chore(deps): bump the production-minor-patch group across 1 directory with 16 updates by dependabot[bot] · Pull Request #1197 · cipherstash/stack

dependabot · 2026-10-13T23:03:22Z

Bumps the production-minor-patch group with 16 updates in the / directory:

Package	From	To
@types/node	`22.20.1`	`22.20.5`
drizzle-orm	`0.45.2`	`0.45.3`
pg	`8.23.0`	`8.23.1`
@clack/prompts	`1.7.0`	`1.8.1`
posthog-node	`5.49.1`	`5.55.0`
jose	`6.2.9`	`6.2.12`
@rollup/rollup-linux-x64-gnu	`4.62.4`	`4.64.2`
uuid	`14.0.1`	`14.0.2`
arktype	`2.2.3`	`2.2.7`
@anthropic-ai/claude-agent-sdk	`0.3.234`	`0.3.293`
@anthropic-ai/sdk	`0.117.1`	`0.132.0`
@modelcontextprotocol/sdk	`1.32.0`	`1.32.1`
@clerk/nextjs	`7.7.7`	`7.9.11`
next	`15.5.24`	`15.5.27`
tsx	`4.23.12`	`4.23.15`
vite	`8.2.1`	`8.3.3`

Updates @types/node from 22.20.1 to 22.20.5

Commits

See full diff in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

0980cef Publish
2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
9683053 fix(pg): do not treat Sync as connection ending (#3772)
4589038 fix: validate server certificate against host when connecting to an IP addres...
9808955 cleanup: Fix typo in comment
2b02f64 fix: avoid mutating query config (#3720)
0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
2991480 Deprecate serializing invalid Dates (#3731)
c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
Additional commits viewable in compare view

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @clack/prompts's releases.

@clack/prompts@1.8.1

Patch Changes

8bd9129 Thanks @gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

Updated dependencies [8bd9129]:

@clack/core@1.5.1

@clack/prompts@1.8.0

Minor Changes

#592 caa32e8 Thanks @gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

#594 37fca4e Thanks @dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

#583 ae636dd Thanks @43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

#588 6506135 Thanks @danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

#599 0547d6f Thanks @43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

@clack/core@1.5.0

Changelog

Sourced from @clack/prompts's changelog.

1.8.1

Patch Changes

8bd9129 Thanks @gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

Updated dependencies [8bd9129]:

@clack/core@1.5.1

1.8.0

Minor Changes

#592 caa32e8 Thanks @gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

#594 37fca4e Thanks @dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

#583 ae636dd Thanks @43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

#588 6506135 Thanks @danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

#599 0547d6f Thanks @43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

@clack/core@1.5.0

Commits

da44e23 [ci] release (#605)
8bd9129 fix: correctly specify return type of CANCEL_SYMBOL (#601)
de1ef16 [ci] release (#589)
0547d6f fix: output submit gap only when guide enabled (#599)
ae636dd feat: add async validation (#583)
37fca4e feat(prompts): add tab-completion to path prompt (#594)
caa32e8 feat: export CANCEL_SYMBOL (#592)
8d81248 chore: stop publishing CHANGELOG.md to npm (#591)
e238070 test(box): remove redundant test (#590)
6506135 fix(prompts): style box guide bar to match other gutters (#588)
See full diff in compare view

Updates posthog-node from 5.49.1 to 5.55.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.55.0

5.55.0

Minor Changes

#5140 2d2560a Thanks @dustinbyrne! - Allow featureFlagsPollingInterval: null to disable automatic local flag polling while retaining initialization and manual refresh. (2026-09-30)

Changelog

Sourced from posthog-node's changelog.

