Repository navigation
chore(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates - #1211
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
the
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Review of 9852b35. No blocking defects.
Checks. All 30 required and path-gated checks pass, which includes the live Drizzle, Supabase, Prisma Next and protect-ffi suites. Main is green again at 141054f (this PR's base), so the 2026-10-13 credential failures do not apply here.
What I examined:
- Cooldown. All eight direct bumps and all new transitive packages in
pnpm-lock.yamlare older than the 7-dayminimumReleaseAge(pnpm-workspace.yaml:172) when Dependabot opened this PR. The newest are@supabase/*@2.117.3androllup@4.64.2(2026-10-07). - No published surface changes. Every manifest edit is in
devDependenciesor in a private package. The@supabase/supabase-jspeer range inlanguages/typescript/packages/stack-supabase/package.json:67stays>=2. A changeset is not necessary. - Lockfile overrides. The
overridesblock (pnpm-lock.yaml:39-41) does not change. - #988. This PR supersedes #988. Dependabot closed it at 2026-10-14 22:32. This PR has the same 7 bumps (Supabase at 2.117.3, not 2.117.2) plus
fta-cli3.0.1 -> 3.1.0. - #1197 and #1135. I merged them in sequence with
git merge-tree. After this PR, #1197 conflicts inlanguages/typescript/packages/stack/package.jsonandpnpm-lock.yaml. #1135 merges cleanly. Merge one, then tell Dependabot to rebase the other. Do not resolve the lockfile by hand.
Note, not blocking. Because of the yaml bump, pnpm gave a new key to the vite@7.3.6 snapshots and resolved them again. They now use esbuild@0.28.2, rollup@4.64.2 and postcss@8.5.29 (pnpm-lock.yaml:6673, :6677, :6690, :6694). tsup keeps esbuild@0.28.1 and the earlier rollup@4.60.4 (pnpm-lock.yaml:2616, :3514). The result is two copies of each build tool. This is correct but not necessary.
Suggested follow-up PR:
- Run
pnpm dedupeafter the open dependency PRs merge, to remove the duplicateesbuild,rollupandpostcssversions. - Dependabot's earlier comment about the missing
supply-chainlabel is still open. Create the label or remove it from.github/dependabot.yml. biome.json:2points to the 2.5.3 schema. This was already wrong before this PR. Change it to 2.5.15.
9852b35 to
729b337
Compare
|
@dependabot rebase |
729b337 to
8d36c6c
Compare
…ith 8 updates Bumps the dev-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.15` | | [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.11.7` | | [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.16.7` | `3.23.1` | | [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js) | `2.112.3` | `2.117.3` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.117.3` | | [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` | | [fta-cli](https://github.com/sgb-io/fta) | `3.0.1` | `3.1.0` | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | Updates `@biomejs/biome` from 2.5.9 to 2.5.15 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome) Updates `turbo` from 2.10.10 to 2.11.7 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.10...v2.11.7) Updates `@clerk/backend` from 3.16.7 to 3.23.1 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.23.1/packages/backend) Updates `@supabase/postgrest-js` from 2.112.3 to 2.117.3 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.117.3/packages/core/postgrest-js) Updates `@supabase/supabase-js` from 2.112.3 to 2.117.3 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.117.3/packages/core/supabase-js) Updates `fast-check` from 4.9.0 to 4.10.2 - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check) Updates `fta-cli` from 3.0.1 to 3.1.0 - [Release notes](https://github.com/sgb-io/fta/releases) - [Changelog](https://github.com/sgb-io/fta/blob/main/CHANGELOG.md) - [Commits](sgb-io/fta@v3.0.1...v3.1.0) Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@clerk/backend" dependency-version: 3.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/postgrest-js" dependency-version: 2.117.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/supabase-js" dependency-version: 2.117.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: fast-check dependency-version: 4.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: fta-cli dependency-version: 3.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: turbo dependency-version: 2.11.7 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
8d36c6c to
502b889
Compare
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Re-review of 502b889. No blocking defects.
Dependabot rebased this PR onto abf9de5. That base includes #1135, #1150 and #1212.
