fix(deps): bump the npm-major group across 1 directory with 13 updates by dependabot[bot] · Pull Request #6396 · supabase/cli

dependabot · 2026-08-30T00:12:26Z

Bumps the npm-major group with 13 updates in the / directory:

Package	From	To
verdaccio	`6.9.3`	`6.10.0`
jose	`6.2.9`	`6.2.10`
@anthropic-ai/sdk	`0.117.1`	`0.120.0`
posthog-node	`5.49.1`	`5.50.0`
fumadocs-core	`16.14.4`	`16.15.0`
fumadocs-mdx	`15.2.3`	`15.3.1`
fumadocs-ui	`16.14.4`	`16.15.0`
next	`16.3.1`	`16.3.2`
@vitest/coverage-istanbul	`4.1.10`	`4.1.11`
oxfmt	`0.63.0`	`0.64.0`
oxlint	`1.78.0`	`1.79.0`
tldts	`6.1.86`	`7.4.10`
vitest	`4.1.10`	`4.1.11`

Updates verdaccio from 6.9.3 to 6.10.0

Release notes

Sourced from verdaccio's releases.

v6.10.0

Minor Changes
51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

Enable it in config.yaml:
server:
  legacyAuthCache:
    enabled: true
    ttlMs: 15000
    maxEntries: 1000
Options:

enabled: enables the legacy token authentication cache. Default: false.

ttlMs: time in milliseconds before a cached validation expires. Default: 15000.

maxEntries: maximum number of cached legacy tokens. Default: 1000.

See #6147 and the original 8.x backport in #6143.

Changelog

Sourced from verdaccio's changelog.

6.10.0

Minor Changes

51c2733: Update internal Verdaccio types to include the optional server.legacyAuthCache configuration used by the 8.x auth and config packages.

Commits

dfe2439 chore: release 6.x (#6148)
51c2733 feat: expose legacy auth cache config (#6147)
See full diff in compare view

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Commits

3eab152 chore(release): 6.2.10
021abf4 refactor(jws): specialize compact processing
a998927 refactor(jwe): specialize compact processing
eedb124 refactor(jose): share binary input validation
52ba159 refactor(jwt): share producer claim state
85e30ed refactor(jose): share compact token processing internals
0bd81d2 test(jose): cover hidden critical-header options
9cf7876 test(jose): reject callable object impostors
f23cafd test(jose): preserve resolved key data properties
1ee6f61 refactor(jwe): consolidate CBC decryption failures
Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.117.1 to 0.120.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

api: additions to files and memory stores (fdc0379)

api: updates to skill, files, and user profiles (671e6b1)

client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

api: remove unsupported mid_conv_system content block (ae6ca94)

session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

internal: bump zod to 4.4.3 (#334) (faa5b7b)

internal: remove leftover prism references (a163b96)

stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

api: additions to files and memory stores (fdc0379)

api: updates to skill, files, and user profiles (671e6b1)

client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

api: remove unsupported mid_conv_system content block (ae6ca94)

session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

internal: bump zod to 4.4.3 (#334) (faa5b7b)

internal: remove leftover prism references (a163b96)

stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)

Commits

bfa9197 chore: release main
bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
7fe6dd5 remove internal ticket references from changelog- #360
c67e4e2 chore: release main
50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
18ea26d chore: release main
6ed9ddd feat(api): updates to skill, files, and user profiles
91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
Additional commits viewable in compare view

Updates posthog-node from 5.49.1 to 5.50.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.50.0

5.50.0

Minor Changes

#4484 557140e Thanks @posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

#4569 00d22ea Thanks @v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

Patch Changes

#4583 6322f09 Thanks @turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

Updated dependencies [6322f09]:

@posthog/core@1.48.7

posthog-node@5.49.2

5.49.2

Patch Changes

#4578 bae46bf Thanks @marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

Updated dependencies [bae46bf, aef2f49]:

@posthog/core@1.48.6

Changelog

Sourced from posthog-node's changelog.