5.55.0

Minor Changes

#5140 2d2560a Thanks @dustinbyrne! - Allow featureFlagsPollingInterval: null to disable automatic local flag polling while retaining initialization and manual refresh. (2026-09-30)

5.54.1

Patch Changes

#4832 ac479db Thanks @dustinbyrne! - Support snake_case feature flag cache payloads while preserving compatibility with camelCase providers and cached data. (2026-09-25)

5.54.0

Minor Changes

#5099 e3955f8 Thanks @marandaneto! - Expose feature flag evaluation reasons and preserve them in OpenFeature resolution metadata. (2026-09-25)

5.53.0

Minor Changes

#5050 31dd1ad Thanks @posthog! - Read a feature flag's evaluation runtime with getFeatureFlagEvaluationRuntime(key) and getFeatureFlagKeysByEvaluationRuntime(runtime) (2026-09-23)

5.52.6

Patch Changes

#5078 f4704ac Thanks @rubychilds! - Honor filters.holdout during local feature flag evaluation. A user in an experiment holdout now receives the holdout-<id> variant instead of being bucketed into a regular variant, matching how the server evaluates the same flag. The holdout is resolved before the release conditions, so a held-out user never reaches the flag's targeting — including when those conditions would have excluded them, so isFeatureEnabled can return true where it previously returned false. Experiments with an active holdout will see variant assignment change for the held-out share of traffic on upgrade, bringing locally evaluated assignments in line with server-evaluated ones. (2026-09-23)

Updated dependencies [f4704ac]:

@posthog/core@1.55.2

5.52.5

Patch Changes

#5018 9cd8ebd Thanks @turnipdabeets! - Stop dropping long spans that end: maxSpanAgeMs now evicts spans only once maxLiveSpans is reached, so a span that runs past the age limit and then ends is exported, and its children are no longer orphaned. (2026-09-21)

#4800 aad7464 Thanks @marandaneto! - Respect the definitions response's property_matching_version during local feature flag evaluation. Version 2 uses explicit boolean/string equality and per-member array matching, while missing or other versions retain service legacy matching (including empty-array truthiness). Preserve the version in Node definition caches and Convex persisted definitions, and propagate it through person, group, cohort and dependency evaluation without mixing snapshots during reloads. Existing numeric ambiguity fallback and SemVer parsing policies are unchanged. (2026-09-21)

Updated dependencies [9cd8ebd, aad7464]:

@posthog/core@1.55.1

5.52.4

... (truncated)

Commits

e1dd962 chore: update versions and lockfile [version bump]
2d2560a feat(node): allow disabling automatic feature flag polling (#5140)
bd66cee fix(replay): reduce debug properties without losing diagnostics (#5144)
3c24aa5 test(node): strengthen SDK regression coverage (#5105)
490ffe8 chore: update versions and lockfile [version bump]
ac479db fix(node): support snake_case flag definition caches (#4832)
518ae78 chore: update versions and lockfile [version bump]
e3955f8 feat: expose feature flag reasons in the Node OpenFeature provider (#5099)
7b3121f chore: update versions and lockfile [version bump]
31dd1ad feat(node): expose a flag's evaluation runtime through the SDK (#5050)
Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

505a55b chore(release): 6.2.12
7bc9a33 perf: encode single-signature JWS input once
78637bd perf: normalize General JWE shared headers once
bf5138b perf: deduplicate pending jwks key imports
b23a6f3 perf: use native encoding for larger ASCII strings
fd3ae3f perf: normalize jwks selection metadata once
6925d43 perf: avoid copying AES-GCM output
be62530 docs: clarify and shorten public API guidance
1b41312 build: preserve README when generation fails
0b51829 build: check tree-shaking for every public binding
Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.62.4 to 4.64.2

Release notes

Sourced from @rollup/rollup-linux-x64-gnu's releases.

v4.64.2

4.64.2

2026-10-07

Bug Fixes

Fix a regression where certain CoreJS helpers were wrongly tree-shaken (#6562)

Do not show errors from closeBundle if there were also build errors (#6554)

Pull Requests

#6554: Preserve build errors when closeBundle fails (@Jo2234, @lukastaegert)

#6561: Rework REPL artefacts and performance report workflows (@lukastaegert)