What changed since 9852b35
- Bumps. The 8 direct bumps are the same as before. They have the same versions in the same manifests.
- Lockfile. #1212 and #1150 already put most of the earlier transitive changes on main (
esbuild@0.28.2,postcss@8.5.29,source-map-js@1.2.2,@clerk/backend@3.23.1). Thus this PR now adds fewer packages. The one new transitive version isrollup@4.64.3(and its platform packages), which replaces4.64.2for thevite@7.3.6snapshots (pnpm-lock.yaml:6627,:6644). npm published it at 2026-10-08 18:12 UTC. That is more than the 7-dayminimumReleaseAge(pnpm-workspace.yaml:176) before the rebase at 2026-10-15 23:03 UTC. - Lockfile integrity. No key occurs two times in
packages:or insnapshots:. Theoverridesblock does not change, and thesource-map-jsoverride from #1150 is still there.
Merge order. The conflict with #1197 from my last review does not apply now. Dependabot closed #1197 at 2026-10-15 02:07 ("no longer needed"), and #1135 merged. The PR merges cleanly with main at 2a70a47 (I checked with git merge-tree).
Checks. All 30 checks that ran pass, and 11 checks were skipped.
Follow-ups. The three items from my last review are still open: pnpm dedupe, the supply-chain label, and the biome.json schema version (still 2.5.3). The rebase does not make them necessary for this PR.
This branch has not been deployed
2 participants
Bumps the dev-dependencies group with 8 updates in the / directory:
2.5.92.5.152.10.102.11.73.16.73.23.12.112.32.117.32.112.32.117.34.9.04.10.23.0.13.1.02.9.02.9.1Updates
@biomejs/biomefrom 2.5.9 to 2.5.15Release notes
Sourced from @biomejs/biome's releases.
... (truncated)
Changelog
Sourced from @biomejs/biome's changelog.
... (truncated)
Commits
0b4c11fci: release (#11815)ad5b362feat: addsnoAstroConflictingSetDirectivesrule for .astro (#11494)034366dchore: update codspeed logo in readme (#12019)717db8cfeat(lint): add noMisplacedListElements (#11917)089bde0feat(lint/js): add useStrictBooleanExpressions (#11750)1fdb5c2feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)faa8b37feat(lint/js/svelte): add noSvelteExportLet (#11956)b2b4400chore: update sponsors (#11973)ff4c4ddfeat(lint/js): add noMeaninglessVoidOperator (#11732)1b9479efeat(lint): add useLogicalProperties rule (#10816)Updates
turbofrom 2.10.10 to 2.11.7Release notes
Sourced from turbo's releases.
... (truncated)
Commits
547747fpublish 2.11.7 to registry3ce82f5fix: Ignore Vercel OIDC token rotation in .env.local cache inputs (#14356)8cc3ccechore: Update with-vite-module-federation example (#14349)41387defix: Pass SDKROOT through to repository tasks (#14353)3a2072cchore: Release Turborepo 2.11.6 (#14352)90718d1fix: Infer single-package mode for query commands (#14351)a409ce5fix: Complete taskquerymetadata for non-script entrypoints (#14350)bc7c148feat: Filter tasks by tags in the CLI (#14345)49d1607feat: Filterquerytasks and packages by tags (#14344)fba5351feat: Expose task and package tags inquery(#14343)Updates
@clerk/backendfrom 3.16.7 to 3.23.1Release notes
Sourced from @clerk/backend's releases.
Changelog
Sourced from @clerk/backend's changelog.
... (truncated)
Commits
ff81d5aci(repo): Version packages (#10074)2e29745ci(repo): Version packages (#10025)dee649cfeat(backend): expose the normalized act claim on verified OAuth access token...2302140feat(backend): add deleteInvitation to the Invitations API (#10034)6fd8e8dci(repo): Version packages (#10021)4eac21ffeat(backend): add the IdP certificate list to SAML connections (#9995)2e03a39ci(repo): Version packages (#9977)0fe89c2docs(backend): include the Electron dev server origin in allowedOrigins JSDoc...e34a5ccdocs(backend): link lockUser() JSDoc to the current Protect rules page (#9976)26feba7ci(repo): Version packages (#9933)Updates
@supabase/postgrest-jsfrom 2.112.3 to 2.117.3Release notes
Sourced from @supabase/postgrest-js's releases.