5.50.0

Minor Changes

#4484 557140e Thanks @posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

5.49.4

Patch Changes

#4569 00d22ea Thanks @v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

5.49.3

Patch Changes

#4583 6322f09 Thanks @turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

Updated dependencies [6322f09]:

@posthog/core@1.48.7

5.49.2

Patch Changes

#4578 bae46bf Thanks @marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

Updated dependencies [bae46bf, aef2f49]:

@posthog/core@1.48.6

Commits

3508c05 chore: update versions and lockfile [version bump]
557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
6ccc78e chore: update versions and lockfile [version bump]
00d22ea fix(node): return undefined instead of null variant in getFeatureFlagResult (...
0832e6e chore: update versions and lockfile [version bump]
960cef8 chore: update versions and lockfile [version bump]
bae46bf fix: drop events when beforeSend hooks throw (#4578)
9e7a421 test(node): add server SDK wire snapshots (#4544)
See full diff in compare view

Updates fumadocs-core from 16.14.4 to 16.15.0

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.0

@fumadocs/base-ui@16.15.0

fumadocs-core@16.15.0

fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:
export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}
cache: 'memory' (default): files() is called once until invalidate().

cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

GraphQL cross-links are generated from the attached loader instead of a baseUrl option on staticSource(). Local, OpenAPI, and AsyncAPI dynamicSource() use cache: 'custom' and reuse generated files by identity until invalidate().

Sanity now uses cache: 'custom' when given a sanityFetch from next-sanity/live, calling invalidate() in draft mode is no longer needed.

Return heading and text results from the Algolia client

algoliaClient grouped hits into page, heading and text results, then dropped everything except pages. All three are now returned with highlighting, matching the other search clients.

Fix locale-only pages leaking into other locales

i18n storages no longer share folder arrays with the fallback locale. Locale-only pages previously appeared in every locale's page tree as duplicate nodes.

Index pages by URL

getPageByHref resolves absolute URLs through an index instead of scanning all pages on every call.

... (truncated)

Commits

f548dab Version Packages (#3491)
992beee fix(mdx): encode import query
01b920c feat(sanity): adopt to Next.js cache API
967cb9b perf(mdx): add queue to index-file generation
21ac4f8 perf(notion): cache asset request
771d556 fix(core): heading & text results from algolia client
e15eaf4 fix(api-docs): ignore self-recursive $ref
442d24c perf(core): shiki checks
36c53f3 perf(mdx): scope lastModified git log to the content directory
030bc4e perf(asyncapi): cache the document proxy in toStaticData
Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.3 to 15.3.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.3.1

Scope lastModified git log to the content directory

git log is scoped to the collection's content directory instead of buffering the repository's entire history in every worker.

Fix Vite dev server crash on declaration-only dependencies

The injected Vite config no longer pre-bundles packages without runtime JavaScript, such as @types/mdx. Pre-bundling them made esbuild parse .d.ts files and fail on imports that only exist in type space, crashing the dev server.

Encode import.meta.glob query values

The Vite codegen passed the query to import.meta.glob as an object, letting the bundler serialize it. Rolldown inlines the values as-is, so a macro id such as src/lib/source.ts#docs left an unescaped / in the content file's module id and relative imports from that module (e.g. images from ![Banner](https://github.com/fuma-nama/fumadocs/blob/HEAD/logo.png)) failed to resolve, since the importer's directory is derived from the raw id.

The query is now serialized (and percent-encoded) by Fumadocs itself, matching what the Node.js codegen already did.

fumadocs-mdx@15.3.0

Sätteri 0.10

@fumadocs/satteri now requires satteri ^0.10.3, and the plugins were rewritten on its new capabilities:

Exports (frontmatter, toc, structuredData, …) are emitted by an after document hook instead of an anchor marker appended to the source, so plugins no longer see (or need to skip) the anchor node.

remark-steps, remark-admonition and remark-code-tab still detect their targets through node visitors (so documents without the construct cost nothing), but process each parent exactly once in an after hook, replacing the per-visit dedup workarounds.

remark-llms stringifies the document root from a before hook instead of subscribing to 19 node types to find it.

Markdown documents compile through Sätteri's own markdownToJs; the hand-assembled pipeline is gone. Raw HTML in .md files is still dropped, matching the previous behavior.

rehype-katex parses KaTeX output with Sätteri's htmlToHast, dropping the hast-util-from-html dependency.

No plugin reads node.position, so Sätteri now skips source-position tracking entirely (~15% faster parse).

Breaking: ExtraPluginHooks.beforeToJs was removed. Seed ctx.data from a Sätteri before hook on the plugin definition instead — it also receives the document root:
import { defineMdastPlugin } from 'satteri';
defineMdastPlugin({
name: 'my-plugin',
before(root, ctx) {
ctx.data.myValue ??= [];
},
});

Commits

f548dab Version Packages (#3491)
992beee fix(mdx): encode import query
01b920c feat(sanity): adopt to Next.js cache API
967cb9b perf(mdx): add queue to index-file generation
21ac4f8 perf(notion): cache asset request
771d556 fix(core): heading & text results from algolia client
e15eaf4 fix(api-docs): ignore self-recursive $ref
442d24c perf(core): shiki checks
36c53f3 perf(mdx): scope lastModified git log to the content directory
030bc4e perf(asyncapi): cache the document proxy in toStaticData
Additional commits viewable in compare view

Updates fumadocs-ui from 16.14.4 to 16.15.0

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.0

@fumadocs/base-ui@16.15.0

fumadocs-core@16.15.0

fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:
export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}
cache: 'memory' (default): files() is called once until invalidate().

cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

GraphQL cross-links are generated from the attached loader instead of a baseUrl option on staticSource(). Local, OpenAPI, and AsyncAPI dynamicSource() use cache: 'custom' and reuse generated files by identity until invalidate().