#6562: Do not resolve values of assigned variables returned on all paths (@lukastaegert)

v4.64.1

4.64.1

2026-10-07

Bug Fixes

Slightly improve performance when rendering ES output (#6534)

Pull Requests

#6534: Avoid repeated export name scans when rendering ES chunks (@irontaek, @lukastaegert)

#6552: chore(ci): remove redundant rust-src setup (@TrickyPi, @lukastaegert)

#6555: Lock file maintenance (@renovate[bot], @lukastaegert)

v4.64.0

4.64.0

2026-10-02

Features

Improve try-catch deoptimization to cover calling methods on objects (#6541)

Bug Fixes

Fix a situation where some feature-detections of core-js were not triggering properly (#6541)

Pull Requests

#6541: Retain callbacks of helper methods called from try statements (@lukastaegert)

#6542: Run additional tests as part of the coverage job (@lukastaegert)

#6544: Update msys2/setup-msys2 digest to ec48f7c (@renovate[bot], @lukastaegert)

#6545: Update minor/patch updates (@renovate[bot])

... (truncated)

Changelog

Sourced from @rollup/rollup-linux-x64-gnu's changelog.

4.64.2

2026-10-07

Bug Fixes

Fix a regression where certain CoreJS helpers were wrongly tree-shaken (#6562)

Do not show errors from closeBundle if there were also build errors (#6554)

Pull Requests

#6554: Preserve build errors when closeBundle fails (@Jo2234, @lukastaegert)

#6561: Rework REPL artefacts and performance report workflows (@lukastaegert)

#6562: Do not resolve values of assigned variables returned on all paths (@lukastaegert)

4.64.1

2026-10-07

Bug Fixes

Slightly improve performance when rendering ES output (#6534)

Pull Requests

#6534: Avoid repeated export name scans when rendering ES chunks (@irontaek, @lukastaegert)

#6552: chore(ci): remove redundant rust-src setup (@TrickyPi, @lukastaegert)

#6555: Lock file maintenance (@renovate[bot], @lukastaegert)

4.64.0

2026-10-02

Features

Improve try-catch deoptimization to cover calling methods on objects (#6541)

Bug Fixes

Fix a situation where some feature-detections of core-js were not triggering properly (#6541)

Pull Requests

#6541: Retain callbacks of helper methods called from try statements (@lukastaegert)

#6542: Run additional tests as part of the coverage job (@lukastaegert)

#6544: Update msys2/setup-msys2 digest to ec48f7c (@renovate[bot], @lukastaegert)

#6545: Update minor/patch updates (@renovate[bot])

#6546: Update dependency @mermaid-js/mermaid-cli to v12 (@renovate[bot])

#6547: Update Rust crate swc_compiler_base to v65 (@renovate[bot])

... (truncated)

Commits

19e0dcb 4.64.2
98ad757 Do not resolve values of assigned variables returned on all paths (#6562)
76c631a Preserve build errors when closeBundle fails (#6554)
9863ae7 Rework REPL artefacts and performance report workflows (#6561)
2e1a753 4.64.1
f48508c Avoid repeated export name scans when rendering ES chunks (#6534)
68da212 Resolve audit
1cc31f7 Lock file maintenance (#6555)
cf5bd17 chore(ci): remove redundant rust-src setup (#6552)
77773bf 4.64.0
Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)

v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)

v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)

v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)

v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

fd59f02 chore(main): release 14.0.2 (#967)
f3c564e docs: point the Node support permalink at the CI version matrix (#974)
b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
ea83515 docs: cleanup API summary (#968)
ac36860 chore: pin publint version in CI (#966)
a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
See full diff in compare view

Updates arktype from 2.2.3 to 2.2.7

Changelog

Sourced from arktype's changelog.

2.2.7

Fix this[] in self-referential object types

Referencing an array of the enclosing type threw a spurious shallow resolution cycle error:
// previously threw, now parses
const Node = type({
	name: "string",
	"children?": "this[]"
})
Thanks to @yharaskrik.