... (truncated)
Changelog
Sourced from @supabase/postgrest-js's changelog.
... (truncated)
Commits
cb76828fix(postgrest): treat TimeoutError as an abort in retry guard (#2732)a684cf9chore(release): version 2.117.2 changelogs (#2707)6d21e3ffix(postgrest): avoid instantiation depth errors for large relationship union...54c225dchore(release): version 2.117.1 changelogs (#2700)f34d428chore(release): version 2.117.0 changelogs (#2697)84af33fchore(release): version 2.116.0 changelogs (#2679)dbe7679chore(release): version 2.115.0 changelogs (#2664)92fb8bafeat(postgrest): add getOpenApiSpec() (#2651)aef432bchore(release): version 2.114.0 changelogs (#2653)67b07b0chore(release): version 2.113.0 changelogs (#2650)Updates
@supabase/supabase-jsfrom 2.112.3 to 2.117.3Release notes
Sourced from @supabase/supabase-js's releases.
... (truncated)
Changelog
Sourced from @supabase/supabase-js's changelog.
... (truncated)
Commits
4d23055fix(storage): send multipart fields before files (#2736)a684cf9chore(release): version 2.117.2 changelogs (#2707)54c225dchore(release): version 2.117.1 changelogs (#2700)739b351fix(auth): return stored session when a refresh loses to another tab (#2698)f34d428chore(release): version 2.117.0 changelogs (#2697)cc45ccffeat(auth): enable passkey API by default and deprecate experimental passkey ...c511286docs(realtime): document relationship ofaccessToken()and heartbeat (#2680)84af33fchore(release): version 2.116.0 changelogs (#2679)5aedaabfeat(auth): add MFA recovery codes API (#2676)e4f675afix(supabase): warn when schema is passed outside db options (#2663)Updates
fast-checkfrom 4.9.0 to 4.10.2Release notes
Sourced from fast-check's releases.
... (truncated)
Changelog
Sourced from fast-check's changelog.
... (truncated)
Commits
c77afa8v4.10.21e80f3av4.10.22df3265🐛 PlugininterruptAfterTimeLimitcrashes (#7333)e93c6a8🔖 Update CHANGELOG.md for fast-check@4.10.1 (#7294)15744d0🐛 Capture timers forinterruptAfterTimeLimitplugin (#7293)fb2ea50🐛 Capture timer globals fortimeoutplugin (#7292)4fba17d🔖 Update CHANGELOG.md for fast-check@4.10.0,@fast-check/jest@2.3.0,@fast-ch...a433d8b⬆️ Update dependency@types/nodeto ^24.13.4 (#7263)8470c46⬆️ Update dependency@microsoft/api-extractorto ^7.59.1 (#7255)5382221🗑️ Deprecate v5 removals (#7261)Updates
fta-clifrom 3.0.1 to 3.1.0Release notes
Sourced from fta-cli's releases.
Changelog
Sourced from fta-cli's changelog.
Commits
812bd55Bump versions and update changelog for v3.1.0 (#340)79ee6a9fix: preserve launcher paths and arguments containing spaces (#339)86a8c4bBump wasm-bindgen from 0.2.128 to 0.2.129 (#337)ef32931Bump clap from 4.6.6 to 4.6.7 (#336)074d51fBump wasm-bindgen from 0.2.127 to 0.2.128 (#335)83fab52Bump log from 0.4.33 to 0.4.34 (#334)6a8df60Add release notes for v3.0.15f5428dAdd manual workflow to publish the npm package via OIDC (#333)07ab67fUpdate NPM publishing to use Trusted Publisher via OIDC (#331)Updates
yamlfrom 2.9.0 to 2.9.1Release notes
Sourced from yaml's releases.
Commits
1440ecd2.9.1c699bc5fix: Simplify line unfolding during quoted string parsing (#714)d11ce77fix: Limit recursive merge aliases (#713)c5f49f4chore: Update docs-slate