Sanity now uses cache: 'custom' when given a sanityFetch from next-sanity/live, calling invalidate() in draft mode is no longer needed.

Return heading and text results from the Algolia client

algoliaClient grouped hits into page, heading and text results, then dropped everything except pages. All three are now returned with highlighting, matching the other search clients.

Fix locale-only pages leaking into other locales

i18n storages no longer share folder arrays with the fallback locale. Locale-only pages previously appeared in every locale's page tree as duplicate nodes.

Index pages by URL

getPageByHref resolves absolute URLs through an index instead of scanning all pages on every call.

... (truncated)

Commits

f548dab Version Packages (#3491)
992beee fix(mdx): encode import query
01b920c feat(sanity): adopt to Next.js cache API
967cb9b perf(mdx): add queue to index-file generation
21ac4f8 perf(notion): cache asset request
771d556 fix(core): heading & text results from algolia client
e15eaf4 fix(api-docs): ignore self-recursive $ref
442d24c perf(core): shiki checks
36c53f3 perf(mdx): scope lastModified git log to the content directory
030bc4e perf(asyncapi): cache the document proxy in toStaticData
Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

d0ac882 v16.3.2
81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
eba236b [backport] Scope app-entry export validation to files inside the app director...
See full diff in compare view

Updates @vitest/coverage-istanbul from 4.1.10 to 4.1.11

Release notes

Sourced from @vitest/coverage-istanbul's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
See full diff in compare view

Updates oxfmt from 0.63.0 to 0.64.0

Changelog

Sourced from oxfmt's changelog.

[0.64.0] - 2026-08-18

🚀 Features

c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)

f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

... (truncated)

Commits

0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
fed6681 docs(oxfmt): skip expanding overrides options (#25572)
See full diff in compare view

Updates oxlint from 1.78.0 to 1.79.0

Release notes

Sourced from oxlint's releases.

oxlint v1.79.0 & oxfmt v0.64.0

Table of Contents

Oxlint v1.79.0

Oxfmt v0.64.0

Oxlint v1.79.0

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

See React Compiler Support for details.

🚀 Features

9b7394e linter/typescript/no-empty-object-type: Implement suggestion (#25833) (Mikhail Baev)

🐛 Bug Fixes

345f981 react_compiler: Skip node_modules by default (#25859) (Boshen)

2f40afa linter/unicorn/no-array-callback-reference: Ignore effect library imports (#25857) (Michaël Bitard)

7b565a0 linter: Align React Compiler rule categories (#25840) (Boshen)

228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)

f8e4884 linter/eslint/no-useless-constructor: Allow parameter properties (#25811) (camc314)

e4b6993 linter: Report exhaustive effect dependencies (#25829) (Boshen)

742e25f linter/eslint/no-return-assign: Anchor diagnostic on return stmt (#25803) (camc314)

b831ca8 react-compiler: Improve derived state diagnostic (#25804) (Boshen)

5908c87 linter/jest/prefer-mock-return-s...
Description has been truncated

Bumps the npm-major group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [verdaccio](https://github.com/verdaccio/verdaccio) | `6.9.3` | `6.10.0` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.10` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.120.0` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.50.0` | | [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.0` | | [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.3.1` | | [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.0` | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.2` | | [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.10` | `4.1.11` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.64.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.79.0` | | [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.10` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `verdaccio` from 6.9.3 to 6.10.0 - [Release notes](https://github.com/verdaccio/verdaccio/releases) - [Changelog](https://github.com/verdaccio/verdaccio/blob/v6.10.0/CHANGELOG.md) - [Commits](verdaccio/verdaccio@v6.9.3...v6.10.0) Updates `jose` from 6.2.9 to 6.2.10 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.9...v6.2.10) Updates `@anthropic-ai/sdk` from 0.117.1 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.120.0) Updates `posthog-node` from 5.49.1 to 5.50.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.50.0/packages/node) Updates `fumadocs-core` from 16.14.4 to 16.15.0 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.0) Updates `fumadocs-mdx` from 15.2.3 to 15.3.1 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.3.1) Updates `fumadocs-ui` from 16.14.4 to 16.15.0 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.0) Updates `next` from 16.3.1 to 16.3.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.1...v16.3.2) Updates `@vitest/coverage-istanbul` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-istanbul) Updates `oxfmt` from 0.63.0 to 0.64.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.64.0/npm/oxfmt) Updates `oxlint` from 1.78.0 to 1.79.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.79.0/npm/oxlint) Updates `tldts` from 6.1.86 to 7.4.10 - [Release notes](https://github.com/remusao/tldts/releases) - [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md) - [Commits](remusao/tldts@v6.1.86...v7.4.10) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: verdaccio dependency-version: 6.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: jose dependency-version: 6.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: posthog-node dependency-version: 5.50.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: fumadocs-core dependency-version: 16.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: fumadocs-mdx dependency-version: 15.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: fumadocs-ui dependency-version: 16.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: next dependency-version: 16.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: "@vitest/coverage-istanbul" dependency-version: 4.1.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: oxfmt dependency-version: 0.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: oxlint dependency-version: 1.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: tldts dependency-version: 7.4.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major ... Signed-off-by: dependabot[bot] <support@github.com>

depthfirst-app · 2026-08-30T00:18:45Z

GHSA-p293-qw3h-jr36

+    "fumadocs-core": "^16.15.0",
+    "fumadocs-mdx": "^15.3.1",
+    "fumadocs-ui": "^16.15.0",
+    "next": "16.3.2",


🔴 Severity: CRITICAL

Next.js 16.3.2 is affected by GHSA-p293-qw3h-jr36 for versions below 16.3.3. On a Windows-hosted App Router server, unauthenticated crafted requests can reach vulnerable filesystem handling and execute code with server privileges, compromising the docs service.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade Next.js from version 16.3.2 to 16.3.3 or later in apps/docs/package.json. Version 16.3.2 is affected by GHSA-p293-qw3h-jr36, which allows unauthenticated remote code execution via vulnerable filesystem handling on App Router servers running on Windows. Bumping the pinned version to 16.3.3 (the first patched release) eliminates the vulnerability.

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change

"next": "16.3.2",

"next": "16.3.3",

dependabot · 2026-08-31T00:10:04Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 30, 2026

supabase-cli-releaser Bot approved these changes Aug 30, 2026

View reviewed changes

supabase-cli-releaser Bot enabled auto-merge August 30, 2026 00:12

depthfirst-app Bot reviewed Aug 30, 2026

View reviewed changes

dependabot Bot closed this Aug 31, 2026

auto-merge was automatically disabled August 31, 2026 00:10
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/npm-major-b4a40f5aa3 branch August 31, 2026 00:10

Navigation Menu

Uh oh!

fix(deps): bump the npm-major group across 1 directory with 13 updates - #6396

fix(deps): bump the npm-major group across 1 directory with 13 updates#6396
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-major-b4a40f5aa3

dependabot Bot commented on behalf of github Aug 30, 2026 •

edited

Loading

Uh oh!

depthfirst-app Bot Aug 30, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.10.0

Minor Changes

6.10.0

Minor Changes

v6.2.10

Fixes

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

Documentation

Refactor

sdk: v0.120.0

0.120.0 (2026-08-19)

Features

Chores

sdk: v0.119.0

0.119.0 (2026-08-19)

Features

sdk: v0.118.0

0.118.0 (2026-08-18)

Features

Bug Fixes

Chores

Documentation

0.120.0 (2026-08-19)

Features

Chores

0.119.0 (2026-08-19)

Features

0.118.0 (2026-08-18)

Features

Bug Fixes

Chores

Documentation

posthog-node@5.50.0

5.50.0

Minor Changes

posthog-node@5.49.4

5.49.4

Patch Changes

posthog-node@5.49.3

5.49.3

Patch Changes

posthog-node@5.49.2

5.49.2

Patch Changes

5.50.0

Minor Changes

5.49.4

Patch Changes

5.49.3

Patch Changes

5.49.2

Patch Changes

fumadocs@16.15.0

Redesign source API

Integrations

Return heading and text results from the Algolia client

Fix locale-only pages leaking into other locales

Index pages by URL

fumadocs-mdx@15.3.1

Scope lastModified git log to the content directory

Fix Vite dev server crash on declaration-only dependencies

Encode import.meta.glob query values

fumadocs-mdx@15.3.0

Sätteri 0.10

fumadocs@16.15.0

Redesign source API

Integrations

Return heading and text results from the Algolia client

Fix locale-only pages leaking into other locales

Index pages by URL

v16.3.2

Core Changes

Credits

dependabot Bot commented on behalf of github Aug 30, 2026 •

edited

Loading

Scope `lastModified` git log to the content directory

Encode `import.meta.glob` query values