Parse string.date.epoch.parse input as milliseconds

The validated integer string was passed directly to new Date(), which runs the date string parser rather than reading it as a timestamp:
const parseEpoch = type("string.date.epoch.parse")
// previously 2000-01-01 local time, now 1970-01-01T00:00:00.000Z
parseEpoch("0")
// previously Invalid Date, now 2023-11-14T22:13:20.000Z
parseEpoch("1700000000000")
Thanks to @breken-ai.

Keep uppercase UUIDs valid in string.uuid JSON Schema

string.uuid accepted uppercase hex digits via the i flag, which JSON Schema pattern cannot carry, so the exported schema rejected uppercase UUIDs the runtime check accepted. The patterns now list both cases explicitly. Thanks to @breken-ai.

Render nested bigints correctly in error messages

Bigints inside arrays or objects were printed as quoted strings, e.g. (was ["1n","0n","1n"]). They now print as (was [1n,0n,1n]). Thanks to @chatman-media.

Release unused ids from the global registry

Repeatedly creating an equivalent type (e.g. type("string") or T.pick("a") in a loop) registered a new id for each parse that nothing could reference, so memory grew without limit. Unused ids are now removed. Thanks to @isaacwasserman.

Fix crashes on Hermes and Turbopack

Unions of objects disjoint at a key no longer throw undefined is not a function on Hermes (Expo, React Native), which doesn't preserve Array subclasses through map.

scope.module no longer references this from a static arrow function, which Turbopack could compile to undefined.

2.2.6

... (truncated)

Commits

1ee4923 release: arktype 2.2.7 + dependents (#1675)
0f88b51 fix(type): keep uppercase UUIDs valid in string.uuid JSON Schema (#1670)
066f4f2 fix: Hermes withPrefixKey crash and Turbopack static this in scope.module (...
14ef64c fix(type): parse string.date.epoch.parse input as milliseconds (#1669)
254328c fix(schema): release unused parse context ids from the global registry (#1673)
ca8ec6c test: partial/required on tuple sequences (#1480) (#1590)
e83417a fix this[] shallow resolution cycle in self-referential types (#1618)
89ee4c2 fix(util): render bigints correctly in printable error messages (#1626)
6082e51 release: arktype 2.2.6 + dependents (#1672)
e6a8b3f fix(schema): give predicate errors an explicit expected default (#1668)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for arktype since your current version.

Updates @anthropic-ai/claude-agent-sdk from 0.3.234 to 0.3.293

Release notes

Sourced from @anthropic-ai/claude-agent-sdk's releases.

v0.3.293

What's changed

Added an optional subagent_type to background_tasks_changed task entries, so hosts can name each subagent's type without pairing with task_started

Updated to parity with Claude Code v2.1.293

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.293
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.293
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.293
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.293
v0.3.292

What's changed

Added agent_id to the assistant and user messages a subagent produces; it equals the task_id on that subagent's task events and stays the same when the subagent is resumed

Added parent_task_id to task_started events and background_tasks_changed entries, naming the subagent task that launched a task

Added run_id to background task events and origin.runId to task notifications, so a host can tell a resumed task's runs apart

Added typed sections and notes to the ListAgents tool's tool_use_result, so hosts can list agents without parsing its text

Added recipient_kind to SendMessage tool_use inputs on assistant messages, and their top-level approve is now always a boolean, so hosts no longer infer them from the raw input

Added two optional fields to the ReadNotifications tool output: read_at, when the tool read the session's queued notifications, and arrived_at on each notification, when it reached the session

Fixed subagents with a declared auto permission mode having their tool calls decided by the auto-mode classifier instead of the canUseTool callback when auto mode is unavailable

Changed background_tasks_changed for a finishing background task to arrive after that task's task_updated and task_notification

Changed canUseTool options to carry suppressAlwaysAllowRule: true for connector tools that an organization set to require approval, so hosts can hide their "always allow" choice

Updated to parity with Claude Code v2.1.292

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.292
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.292
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.292
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.292
v0.3.291

What's changed

Updated to parity with Claude Code v2.1.291

Update

... (truncated)

Changelog

Sourced from @anthropic-ai/claude-agent-sdk's changelog.

0.3.293

Added an optional subagent_type to background_tasks_changed task entries, so hosts can name each subagent's type without pairing with task_started

Updated to parity with Claude Code v2.1.293

0.3.292

Added agent_id to the assistant and user messages a subagent produces; it equals the task_id on that subagent's task events and stays the same when the subagent is resumed

Added parent_task_id to task_started events and background_tasks_changed entries, naming the subagent task that launched a task

Added run_id to background task events and origin.runId to task notifications, so a host can tell a resumed task's runs apart

Added typed Description has been truncated

dependabot · 2026-10-13T23:03:26Z

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

changeset-bot · 2026-10-13T23:03:28Z

⚠️ No Changeset found

Latest commit: 9c0f645

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-13T23:03:33Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 152502df-b90d-4752-a067-36704fb24bbe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

freshtonic

The bumps are correct. Two red cells come from the CI credentials, not from this PR. But the Drizzle integration suites are the only live check for the drizzle-orm bump, and they did not run on this PR.

Why Drizzle v3 integration fails

First attempt, db=postgres (23:03 UTC): only lock-context.integration.test.ts fails, with getJwt rejected: Unauthorized. The Clerk tokens are now in the Dependabot secrets, but Clerk refuses the token. #1135 changes no Clerk package and fails the same way.
Second attempt, db=supabase (23:53 UTC): every suite fails with 401 Unauthorized: Authorization failed: Unknown credential id=Some("ZHWW54P57PJOIP6E"). CS_WORKSPACE_CRN, CS_CLIENT_ID and the CS_* secrets all changed between 23:49 and 23:51 UTC. Since then, Tests on main also fails with Server error: 401.

Thus drizzle-orm 0.45.2 → 0.45.3 has no live coverage yet. Re-run both cells after the credentials work again, before you merge.

Overlap with other PRs

This PR also moves next to 15.5.27, so it contains all of #1135.
git merge-tree gives a pnpm-lock.yaml conflict with #1135, #1151 and #988. With #988 there is also a conflict in languages/typescript/packages/stack/package.json. Merge the security PRs (#1135, #1151) first. Then tell Dependabot to rebase this PR.

What I checked

Lockfile: no package gets an install script, and onlyBuiltDependencies does not change.
rollup 4.64.0 adds the optional dependency @napi-rs/lzma-linux-x64-gnu@1.5.1. This is real. Upstream rollup/rollup has it in package.json at v4.64.0, with a reason (issue #6461). rollup@4.64.0 has an npm provenance attestation. The lzma package has no install scripts and installs only on linux/x64.
@hono/node-server goes from 1.19.17 to 2.1.3, which is a major version. It comes in through @modelcontextprotocol/sdk 1.32.1, which accepts ^1.19.9 || ^2.0.5. The wizard tests pass.
@anthropic-ai/sdk ^0.117.1 → ^0.131.0 is a 0.x minor bump, so semver lets it break. But wizard source does not import it. It only satisfies the >=0.93.0 peer range of @anthropic-ai/claude-agent-sdk.
jose 6.2.10 (in this range) adds JWS/JWE validation fixes. @cipherstash/nextjs gets them.

Suggested follow-up PR

This PR changes runtime dependencies in five published packages: stash, @cipherstash/wizard, @cipherstash/stack (uuid), @cipherstash/nextjs (jose) and @cipherstash/stack-prisma (arktype). #1153 added a @cipherstash/wizard patch changeset for a similar runtime pin. If you want these versions in the next release notes, add patch changesets for those five packages.
This problem was on main before this PR: @anthropic-ai/claude-agent-sdk has a peer range of zod: ^4.0.0, but the lockfile resolves zod@3.25.76, because wizard declares zod: ^3.25.76.

… with 16 updates Bumps the production-minor-patch group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.1` | `22.20.5` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` | | [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.1` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.55.0` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` | | [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.62.4` | `4.64.2` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` | | [arktype](https://github.com/arktypeio/arktype/tree/HEAD/ark/type) | `2.2.3` | `2.2.7` | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.234` | `0.3.293` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.132.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.0` | `1.32.1` | | [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.7.7` | `7.9.11` | | [next](https://github.com/vercel/next.js) | `15.5.24` | `15.5.27` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.15` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.3.3` | Updates `@types/node` from 22.20.1 to 22.20.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `drizzle-orm` from 0.45.2 to 0.45.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3) Updates `pg` from 8.23.0 to 8.23.1 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg) Updates `@clack/prompts` from 1.7.0 to 1.8.1 - [Release notes](https://github.com/bombshell-dev/clack/releases) - [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md) - [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.1/packages/prompts) Updates `posthog-node` from 5.49.1 to 5.55.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.55.0/packages/node) Updates `jose` from 6.2.9 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.9...v6.2.12) Updates `@rollup/rollup-linux-x64-gnu` from 4.62.4 to 4.64.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.62.4...v4.64.2) Updates `uuid` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.1...v14.0.2) Updates `arktype` from 2.2.3 to 2.2.7 - [Release notes](https://github.com/arktypeio/arktype/releases) - [Changelog](https://github.com/arktypeio/arktype/blob/main/ark/type/CHANGELOG.md) - [Commits](https://github.com/arktypeio/arktype/commits/arktype@2.2.7/ark/type) Updates `@anthropic-ai/claude-agent-sdk` from 0.3.234 to 0.3.293 - [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-typescript@v0.3.234...v0.3.293) Updates `@anthropic-ai/sdk` from 0.117.1 to 0.132.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.132.0) Updates `@modelcontextprotocol/sdk` from 1.32.0 to 1.32.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.32.0...1.32.1) Updates `@clerk/nextjs` from 7.7.7 to 7.9.11 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.11/packages/nextjs) Updates `next` from 15.5.24 to 15.5.27 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.24...v15.5.27) Updates `tsx` from 4.23.12 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.12...v4.23.15) Updates `vite` from 8.2.1 to 8.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.3/packages/vite) --- updated-dependencies: - dependency-name: "@anthropic-ai/claude-agent-sdk" dependency-version: 0.3.292 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.131.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@clack/prompts" dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@clerk/nextjs" dependency-version: 7.9.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@types/node" dependency-version: 22.20.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: arktype dependency-version: 2.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: drizzle-orm dependency-version: 0.45.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: next dependency-version: 15.5.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: pg dependency-version: 8.23.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: posthog-node dependency-version: 5.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: vite dependency-version: 8.3.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

freshtonic

Re-review of 9c0f645f3. Dependabot recreated the PR on main (141054f5e).

Delta

The manifest changes (package.json files and pnpm-workspace.yaml) are the same as in 80007a3b7.
The lockfile picks up newer transitive patches: @anthropic-ai/claude-agent-sdk 0.3.292 → 0.3.293, @anthropic-ai/sdk 0.131.0 → 0.132.0, @posthog/core 1.57.0 → 1.57.2, rollup 4.64.0 → 4.64.2. It adds @babel/runtime@7.29.10 beside 7.29.7, for @manypkg/find-root and json-schema-to-ts (build tools only).
No package gets an install script (requiresBuild count is 0, as on main). onlyBuiltDependencies does not change. The @napi-rs/lzma-linux-x64-gnu@1.5.1 optional dependency is still there; my earlier check of it still applies.
The sharp@<0.35.5 override from #1151 is kept (lockfile line 46).

Status of earlier points

No live coverage for drizzle-orm 0.45.3: resolved. Drizzle v3 integration passes for db=postgres and db=supabase. The Supabase and prisma-next integration suites also pass. All checks are green.
Overlap with #1135: still open. git merge-tree gives conflicts in pnpm-lock.yaml and pnpm-workspace.yaml. Merge #1135 first, then tell Dependabot to rebase this PR. #988 is closed, so that conflict is gone.
Suggested follow-up (patch changesets for stash, @cipherstash/wizard, @cipherstash/stack, @cipherstash/nextjs, @cipherstash/stack-prisma): still open.
Suggested follow-up (zod peer mismatch for @anthropic-ai/claude-agent-sdk): still open. It is on main, not caused by this PR.

I found no new defect.

freshtonic

Approved. Merge #1135 first, then rebase this PR. Rebase this PR or #1150, whichever merges second, to prevent a duplicate source-map-js@1.2.2: key in pnpm-lock.yaml.

tobyhede · 2026-10-15T02:01:42Z

@dependabot rebase

dependabot · 2026-10-15T02:07:40Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from a team as a code owner October 13, 2026 23:03

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 13, 2026

This was referenced Oct 14, 2026

fix(deps): patch sharp to 0.35.5 #1151

Merged

fix(deps): patch source-map-js to 1.2.2 #1150

Merged

freshtonic reviewed Oct 14, 2026

View reviewed changes

This was referenced Oct 14, 2026

chore(deps): bump next from 15.5.24 to 15.5.27 #1135

Merged

chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates #988

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-minor-patch-94a844da9d branch from 80007a3 to 9c0f645 Compare October 14, 2026 22:35

freshtonic reviewed Oct 15, 2026

View reviewed changes

freshtonic mentioned this pull request Oct 15, 2026

chore(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates #1211

Open

freshtonic approved these changes Oct 15, 2026

View reviewed changes

dependabot Bot closed this Oct 15, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-minor-patch-94a844da9d branch October 15, 2026 02:07

Navigation Menu

Repository navigation

chore(deps): bump the production-minor-patch group across 1 directory with 16 updates - #1197

chore(deps): bump the production-minor-patch group across 1 directory with 16 updates#1197
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-94a844da9d

dependabot Bot commented on behalf of github Oct 13, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 13, 2026

Uh oh!

changeset-bot Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Review skipped

Uh oh!

freshtonic left a comment

Uh oh!

freshtonic left a comment

Uh oh!

freshtonic left a comment

Uh oh!

tobyhede commented Oct 15, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.45.3

New Netlify DB Driver

@​clack/prompts@​1.8.1

Patch Changes

@​clack/prompts@​1.8.0

Minor Changes

Patch Changes

1.8.1

Patch Changes

1.8.0

Minor Changes

Patch Changes

posthog-node@5.55.0

5.55.0

Minor Changes

5.55.0

Minor Changes

5.54.1

Patch Changes

5.54.0

Minor Changes

5.53.0

Minor Changes

5.52.6

Patch Changes

5.52.5

Patch Changes

5.52.4

v6.2.12

Documentation

Refactor

Performance

v6.2.11

Documentation

Refactor

v6.2.10

Fixes

6.2.12 (2026-09-05)

Documentation

Refactor

Performance

6.2.11 (2026-09-04)

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

v4.64.2

4.64.2

Bug Fixes

Pull Requests

v4.64.1

4.64.1

Bug Fixes

Pull Requests

v4.64.0

4.64.0

Features

Bug Fixes

Pull Requests

4.64.2

Bug Fixes

Pull Requests

4.64.1

Bug Fixes

Pull Requests

4.64.0

Features

Bug Fixes

Pull Requests

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

14.0.2 (2026-08-18)

Bug Fixes

2.2.7

Fix this[] in self-referential object types

Parse string.date.epoch.parse input as milliseconds

dependabot Bot commented on behalf of github Oct 13, 2026 •

edited

Loading

`@clack/prompts@1`.8.1

`@clack/prompts@1`.8.0

Fix `this[]` in self-referential object types

Parse `string.date.epoch.parse` input as milliseconds

Keep uppercase UUIDs valid in `string.uuid` JSON Schema

changeset-bot Bot commented Oct 13, 2026 •

edited

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading