fix(deps): bump the npm-major group across 1 directory with 15 updates by dependabot[bot] · Pull Request #6398 · supabase/cli

dependabot · 2026-08-31T00:10:49Z

Bumps the npm-major group with 15 updates in the / directory:

Package	From	To
verdaccio	`6.9.3`	`6.10.0`
jose	`6.2.9`	`6.2.10`
@anthropic-ai/claude-agent-sdk	`0.3.234`	`0.3.241`
@anthropic-ai/sdk	`0.117.1`	`0.120.0`
posthog-node	`5.49.1`	`5.50.0`
fumadocs-core	`16.14.4`	`16.15.1`
fumadocs-mdx	`15.2.3`	`15.3.1`
fumadocs-ui	`16.14.4`	`16.15.1`
next	`16.3.1`	`16.3.2`
@types/react-dom	`19.2.4`	`19.2.5`
@vitest/coverage-istanbul	`4.1.10`	`4.1.11`
oxfmt	`0.63.0`	`0.64.0`
oxlint	`1.78.0`	`1.79.0`
tldts	`6.1.86`	`7.4.10`
vitest	`4.1.10`	`4.1.11`

Updates verdaccio from 6.9.3 to 6.10.0

Release notes

Sourced from verdaccio's releases.

v6.10.0

Minor Changes
51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

Enable it in config.yaml:
server:
  legacyAuthCache:
    enabled: true
    ttlMs: 15000
    maxEntries: 1000
Options:

enabled: enables the legacy token authentication cache. Default: false.

ttlMs: time in milliseconds before a cached validation expires. Default: 15000.

maxEntries: maximum number of cached legacy tokens. Default: 1000.

See #6147 and the original 8.x backport in #6143.

Changelog

Sourced from verdaccio's changelog.

6.10.0

Minor Changes

51c2733: Update internal Verdaccio types to include the optional server.legacyAuthCache configuration used by the 8.x auth and config packages.

Commits

dfe2439 chore: release 6.x (#6148)
51c2733 feat: expose legacy auth cache config (#6147)
See full diff in compare view

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Commits

3eab152 chore(release): 6.2.10
021abf4 refactor(jws): specialize compact processing
a998927 refactor(jwe): specialize compact processing
eedb124 refactor(jose): share binary input validation
52ba159 refactor(jwt): share producer claim state
85e30ed refactor(jose): share compact token processing internals
0bd81d2 test(jose): cover hidden critical-header options
9cf7876 test(jose): reject callable object impostors
f23cafd test(jose): preserve resolved key data properties
1ee6f61 refactor(jwe): consolidate CBC decryption failures
Additional commits viewable in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.234 to 0.3.241

Release notes

Sourced from @anthropic-ai/claude-agent-sdk's releases.

v0.3.241

What's changed

Updated to parity with Claude Code v2.1.241

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.241
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.241
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.241
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.241
v0.3.240

What's changed

Updated to parity with Claude Code v2.1.240

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.240
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.240
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.240
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.240
v0.3.239

What's changed

total_cost_usd / modelUsage.costUSD now include the 1.1× US-only-inference (data residency) multiplier when the response reports inference_geo: "us"

A result held back for background subagents in one-shot mode now reports total_cost_usd, duration_api_ms and modelUsage as of its release, not the turn-end snapshot

Fixed SYSTEM_PROMPT_DYNAMIC_BOUNDARY in an array systemPrompt being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers

A repeated initialize on a running process is now followed by a background_tasks_changed snapshot of the live background tasks, so reconnecting hosts see work that is still running

Update
npm install @anthropic-ai/claude-agent-sdk@0.3.239
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.239
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.239
</tr></table> 

... (truncated)

Changelog

Sourced from @anthropic-ai/claude-agent-sdk's changelog.

0.3.241

Updated to parity with Claude Code v2.1.241

0.3.240

Updated to parity with Claude Code v2.1.240

0.3.239

total_cost_usd / modelUsage.costUSD now include the 1.1× US-only-inference (data residency) multiplier when the response reports inference_geo: "us"

A result held back for background subagents in one-shot mode now reports total_cost_usd, duration_api_ms and modelUsage as of its release, not the turn-end snapshot

Fixed SYSTEM_PROMPT_DYNAMIC_BOUNDARY in an array systemPrompt being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers

A repeated initialize on a running process is now followed by a background_tasks_changed snapshot of the live background tasks, so reconnecting hosts see work that is still running

0.3.238

Added is_backgrounded and spawn_depth to task_started events for subagent tasks (is_backgrounded also on background Bash tasks)

Added suppressOriginalPrompt to UserPromptExpansion hook output, matching UserPromptSubmit

Added command_lifecycle state refused: a cross-session peer message the session's receive-side policy declines now reports this terminal state instead of producing no lifecycle frames

Fixed SDK hook callbacks silently not applying after a host re-sends initialize to an already-running CLI; the response now reports hooks_applied

Fixed CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true not keeping prompt_suggestion messages on when the account is near, but not over, its usage limit

Changed vcs_state_changed push events to emit one event per pushed branch

0.3.237

Updated to parity with Claude Code v2.1.237

0.3.236

PostToolUse hooks can return hookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that result

0.3.235

Updated to parity with Claude Code v2.1.235

Commits

4827507 chore: Update CHANGELOG.md
bfa6b84 chore: Update CHANGELOG.md
ae7e3dd chore: Update CHANGELOG.md
c4fdbe3 chore: Update CHANGELOG.md
591a180 chore: Update CHANGELOG.md
d933c99 chore: Update CHANGELOG.md
076593f chore: Update CHANGELOG.md
See full diff in compare view

Updates @anthropic-ai/sdk from 0.117.1 to 0.120.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

api: additions to files and memory stores (fdc0379)

api: updates to skill, files, and user profiles (671e6b1)

client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

api: remove unsupported mid_conv_system content block (ae6ca94)

session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

internal: bump zod to 4.4.3 (#334) (faa5b7b)

internal: remove leftover prism references (a163b96)

stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

api: additions to files and memory stores (fdc0379)

api: updates to skill, files, and user profiles (671e6b1)

client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

api: remove unsupported mid_conv_system content block (ae6ca94)

session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

internal: bump zod to 4.4.3 (#334) (faa5b7b)

internal: remove leftover prism references (a163b96)

stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)

Commits

bfa9197 chore: release main
bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
7fe6dd5 remove internal ticket references from changelog- #360
c67e4e2 chore: release main
50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
18ea26d chore: release main
6ed9ddd feat(api): updates to skill, files, and user profiles
91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
Additional commits viewable in compare view

Updates posthog-node from 5.49.1 to 5.50.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.50.0

5.50.0

Minor Changes

#4484 557140e Thanks @posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

#4569 00d22ea Thanks @v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

Patch Changes

#4583 6322f09 Thanks @turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

Updated dependencies [6322f09]:

@posthog/core@1.48.7

posthog-node@5.49.2

5.49.2

Patch Changes

#4578 bae46bf Thanks @marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

Updated dependencies [bae46bf, aef2f49]:

@posthog/core@1.48.6

Changelog

Sourced from posthog-node's changelog.

5.50.0

Minor Changes

#4484 557140e Thanks @posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

5.49.4

Patch Changes

#4569 00d22ea Thanks @v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

5.49.3

Patch Changes

#4583 6322f09 Thanks @turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)

Updated dependencies [6322f09]:

@posthog/core@1.48.7

5.49.2

Patch Changes

#4578 bae46bf Thanks @marandaneto! - Drop events when a before-send hook throws instead of sending the unmodified event. (2026-08-20)

Updated dependencies [bae46bf, aef2f49]:

@posthog/core@1.48.6

Commits

3508c05 chore: update versions and lockfile [version bump]
557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
6ccc78e chore: update versions and lockfile [version bump]
00d22ea fix(node): return undefined instead of null variant in getFeatureFlagResult (...
0832e6e chore: update versions and lockfile [version bump]
960cef8 chore: update versions and lockfile [version bump]
bae46bf fix: drop events when beforeSend hooks throw (#4578)
9e7a421 test(node): add server SDK wire snapshots (#4544)
See full diff in compare view

Updates fumadocs-core from 16.14.4 to 16.15.1

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.1

@fumadocs/base-ui@16.15.1

fumadocs-core@16.15.1

fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():
const structuredData = await page.data.structuredData();
The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

@fumadocs/base-ui@16.15.0

fumadocs-core@16.15.0

fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:
export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}
cache: 'memory' (default): files() is called once until invalidate().

cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

... (truncated)

Commits

78e836b Version Packages (#3494)
5e7826f backward compat
31afd1b feat(python): support runtime content source
b65dac8 docs: rewrite content generators section
59a993c refactor(core): unify structured data across content sources
d87c629 chore: simplify cache
2c4ebff feat(notion): forward dynamic loader from fumadocs-core/source
f548dab Version Packages (#3491)
992beee fix(mdx): encode import query
01b920c feat(sanity): adopt to Next.js cache API
Additional commits viewable in compare view

Updates fumadocs-mdx from 15.2.3 to 15.3.1

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@15.3.1

Scope lastModified git log to the content directory

git log is scoped to the collection's content directory instead of buffering the repository's entire history in every worker.

Fix Vite dev server crash on declaration-only dependencies

The injected Vite config no longer pre-bundles packages without runtime JavaScript, such as @types/mdx. Pre-bundling them made esbuild parse .d.ts files and fail on imports that only exist in type space, crashing the dev server.

Encode import.meta.glob query values

The Vite codegen passed the query to import.meta.glob as an object, letting the bundler serialize it. Rolldown inlines the values as-is, so a macro id such as src/lib/source.ts#docs left an unescaped / in the content file's module id and relative imports from that module (e.g. images from ![Banner](https://github.com/fuma-nama/fumadocs/blob/HEAD/logo.png)) failed to resolve, since the importer's directory is derived from the raw id.

The query is now serialized (and percent-encoded) by Fumadocs itself, matching what the Node.js codegen already did.

fumadocs-mdx@15.3.0

Sätteri 0.10

@fumadocs/satteri now requires satteri ^0.10.3, and the plugins were rewritten on its new capabilities:

Exports (frontmatter, toc, structuredData, …) are emitted by an after document hook instead of an anchor marker appended to the source, so plugins no longer see (or need to skip) the anchor node.

remark-steps, remark-admonition and remark-code-tab still detect their targets through node visitors (so documents without the construct cost nothing), but process each parent exactly once in an after hook, replacing the per-visit dedup workarounds.

remark-llms stringifies the document root from a before hook instead of subscribing to 19 node types to find it.

Markdown documents compile through Sätteri's own markdownToJs; the hand-assembled pipeline is gone. Raw HTML in .md files is still dropped, matching the previous behavior.

rehype-katex parses KaTeX output with Sätteri's htmlToHast, dropping the hast-util-from-html dependency.

No plugin reads node.position, so Sätteri now skips source-position tracking entirely (~15% faster parse).

Breaking: ExtraPluginHooks.beforeToJs was removed. Seed ctx.data from a Sätteri before hook on the plugin definition instead — it also receives the document root:
import { defineMdastPlugin } from 'satteri';
defineMdastPlugin({
name: 'my-plugin',
before(root, ctx) {
ctx.data.myValue ??= [];
},
});

Commits

f548dab Version Packages (#3491)
992beee fix(mdx): encode import query
01b920c feat(sanity): adopt to Next.js cache API
967cb9b perf(mdx): add queue to index-file generation
21ac4f8 perf(notion): cache asset request
771d556 fix(core): heading & text results from algolia client
e15eaf4 fix(api-docs): ignore self-recursive $ref
442d24c perf(core): shiki checks
36c53f3 perf(mdx): scope lastModified git log to the content directory
030bc4e perf(asyncapi): cache the document proxy in toStaticData
Additional commits viewable in compare view

Updates fumadocs-ui from 16.14.4 to 16.15.1

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.1

@fumadocs/base-ui@16.15.1

fumadocs-core@16.15.1

fumadocs-ui@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

Search indexing no longer falls back to (await page.data.load()).structuredData. Runtime content sources expose structuredData() on page data instead, sharing the compile with load():
const structuredData = await page.data.structuredData();
The renderer returned by load() still carries structuredData, existing code keeps working.

fumadocs@16.15.0

@fumadocs/base-ui@16.15.0

fumadocs-core@16.15.0

fumadocs-ui@16.15.0

Redesign source API

Content sources can hook into the static loader they are attached to, and dynamic sources can opt out of the loader's in-memory file cache.

configureStatic runs when a source is attached to loader(), and again whenever dynamicLoader() builds a new static loader:
export function createMySource(): DynamicSource {
  return {
    cache: 'custom',
    async files() {
      return loadFiles();
    },
    configureStatic({ loader, source }) {
      // `loader` is the created static loader
      // `source` is the record key when using named sources
    },
    configure(loader, { source }) {
      loader.invalidate();
    },
  };
}
cache: 'memory' (default): files() is called once until invalidate().

cache: 'custom': the source caches itself. dynamicLoader() re-runs files() on get() and rebuilds only when the file list is shallowly different (by identity).

Integrations

... (truncated)

Commits

78e836b Version Packages (#3494)
5e7826f backward compat
31afd1b feat(python): support runtime content source
b65dac8 docs: rewrite content generators section
59a993c refactor(core): unify structured data across content sources
d87c629 chore: simplify cache
2c4ebff feat(notion): forward dynamic loader from fumadocs-core/source
f548dab Version Packages (#3491)
992beee fix(mdx): encode import query
01b920c feat(sanity): adopt to Next.js cache API
Additional commits viewable in compare view

Updates next from 16.3.1 to 16.3.2

Release notes

Sourced from next's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

d0ac882 v16.3.2
81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
f4dc7c8 [backport] Fix catch-all index page being served for every other slug (#97416)
eba236b [backport] Scope app-entry export validation to files inside the app director...
See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

See full diff in compare view

Updates @vitest/coverage-istanbul from 4.1.10 to 4.1.11

Release notes

Sourced from @vitest/coverage-istanbul's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
See full diff...
Description has been truncated

Bumps the npm-major group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [verdaccio](https://github.com/verdaccio/verdaccio) | `6.9.3` | `6.10.0` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.10` | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.234` | `0.3.241` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.120.0` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.50.0` | | [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.1` | | [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.3.1` | | [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.1` | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.2` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.10` | `4.1.11` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.64.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.79.0` | | [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.10` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `verdaccio` from 6.9.3 to 6.10.0 - [Release notes](https://github.com/verdaccio/verdaccio/releases) - [Changelog](https://github.com/verdaccio/verdaccio/blob/v6.10.0/CHANGELOG.md) - [Commits](verdaccio/verdaccio@v6.9.3...v6.10.0) Updates `jose` from 6.2.9 to 6.2.10 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.9...v6.2.10) Updates `@anthropic-ai/claude-agent-sdk` from 0.3.234 to 0.3.241 - [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-typescript@v0.3.234...v0.3.241) Updates `@anthropic-ai/sdk` from 0.117.1 to 0.120.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.120.0) Updates `posthog-node` from 5.49.1 to 5.50.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.50.0/packages/node) Updates `fumadocs-core` from 16.14.4 to 16.15.1 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.1) Updates `fumadocs-mdx` from 15.2.3 to 15.3.1 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@15.2.3...fumadocs-mdx@15.3.1) Updates `fumadocs-ui` from 16.14.4 to 16.15.1 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.14.4...fumadocs@16.15.1) Updates `next` from 16.3.1 to 16.3.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.1...v16.3.2) Updates `@types/react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitest/coverage-istanbul` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-istanbul) Updates `oxfmt` from 0.63.0 to 0.64.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.64.0/npm/oxfmt) Updates `oxlint` from 1.78.0 to 1.79.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.79.0/npm/oxlint) Updates `tldts` from 6.1.86 to 7.4.10 - [Release notes](https://github.com/remusao/tldts/releases) - [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md) - [Commits](remusao/tldts@v6.1.86...v7.4.10) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: verdaccio dependency-version: 6.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: jose dependency-version: 6.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: "@anthropic-ai/claude-agent-sdk" dependency-version: 0.3.241 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.120.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: posthog-node dependency-version: 5.50.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: fumadocs-core dependency-version: 16.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: fumadocs-mdx dependency-version: 15.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: fumadocs-ui dependency-version: 16.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: next dependency-version: 16.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: "@vitest/coverage-istanbul" dependency-version: 4.1.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major - dependency-name: oxfmt dependency-version: 0.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: oxlint dependency-version: 1.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-major - dependency-name: tldts dependency-version: 7.4.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-major ... Signed-off-by: dependabot[bot] <support@github.com>

depthfirst-app · 2026-08-31T00:19:13Z

GHSA-p293-qw3h-jr36

+    "fumadocs-core": "^16.15.1",
+    "fumadocs-mdx": "^15.3.1",
+    "fumadocs-ui": "^16.15.1",
+    "next": "16.3.2",


🟡 Severity: MEDIUM

Next.js 16.3.2 is in CVE-2026-75604’s affected range (>=16.0, <16.3.3). On a Windows-hosted app using both Pages and App Routers without Cache Components, an unauthenticated attacker’s crafted HTTP request reaches vulnerable filesystem handling and can execute code with server privileges. GHSA-p293-qw3h-jr36
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade Next.js from 16.3.2 to 16.3.3 (or later) to remediate CVE-2026-75604. Version 16.3.2 falls within the affected range (>=16.0, <16.3.3) for a path traversal vulnerability that can allow unauthenticated remote code execution on Windows-hosted apps. Change the next dependency version to "16.3.3" (or use "^16.3.3" to allow future patch updates).

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change

"next": "16.3.2",

"next": "16.3.3",

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026

supabase-cli-releaser Bot approved these changes Aug 31, 2026

View reviewed changes

supabase-cli-releaser Bot enabled auto-merge August 31, 2026 00:11

depthfirst-app Bot reviewed Aug 31, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(deps): bump the npm-major group across 1 directory with 15 updates - #6398

fix(deps): bump the npm-major group across 1 directory with 15 updates#6398
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm-major-0c541662a2

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

depthfirst-app Bot Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v6.10.0

Minor Changes

6.10.0

Minor Changes

v6.2.10

Fixes

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

Documentation

Refactor

v0.3.241

What's changed

Update

v0.3.240

What's changed

Update

v0.3.239

What's changed

Update

0.3.241

0.3.240

0.3.239

0.3.238

0.3.237

0.3.236

0.3.235

sdk: v0.120.0

0.120.0 (2026-08-19)

Features

Chores

sdk: v0.119.0

0.119.0 (2026-08-19)

Features

sdk: v0.118.0

0.118.0 (2026-08-18)

Features

Bug Fixes

Chores

Documentation

0.120.0 (2026-08-19)

Features

Chores

0.119.0 (2026-08-19)

Features

0.118.0 (2026-08-18)

Features

Bug Fixes

Chores

Documentation

posthog-node@5.50.0

5.50.0

Minor Changes

posthog-node@5.49.4

5.49.4

Patch Changes

posthog-node@5.49.3

5.49.3

Patch Changes

posthog-node@5.49.2

5.49.2

Patch Changes

5.50.0

Minor Changes

5.49.4

Patch Changes

5.49.3

Patch Changes

5.49.2

Patch Changes

fumadocs@16.15.1

Forward dynamic loader from fumadocs-core/source

Read structured data from page.data.structuredData()

fumadocs@16.15.0

Redesign source API

Integrations

Forward dynamic loader from `fumadocs-core/source`

Read structured data from `page.data.structuredData()`

Scope `lastModified` git log to the content directory

Encode `import.meta.glob` query values

Forward dynamic loader from `fumadocs-core/source`

Read structured data from `page.data.structuredData()`