1 → 8.1.2
    • @verdaccio/loaders: 8.1.0 → 8.1.1
    • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
    • @verdaccio/logger: 8.1.0 → 8.1.1
    • @verdaccio/middleware: 8.1.0 → 8.1.1
    • @verdaccio/package-filter: 13.1.0 → 13.1.1
    • @verdaccio/signature: 8.1.0 → 8.1.1
    • @verdaccio/tarball: 13.1.0 → 13.1.1
    • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
    • @verdaccio/url: 13.1.0 → 13.1.1
    • @verdaccio/utils: 8.2.0 → 8.2.1
    • verdaccio-audit: 13.1.0 → 13.1.1
    • verdaccio-htpasswd: 13.1.0 → 13.1.1
Changelog

Sourced from verdaccio's changelog.

6.9.2

Patch Changes

  • 297dc43: fix: apply package access controls to the starredByUser endpoint

    The GET /-/_view/starredByUser view did not enforce the configured package access policy when listing a user's starred packages. Results are now filtered through auth.allow_access, so the response only includes packages the requesting client is authorized to see.

  • 05917d5: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/ui-theme: 9.0.0-next-9.22 → 9.0.0-next-9.23

6.9.1

Patch Changes

  • dfe3938: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

    • @verdaccio/auth: 8.1.0 → 8.1.1
    • @verdaccio/config: 8.2.0 → 8.2.1
    • @verdaccio/core: 8.2.0 → 8.2.1
    • @verdaccio/hooks: 8.1.1 → 8.1.2
    • @verdaccio/loaders: 8.1.0 → 8.1.1
    • @verdaccio/local-storage-legacy: 11.4.0 → 11.4.1
    • @verdaccio/logger: 8.1.0 → 8.1.1
    • @verdaccio/middleware: 8.1.0 → 8.1.1
    • @verdaccio/package-filter: 13.1.0 → 13.1.1
    • @verdaccio/signature: 8.1.0 → 8.1.1
    • @verdaccio/tarball: 13.1.0 → 13.1.1
    • @verdaccio/ui-theme: 9.0.0-next-9.21 → 9.0.0-next-9.22
    • @verdaccio/url: 13.1.0 → 13.1.1
    • @verdaccio/utils: 8.2.0 → 8.2.1
    • verdaccio-audit: 13.1.0 → 13.1.1
    • verdaccio-htpasswd: 13.1.0 → 13.1.1
Commits

Updates undici from 8.9.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

Commits
  • c8d80e6 Bumped v8.10.0 (#5644)
  • 66923b4 fix: preserve DNS origin hostname on sockets (#5577)
  • 3926499 fix: retry refused HTTP/2 streams (#5598)
  • 73d6e9e fix(h2): detach upgrade close handler after GOAWAY (#5641)
  • b111adb fix(mock): emit request body lifecycle hooks (#5367)
  • ae4a3e3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5636)
  • ec3fbf1 build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 (#5634)
  • 2151720 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5633)
  • b96a116 fix(interceptors): allow interceptors without opts.origin (#5628)
  • a18ef2d fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r...
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.111.0 to 2.112.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

  • realtime: prevent duplicate on bindings (#2594)
  • realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

  • realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

🩹 Fixes

  • realtime: prevent duplicate on bindings (#2594)

❤️ Thank You

v2.112.1

2.112.1 (2026-08-05)

🩹 Fixes

  • auth: preserve 5xx error message (#2587)
  • realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

v2.112.1-canary.1

2.112.1-canary.1 (2026-08-05)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

  • realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

  • Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

  • supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

  • supabase: forward db retry option (#2571)

❤️ Thank You

Commits
  • 07b27ee chore(release): version 2.112.1 changelogs (#2593)
  • 1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
  • 0136f34 chore(release): version 2.112.0 changelogs (#2589)
  • 2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
  • a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
  • e6c975c fix(supabase): forward db retry option (#2571)
  • a262492 chore(release): version 2.111.0 changelogs (#2572)
  • See full diff in compare view

Updates jose from 6.2.4 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

v6.2.6

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

6.2.6 (2026-07-31)

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits
  • 8b768eb chore(release): 6.2.8
  • 1500459 refactor: name the "alg" source in unsupported algorithm failures
  • 714f870 fix: reject a non-string "alg" in EmbeddedJWK
  • 925f3bb refactor: index the JWS and JWE registries without a wrapper
  • 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
  • 514831d chore(deps): bump the actions group with 3 updates
  • 45965db chore: cleanup after release
  • 60b941f chore(release): 6.2.7
  • 90ab09c fix: require own JOSE properties for presence checks
  • 767d7f1 refactor: reduce bundle size
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.220 to 0.3.226

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.226

What's changed

  • Updated to parity with Claude Code v2.1.226

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.226
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.226
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.226
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.226

v0.3.225

What's changed

  • Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.225
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.225
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.225
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.225

v0.3.224

What's changed

  • Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
  • Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
  • Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
  • Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
  • Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.224
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.224
# or
</tr></table>

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.226

  • Updated to parity with Claude Code v2.1.226

0.3.225

  • Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

0.3.224

  • Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
  • Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
  • Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
  • Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
  • Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

0.3.223

  • Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
  • Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
  • Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
  • Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

0.3.222

  • Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

0.3.221

  • Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
  • Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text
Commits

Updates @anthropic-ai/sdk from 0.115.0 to 0.116.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.116.0

0.116.0 (2026-08-07)

Full Changelog: sdk-v0.115.0...sdk-v0.116.0

Features

  • api: add mid-conversation-tool-changes-2026-07-01 beta (70e04f6)
  • api: add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (1336a4a)
  • tools: make bash timeout and abort errors matchable by class (#259) (201b12e)

Bug Fixes

  • client: use hardcoded User-Agent strings instead of constructor names (0b97f04)

Chores

  • api: remove retired Claude Opus 4.1 models (11b685c)
  • docs: small updates to descriptions (413cc5f)
  • docs: updates to a few documentation strings (c38a1de)
  • internal/deps: bump @​babel/core and @​babel/helpers to 7.29.7 (#261) (3164934)
  • internal/deps: install tsc-multi from the npm registry (#265) (c787f90)
  • internal: codegen related update (73b3d61)
Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.116.0 (2026-08-07)

Full Changelog: sdk-v0.115.0...sdk-v0.116.0

Features

  • api: add mid-conversation-tool-changes-2026-07-01 beta (70e04f6)
  • api: add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (1336a4a)
  • tools: make bash timeout and abort errors matchable by class (#259) (201b12e)

Bug Fixes

  • client: use hardcoded User-Agent strings instead of constructor names (0b97f04)

Chores

  • api: remove retired Claude Opus 4.1 models (11b685c)
  • docs: small updates to descriptions (413cc5f)
  • docs: updates to a few documentation strings (c38a1de)
  • internal/deps: bump @​babel/core and @​babel/helpers to 7.29.7 (#261) (3164934)
  • internal/deps: install tsc-multi from the npm registry (#265) (c787f90)
  • internal: codegen related update (73b3d61)
Commits
  • ed02a89 chore: release main
  • d72ff6a feat(api): add support for session budgets, advisor tool, pinned inference lo...
  • dbfed51 chore(internal/deps): refresh provider package dev tooling to mirror-availabl...
  • b7e95bf chore(docs): updates to a few documentation strings
  • 9efb7bd chore(api): remove retired Claude Opus 4.1 models
  • 342d422 chore(internal/deps): install tsc-multi from the npm registry (#265)
  • 501955c chore(internal/deps): bump @​babel/core and @​babel/helpers to 7.29.7 (#261)
  • 6641c5e feat(tools): make bash timeout and abort errors matchable by class (#259)
  • e421c43 chore(docs): small updates to descriptions
  • c0a963e feat(api): add mid-conversation-tool-changes-2026-07-01 beta
  • Additional commits viewable in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

Updates @vercel/detect-agent from 1.2.3 to 1.2.4

Release notes

Sourced from @​vercel/detect-agent's releases.

@​vercel/h3@​0.1.116

Patch Changes

  • @​vercel/node@​5.9.3

@​vercel/h3@​0.1.115

Patch Changes

  • @​vercel/node@​5.9.2

@​vercel/h3@​0.1.114

Patch Changes

  • @​vercel/node@​5.9.1

@​vercel/h3@​0.1.113

Patch Changes

  • Updated dependencies [4502520]
    • @​vercel/node@​5.9.0

@​vercel/h3@​0.1.112

Patch Changes

  • @​vercel/node@​5.8.27
Changelog

Sourced from @​vercel/detect-agent's changelog.

@​vercel/detect-agent

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vercel/detect-agent since your current version.

Attestation changes

This version has no provenance attestation, while the previous version (1.2.3) was attested. Review the package versions before updating.


Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

  • Add support for query

@dependabot
fix(deps): bump the npm-major group across 1 directory with 30 updates
f0a027a 
Bumps the npm-major group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.82` | `0.0.87` |
| [verdaccio](https://github.com/verdaccio/verdaccio) | `6.9.0` | `6.9.2` |
| [undici](https://github.com/nodejs/undici) | `8.9.0` | `8.10.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.111.0` | `2.112.2` |
| [jose](https://github.com/panva/jose) | `6.2.4` | `6.2.8` |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.220` | `0.3.226` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.115.0` | `0.116.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@vercel/detect-agent](https://github.com/vercel/vercel/tree/HEAD/packages/detect-agent) | `1.2.3` | `1.2.4` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.21.0` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.1` | `5.48.1` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.8` | `25.0.9` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.13.0` | `16.14.3` |
| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.0` | `15.2.3` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.13.0` | `16.14.3` |
| [next](https://github.com/vercel/next.js) | `16.3.0-preview.10` | `16.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [@effect/atom-react](https://github.com/Effect-TS/effect/tree/HEAD/packages/atom/react) | `4.0.0-beta.103` | `4.0.0-beta.107` |
| [@effect/platform-bun](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-bun) | `4.0.0-beta.103` | `4.0.0-beta.107` |
| [@effect/platform-node](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-node) | `4.0.0-beta.103` | `4.0.0-beta.107` |
| [@effect/sql-pg](https://github.com/Effect-TS/effect/tree/HEAD/packages/sql-pg) | `4.0.0-beta.103` | `4.0.0-beta.107` |
| [@effect/vitest](https://github.com/Effect-TS/effect/tree/HEAD/packages/vitest) | `4.0.0-beta.103` | `4.0.0-beta.107` |
| [@nx/devkit](https://github.com/nrwl/nx/tree/HEAD/packages/devkit) | `23.1.0` | `23.1.1` |
| [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `4.0.0-beta.103` | `4.0.0-beta.107` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.29.0` | `6.32.1` |
| [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx) | `23.1.0` | `23.1.1` |
| [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.10` |



Updates `pkg-pr-new` from 0.0.82 to 0.0.87
- [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.87/packages/cli)

Updates `verdaccio` from 6.9.0 to 6.9.2
- [Release notes](https://github.com/verdaccio/verdaccio/releases)
- [Changelog](https://github.com/verdaccio/verdaccio/blob/v6.9.2/CHANGELOG.md)
- [Commits](verdaccio/verdaccio@v6.9.0...v6.9.2)

Updates `undici` from 8.9.0 to 8.10.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.9.0...v8.10.0)

Updates `@supabase/supabase-js` from 2.111.0 to 2.112.2
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.2/packages/core/supabase-js)

Updates `jose` from 6.2.4 to 6.2.8
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.4...v6.2.8)

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.220 to 0.3.226
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.220...v0.3.226)

Updates `@anthropic-ai/sdk` from 0.115.0 to 0.116.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.115.0...sdk-v0.116.0)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@vercel/detect-agent` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/detect-agent/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/ruby@1.2.4/packages/detect-agent)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@types/pg` from 8.20.0 to 8.21.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

Updates `posthog-node` from 5.46.1 to 5.48.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.48.1/packages/node)

Updates `semantic-release` from 25.0.8 to 25.0.9
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v25.0.8...v25.0.9)

Updates `fumadocs-core` from 16.13.0 to 16.14.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.13.0...fumadocs@16.14.3)

Updates `fumadocs-mdx` from 15.2.0 to 15.2.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.0...fumadocs-mdx@15.2.3)

Updates `fumadocs-ui` from 16.13.0 to 16.14.3
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.13.0...fumadocs@16.14.3)

Updates `next` from 16.3.0-preview.10 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.0-preview.10...v16.3.0)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@effect/atom-react` from 4.0.0-beta.103 to 4.0.0-beta.107
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/atom/react/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/atom-react@4.0.0-beta.107/packages/atom/react)

Updates `@effect/platform-bun` from 4.0.0-beta.103 to 4.0.0-beta.107
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/@effect/platform-bun@4.0.0-beta.107/packages/platform-bun/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/platform-bun@4.0.0-beta.107/packages/platform-bun)

Updates `@effect/platform-node` from 4.0.0-beta.103 to 4.0.0-beta.107
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/@effect/platform-node@4.0.0-beta.107/packages/platform-node/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/platform-node@4.0.0-beta.107/packages/platform-node)

Updates `@effect/sql-pg` from 4.0.0-beta.103 to 4.0.0-beta.107
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/sql-pg@4.0.0-beta.107/packages/sql-pg)

Updates `@effect/vitest` from 4.0.0-beta.103 to 4.0.0-beta.107
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/vitest/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/@effect/vitest@4.0.0-beta.107/packages/vitest)

Updates `@nx/devkit` from 23.1.0 to 23.1.1
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.1/packages/devkit)

Updates `effect` from 4.0.0-beta.103 to 4.0.0-beta.107
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/effect@4.0.0-beta.107/packages/effect)

Updates `knip` from 6.29.0 to 6.32.1
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.1/packages/knip)

Updates `nx` from 23.1.0 to 23.1.1
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.1/packages/nx)

Updates `tldts` from 6.1.86 to 7.4.10
- [Release notes](https://github.com/remusao/tldts/releases)
- [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md)
- [Commits](remusao/tldts@v6.1.86...v7.4.10)

---
updated-dependencies:
- dependency-name: pkg-pr-new
  dependency-version: 0.0.87
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: verdaccio
  dependency-version: 6.9.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: undici
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: jose
  dependency-version: 6.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.226
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.116.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@vercel/detect-agent"
  dependency-version: 1.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@types/pg"
  dependency-version: 8.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: posthog-node
  dependency-version: 5.48.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: fumadocs-core
  dependency-version: 16.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: fumadocs-mdx
  dependency-version: 15.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: fumadocs-ui
  dependency-version: 16.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/atom-react"
  dependency-version: 4.0.0-beta.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/platform-bun"
  dependency-version: 4.0.0-beta.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/platform-node"
  dependency-version: 4.0.0-beta.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/sql-pg"
  dependency-version: 4.0.0-beta.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@effect/vitest"
  dependency-version: 4.0.0-beta.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: "@nx/devkit"
  dependency-version: 23.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: effect
  dependency-version: 4.0.0-beta.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: knip
  dependency-version: 6.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-major
- dependency-name: nx
  dependency-version: 23.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-major
- dependency-name: tldts
  dependency-version: 7.4.10
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 18, 2026
auto-merge was automatically disabled August 18, 2026 00:18

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-major-aa297c6e16 branch August 18, 2026 00:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@supabase-cli-releaser supabase-cli-releaser[bot] supabase-cli-releaser[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants